summaryrefslogtreecommitdiff
path: root/source4/dsdb
AgeCommit message (Collapse)AuthorFilesLines
2010-09-26s4-ldbmodules: Added new module aclread to handle access checks on LDAP searchNadezhda Ivanova4-0/+327
It is currently enabled only if the request comes from the LDAP server, and is disabled by default. Use acl:search=true in smb.conf to enable it. It filters out all objects the user is not allowed to see, and all attributes the user does not have RP on. Extended access not supported yet.
2010-09-26s4-tests: Added tests for search checks on attributesNadezhda Ivanova1-5/+100
The ACL reach tests are in the knowfail because aclread module is not enabled by default
2010-09-26s4-tests: Removed search tests with anonymous credentials as they fail ↵Nadezhda Ivanova1-1/+1
againts Windows These tests will fail in make test as well if the acl_read module is enabled.
2010-09-26s4-dsdb: Added a function to check access on a particular object by its guidNadezhda Ivanova1-0/+37
Similar to dsdb_check_access_on_dn, only it searches by guid.
2010-09-26s4-dsdb: A helper to determine if an attribute is part of the search filterNadezhda Ivanova1-0/+46
2010-09-26s4-dsdb: Moved some helper functions to a separate fileNadezhda Ivanova5-222/+260
We need these to be accessible to the aclread module as well.
2010-09-26s4-ldap: Added a control to apply the access checks on read via LDAPNadezhda Ivanova1-0/+3
2010-09-26s4-auth: fixed the SID list for DCs in the PACAndrew Tridgell1-10/+0
the S-1-5-9 SID is added in the PAC by the KDC, not on the server that receives the PAC Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Autobuild-User: Andrew Tridgell <tridge@samba.org> Autobuild-Date: Sun Sep 26 07:09:08 UTC 2010 on sn-devel-104
2010-09-26s4-possibleinferiors.py: Fix usage of 'paged_search' module for remote LDB ↵Kamen Mazdrashki1-1/+7
connections
2010-09-26s4-sec_descriptor.py: Fix usage of 'paged_search' module for remote LDB ↵Kamen Mazdrashki1-1/+9
connections
2010-09-26s4-ldap_schema.py: Remove unused LDB connection to GC portKamen Mazdrashki1-5/+0
2010-09-26s4-dsdb_schema_info.py: Fix usage of 'paged_search' module for remote LDB ↵Kamen Mazdrashki1-6/+7
connections
2010-09-25ldb: mark the location of a lot more ldb requestsAndrew Tridgell28-15/+109
2010-09-25s4-dsdb: added tagging of requests in dsdb modulesAndrew Tridgell8-0/+30
this allows you to call dsdb_req_chain_debug() in gdb or when writing debug code to see the request chain
2010-09-25s4-repl: don't store repsFrom on DNs other than NC headsAndrew Tridgell1-0/+9
we don't want a refsFrom on the Rid Manage$ DN Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
2010-09-25s4-repl: use namingContexts from rootDSE to initialise partition listAndrew Tridgell1-53/+36
this is preferable to looking for the hasMasterNCs attribute on nTDSDSA objects.
2010-09-25s4-repl: force on WRIT_REP when we are a writable replicaAndrew Tridgell1-4/+3
this ensures we always mark ourselves as writeable when we are not an RODC
2010-09-25s4-repl: use dreplsrv_partition_source_dsa_by_guid to find source dsaAndrew Tridgell1-5/+6
this avoids a list walk in the calling code
2010-09-25s4-dsdb: Fixed a call to the wrong ops function in dsdb_module_search_dn.Nadezhda Ivanova1-1/+1
2010-09-24s4-kerberos Rework keytab handling to export servicePrincipalName entriesAndrew Bartlett1-2/+6
This creates keytab entries with all the servicePrincipalNames listed in the secrets.ldb entry. Andrew Bartlett
2010-09-24s4-kerberos Move 'set key into keytab' code out of credentials.Andrew Bartlett1-31/+23
This code never really belonged in the credentials layer, and is easier done with direct access to the ldb_message that is in secrets.ldb. Andrew Bartlett
2010-09-24s4:repl_meta_data - also on delete operations the new RDN attribute has to ↵Matthias Dieter Wallnöfer1-1/+10
be casefolded correctly Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:lazy_commit LDB module - the "show_deleted" control is initialised by the ↵Matthias Dieter Wallnöfer1-17/+0
"show_deleted" LDB module Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - make use of "dsdb_forest_functional_level"Matthias Dieter Wallnöfer1-3/+2
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:ldap.py - add tests for the "dsServiceName", "serverName", "dnsHostName" ↵Matthias Dieter Wallnöfer1-0/+34
and "ldapServiceName" rootDSE attributes Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - introduce dynamic "ldapServiceName"Matthias Dieter Wallnöfer1-0/+25
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - introduce dynamic "dnsHostName" attributeMatthias Dieter Wallnöfer1-0/+8
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - make "serverName" dynamicMatthias Dieter Wallnöfer1-0/+7
This helps to fix bug #7347. "dsServiceName" cannot be made dynamic in such a simple way since it's already needed on LDB initialisation time. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - remove "priv" checks where not neededMatthias Dieter Wallnöfer1-3/+3
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - better that the "edn" control handling is done lastMatthias Dieter Wallnöfer1-20/+20
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:samldb LDB module - it isn't allowed to create user/computer accounts ↵Matthias Dieter Wallnöfer2-10/+13
with a primary group specified It can only be changed afterwards. We allow a "relax"ed exception for the provision state since we need this for the guest account. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:dsdb/common/util_samr.c - remove the primary group specificationsMatthias Dieter Wallnöfer1-4/+0
Now also the primary group detection/change on modify operations does work Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:ldap.py - test default primary groups on modify operationsMatthias Dieter Wallnöfer1-0/+70
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:samldb LDB module - support the "userAccountControl" -> "primaryGroupID" ↵Matthias Dieter Wallnöfer1-16/+11
detection also on modify operations Also requested by MS-SAMR 3.1.1.8.1. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:ldap.py - enhance SAM user/groups behaviour test regarding default ↵Matthias Dieter Wallnöfer1-5/+34
primary groups Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - make more use of LDB result constantsMatthias Dieter Wallnöfer1-17/+17
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - fix comment typoMatthias Dieter Wallnöfer1-1/+1
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:password_hash LDB module - don't assign "lp_ctx" twiceMatthias Dieter Wallnöfer1-2/+2
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:rootdse LDB module - fix counter typesMatthias Dieter Wallnöfer1-1/+1
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:extended_dn_in LDB module - fix a counter typeMatthias Dieter Wallnöfer1-1/+1
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-24s4:drepl_out_helpers.c - fix a counter typeMatthias Dieter Wallnöfer1-1/+1
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-23s4/dsdb:kcc: cleanup and improve readabilityAnatoliy Atanasov1-4/+5
2010-09-23s4:dsdb/kcc: we don't need to manually allocate [out,ref] pointers anymoreStefan Metzmacher1-6/+1
metze Signed-off-by: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
2010-09-23s4-kcc: the kcc should not be setting the repsTo attributeAndrew Tridgell1-32/+2
repsTo is set by other DCs, when they ask to be notified about changes in a partition
2010-09-23s4-kcc: added service->am_rodcAndrew Tridgell4-21/+14
use a rodc flag on the service instead of calling samdb_rodc each time
2010-09-23s4-kcc: pass the service context into the kcc connection codeAndrew Tridgell2-64/+65
this will be used for the RODC changes needed for the kcc
2010-09-22s4-selftest: Move samba3sam test to standard python directory.Jelmer Vernooij1-1092/+0
2010-09-22dsdb: Use short path for ldb_handlers.h, in case ldb is installed in theJelmer Vernooij1-1/+1
system.
2010-09-21s4-ldap: Fixed a problem with NC's having a parentGUID attributeNadezhda Ivanova2-14/+48
NC's other than default NC had a parentGUID, due to an incorrect check of whether the object has a parent. Fixed by checking object's instanceType instead.
2010-09-20s4-drepl: use the partition UDV and hwm for extended getncchanges opsAndrew Tridgell3-28/+75
we find the NC root then load the uptodateness vector and highwater mark, if available, from there
generated by cgit (git 2.34.1) at 2024-07-06 23:30:55 +0000