sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-28 07:21:54 +03:00
Code
94,452 Commits 60 Branches 1,144 Tags 452 MiB
2f2421bae1
Commit Graph

94452 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Andrew Bartlett
a0de929009 dsdb: Put password lockout support in samdb_result_passwords() 
This seems to be the best choke point to check for locked out
accounts, as aside from the KDC, all the password authentication and
change callers use it.

Andrew Bartlett

Change-Id: I0f21a79697cb8b08ef639445bd05a896a2c9ee1b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
6f8fb163e0 dsdb: Rework samdb_result_acct_flags to use either userAccountControl or msDS-User-Account-Control-Computed 
This allows us to avoid the domain lookup in the constructed attribute
when not required.

By using msDS-User-Account-Control-Computed the lockout and password
expiry checks are now handled in the operational ldb module.

Andrew Bartlett

Change-Id: I6eb94933e4602e2e50c2126062e9dfa83a46191b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
77e4beb0e0 dsdb-operational: Implement msDS-UserPasswordExpiryTimeComputed 
This assists in testing this aspect of
msDS-User-Account-Control-Computed, and is exposed in AD for clients
to query.

Andrew Bartlett

Change-Id: I10fd214b0585a16f8addb00c252f656419a03f4a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
1d266b4938 dsdb-operational: Implement msDS-User-Account-Control-Computed 
This is needed to get consistent account lockout support across the whole server.

Andrew Bartlett

Change-Id: I2fa1e707d33f5567b6cb4e2b27e340fa9f40cee9
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
9a3651ece1 dsdb-operational: Use a list for the extra attributes that may be required 
Change-Id: Ifa2e006c9401e92e71d6588d6ea879c6f437cdd5
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Stefan Metzmacher
9a36fabde0 s4:auth/sam: use a higher time resolution in authsam_account_ok() 
Change-Id: I2961e7311f31e239a6768f56437e5c112a7a9bb0
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 17:12:46 +02:00
Stefan Metzmacher
5c1cfe267c s4:dsdb/util_samr: simplify dsdb_add_user() 
We can specify userAccountControl on the ldb_add() call.

Change-Id: Ic990a74eaf9b38ddc1db3183a964972c786dbfdf
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
090c55681d selftest: Run rpc.samr.passwords.lockout against the s3dc environment 
Change-Id: I7ee562cbf1e067ed90b22e212002e88752450e34
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
9e1a8dc8b7 dsdb-tests: Remove pointless creation of ldaptestou 
This is not used in this test, and is not removed by the test either.

Andrew Bartlett

Change-Id: I34366d469a1ebed04c3cea5a7f206cb0bf433e03
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
fa8a3ca0b8 torture-samr: Do not issue a TORTURE_FAIL unless *this* test failed 
Change-Id: I349d8ac77a98b934cd4b11b01a96a231097eeeed
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
ae81cca5b7 torture-samr: Lock accounts for 5 seconds in rpc.samr.passwords.badpwdcount test to ensure consistent results 
For "samba3" we use 60 seconds as in test_Password_lockout().

Change-Id: I886eb83d4c620e4d719a38ec47b45bacd1406b9d
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
b53b3fa2a0 torture-samr: Try breaking the NT hash first, as the LM hash may not be being checked 
Change-Id: Iea9040bc7130f8b779c35bd367a9915633cd494d
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
8e147f838e torture-samr: set min password age to 0 for lockout and badpwdcount tests 
Change-Id: I0d44fcc712e6f239d9adc739fdafc1b20dd2beba
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
2d2dbafd2b torture-samr: Make failures easier to trace with torture_assert 
Change-Id: I729ba2f0a0501575357977754401a0cb40d95b34
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
2acfba33c6 torture-samr: Indent samba3-skip block 
Change-Id: I2bb9f175e61401606742737a883604b922044ea5
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
b8223531de torture-samr: Actually fail on failures in rpc.samr, rather than just printing pretty warnings 
Change-Id: I00d66ecd84cd1a7d733f491d19328cec93ba8d2b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
60024cdd73 kerberos: Map KRB5KDC_ERR_CLIENT_REVOKED to NT_STATUS_ACCOUNT_LOCKED_OUT 
Change-Id: I333083e11a56d0f99ec36df25a96804d0ff2d110
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
befae7f6e6 ldb_ildap: Map some wrong username/password errors on to LDB_ERR_INVALID_CREDENTIALS 
This is better than just LDB_ERR_OPERATIONS_ERROR for all errors.

Andrew Bartlett

Change-Id: Id832cf02fcd1dc0347d5ab9eb9a2db78fda39dc6
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:46 +02:00
Andrew Bartlett
c3baddf271 auth: Pass though error from GENSEC sub-mechanism 
This allows wrong-password or account-locked-out errors to be passed
though from Kerberos (gssapi).

Andrew Bartlett

Change-Id: I4bc11a1ad98dfbcc5a4ad9101cd843a7a59f0b59
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:45 +02:00
Andrew Bartlett
6f8297d3cf selftest: make blackbox_setpassword.sh test run independently 
Change-Id: I8f3cdfc2c66800f9a1e11aec4f25a42752b6b205
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:45 +02:00
Andrew Bartlett
c8e4c6a022 s3-auth: Do not reset bad password count to 0 if account is disabled 
Change-Id: I895435fb278eae5d92b4a8e15d062769c0e8a71a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:45 +02:00
Andrew Bartlett
56d3e528bd s3-auth: Only call pdb_get_acct_ctrl() once in check_sam_security 
Change-Id: I43792711543e25c50c29ab5a24d16f614c670cca
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:45 +02:00
Andrew Bartlett
3f8f9972f4 torture/samr: Re-open the user when checking for ACB_AUTOLOCK 
This flag appears to be cached from the open, so the test incorrectly
indicated that the flag was not set over SAMR.

Andrew Bartlett

Change-Id: I2f1f017191dddb6c2ac496712064fa1b6b48be53
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:45 +02:00
Andrew Bartlett
5a2eae4229 torture-samr: Set lockout_seconds to 60 for samba3 
The source3 account policy code deals with lockouts in terms of
minutes, not nanoseconds, so we have to lock out for at least 60
seconds otherwise we do not wait long enough.

Andrew Bartlett.

Change-Id: I2b30d1c0d9b020b3aba6ed3343361e9a576b7d9a
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:45 +02:00
Andrew Bartlett
44a624d6ce s3-samr: Refuse to set lockout_duration < lockout_window per rpc.samr.passwords.lockout 
This was not noticed previously because the test was not run.

Andrew Bartlett

Change-Id: I88701b6c3057ec26f44b3ccab4134ac9aabe552a
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
 2014-04-02 17:12:45 +02:00
Volker Lendecke
1dba07db0d dlinklist: Fix a typo 
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Wed Apr  2 17:11:37 CEST 2014 on sn-devel-104
 2014-04-02 17:11:37 +02:00
Andrew Bartlett
8175e98029 selftest: Rename wbinfo_s3 to wbinfo_simple and reorder code for clarity 
Change-Id: Ic2e06e448fce1d91422b711abf663b9253009a53
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Wed Apr  2 13:07:24 CEST 2014 on sn-devel-104
 2014-04-02 13:07:24 +02:00
Andrew Bartlett
95e0d759ac winbindd: Ensure we do not look at rid_array before checking if it was returned 
We no longer return early if there are no members, we just return an empty array.

Change-Id: I7b0949e0c0b9277426a8007514a8658615f6c709
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
 2014-04-02 11:05:46 +02:00
Andrew Bartlett
8d28437318 s3-auth: Add prototype for plugin function to reduce warnings in auth_samba4 
Change-Id: I0aa703bb2766f1353a176a0c3f25424bbc4953f5
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
 2014-04-02 11:05:46 +02:00
Andrew Bartlett
d13b38dc96 s3-auth: Remember to always free the talloc_stackframe() in auth_samba4 
Change-Id: I94469de9d463ee90365bae43094231efaf0a7d8c
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
 2014-04-02 11:05:46 +02:00
Andrew Bartlett
dd499395a5 auth_samba4: Fix auth_samba4 to correctly provide a messaging context for itself 
This is done by calling make_auth4_context_s4(), avoiding code duplication.

Change-Id: I3a3bf4e4273f27078c308d55102e4a1f4b052d17
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
 2014-04-02 11:05:46 +02:00
Andrew Bartlett
4d50c75159 s3-auth: Finally change make_user_info_*() use a parent talloc context 
Change-Id: Iedf516e8c24e0d18064aeedd8e287ed692d3c5b4
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
 2014-04-02 11:05:46 +02:00
Stefan Metzmacher
e1ec1f5d8d wafsamba: explicitly use allow_warnings=True for SAMBA_PYTHON() 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Apr  2 11:04:36 CEST 2014 on sn-devel-104
 2014-04-02 11:04:36 +02:00
Stefan Metzmacher
b7f8ec97db s4:torture/wscript_build: explicitly use allow_warnings=True where needed 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:47 +02:00
Stefan Metzmacher
fce5bc4f42 s4:torture/winbind: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:47 +02:00
Stefan Metzmacher
75cca8a306 s4:torture/smb2: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:47 +02:00
Stefan Metzmacher
a2c82a7d19 s4:torture/libnetapi: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
cea6d7e4a3 s4:ntvfs/unixuid: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
3f742fc2f2 s4:rpc_server: explicitly use allow_warnings=True where needed 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
daadf3b928 s4:kdc: explicitly use allow_warnings=True for MIT_SAMBA 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
daf6d0fb28 s4:auth/gensec: explicitly use allow_warnings=True for gssapi and sasl modules 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
6662c2b096 s4:librpc: explicitly use allow_warnings=True where needed 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
bb187cc1e9 s4:lib/tls: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
835f8b7e2e s4:lib/registry: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
1b16b425d3 s4:lib/messaging: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
19f30c3834 s4:lib/events: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
7e3e5738e4 s4:lib/com: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
7a53e14d3b s3:wscript_build: explicitly use allow_warnings=True where needed 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
f42046692a s3:rpc_server: explicitly use allow_warnings=True for RPC_SPOOLSS 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00
Stefan Metzmacher
0f6c31cf53 s3:pam_smbpass: explicitly use allow_warnings=True 
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2014-04-02 09:03:46 +02:00