1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

664 Commits

Author SHA1 Message Date
Andrew Bartlett
c1819f5fd1 kdc: Correctly return the krbtgt/realm@REALM principal from our KDC
This needs to vary depending on if the client requested the canonicalize flag

This was found by our new krb5.kdc test

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2015-01-23 05:42:08 +01:00
Andrew Bartlett
69fb2a7616 kdc: Add TODO to remind us where we need to hook for RODC to get secrets
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2015-01-23 05:42:08 +01:00
Andrew Bartlett
9fc3f1e3d6 kdc: Fix Samba's KDC to only change the principal in the right cases
If we are set to canonicalize, we get back the fixed UPPER
case realm, and the real username (ie matching LDAP
samAccountName)

Otherwise, if we are set to enterprise, we
get back the whole principal as-sent

Finally, if we are not set to canonicalize, we get back the
fixed UPPER case realm, but the as-sent username

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2015-01-23 05:42:08 +01:00
Andrew Bartlett
86021a081f kdc: Fix enterpise principal name handling
Based on a patch by Samuel Cabrero <scabrero@zentyal.com>

This ensures we write the correct (implict, samAccountName) based UPN into
the ticket, rather than the userPrincipalName, which will have a different
realm.

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
2015-01-23 05:42:08 +01:00
Stefan Metzmacher
01c02340c1 s4:kdc/db-glue: fix supported_enctypes samba_kdc_trust_message2entry()
This avoids writing invalid memory, because num_keys was calculated
in a wrong way...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
2015-01-21 14:56:07 +01:00
Stefan Metzmacher
8dd37327b0 s4:kdc: add aes key support for trusted domains
We have a look at "msDS-SupportedEncryptionTypes" and >= DS_DOMAIN_FUNCTION_2008

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Fri Dec 19 15:39:40 CET 2014 on sn-devel-104
2014-12-19 15:39:40 +01:00
Stefan Metzmacher
4bb9aca900 s4:kdc: remove unused allow_warnings=True for 'MIT_SAMBA'
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-11-25 07:25:45 +01:00
Stefan Metzmacher
e5e5c22353 s4:kdc: comment out unused code in db-glue.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-11-25 07:25:45 +01:00
Andrew Bartlett
3fc5b2269b Fix commented out code in kpasswd server to use correct function
The fix in ac2d31e24c picked the wrong function name.  This is meant
to be the remote address, not the local one, if we ever have to re-instate this code.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-09-27 01:35:36 +02:00
Andrew Bartlett
80be6993c9 auth: Split out fetching trusted domain into sam_get_results_trust()
This new helper function will also be used by pdb_samba_dsdb.

Change-Id: I008af94a0822012c211cfcc6108a8b1285f4d7c7
Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-09-01 00:36:42 +02:00
Jeremy Allison
463311422c s3/s4: smbd, rpc, ldap, cldap, kdc services.
Allow us to start if we bind to *either* :: or 0.0.0.0.

Allows us to cope with systems configured as only IPv4
or only IPv6.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-By: Amitay Isaacs <amitay@gmail.com>
Reviewed-By: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sat Jun  7 01:01:44 CEST 2014 on sn-devel-104
2014-06-07 01:01:43 +02:00
Andrew Bartlett
086c06e361 kerberos: Remove un-used event context argument from smb_krb5_init_context()
The event context here was only specified in the server or admin-tool
context, which does not do network communication, so this only caused
a talloc_reference() and never any useful result.

The actual network communication code sets an event context directly
before making the network call.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Apr 28 02:24:57 CEST 2014 on sn-devel-104
2014-04-28 02:24:57 +02:00
Andrew Bartlett
752b817365 kdc: call authsam_zero_bad_pwd_count on successful AS-REQ
Change-Id: I91bb663dcf1b1033cf756a860404c677e4ac4ade
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-02 17:12:47 +02:00
Andrew Bartlett
997e120f66 kdc: Include values from msDS-User-Account-Control-Computed when checking user flags
Change-Id: I27280d7dd139c6c65dddac611dbdcd7e518ee536
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-02 17:12:47 +02:00
Andrew Bartlett
10cbd5e430 kdc: Set flags.locked_out on a locked-out user.
This only changes the log output, the same error is still returned

Change-Id: Id3c13e9373140c276783e5bd288f29de2bf4a45d
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-02 17:12:47 +02:00
Andrew Bartlett
3f07737fd4 s4:auth: Add password lockout support to the AD DC
Including a fix by Arvid Requate <requate@univention.de>

Change-Id: I25d10da50dd6119801cd37349cce970599531c6b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-02 17:12:46 +02:00
Andrew Bartlett
a0de929009 dsdb: Put password lockout support in samdb_result_passwords()
This seems to be the best choke point to check for locked out
accounts, as aside from the KDC, all the password authentication and
change callers use it.

Andrew Bartlett

Change-Id: I0f21a79697cb8b08ef639445bd05a896a2c9ee1b
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-02 17:12:46 +02:00
Stefan Metzmacher
daadf3b928 s4:kdc: explicitly use allow_warnings=True for MIT_SAMBA
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-04-02 09:03:46 +02:00
Stefan Metzmacher
26f497b83f s4:kdc: make use of gensec_update_ev()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-03-27 00:36:31 +01:00
Andrew Bartlett
83fbdc81cd kdc: Use correct KDC include path when building against the system heimdal
This ensures we notice any API changes at compile time.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2014-03-14 08:17:29 +01:00
Stefan Metzmacher
f7883ae02a s4:lib/socket: simplify iface_list_wildcard() and its callers
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10464
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Change-Id: Ib317d71dea01fc8ef6b6a26455f15a8a175d59f6
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Mar  7 02:18:17 CET 2014 on sn-devel-104
2014-03-07 02:18:17 +01:00
Santosh Kumar Pradhan
58e7e564d7 kdc: Free the resource which is not used anymore
In samba_kdc_firstkey() routine, krb5_get_default_realm() allocates
memory for "realm" but never used afterwards. Free() the leaked memory.

CID: 1107223

Signed-off-by: Santosh Kumar Pradhan <spradhan@redhat.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2014-02-21 15:59:28 +01:00
Andrew Bartlett
e758f41113 kdc: Add belts-and-braces check that we fail if the hdb version changes
This checks both if host system run-time Heimdal has changed version,
and that the build-time version is supported.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-By: Jelmer Vernooij <jelmer@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jan 20 22:26:49 CET 2014 on sn-devel-104
2014-01-20 22:26:49 +01:00
Jeffrey Clark
368208069e Support for Heimdal's unified krb5 and hdb plugin system.
Fixes exportkeytab and a kdc crash when building against heimdal master.

Bug-Debian: http://bugs.debian.org/732342

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
2014-01-21 08:30:36 +13:00
Christian Ambach
7964a83447 s4:kdc fix compiler warnings
about set but unused variables

Signed-off-by: Christian Ambach <ambi@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2013-12-12 14:21:28 -08:00
Jelmer Vernooij
92489bfed4 Cope with first element in hdb_method having a different name in different heimdal versions.
It's called `interface_version` in older Heimdal versions and
`version` in newer versions.

Signed-off-by: Jelmer Vernooij <jelmer@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Thu Nov 28 04:17:55 CET 2013 on sn-devel-104
2013-11-28 04:17:55 +01:00
Andrew Bartlett
8557c692f6 s4-kdc: Improve grammer and clarity of password change failure messages.
This can still be improved further, but avoid mentioning reasons that
clearly do not apply in this case.

Andrew Bartlett
2012-09-01 03:33:21 +02:00
Andrew Bartlett
d2c0387d66 s4-kdc: Give information on how long the password history is
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Aug 31 08:06:17 CEST 2012 on sn-devel-104
2012-08-31 08:06:17 +02:00
Andrew Bartlett
1ed6070570 lib/krb5_wrap: Move kerberos_enctype_to_bitmap() into krb5_wrap 2012-08-28 07:57:28 +10:00
Matthias Dieter Wallnöfer
f11a1a4a07 s4:kdc/wdc-samba4.c - fix user logins on specific workstations
The decrement operation has been missing.

Problem found by Mohammad Ebrahim Abravi <lamp.mia@gmail.com>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-14 08:37:49 +10:00
Andrew Bartlett
b8815dc23d lib/param: Create a seperate server role for "active directory domain controller"
This will allow us to detect from the smb.conf if this is a Samba4 AD
DC which will allow smarter handling of (for example) accidentially
starting smbd rather than samba.

To cope with upgrades from existing Samba4 installs, 'domain
controller' is a synonym of 'active directory domain controller' and
new parameters 'classic primary domain controller' and 'classic backup
domain controller' are added.

Andrew Bartlett
2012-06-15 09:18:33 +02:00
Jelmer Vernooij
890485bd17 heimdal: Cope with newer Heimdal versions accepting a keyset argument to
hdb_enctype2key.

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Mon May  7 18:33:10 CEST 2012 on sn-devel-104
2012-05-07 18:33:10 +02:00
Simo Sorce
110dad8c9e Make krb5 context initialization not heimdal specific
Turn the logging data to an opaque pointer.
Ifdef code and use MIT logging function when built against system MIT.
2012-04-23 16:40:05 -04:00
Simo Sorce
4b29cf5f66 Move kdc_get_policy helper in the lsa server where it belongs.
This was used in only 2 places, db-glue.c and the lsa server.
In db-glue.c it is awkward though, as it forces to use an unconvenient lsa
structure and conversions from time_t to nt_time only to have nt_times
converted back to time_t for actual use. This is silly.

Also the kdc-policy file was a single funciton library, that's just ridiculous.

The loadparm helper is all we need to keep the values consistent, and if we
ever end up doing something with group policies we will care about it when it's
the time. the code would have to change quite a lot anyway.

Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Fri Apr 20 01:53:37 CEST 2012 on sn-devel-104
2012-04-20 01:53:37 +02:00
Simo Sorce
37e98ff252 Use loadparm helper to find lifetime defaults
Implictly fixes buggy use of int for time_t
2012-04-19 18:14:02 -04:00
Simo Sorce
70c303a7f3 auth-krb: Move pac related util functions in a single place.
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12 12:06:43 +02:00
Simo Sorce
6de578a8f7 s4-auth-krb: Move function to db-glue.c and make it static.
kerberos_enctype_to_bitmap is not used anywhere else, so just move it there and
make it static, one less dependency to worry about.

Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12 12:06:42 +02:00
Michael Wood
d65f33de1d Log short_princ instead of uninitialised filter.
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Sat Jan 21 13:06:35 CET 2012 on sn-devel-104
2012-01-21 13:06:35 +01:00
Andrew Bartlett
b69c40ffce auth/kerberos: Remove unused TALLOC_CTX argument to check_pac_checksum 2012-01-12 18:02:54 +11:00
Andrew Bartlett
49f8113fab s4-kdc Do the KDC PAC checksum validation in the Samba plugin
Here we can fetch the right key, and check if the PAC is likely to be signed by a key that
we know.  We cannot check the KDC signature on incoming trusts.

Andrew Bartlett
2012-01-12 18:02:54 +11:00
Andrew Bartlett
d0bb8b8a15 s4-kdc: use IDL constant NETLOGON_GENERIC_KRB5_PAC_VALIDATE 2012-01-12 17:54:15 +11:00
Andrew Bartlett
8d3e92d043 s4-kdc: only build hdb plugin if we build against system Heimdal
It is not safe to have a system kadmin use our plugin if we do not
share the same libkrb5.

Andrew Bartlett
2011-12-07 03:09:08 +01:00
Andrew Bartlett
12ce07e53b s4-kdc: Add hdb plugin for samba4, to allow kadmin to work
This will help users who are used to the kadmin interface, and could
be extended to import existing MIT or Heimdal keys into a Samba4 AD
domain.

To use, add to your krb5.conf

[kdc]

database = {
   dbname = samba4:
}

or

[kdc]

database = {
   dbname = samba4:/usr/local/samba/etc/smb.conf
}

And copy hdb_samba4.so from PREFIX/modules/hdb to your Heimdal lib directory

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Wed Nov 30 03:22:11 CET 2011 on sn-devel-104
2011-11-30 03:22:11 +01:00
Andrew Bartlett
e7d5f0a357 gensec: move event context from gensec_*_init() to gensec_update()
This avoids keeping the event context around on a the gensec_security
context structure long term.

In the Samba3 server, the event context we either supply is a NULL
pointer as no server-side modules currently use the event context.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-18 13:13:33 +11:00
Simo Sorce
6bed57788c pac: Fix wrong memory allocation check
Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Tue Oct 11 01:18:22 CEST 2011 on sn-devel-104
2011-10-11 01:18:22 +02:00
Andrew Tridgell
0ef8dca9fb s4-kdc: fixed handling of previous vs current trust password
This sorts out the correct handling for the 'kvno=255'
problem. Windows will use the previous trust password for 1 hour after
a password set, and indicates that the previous password is being used
by sending current_kvno-1. That maps to 255 if the trust password has
not actually been changed, so the initial trust password is being
used.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-10-04 15:08:57 +11:00
Andrew Tridgell
aee896ad98 s4-kdc: don't look at global catalog NCs in the kdc
the kdc should not be looking for users in GC partial replicas, as
these users do not have all of the attributes needed for the KDC to
operate

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-10-04 15:08:57 +11:00
Andrew Tridgell
5717da34b9 s4-kdc: treat a kvno of 255 as unspecified
windows sometimes sends us a kvno of 255 for inter-domain trusts. We
don't yet know why it does this, but it seems that we need to treat
this as an unspecified kvno

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-10-04 15:08:57 +11:00
Andrew Tridgell
b92e0a232e s4-kdc: set NO_GLOBAL_CATALOG control in kdc
the kdc doesn't want to find users who are in partialReplica
partitions, as they won't have the needed secret info for the kdc to
operate. We need to generate referrals instead

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-09-22 10:00:49 +10:00
Andrew Tridgell
ee7cfcadc6 s4-kdc: default kvno for inter-domain trusts to zero
the exact value doesn't matter, as both Samba and windows check
against the latest password, but the old default of -1 caused ASN.1
parsing errors on windows, which prevented it answering TGS requests

thanks to Hongwei Sun for finding this from a ttt trace

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-09-19 10:57:03 +10:00
Andrew Tridgell
8510e405f5 s4-kdc: fixed subtree search in KDC
use ldb_get_default_basedn() with a subtree search

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-08-25 07:39:37 +10:00
Jelmer Vernooij
292fe74971 credentials: Rename library to samba-credentials to avoid name clashes.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Thu Aug 18 22:16:38 CEST 2011 on sn-devel-104
2011-08-18 22:16:38 +02:00
Andrew Bartlett
35b309fa0c gensec: clarify memory ownership for gensec_session_info() and gensec_session_key()
This is slightly less efficient, because we no longer keep a cache on
the gensec structures, but much clearer in terms of memory ownership.
Both gensec_session_info() and gensec_session_key() now take a mem_ctx
and put the result only on that context.

Some duplication of memory in the callers (who were rightly uncertain
about who was the rightful owner of the returned memory) has been
removed to compensate for the internal copy.

Andrew Bartlett
2011-08-03 18:48:02 +10:00
Stefan Metzmacher
ac8096e69d s4:kdc: fix compiler warning
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Aug  2 06:06:15 CEST 2011 on sn-devel-104
2011-08-02 06:06:15 +02:00
Stefan Metzmacher
51b94ab3fd s4:kdc: canonicalize the principal if HDB_F_FOR_TGS_REQ is given
Windows seems to always canonicalize the principal in TGS replies.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Jul 26 03:25:06 CEST 2011 on sn-devel-104
2011-07-26 03:25:06 +02:00
Stefan Metzmacher
8d159e9de1 s4:kdc: restore the behavior before the last heimdal import
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Jul 20 12:12:38 CEST 2011 on sn-devel-104
2011-07-20 12:12:38 +02:00
Stefan Metzmacher
7acc1a7a2f s4:kdc: set *_strongest_*_key to true to restore the old behavior
TODO: check why this is needed.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Fri Jul 15 12:26:25 CEST 2011 on sn-devel-104
2011-07-15 12:26:25 +02:00
Stefan Metzmacher
b005fa142f s4:kdc/mit_samba: disable mit_samba_check_s4u2proxy()
As mit_samba_update_pac_data() doesn't support adding
S4U_DELEGATION_INFO to the pac (and I have no clue how to add that)
we should disable S4U2Proxy until this is implemented.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Jun 28 20:35:19 CEST 2011 on sn-devel-104
2011-06-28 20:35:18 +02:00
Stefan Metzmacher
73b1e1466c s4:kdc: generate the S4U_DELEGATION_INFO in the regenerated pac
metze
2011-06-28 19:23:43 +02:00
Stefan Metzmacher
020f60287c s4:kdc: use KRB5_WINDC_PLUGIN_MINOR define instead of KRB5_WINDC_PLUGING_MINOR
metze
2011-06-28 18:24:37 +02:00
Stefan Metzmacher
ad45072aaf s4:kdc: implement samba_kdc_check_s4u2proxy()
metze
2011-06-24 19:06:44 +02:00
Volker Lendecke
f0ff6f390a Use tevent_req_oom
This fixes a few Coverity errors
2011-06-20 12:33:24 +02:00
Andrew Bartlett
a1f04e8abc libcli/util Rename common map_nt_error_from_unix to avoid duplicate symbol
The two error tables need to be combined, but for now seperate the names.

(As the common parts of the tree now use the _common function,
errmap_unix.c must be included in the s3 autoconf build).

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Mon Jun 20 08:12:03 CEST 2011 on sn-devel-104
2011-06-20 08:12:03 +02:00
Andrew Tridgell
40dc94a53f s4-ipv6: update callers to load_interface_list() 2011-06-06 12:26:10 +10:00
Andrew Tridgell
dc8c8fd9e4 s4-ipv6: use iface_list_wildcard() to listen on IPv6
when we need to listen on a wildcard address, we now listen on a list
of sockets, usually 0.0.0.0 and ::
2011-06-06 12:26:10 +10:00
Stefan Metzmacher
a7b8593f9c s4:kdc: split s4u2self and s4u2proxy checks
metze
2011-05-18 07:46:44 +02:00
Stefan Metzmacher
5f48c5df51 s4:kdc: UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION => flags.trusted_for_delegation
metze
2011-05-18 07:46:43 +02:00
Andrew Bartlett
22cb631b4f s4-interfaces Rename interfaces code so not to conflict with source3/
The iface_count, iface_n_bcast, and load_interfaces functions
conflicted with functions of the same name in source3, so the source4
functions were renamed.  Hopefully we can actually wrap one around the
other in future.

Andrew Bartlett
2011-05-08 12:57:04 +02:00
Andrew Bartlett
86baefe224 kdc: always ldb escape the realm 2011-04-05 23:46:04 +02:00
Andrew Bartlett
b5616adc8a lib/util/charset rename iconv_convenience to iconv_handle
This better reflects what this structure is

Andrew Bartlett
2011-03-25 04:37:06 +01:00
Andrew Tridgell
15e84a9a09 charcnv: removed the allow_badcharcnv and allow_bad_conv options to convert_string*()
we shouldn't accept bad multi-byte strings, it just hides problems

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Thu Mar 24 01:47:26 CET 2011 on sn-devel-104
2011-03-24 01:47:26 +01:00
Jelmer Vernooij
a68b59e9a6 source4/kdc: Fix prototypes for all functions. 2011-03-19 03:20:05 +01:00
Stefan Metzmacher
8002406c51 s4:kdc: split the kdc_tcp_proxy() logic from the main kdc logic
By having kdc_tcp_proxy_send/recv(), which just asks any writeable
dc for a reponse blob, we simplify the interaction between
client-local and local-writeable sockets.

This allows us to make kdc_socket, kdc_process_fn_t, kdc_tcp_call and kdc_tcp_socket
private to kdc.c again.

metze
2011-03-04 21:19:05 +01:00
Stefan Metzmacher
e70b09e8f8 s4:kdc: split the kdc_udp_proxy() logic from the main kdc logic
By having kdc_udp_proxy_send/recv(), which just asks any writeable
dc for a reponse blob, we simplify the interaction between
client-local and local-writeable sockets.

This allows us to make kdc_udp_call and kdc_udp_socket private to
kdc.c again.

metze
2011-03-04 21:19:05 +01:00
Stefan Metzmacher
ad9ac99afd s4:kdc: add a kdc_proxy_unavailable_error() helper function
metze
2011-03-04 21:19:05 +01:00
Stefan Metzmacher
0c78640e67 s4:kdc: fix calculation of the rodc kvno
Bit shifting is non-trivial in C:-)

This

	int32_t a = 0x12340000;
	uint32_t b = (a >> 16);

results in 0x00001234, but this

	int32_t a = 0xEDCB0000;
	uint32_t b = (a >> 16);

results in 0xFFFFEDCB, while we expected 0x0000EDCB.

metze
2011-03-04 21:19:05 +01:00
Andrew Tridgell
ed71c1ef1f s4-auth: rename 'auth' subsystem to 'auth4'
this prevents conflicts with the s3 auth modules. The auth modules in
samba3 may appear in production smb.conf files, so it is preferable to
rename the s4 modules for minimal disruption.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-02-18 15:09:46 +11:00
Andrew Tridgell
8dc92c8f71 ldb: use #include <ldb.h> for ldb
thi ensures we are using the header corresponding to the version of
ldb we're linking against. Otherwise we could use the system ldb for
link and the in-tree one for include

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-02-10 06:51:07 +01:00
Andrew Bartlett
a2ce53c1f5 s4-auth Rework auth subsystem to remove struct auth_serversupplied_info
This changes auth_serversupplied_info into the IDL-defined struct
auth_user_info_dc.  This then in turn contains a struct
auth_user_info, which is the only part of the structure that is
mainted into the struct session_info.

The idea here is to avoid keeping the incomplete results of the
authentication (such as session keys, lists of SID memberships etc) in
a namespace where it may be confused for the finalised results.

Andrew Barltett
2011-02-09 01:11:06 +01:00
Simo Sorce
1d27f0b264 mit-samba: Allow nesting on the event context
This context is used in ldb, and ldb modules apparently abort if nesting is not
allowed.

Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Mon Feb  7 20:58:02 CET 2011 on sn-devel-104
2011-02-07 20:58:02 +01:00
Andrew Tridgell
60be4a4c37 s4-kdc: don't ask for an extended DN for krbtgt_dn
otherwise msg->dn would be non-minimal and would fail in searches

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-01-14 16:39:33 +11:00
Brad Hards
bf0d5d04ab Typo fix in KDC parameters.
Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org>

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Fri Dec 24 12:09:00 CET 2010 on sn-devel-104
2010-12-24 12:09:00 +01:00
Matthias Dieter Wallnöfer
136a5d7a26 s4:kdc/*.c - minimise includes
Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Dec 12 15:20:46 CET 2010 on sn-devel-104
2010-12-12 15:20:46 +01:00
Matthias Dieter Wallnöfer
c7b2ec6fbb s4:kdc/proxy.c - optimise includes in order to fix a build warning on Tru64 2010-12-12 12:15:51 +01:00
Matthias Dieter Wallnöfer
3c38166cdb s4:kdc/kpasswdd.c - don't return an uninitialised NT_STATUS
Discovered by Tru64 build
2010-12-12 11:58:59 +01:00
Andrew Bartlett
f681859eb8 s4-lsa Implement kerberos ticket life policy
We now no longer print tickets with a potentially infinite life, and
we report the same life over LSA as we use in the KDC.  We should get
this from group policy, but for now it's parametric smb.conf options.

Andrew Bartlett
2010-12-09 18:02:59 +11:00
Matthias Dieter Wallnöfer
f156c340b4 s4:kdc/kpasswdd.c - fix memory leaks 2010-12-04 16:40:25 +01:00
Matthias Dieter Wallnöfer
88a2ad28fe s4/kdc - fix a warning regarding a changed parameter type (kvno)
Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Fri Dec  3 23:56:15 CET 2010 on sn-devel-104
2010-12-03 23:56:15 +01:00
Andrew Bartlett
c5bea98ddb s4:heimdal: import lorikeet-heimdal-201012010201 (commit 81fe27bcc0148d410ca4617f8759b9df1a5e935c) 2010-12-01 17:00:47 +11:00
Andrew Tridgell
33d178767b s4-loadparm: use loadparm_init_global() instead of loadparm_init()
this prevents us having two lp_ctx contexts in these tools which leads
to bizarre behaviour

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-11-29 18:04:42 +11:00
Andrew Bartlett
deed2a935b s4-kdc Rework supported encryption type logic to match Microsoft
Thanks to Hongwei Sun for the clear description of the algorithim
involved.  Importantly, it isn't possible to remove encryption types
from the list, only to add them over the defaults (DES and
arcfour-hmac-md5, and additional AES for DCs and RODCs).

This changes the behaviour for entries with
msDS-supportedEncryptionTypes: 0, which Angelos Oikonomopoulos
reported finding set by ADUC when attempting to store cleartext
passwords.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Tue Nov 16 21:24:43 UTC 2010 on sn-devel-104
2010-11-16 21:24:43 +00:00
Andrew Bartlett
d76f11a8bd s4-kdc Fix the realm handling again, this time pay attention to the flags
The KDC sets different flags for the AS-REQ (this is client-depenent)
and the TGS-REQ to determine if the realm should be forced to the
canonical value.  If we do this always, or do this never, we get into
trouble, so it's much better to honour the flags we are given.

Andrew Bartlett
2010-11-16 15:30:13 +11:00
Andrew Bartlett
5c72c6b760 s4-kdc use 'flags' to only create the 'admin data' elements when requested
This avoids setting these values when the caller simply does not care

Andrew Bartlett
2010-11-16 15:30:12 +11:00
Andrew Bartlett
935d7a6f72 s4-kdc Add 'flags' parameter to db fetch calls
This will allow these calls to honour the flags passed in from the KDC

Andrew Bartlett
2010-11-16 15:30:12 +11:00
Andrew Bartlett
96bdcf7ea9 s4-kdc Don't regenerate the PAC for cross-realm tickets
We should never get a cross-realm ticket that was not issued by a full
DC, but if someone claims to have such a thing, reject it rather than
segfaulting on the NULL client pointer.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Mon Nov 15 23:59:34 UTC 2010 on sn-devel-104
2010-11-15 23:59:34 +00:00
Andrew Bartlett
a32ade647d s4-kdc Don't always regenerate the PAC
The PAC was being regenerated on all normal DCs, because they don't
have a msDS-SecondaryKrbTgtNumber attribute.  Instead we need to check
if it's set and not equal to our RODC number, allowing RODCs to trust
the full DCs and itself, but not other RODCs.

Andrew Bartlett
2010-11-15 23:17:05 +00:00
Andrew Bartlett
6358303784 s4-kdc Fix realm handling in our KDC
we should reset the realm part of the principal, but not the lowercase
realm embedded in the 'krbtgt/realm@REALM'.

Andrew Bartlett
2010-11-15 08:04:04 +00:00
Jelmer Vernooij
caa3935a38 kdc: Build as shared module by default. 2010-11-15 03:14:23 +01:00
Andrew Bartlett
be8526a0a1 s4-kdc update startup routines after heimdal update
We should check the errors from krb5_kdc_windc_init and we now need to
additionally run krb5_kdc_pkinit_config()

Andrew Bartlett
2010-11-15 01:25:06 +00:00
Andrew Bartlett
bbfaa9bbdf s4-kdc Remove use of heimdal private headers in kpasswd server.
This remains an abuse, because it relies on setting into the krb5_principal
structure, but at least it causes less trouble for the server.

Andrew Bartlett
2010-11-15 01:25:06 +00:00
Andrew Tridgell
2d7dc86b5d s4-kdc: if "bind interfaces only" is false, then also listen on wildcard
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Mon Nov 15 00:13:59 UTC 2010 on sn-devel-104
2010-11-15 00:13:59 +00:00
Jelmer Vernooij
bee3b665a8 Build wrepl server as service by default. 2010-11-14 17:14:05 +00:00
Andrew Tridgell
1ec8d55e27 s4-kdc: added proxying of kdc requests for RODCs
when we are an RODC and we get a request for a principal that we don't
have the right secrets for, we need to proxy the request to a
writeable DC. This happens for both TCP and UDP requests, for both
krb5 and kpasswd

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Fri Nov 12 08:03:20 UTC 2010 on sn-devel-104
2010-11-12 08:03:20 +00:00
Andrew Bartlett
e7fb5a6c91 s4-kdc Return HDB_ERR_NOT_FOUND_HERE on un-revealed accounts on an RODC
This means that when we are an RODC, and an account does not have the
password attributes, we can now indicate to the kdc code that it
should forward the request to a real DC.

(The proxy code itself is not in this commit).

Andrew Bartlett
2010-11-12 18:18:55 +11:00
Andrew Tridgell
2fbaa09919 s4-kdc: split the kdc process return into a tri-state
this is in preparation for doing forwarding of packets for RODCs

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-11-12 18:18:55 +11:00
Andrew Tridgell
4f352a5b6a s4-kdc: we don't need the special include handling now
the special handling was to cope with the conflict with the kdc.h
header

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-11-12 18:18:55 +11:00
Andrew Tridgell
e26609b667 s4-kdc: rename kdc/kdc.h to kdc/kdc-glue.h
kdc.h conflicts with a heimdal header name
2010-11-12 18:18:55 +11:00
Jelmer Vernooij
4217734a51 credentials: Lowercase library name,
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sun Nov  7 01:48:44 UTC 2010 on sn-devel-104
2010-11-07 01:48:44 +00:00
Jelmer Vernooij
3deece5591 s4: Remove the old perl/m4/make/mk-based build system.
The new waf-based build system now has all the same functionality, and
the old build system has been broken for quite some time.

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sun Oct 31 02:01:44 UTC 2010 on sn-devel-104
2010-10-31 02:01:44 +00:00
Andrew Tridgell
046d38faa5 s4-smbd: don't initialise process models more than once
this also removes the event_context parameter from process model
initialisation. It isn't needed, and is confusing when a process model
init can be called from more than one place, possibly with different
event contexts.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-30 23:49:00 +11:00
Andrew Tridgell
b6b0d2cea3 s4-kdc: create a 'pac' private grouping library
this removes the final case where we have an object file linked into
two libraries

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-10-30 23:49:00 +11:00
Jelmer Vernooij
a74e8be6d1 waf: Stop automaticaly changing dashes to underscores in library names. 2010-10-26 10:17:18 -07:00
Jelmer Vernooij
8cf61377aa waf: Remove lib prefix from libraries manually. 2010-10-26 10:17:17 -07:00
Jelmer Vernooij
18ae8887a3 s4: Rename DB_GLUE to db_glue. 2010-10-24 00:20:04 +00:00
Jelmer Vernooij
833480d3ad s4: Rename LIBSAMBA-* to libsamba-* 2010-10-24 00:20:04 +00:00
Andrew Tridgell
7c92baf0dc s4-kdc: make DB_GLUE a private library 2010-10-21 19:03:25 +11:00
Matthias Dieter Wallnöfer
3ead246062 s4:"util_ldb" - remove some really unused dependancies 2010-10-18 19:35:11 +02:00
Matthias Dieter Wallnöfer
a3f61dea40 Revert "s4:remove "util_ldb" submodule and integrate the three gendb_* calls in "dsdb/common/util.c""
This reverts commit 8a2ce5c47c.

Jelmer pointed out that these are also in use by other LDB databases - not only
SAMDB ones.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Oct 17 13:37:16 UTC 2010 on sn-devel-104
2010-10-17 13:37:16 +00:00
Matthias Dieter Wallnöfer
8a2ce5c47c s4:remove "util_ldb" submodule and integrate the three gendb_* calls in "dsdb/common/util.c"
They're only in use by SAMDB code.

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Oct 17 09:40:13 UTC 2010 on sn-devel-104
2010-10-17 09:40:13 +00:00
Andrew Bartlett
42127cdbb0 s4-credentials Add explicit event context handling to Kerberos calls (only)
By setting the event context to use for this operation (only) onto
the krb5_context just before we call that operation, we can try
and emulate the specification of an event context to the actual send_to_kdc()

This eliminates the specification of an event context to many other
cli_credentials calls, and the last use of event_context_find()

Special care is taken to restore the event context in the event of
nesting in the send_to_kdc function.

Andrew Bartlett
2010-10-11 13:02:16 +00:00
Andrew Bartlett
baeaa17986 s4-kerberos Remove unused parameter 2010-10-11 13:02:15 +00:00
Jelmer Vernooij
6c410dd615 kdc: Add missing dependency on samba_gensec_server. 2010-10-11 01:06:36 +02:00
Jelmer Vernooij
93126b3315 samdb: Add flags argument to samdb_connect(). 2010-10-10 23:08:49 +02:00
Matthias Dieter Wallnöfer
0e5b77bec4 s4:kdc - use "userAccountControl" always unsigned
It doesn't change much but it's nicer to have it consistent.
2010-10-05 08:43:19 +00:00
Jelmer Vernooij
5548d3d41e Add missing dependencies for com_err. 2010-10-05 00:38:35 +02:00
Jelmer Vernooij
39f9bfde39 heimdal: Fix name of kdc library. 2010-10-05 00:38:34 +02:00
Jelmer Vernooij
1db3221c94 heimdal: Fix name of 'hdb'. 2010-10-05 00:38:34 +02:00
Matthias Dieter Wallnöfer
7d0d6d4d23 s4:kdc/db-glue.c - remove unused variable
Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sun Oct  3 17:30:34 UTC 2010 on sn-devel-104
2010-10-03 17:30:34 +00:00
Andrew Bartlett
dcb1a0698a s4-kdc Remove special case kerberos restriction in the KDC
We should avoid using Kerberos or any other recursive auth mechanism
in ldb backends, but denying Kerberos here won't be enough, so
remove the special case.  (Typcially we bind using a different password
space and DIGEST-MD5 or NTLM).

Andrew Bartlett
2010-10-03 15:23:19 +00:00
Andrew Bartlett
0e11d18d14 s4-kdc Fix up after import of new lorikeet-heimdal
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Sun Oct  3 01:56:04 UTC 2010 on sn-devel-104
2010-10-03 01:56:04 +00:00
Andrew Bartlett
7b9a6645b1 s4-kdc Rework 'allowed encryption types' handling in the KDC
All DCs and all krbtgt servers are forced to use AES, regardless
of the msDS-SecondaryKrbTgtNumber value.

Andrew Bartlett
2010-10-02 09:11:37 +10:00
Andrew Tridgell
4e0a3ea705 s4-kdc: RODC DCs should be able to produce forwardable tickets
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-28 19:25:51 -07:00
Andrew Bartlett
3d4576b170 s4-kdc Ensure that an RODC may act as a server (needed to fill
the krbtgt role).

Andrew Bartlett
2010-09-28 19:25:50 -07:00
Andrew Bartlett
89ee9e6518 s4-kdc Handle the case where we may be given a ticket from an RODC in db layer
This includes rewriting the PAC if the original krbtgt isn't to be
trusted, and reading different entries from the DB for the krbtgt
depending on the krbtgt number.

Andrew Bartlett
2010-09-29 04:23:07 +10:00
Andrew Bartlett
3021af2777 s4-kdc Add common setup, handle RODC setup case
This means we just set up the system_session etc in one place
and don't diverge between the MIT and Heimdal plugins.

We also now determine if we are an RODC and store some details
that we will need later.

Andrew Bartlett
2010-09-29 04:23:07 +10:00
Andrew Bartlett
990720b8cd s4-kdc Add function to determine if a hdb entry is a RODC
This is important, as we must ignore the PAC from an RODC.

Andrew Bartlett
2010-09-29 04:23:07 +10:00
Andrew Bartlett
85f7bce865 s4-kdc Use msDS-SecondaryKrbTgtNumber to fill in the full KVNO
Andrew Bartlett
2010-09-29 04:23:07 +10:00
Andrew Tridgell
bc47af50eb s4-kdc: added ifdef guards in kdc.h
this prevents too much recursion in the compiler preprocessor
2010-09-27 22:55:04 -07:00
Andrew Tridgell
d5a4e53ad8 s4-kdc: prevent segfault on bad trust strings
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-16 21:09:17 +10:00
Günther Deschner
e2f15d2a25 s4-trusts: fix trustDomainPasswords drsblobs IDL and server side support.
Also remove bogus trustCurrentPasswords struct which we just had because our IDL
was incorrect.

Guenther
2010-08-25 13:27:50 +02:00
Andrew Bartlett
6cf29b3e4f s4:security Change struct security_token->sids from struct dom_sid * to struct dom_sid
This makes the structure much more like NT_USER_TOKEN in the source3/
code.  (The remaining changes are that privilages still need to be merged)

Andrew Bartlett
2010-08-23 08:50:55 +10:00
Andrew Bartlett
7c6ca95bec s4:security Remove use of user_sid and group_sid from struct security_token
This makes the structure more like Samba3's NT_USER_TOKEN
2010-08-18 09:50:38 +10:00
Matthias Dieter Wallnöfer
4c8edc8f5e s4:kdc/kpasswdd.c - let the user change his own password with his own rights
Now it's finally possible that the user can change his password with a DSDB
connection using his credentials.

NOTICE: I had to extract the old password from the SAMDB since I was unable to
find it somewhere else (authinfo for example).
2010-08-17 18:45:34 +02:00
Matthias Dieter Wallnöfer
2a423e0547 s4:kdc/rpc server - adapt the "samdb_set_password" calls which perform password sets 2010-08-17 18:45:34 +02:00
Andrew Tridgell
6b266b85cf s4-loadparm: 2nd half of lp_ to lpcfg_ conversion
this converts all callers that use the Samba4 loadparm lp_ calling
convention to use the lpcfg_ prefix.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-07-16 18:24:27 +10:00
Andrew Bartlett
d76e4852eb s4:kdc Rework the 'allowed enc types' calculation
This changes the calculation to apply the allowed enc types to all
uses of the key (no point allowing a weak kinit to a key the server
wanted strongly protected).  It also ensures that all the non-DES keys
are available on the krbtgt in particular, even as it does not have a
msds-SupportedEncryptionTypes attributes.

Andrew Bartlett
2010-06-29 16:59:30 +10:00
Matthias Dieter Wallnöfer
0c29224da3 s4:kdc/kdc.c - add cast to suppress warnings on Solaris 10 cc 2010-06-26 19:43:51 +02:00
Matthias Dieter Wallnöfer
c8a5ed8db9 s4:kdc/kpasswdd.c - remove unreachable code 2010-06-26 19:42:29 +02:00
Jelmer Vernooij
c5d07d2a1a Per Andrews request, revert
"heimdal/waf: Initial work on making it possible to use the system"
as the hdb_check_s4u2self function handling is incorrect.

This reverts commit b099631f42.
2010-06-23 14:49:02 +02:00
Andrew Bartlett
80701e5f29 s4:kdc Use msDS-SupportedEncTypes in our KDC
We need to honour this, otherwise we will send AES-encrypted tickets
to unprepared Kerberos targets.

Andrew Bartlett
2010-06-23 20:10:01 +10:00
Matthias Dieter Wallnöfer
ecbe9a74c6 s4:kdc/db-glue.c - remove unreachable code
Would be nice if someone could check if this fits.
2010-06-20 22:33:03 +02:00
Jelmer Vernooij
b099631f42 heimdal/waf: Initial work on making it possible to use the system
heimdal again.

Still missing are the detection of the right Heimdal version and
linking (unresolved symbols at the moment).
2010-06-19 15:32:27 +02:00
Andrew Bartlett
e5232bdc69 s4:kdc Remove special talloc_free of the ldb context
I can see no reason not to just let this go with the talloc tree that
created it, and avoid a talloc_free with references.

Andrew Bartlett
2010-05-28 21:59:04 +10:00
Jelmer Vernooij
390ada6ec7 Remove more usages of iconv_convenience in files which were apparently not recompiled by waf. 2010-05-18 11:45:31 +02:00
Jelmer Vernooij
b8268cf7b0 s3: Remove use of iconv_convenience. 2010-05-18 11:45:31 +02:00
Jelmer Vernooij
f9ca9e46ad Finish removal of iconv_convenience in public API's. 2010-05-18 11:45:30 +02:00
Matthias Dieter Wallnöfer
6e8098b261 s4:samdb_set_password/samdb_set_password_sid - Rework
Adapt the two functions for the restructured "password_hash" module. This
means that basically all checks are now performed in the mentioned module.

An exception consists in the SAMR password change calls since they need very
precise NTSTATUS return codes on wrong constraints ("samr_password.c") file
2010-05-10 19:07:46 +02:00
Marcel Ritter
6be72df736 Simple fix to prevent crash for non-pac principals
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-04-27 16:41:51 +10:00
Matthias Dieter Wallnöfer
c678563efe s4:kdc/db-glue.c - use "TALLOC_FREE" insteal of "talloc_free" for the "priv" context
Also after a free "priv" could be != NULL and may be freed again.
This should fix bug #7365.
2010-04-17 20:10:27 +02:00
Matthias Dieter Wallnöfer
827ccdf6b9 s4:kdc/wdc-samba4.c - fix integer counter types 2010-04-12 02:03:12 +02:00
Matthias Dieter Wallnöfer
ad898fd638 s4:kdc/db-glue.c - fix integer counter types 2010-04-12 02:03:11 +02:00
Andrew Bartlett
f2b63d58da s4:kdc Add functions to hdb-samba4 for the new s4u2self callback.
For now, this shares the 'if it's the same host' system with the
constrained delegation code.

Andrew Bartlett
2010-04-10 21:40:59 +10:00
Andrew Tridgell
f9eae32f4b s4-waf: mark the wscript files as python so vim/emacs knows how to highlight them 2010-04-06 20:27:11 +10:00
Andrew Tridgell
844acb2260 build: waf quicktest nearly works
Rewrote wafsamba using a new dependency handling system, and started
adding the waf test code
2010-04-06 20:26:48 +10:00
Andrew Tridgell
845e0cbe6f build: commit all the waf build files in the tree 2010-04-06 20:26:48 +10:00
Andrew Bartlett
5f6f7a2e51 s4:kdc Add support for changing password of a servicePrincipalName
Apparently AD supports setting a password on a servicePrincipalName,
not just a user principal name.  This should fix (part of) the join of
OpenSolaris's internal CIFS server to Samba4 as reported by Bug #7273

Andrew Bartlett
2010-03-25 16:32:04 +11:00
Andreas Schneider
c3b90f00d4 s4-kdc: Fixed the memory context of tstream_bsd_existing()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2010-02-26 12:08:53 +01:00
Simo Sorce
d8cbc6ccdb s4:kdc add mit plugin code 2010-02-25 13:01:14 -05:00
Simo Sorce
489f78d19e s4:kdc make function static 2010-02-25 13:01:14 -05:00
Brad Hards
1e986c1cb3 More spelling fixes across source4/
Signed-off-by: Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de>
2010-02-22 21:45:38 +01:00
Brad Hards
7a23b9769b Various source4 spelling fixes.
Signed-off-by: Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de>
2010-02-22 21:45:37 +01:00
Andrew Tridgell
0bedb9cf5e s4-dsdb: removed gendb_search_single_extended_dn()
Use dsdb_search_one() instead, which allows for arbitrary controls

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-02-16 21:10:51 +11:00
Andrew Tridgell
90203f87e7 s4-dsdb: change samdb_replace() to dsdb_replace() and allow for dsdb_flags
This allows for controls to be added easily where they are needed.
2010-02-16 21:10:50 +11:00
Simo Sorce
30797cec7d s4:kdc Fill in created_by principal field 2010-02-12 16:39:33 -05:00
Simo Sorce
2e2b7e8259 s4:kdc Fix double free and uninitialized memory.
In samba_kdc_trust_message2entry() on error, hdb_free_entry()
may end up trying to access uninitialized memory or double
free the hdb_entry.
2010-02-12 16:39:26 -05:00
Simo Sorce
b116d4e5b9 s4:kdc Streamline client access verification call
Move the core to pac-glue so that other plugins can use it.
2010-01-31 13:25:17 -05:00
Simo Sorce
0520bd7782 s4:kdc Fix netbios name retrieval
The code was looping but always checking only the first address.
2010-01-31 13:25:17 -05:00
Simo Sorce
14e006747e s4:kdc remove dead code and comments 2010-01-28 19:33:34 -05:00
Simo Sorce
7b355d41b5 s4:kdc Fill in more data fields 2010-01-28 19:33:34 -05:00
Simo Sorce
3ce54a4a97 s4:kdc move db functions in their own file
Keep all heimdal related plugin code within hdb_samba4.c
Move interfaces needed by multiple plugins in db-glue.c

Move sequence context in main db context so that we do
not depend on db->hdb_dbc in the common code.

Remove unnecessary paremeters from function prototypes
2010-01-28 19:33:34 -05:00
Simo Sorce
a097527ab7 s4:kdc Use a clearer name for the samba kdc entry
Renames hdb_samba4_private to samba_kdc_entry
Streamlines members of the entry and the kdc db contextto avoid
unnecessary duplication.
2010-01-28 19:33:34 -05:00
Simo Sorce
c6865af445 s4:kdc Use better db context structure
This allows to use a common structure not tied to hdb_samba4
Also allows to avoid many casts within hdb_samba4 functions

This is the first step to abstract samba kdc databse functions
so they can be used by the MIT forthcoming plugin.
2010-01-28 19:33:34 -05:00
Simo Sorce
b63b9bcd42 s4:windc move windc plugin in its own file
Keep all heimdal related plugin code within wdc-samba4.c
Leave only interfaces common to multiple plugins in pac-glue.c
2010-01-27 14:03:06 -05:00
Simo Sorce
1f2e9e90bd s4:PAC make common functions public 2010-01-27 14:03:06 -05:00
Simo Sorce
82a80b7f71 s4:PAC Streamline pac-glue step 2
Split functions so that no assumption is made about which plugin
is using them
2010-01-27 14:03:06 -05:00
Simo Sorce
85e3561dc9 s4:PAC Streamline pac-glue
First step, preparing to share the code between multiple plugins.
2010-01-27 14:03:06 -05:00
Simo Sorce
4c548048c5 s4:kdc Simplify header files 2010-01-22 11:16:24 -05:00
Simo Sorce
e0e255fb24 Fix comment/debug messages 2010-01-11 11:55:28 -05:00
Simo Sorce
7eee8e053b Fix comment 2010-01-08 17:01:02 -05:00
Andreas Schneider
0588f34467 s4-kdc: Migrate tcp connections to tsocket.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2010-01-08 14:38:35 +01:00
Stefan Metzmacher
42c34cdafa s4:kdc: use LIBSAMBA_TSOCKET
metze
2010-01-08 14:36:49 +01:00
Stefan Metzmacher
d97562b382 s4:kdc: the ->process function returns "bool"
metze
2010-01-08 14:36:49 +01:00
Stefan Metzmacher
5126b52810 s4:kdc: use the remote and local address from the stream_connection struct
metze
2009-12-24 17:38:33 +01:00
Simo Sorce
67d1af4384 s4:cleanups More trailing spaces and tabs 2009-12-23 15:17:56 -05:00
Simo Sorce
da27d4e465 s4:cleanups remove trailing spaces and tabs 2009-12-23 15:09:49 -05:00
Stefan Metzmacher
fcbe8f0c80 s4:kdc: setup the local and remote tsocket_address at accept time
metze
2009-12-19 18:24:26 +01:00
Stefan Metzmacher
4dc958c7c8 s4:kdc: convert UDP based communication to tdgram_context
metze
2009-12-19 18:24:26 +01:00
Andreas Schneider
ac2d31e24c s4-gensec: Replace gensec_set_peer_addr with new tsocket based fn. 2009-12-16 20:28:38 +01:00
Andreas Schneider
226a9db2d9 s4-gensec: Replace gensec_set_my_addr() with new tsocket based fn. 2009-12-16 20:28:38 +01:00
Andreas Schneider
b55d07615b s4-kdc: Migrate to tsocket_address. 2009-12-15 23:34:23 +01:00