1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

485 Commits

Author SHA1 Message Date
Matthias Dieter Wallnöfer
f11a1a4a07 s4:kdc/wdc-samba4.c - fix user logins on specific workstations
The decrement operation has been missing.

Problem found by Mohammad Ebrahim Abravi <lamp.mia@gmail.com>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-14 08:37:49 +10:00
Andrew Bartlett
b8815dc23d lib/param: Create a seperate server role for "active directory domain controller"
This will allow us to detect from the smb.conf if this is a Samba4 AD
DC which will allow smarter handling of (for example) accidentially
starting smbd rather than samba.

To cope with upgrades from existing Samba4 installs, 'domain
controller' is a synonym of 'active directory domain controller' and
new parameters 'classic primary domain controller' and 'classic backup
domain controller' are added.

Andrew Bartlett
2012-06-15 09:18:33 +02:00
Jelmer Vernooij
890485bd17 heimdal: Cope with newer Heimdal versions accepting a keyset argument to
hdb_enctype2key.

Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Mon May  7 18:33:10 CEST 2012 on sn-devel-104
2012-05-07 18:33:10 +02:00
Simo Sorce
110dad8c9e Make krb5 context initialization not heimdal specific
Turn the logging data to an opaque pointer.
Ifdef code and use MIT logging function when built against system MIT.
2012-04-23 16:40:05 -04:00
Simo Sorce
4b29cf5f66 Move kdc_get_policy helper in the lsa server where it belongs.
This was used in only 2 places, db-glue.c and the lsa server.
In db-glue.c it is awkward though, as it forces to use an unconvenient lsa
structure and conversions from time_t to nt_time only to have nt_times
converted back to time_t for actual use. This is silly.

Also the kdc-policy file was a single funciton library, that's just ridiculous.

The loadparm helper is all we need to keep the values consistent, and if we
ever end up doing something with group policies we will care about it when it's
the time. the code would have to change quite a lot anyway.

Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Fri Apr 20 01:53:37 CEST 2012 on sn-devel-104
2012-04-20 01:53:37 +02:00
Simo Sorce
37e98ff252 Use loadparm helper to find lifetime defaults
Implictly fixes buggy use of int for time_t
2012-04-19 18:14:02 -04:00
Simo Sorce
70c303a7f3 auth-krb: Move pac related util functions in a single place.
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12 12:06:43 +02:00
Simo Sorce
6de578a8f7 s4-auth-krb: Move function to db-glue.c and make it static.
kerberos_enctype_to_bitmap is not used anywhere else, so just move it there and
make it static, one less dependency to worry about.

Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12 12:06:42 +02:00
Michael Wood
d65f33de1d Log short_princ instead of uninitialised filter.
Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Sat Jan 21 13:06:35 CET 2012 on sn-devel-104
2012-01-21 13:06:35 +01:00
Andrew Bartlett
b69c40ffce auth/kerberos: Remove unused TALLOC_CTX argument to check_pac_checksum 2012-01-12 18:02:54 +11:00
Andrew Bartlett
49f8113fab s4-kdc Do the KDC PAC checksum validation in the Samba plugin
Here we can fetch the right key, and check if the PAC is likely to be signed by a key that
we know.  We cannot check the KDC signature on incoming trusts.

Andrew Bartlett
2012-01-12 18:02:54 +11:00
Andrew Bartlett
d0bb8b8a15 s4-kdc: use IDL constant NETLOGON_GENERIC_KRB5_PAC_VALIDATE 2012-01-12 17:54:15 +11:00
Andrew Bartlett
8d3e92d043 s4-kdc: only build hdb plugin if we build against system Heimdal
It is not safe to have a system kadmin use our plugin if we do not
share the same libkrb5.

Andrew Bartlett
2011-12-07 03:09:08 +01:00
Andrew Bartlett
12ce07e53b s4-kdc: Add hdb plugin for samba4, to allow kadmin to work
This will help users who are used to the kadmin interface, and could
be extended to import existing MIT or Heimdal keys into a Samba4 AD
domain.

To use, add to your krb5.conf

[kdc]

database = {
   dbname = samba4:
}

or

[kdc]

database = {
   dbname = samba4:/usr/local/samba/etc/smb.conf
}

And copy hdb_samba4.so from PREFIX/modules/hdb to your Heimdal lib directory

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Wed Nov 30 03:22:11 CET 2011 on sn-devel-104
2011-11-30 03:22:11 +01:00
Andrew Bartlett
e7d5f0a357 gensec: move event context from gensec_*_init() to gensec_update()
This avoids keeping the event context around on a the gensec_security
context structure long term.

In the Samba3 server, the event context we either supply is a NULL
pointer as no server-side modules currently use the event context.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-10-18 13:13:33 +11:00
Simo Sorce
6bed57788c pac: Fix wrong memory allocation check
Autobuild-User: Simo Sorce <idra@samba.org>
Autobuild-Date: Tue Oct 11 01:18:22 CEST 2011 on sn-devel-104
2011-10-11 01:18:22 +02:00
Andrew Tridgell
0ef8dca9fb s4-kdc: fixed handling of previous vs current trust password
This sorts out the correct handling for the 'kvno=255'
problem. Windows will use the previous trust password for 1 hour after
a password set, and indicates that the previous password is being used
by sending current_kvno-1. That maps to 255 if the trust password has
not actually been changed, so the initial trust password is being
used.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-10-04 15:08:57 +11:00
Andrew Tridgell
aee896ad98 s4-kdc: don't look at global catalog NCs in the kdc
the kdc should not be looking for users in GC partial replicas, as
these users do not have all of the attributes needed for the KDC to
operate

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-10-04 15:08:57 +11:00
Andrew Tridgell
5717da34b9 s4-kdc: treat a kvno of 255 as unspecified
windows sometimes sends us a kvno of 255 for inter-domain trusts. We
don't yet know why it does this, but it seems that we need to treat
this as an unspecified kvno

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-10-04 15:08:57 +11:00
Andrew Tridgell
b92e0a232e s4-kdc: set NO_GLOBAL_CATALOG control in kdc
the kdc doesn't want to find users who are in partialReplica
partitions, as they won't have the needed secret info for the kdc to
operate. We need to generate referrals instead

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-09-22 10:00:49 +10:00
Andrew Tridgell
ee7cfcadc6 s4-kdc: default kvno for inter-domain trusts to zero
the exact value doesn't matter, as both Samba and windows check
against the latest password, but the old default of -1 caused ASN.1
parsing errors on windows, which prevented it answering TGS requests

thanks to Hongwei Sun for finding this from a ttt trace

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-09-19 10:57:03 +10:00
Andrew Tridgell
8510e405f5 s4-kdc: fixed subtree search in KDC
use ldb_get_default_basedn() with a subtree search

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-08-25 07:39:37 +10:00
Jelmer Vernooij
292fe74971 credentials: Rename library to samba-credentials to avoid name clashes.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Thu Aug 18 22:16:38 CEST 2011 on sn-devel-104
2011-08-18 22:16:38 +02:00
Andrew Bartlett
35b309fa0c gensec: clarify memory ownership for gensec_session_info() and gensec_session_key()
This is slightly less efficient, because we no longer keep a cache on
the gensec structures, but much clearer in terms of memory ownership.
Both gensec_session_info() and gensec_session_key() now take a mem_ctx
and put the result only on that context.

Some duplication of memory in the callers (who were rightly uncertain
about who was the rightful owner of the returned memory) has been
removed to compensate for the internal copy.

Andrew Bartlett
2011-08-03 18:48:02 +10:00
Stefan Metzmacher
ac8096e69d s4:kdc: fix compiler warning
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Aug  2 06:06:15 CEST 2011 on sn-devel-104
2011-08-02 06:06:15 +02:00
Stefan Metzmacher
51b94ab3fd s4:kdc: canonicalize the principal if HDB_F_FOR_TGS_REQ is given
Windows seems to always canonicalize the principal in TGS replies.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Jul 26 03:25:06 CEST 2011 on sn-devel-104
2011-07-26 03:25:06 +02:00
Stefan Metzmacher
8d159e9de1 s4:kdc: restore the behavior before the last heimdal import
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Jul 20 12:12:38 CEST 2011 on sn-devel-104
2011-07-20 12:12:38 +02:00
Stefan Metzmacher
7acc1a7a2f s4:kdc: set *_strongest_*_key to true to restore the old behavior
TODO: check why this is needed.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Fri Jul 15 12:26:25 CEST 2011 on sn-devel-104
2011-07-15 12:26:25 +02:00
Stefan Metzmacher
b005fa142f s4:kdc/mit_samba: disable mit_samba_check_s4u2proxy()
As mit_samba_update_pac_data() doesn't support adding
S4U_DELEGATION_INFO to the pac (and I have no clue how to add that)
we should disable S4U2Proxy until this is implemented.

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Jun 28 20:35:19 CEST 2011 on sn-devel-104
2011-06-28 20:35:18 +02:00
Stefan Metzmacher
73b1e1466c s4:kdc: generate the S4U_DELEGATION_INFO in the regenerated pac
metze
2011-06-28 19:23:43 +02:00
Stefan Metzmacher
020f60287c s4:kdc: use KRB5_WINDC_PLUGIN_MINOR define instead of KRB5_WINDC_PLUGING_MINOR
metze
2011-06-28 18:24:37 +02:00
Stefan Metzmacher
ad45072aaf s4:kdc: implement samba_kdc_check_s4u2proxy()
metze
2011-06-24 19:06:44 +02:00
Volker Lendecke
f0ff6f390a Use tevent_req_oom
This fixes a few Coverity errors
2011-06-20 12:33:24 +02:00
Andrew Bartlett
a1f04e8abc libcli/util Rename common map_nt_error_from_unix to avoid duplicate symbol
The two error tables need to be combined, but for now seperate the names.

(As the common parts of the tree now use the _common function,
errmap_unix.c must be included in the s3 autoconf build).

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Mon Jun 20 08:12:03 CEST 2011 on sn-devel-104
2011-06-20 08:12:03 +02:00
Andrew Tridgell
40dc94a53f s4-ipv6: update callers to load_interface_list() 2011-06-06 12:26:10 +10:00
Andrew Tridgell
dc8c8fd9e4 s4-ipv6: use iface_list_wildcard() to listen on IPv6
when we need to listen on a wildcard address, we now listen on a list
of sockets, usually 0.0.0.0 and ::
2011-06-06 12:26:10 +10:00
Stefan Metzmacher
a7b8593f9c s4:kdc: split s4u2self and s4u2proxy checks
metze
2011-05-18 07:46:44 +02:00
Stefan Metzmacher
5f48c5df51 s4:kdc: UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION => flags.trusted_for_delegation
metze
2011-05-18 07:46:43 +02:00
Andrew Bartlett
22cb631b4f s4-interfaces Rename interfaces code so not to conflict with source3/
The iface_count, iface_n_bcast, and load_interfaces functions
conflicted with functions of the same name in source3, so the source4
functions were renamed.  Hopefully we can actually wrap one around the
other in future.

Andrew Bartlett
2011-05-08 12:57:04 +02:00
Andrew Bartlett
86baefe224 kdc: always ldb escape the realm 2011-04-05 23:46:04 +02:00
Andrew Bartlett
b5616adc8a lib/util/charset rename iconv_convenience to iconv_handle
This better reflects what this structure is

Andrew Bartlett
2011-03-25 04:37:06 +01:00
Andrew Tridgell
15e84a9a09 charcnv: removed the allow_badcharcnv and allow_bad_conv options to convert_string*()
we shouldn't accept bad multi-byte strings, it just hides problems

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Thu Mar 24 01:47:26 CET 2011 on sn-devel-104
2011-03-24 01:47:26 +01:00
Jelmer Vernooij
a68b59e9a6 source4/kdc: Fix prototypes for all functions. 2011-03-19 03:20:05 +01:00
Stefan Metzmacher
8002406c51 s4:kdc: split the kdc_tcp_proxy() logic from the main kdc logic
By having kdc_tcp_proxy_send/recv(), which just asks any writeable
dc for a reponse blob, we simplify the interaction between
client-local and local-writeable sockets.

This allows us to make kdc_socket, kdc_process_fn_t, kdc_tcp_call and kdc_tcp_socket
private to kdc.c again.

metze
2011-03-04 21:19:05 +01:00
Stefan Metzmacher
e70b09e8f8 s4:kdc: split the kdc_udp_proxy() logic from the main kdc logic
By having kdc_udp_proxy_send/recv(), which just asks any writeable
dc for a reponse blob, we simplify the interaction between
client-local and local-writeable sockets.

This allows us to make kdc_udp_call and kdc_udp_socket private to
kdc.c again.

metze
2011-03-04 21:19:05 +01:00
Stefan Metzmacher
ad9ac99afd s4:kdc: add a kdc_proxy_unavailable_error() helper function
metze
2011-03-04 21:19:05 +01:00
Stefan Metzmacher
0c78640e67 s4:kdc: fix calculation of the rodc kvno
Bit shifting is non-trivial in C:-)

This

	int32_t a = 0x12340000;
	uint32_t b = (a >> 16);

results in 0x00001234, but this

	int32_t a = 0xEDCB0000;
	uint32_t b = (a >> 16);

results in 0xFFFFEDCB, while we expected 0x0000EDCB.

metze
2011-03-04 21:19:05 +01:00
Andrew Tridgell
ed71c1ef1f s4-auth: rename 'auth' subsystem to 'auth4'
this prevents conflicts with the s3 auth modules. The auth modules in
samba3 may appear in production smb.conf files, so it is preferable to
rename the s4 modules for minimal disruption.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-02-18 15:09:46 +11:00
Andrew Tridgell
8dc92c8f71 ldb: use #include <ldb.h> for ldb
thi ensures we are using the header corresponding to the version of
ldb we're linking against. Otherwise we could use the system ldb for
link and the in-tree one for include

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-02-10 06:51:07 +01:00
Andrew Bartlett
a2ce53c1f5 s4-auth Rework auth subsystem to remove struct auth_serversupplied_info
This changes auth_serversupplied_info into the IDL-defined struct
auth_user_info_dc.  This then in turn contains a struct
auth_user_info, which is the only part of the structure that is
mainted into the struct session_info.

The idea here is to avoid keeping the incomplete results of the
authentication (such as session keys, lists of SID memberships etc) in
a namespace where it may be confused for the finalised results.

Andrew Barltett
2011-02-09 01:11:06 +01:00