| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Andrew Bartlett
(This used to be commit 30f4ece4d2e55d2d50061f74a491d3f77551a6ae)
|
|
authentication. This pulls the creating of the keytab back to the
credentials code, and removes the special case of 'use keberos keytab
= yes' for now.
This allows (and requires) the callers to specify the credentials for
the server credentails to GENSEC. This allows kpasswdd (soon to be
added) to use a different set of kerberos credentials.
The 'use kerberos keytab' code will be moved into the credentials
layer, as the layers below now expect a keytab.
We also now allow for the old secret to be stored into the
credentials, allowing service password changes.
Andrew Bartlett
(This used to be commit 205f77c579ac8680c85f713a76de5767189c627b)
|
|
metze
(This used to be commit 16b2569788348ee3654557cf714ea3b204375c3c)
|
|
authenticated session down into LDB. This associates a session info
structure with the open LDB, allowing a future ldb_ntacl module to
allow/deny operations on that basis.
Along the way, I cleaned up a few things, and added new helper functions
to assist. In particular the LSA pipe uses simpler queries for some of
the setup.
In ldap_server, I have removed the 'ldasrv:hacked' module, which hasn't
been worked on (other than making it continue to compile) since January,
and I think the features of this module are being put into ldb anyway.
I have also changed the partitions in ldap_server to be initialised
after the connection, with the private pointer used to associate the ldb
with the incoming session.
Andrew Bartlett
(This used to be commit fd7203789a2c0929eecea8125b57b833a67fed71)
|
|
Andrew Bartlett
(This used to be commit 8cb8f99ae602f3bca0235e5e695ecb1ba55b0e46)
|
|
(This used to be commit 355983493bc87b9e812152ef81773dccb23e03d5)
|
|
- got rid of the special cases for sasl buffers
- added a tls_socket_pending() call to determine how much data is waiting on a tls connection
- removed the attempt at async handling of ldap calls. The buffers/sockets are all async, but the calls themselves
are sync.
(This used to be commit 73cb4aad229d08e17e22d5792580bd43a61b142a)
|
|
event_context for the socket_connect() call, so that when things that
use dcerpc are running alongside anything else it doesn't block the
whole process during a connect.
Then of course I needed to change any code that created a dcerpc
connection (such as the auth code) to also take an event context, and
anything that called that and so on .... thus the size of the patch.
There were 3 places where I punted:
- abartlet wanted me to add a gensec_set_event_context() call
instead of adding it to the gensec init calls. Andrew, my
apologies for not doing this. I didn't do it as adding a new
parameter allowed me to catch all the callers with the
compiler. Now that its done, we could go back and use
gensec_set_event_context()
- the ejs code calls auth initialisation, which means it should pass
in the event context from the web server. I punted on that. Needs fixing.
- I used a NULL event context in dcom_get_pipe(). This is equivalent
to what we did already, but should be fixed to use a callers event
context. Jelmer, can you think of a clean way to do that?
I also cleaned up a couple of things:
- libnet_context_destroy() makes no sense. I removed it.
- removed some unused vars in various places
(This used to be commit 3a3025485bdb8f600ab528c0b4b4eef0c65e3fc9)
|
|
prevents a bogus:
GSS Update failed: Miscellaneous failure (see text): ASN.1 identifier doesn't match expected value
error on every ldap connection. I'll remove it and let the error remain until Andrew
works out a better fix.
(This used to be commit 6123eb2ecad6f53521b546f76954523fbc0fb981)
|
|
element in a structure is not necessary any more.
(This used to be commit 912d0427f52eac811b27bf7e385b0642f7dc7f53)
|
|
now works with windows clients, as I fixed the zero length bind ack packet.
Andrew, note that this has the strncmp("NTLMSSP", data, 7) hack. Please
replace with a more correct fix as we discussed.
(This used to be commit 69b02e8adb25a5152aec15f55b2b2f67457cf08a)
|
|
(This used to be commit 0df3fdd8178085c40f9cd776cc3e1486ca559c8e)
|
|
metze
(This used to be commit 872c687184e5317b4477a184e0a954e6de0b8e9e)
|
|
In developing a GSSAPI plugin for GENSEC, it became clear that the API
needed to change:
- GSSAPI exposes only a wrap() and unwrap() interface, and determines
the location of the signature itself.
- The 'have feature' API did not correctly function in the recursive
SPNEGO environment.
As such, NTLMSSP has been updated to support these methods.
The LDAP client and server have been updated to use the new wrap() and
unwrap() methods, and now pass the LDAP-* tests in our smbtorture.
(Unfortunely I still get valgrind warnings, in the code that was
previously unreachable).
Andrew Bartlett
(This used to be commit 9923c3bc1b5a6e93a5996aadb039bd229e888ac6)
|
|
- Update Samba4's kerberos code to match the 'salting' changes in
Samba3 (and many other cleanups by jra).
- Move GENSEC into the modern era of talloc destructors. This avoids
many of the memory leaks in this code, as we now can't somehow
'forget' to call the end routine.
- This required fixing some of the talloc hierarchies.
- The new krb5 seems more sensitive to getting the service name
right, so start actually setting the service name on the krb5 context.
Andrew Bartlett
(This used to be commit 278bf1a61a6da6ef955a12c13d7b1a0357cebf1f)
|
|
(This used to be commit 70d2090f6bf2c7e0caf1e9c020f330de88871f8e)
|
|
metze
(This used to be commit 82e792a0ce94f63eeb8573d340b2198660aef132)
|
|
metze
(This used to be commit f3f2d1c6765a5799c3b0a302b68d41d045e1ba22)
|
|
metze
(This used to be commit 0f5267c29cca943acf5df392ce1f5c601c4ef7f0)
|
|
(there are a lot of clean ups following later, but the LDAP-BASIC test
works :-)
metze
(This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
|
|
- move Bind Unbind code to a seperate file
metze
(This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
|
