1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Commit Graph

37 Commits

Author SHA1 Message Date
Stefan Metzmacher
e1caa51146 s4:rpc_server/drsuapi: make use dcesrv_call_session_info()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-12 03:13:32 +01:00
Andrew Bartlett
51289a6f9b debug: Add new debug class "drs_repl" for DRS replication processing
This is used in the client and in the server

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-09-07 06:56:27 +02:00
Garming Sam
63c6209f5c updaterefs: Do not open transaction even when unnecessary
This can be called during GetNCChanges (a generally read-only call), it
is not wise to be blocking the database for no reason.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Garming Sam <garming@samba.org>
Autobuild-Date(master): Thu Apr 13 11:25:06 CEST 2017 on sn-devel-144
2017-04-13 11:25:06 +02:00
Garming Sam
d055b20298 drepl_server: Allow refresh of partitions on UpdateRef
When we call UpdateRef, the push replication will not begin until the
drepl_server has done its periodic refresh. If UpdateRefs is called, we
should just send an IRPC message to call the refresh.

NOTE: This has the same dependencies and issues as repl_secrets in
auth_sam.c in terms of IRPC implementation.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13 07:29:18 +02:00
Volker Lendecke
7c2b5e77b0 Use GUID_equal in a few places
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2014-06-10 19:19:13 +02:00
Matthieu Patou
2f7d772583 Add Notes related to DRSUAPI
Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Andrew Bartlett <abarlett@samba.org>
2013-08-06 21:21:56 -07:00
Matthieu Patou
3f3576d642 drsuapi: Debug more clearly why NC is bad in updateRefs
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri May 17 04:17:14 CEST 2013 on sn-devel-104
2013-05-17 04:17:14 +02:00
Matthieu Patou
65396adaad drsuapi: Add documentation
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-22 21:14:02 +11:00
Matthieu Patou
dc002a394b drsuapi: Validate the input parameters for the drsuapi_UpdateRefs function 2012-10-07 21:51:03 -07:00
Matthieu Patou
8be6a106ab drsuapi: check more carefully the validity of the NC
Check that both the GUID and DN are the GUID/DN of a NC if not return
WERR_DS_DRA_BAD_NC
2012-10-07 21:51:03 -07:00
Matthias Dieter Wallnöfer
6df6364220 s4:drsuapi RPC server - fix "enum security_user_level" warning on Tru64 2010-11-27 21:50:42 +01:00
Andrew Bartlett
8beaa29242 s4-libcli/security Use seperate subsystem for session related functions
The merged I plan in this area require spliting security.h into
two header files, a common header and a session.h for the
remaining source4-specific code.

Andrew Bartlett
2010-10-12 02:54:16 +00:00
Andrew Tridgell
75a542a1d9 s4-drs: put the GCSPN flag into the repsTo if requested
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-30 14:36:12 -07:00
Nadezhda Ivanova
8045b35b1b s4-drs: Added check for drs-manage-topology to updateRefs. 2010-09-28 11:36:40 -07:00
Andrew Tridgell
f33fc39f37 s4-drs: use the system sam_ctx for updaterefs
this is needed for RODC clients calling updaterefs
2010-09-26 06:29:06 +00:00
Andrew Tridgell
377ffcb029 s4-drs: make debugging DsUpdateRefs a bit easier 2010-09-16 16:08:46 +10:00
Kamen Mazdrashki
3f109f8fd7 s4-drs: Dump exact error when failure occurs during DsReplicaUpdateRefs call 2010-09-07 17:09:34 +03:00
Andrew Bartlett
6cf29b3e4f s4:security Change struct security_token->sids from struct dom_sid * to struct dom_sid
This makes the structure much more like NT_USER_TOKEN in the source3/
code.  (The remaining changes are that privilages still need to be merged)

Andrew Bartlett
2010-08-23 08:50:55 +10:00
Andrew Bartlett
7c6ca95bec s4:security Remove use of user_sid and group_sid from struct security_token
This makes the structure more like Samba3's NT_USER_TOKEN
2010-08-18 09:50:38 +10:00
Andrew Tridgell
45a2b408ba s4-drs: added domain_sid to DRS security checks
we need the domain_sid to determine if the account is a RODC for our
domain

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-08-17 21:21:50 +10:00
Kamen Mazdrashki
bf49ac99c9 s4/dsdb: dsdb_validate_invocation_id() should validate by objectGUID
This function is used in DRSUpdateRefs() implementation where we
get DSA's objectGUID rather than invocationId
2010-04-28 12:11:03 +03:00
Andrew Tridgell
bb1ba4ff76 s4-drs: added new SECURITY_RO_DOMAIN_CONTROLLER level
This is used for allowing operations by RODCs, and denying them
operations that should only be allowed for a full DC

This required a new domain_sid argument to
security_session_user_level()

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-With: Rusty Russell <rusty@samba.org>
2010-04-22 19:36:16 +10:00
Matthias Dieter Wallnöfer
f24dfbfb18 s4:drsuapi RPC - Change also here counters to "unsigned"
No need to have "signed" counters at those places.
2010-03-05 18:38:58 +01:00
Andrew Tridgell
2008d24e91 s4-drs: switch the DRS server to the generic DRS options flags 2010-01-14 15:37:59 +11:00
Andrew Tridgell
e809b721e9 s4-drs: don't give an error on repsTo delete if add is also specified
w2k8-r2 in dcpromo asks for a delete+add during its initial join.
2010-01-02 17:28:35 +11:00
Andrew Tridgell
95e895d880 s4: ran minimal_includes.pl on source4/rpc_server 2009-10-20 16:04:56 +11:00
Andrew Tridgell
59818f2f79 s4-drs: implement more of DsUpdateRefs
The DsUpdateRefs calls takes a set of flags that indicates if the
server should ignore specific add/delete error codes. 

This patch also exposes the core UpdateRefs call into a public
function, so that it can be called from DsGetNCChanges
2009-10-15 08:20:37 +11:00
Andrew Tridgell
0285d568c5 s4-drs: take advantage of system session auth in dsbind
Now that the bind opens samdb with the right credentials, we no longer
need the re-open in updaterefs and getncchanges
2009-10-06 18:59:30 +11:00
Anatoliy Atanasov
6e56261eb7 Add drs_security_level_check for dcesrv calls security checks
There is also an option to disable the security check
by specifying in the smb.conf file:
drs:disable_sec_check = true
2009-09-19 15:39:40 -07:00
Andrew Tridgell
1261d694f0 more include minimisation 2009-09-19 14:12:01 -07:00
Andrew Tridgell
5d2dfd12cf s4-drs: lock down key DRS calls
The key DRS calls should only be allowed by administrators or domain
controllers
2009-09-15 19:52:25 -07:00
Andrew Tridgell
5da0a7e1a1 s4-repl: use common functions to simplify updaterefs.c
We now have dsdb_loadreps() and dsdb_savereps()
2009-09-12 11:15:27 +10:00
Andrew Tridgell
a08d17342d s4/drs: changed the UpdateRefs server to use the dn instead of the GUID
Our vampire code sends a zero GUID in the updaterefs calls. Windows
seems to ignore the GUID and use the DN in the naming context instead,
so I have changed our UpdateRefs server implementation to do the same.

With this change we can now vampire from s4<->s4 successfully! Now to
see if all the attributes came across correctly.
2009-09-10 14:28:24 +10:00
Andrew Tridgell
78a5a5e665 s4: fix spelling 2009-09-10 13:50:46 +10:00
Andrew Tridgell
51baffab5f s4:drs split addentry and getncchanges into separate files
These will get quite complex eventually, I think we are better
separating them so the code is a bit easier to follow
2009-09-09 21:06:36 +10:00
Andrew Tridgell
dca7afb799 s4: fixed format of repsTo in samdb
Metze pointed out what the windows tool ldp.exe will examine repsTo
attributes on remote DCs, so we do in fact need to use the same format
that windows uses. This patch changes the server side implementation
of UpdateRefs to use the windows format
2009-09-09 12:36:51 +10:00
Andrew Tridgell
91805627c9 s4: implemented server side of DSUpdateRefs call
This call is made by DCs to tell us we should notify them of directory
changes
2009-09-08 11:52:45 +10:00