From 541809b006e40c5acba7570bcd858196db634e56 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Tue, 31 Jan 2006 22:58:50 +0000 Subject: r13265: Clarify how delegation works with the remote RPC backend. Andrew Bartlett (This used to be commit 75489ac8bced0f9e7ab28739fd6b26ab12cfa585) --- source4/rpc_server/remote/README | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) (limited to 'source4/rpc_server') diff --git a/source4/rpc_server/remote/README b/source4/rpc_server/remote/README index 670777806e..0d235a9901 100644 --- a/source4/rpc_server/remote/README +++ b/source4/rpc_server/remote/README @@ -1,7 +1,38 @@ -This smb.conf example should get you started: +This is an RPC backend that implements all operations in terms of +remote RPC operations. This may be useful in certain debugging +situations, where the traffic is encrypted, or you wish to validate +that IDL is correct before implementing full test clients, or with +windows clients. +There are two modes of operation: Password specified and delegated +credentials. + +Password specified: +------------------- + +This uses a static username/password in the config file, example: + +[global] dcerpc endpoint servers = remote dcerpc_remote:binding = ncacn_np:win2003 dcerpc_remote:username = administrator dcerpc_remote:password = PASSWORD dcerpc_remote:interfaces = samr, lsarpc, netlogon + +Delegated credentials: +---------------------- + +If your incoming user is authenticated with Kerberos, and the machine +account for this Samba4 proxy server is 'trusted for delegation', then +the Samba4 proxy can forward the client's credentials to the target. + +You must be joined to the domain (net join member). + +To set 'trusted for delegation' with MMC, see the checkbox in the +Computer account property page under Users and Computers. + +[global] + dcerpc endpoint servers = remote + dcerpc_remote:binding = ncacn_np:win2003 + dcerpc_remote:interfaces = samr, lsarpc, netlogon + -- cgit