sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

smbdotconf: add client ldap sasl wrapping = {starttls,ldaps}

Browse Source 
In order to use SASL authentitation within a TLS connection
we now provide "client ldap sasl wrapping = starttls" or
"client ldap sasl wrapping = ldaps".

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Stefan Metzmacher 2024-02-09 15:40:00 +01:00 committed by Andrew Bartlett
parent 576ac69cbb
commit 844e1bdc6d
3 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml
View File

@ -36,6 +36,13 @@
The default value is <emphasis>seal</emphasis>. That implies synchronizing the time
with the KDC in the case of using <emphasis>Kerberos</emphasis>.
</para>
<para>In order to force using LDAP (on port 389) with STARTTLS
or LDAPS (on port 636), it is possible to use <emphasis>starttls</emphasis>
or <emphasis>ldaps</emphasis>. In that case the NTLMSSP or Kerberos
authentication using the TLS channel bindings in order to glue
it to the connection.</para>
</description>
<value type="default">seal</value>
</samba:parameter>

2
lib/param/param_table.c
View File

@ -309,6 +309,8 @@ static const struct enum_list enum_ldap_sasl_wrapping[] = {
{0, "plain"},
{ADS_AUTH_SASL_SIGN, "sign"},
{ADS_AUTH_SASL_SEAL, "seal"},
{ADS_AUTH_SASL_STARTTLS, "starttls"},
{ADS_AUTH_SASL_LDAPS, "ldaps"},
{-1, NULL}
};

4
source3/librpc/idl/ads.idl
View File

@ -29,7 +29,9 @@ interface ads
ADS_AUTH_SASL_SIGN = 0x0020,
ADS_AUTH_SASL_SEAL = 0x0040,
ADS_AUTH_SASL_FORCE = 0x0080,
ADS_AUTH_USER_CREDS = 0x0100
ADS_AUTH_USER_CREDS = 0x0100,
ADS_AUTH_SASL_STARTTLS = 0x0200,
ADS_AUTH_SASL_LDAPS = 0x0400
} ads_auth_flags;
const int ADS_SASL_WRAPPING_IN_MAX_WRAPPED = 0x0FFFFFFF;