137757 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Stefan Metzmacher	2de585a978	s3:include: remove unused krb5_env.h ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	eb9ad5cc89	s3:net_ads: remove unused use_in_memory_ccache() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	e76fe56fdf	s3:net_ads: make use of ads_connect_{cldap_only,creds}() in ads_startup_int() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	d59d957cab	s3:libads: let ads_krb5_set_password() require an explicit krb5 ccache to operate on ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	432273dd3e	s3:libads: kerberos_set_password() don't need to kinit before ads_krb5_chg_password() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	125db2ed81	s3:libads: remove unused kdc_host and time_offset arguments to kerberos_set_password() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	b641b35b02	s3:libads: remove unused kdc_host and time_offset arguments to ads_krb5_chg_password() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	3141423feb	s3:libads: remove krb5_set_real_time() from ads_krb5_set_password() ... Callers typically only pass in 0 anyway. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	c85c084d69	s3:libads: remove unused kdc_host argument of ads_krb5_set_password() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	5f32f14ef5	s3:net_ads: require kerberos if we use ads_krb5_set_password() in ads_user_add() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	1eeeb76e6c	s3:net_ads: use ADS_SASL_SEAL by default, so that we always get encryption ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	612af29cef	s3:net_ads: use cli_credentials_get_principal() in order to call kerberos functions ... This is better than the value from cli_credentials_get_username()... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	55c9a6c0e3	s3:net: remove useless net_prompt_pass() wrapper ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	d9082129f2	s3:net_rpc: make use of !c->explicit_credentials for NET_FLAGS_ANONYMOUS ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	e690666fd1	s3:net: make use of c->explicit_credentials in order to check for valid credentials ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	be1051f379	s3:net: add net_context->explicit_credentials to check if credentials were passed ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	a9beae36f0	s3:net: correctly implement --use-ccache as legacy for --use-winbind-ccache for 'net' ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	579195769d	s3:net_offlinejoin: we don't need to call libnetapi_set_use_kerberos() as we already passed cli_credentials ... c->opt_kerberos is derived from c->creds... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	f4f31236c4	s3:libnet_join: pass down cli_credentials *admin_credentials to libnet_{Join,Unjoin}Ctx() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	c0edd3406b	s3:lib/netapi: make use of ads_simple_creds/libnetapi_get_creds in NetGetJoinableOUs_l ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	0470cc385d	s3:lib/netapi: add libnetapi_get_creds() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	bd53e20764	libgpo/pygpo: make use of ads_connect_{creds,machine}() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	87e7a9488a	s3:printing: make use of ads_connect_machine() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	f9496bfdf4	s3:libads: add ads_connect_machine() helper ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	353abcb4d3	s3:libads: add ads_simple_creds() helper ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	c36b044224	s3:libads: make use of ads_connect_simple_anon() in ldap.c where possible ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	7bfbea4c3c	s3:libads: add ads_connect_simple_anon() helper ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	c95a2785e2	lib/addns: rewrite signed dns update code to use gensec instead of plain gssapi ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	5807689f96	s3:utils: let net_update_dns_internal() set status before goto done in all cases ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	28af082926	s3:winbindd: make use of winbindd_get_trust_credentials() in idmap_ad.c ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	ed75331f52	s3:winbindd: make use of winbindd_get_trust_credentials() in _winbind_LogonControl_TC_VERIFY() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	16bbb407fa	s3:winbindd: make use of samba_sockaddr to avoid compiler warnings ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	f903d80769	s3:winbindd: use winbindd_get_trust_credentials()/ads_connect_creds() in winbindd_ads.c ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	8166642e1b	s3:winbindd: make winbindd_get_trust_credentials() public ... We'll use it outside of winbindd_cm.c soon. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	81a6c54fdd	s3:libads: add ads_set_reconnect_fn() and only reconnect if we can get creds ... This reconnect is only useful for long running connections (e.g. in winbindd) and there we'll make use of it... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	31e4614ee3	s3:libads: add ads_connect_creds() helper ... In future ads_connect_creds() will be used by callers directly instead of using ads_connect(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	76e0d348dd	s3:libads: fix compiler warning in ads_mod_ber() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	bac243442a	s3:libads: move ads->auth.time_offset to ads->config.time_offset ... There's no reason to pass the LDAP servers time to the kerberos libraries, as we may talk to a KDC different than the LDAP server! Also Heimdal handles AS-REQ with KRB5KRB_AP_ERR_SKEW fine and retries with the time from the krb-error. MIT records the time from the KDC_ERR_PREAUTH_REQUIRED response in order to use the KDCs time. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	ea97abd545	s3:libads: we only need to gensec_expire_time()... ... The lifetime of a service ticket is never longer than the lifetime of the TGT... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	ce1ad21ce6	s3:libads: remove unused ads->auth.renewable ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	fcd47a4966	s3:winbindd: remove useless 'renewable' argument to ads_cached_connection_connect() ... There's really no need to get a reneable ticket for an ldap connection, we currently always do a kinit for each connection anyway. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	bb8b7be74a	s3:libads: let ads_sasl_spnego_bind() really use spnego to negotiate krb5/ntlmssp ... For now we still do the ads_kinit_password() in ads_legacy_creds() for callers that rely on the global krb5ccache to be filled. E.g. the dns update code and the kpasswd code. But at least ads_connect_internal() and ads_sasl_spnego_bind() will allow to do the kinit in the gensec layer only if needed... We'll remove ads_legacy_creds() during the following commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	1474f9c5de	testprogs/blackbox: add better testnames in test_weak_disable_ntlmssp_ldap.sh ... This makes it easier to adjust the expected output when it changes in the next commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	cff7656e66	s3:net_ads: make use of ads_connect_cldap_only() and ADS_AUTH_GENERATE_KRB5_CONFIG in net_ads_password() ... We don't need a real ldap connection here. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	f024063aec	s3:winbindd: make use of ads_connect_cldap_only() in dcip_check_name_ads() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	e8250f1624	s3:net_ads: make use of ads_connect_cldap_only() in net_ads_check_int() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	fdd34b57c4	s3:libsmb: make use of ads_connect_cldap_only() ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	f34e64baf6	s3:libads: add ads_connect_cldap_only() helper ... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	36748002f0	s3:libads: also avoid ADS_AUTH_GENERATE_KRB5_CONFIG for ADS_AUTH_ANON_BIND ... For anonymous binds we don't need a krb5.conf. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00
Stefan Metzmacher	9ea1ea1629	s3:libads: add ADS_AUTH_GENERATE_KRB5_CONFIG to generate a custom krb5.conf ... That's better then using !ADS_AUTH_NO_BIND. And it allows callers to be more flexible in future. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>	2024-05-14 10:18:31 +00:00