1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Commit Graph

239 Commits

Author SHA1 Message Date
Andrew Bartlett
99315a19be Fix errrors in new password handling code found by RPC-SAMR.
I'm very glad we have such a comprehensive testsuite for the SAMR
password change process, as it makes this a much easier task to get
right.

Andrew Bartlett
2008-10-17 12:41:02 +11:00
Andrew Bartlett
7c88ea8aad Create a 'straight paper path' for UTF16 passwords.
This uses a virtual attribute 'clearTextPassword' (name chosen to
match references in MS-SAMR) that contains the length-limited blob
containing an allegidly UTF16 password.  This ensures we do no
validation or filtering of the password before we get a chance to MD4
it.  We can then do the required munging into UTF8, and in future
implement the rules Microsoft has provided us with for invalid inputs.

All layers in the process now deal with the strings as length-limited
inputs, incluing the krb5 string2key calls.

This commit also includes a small change to samdb_result_passwords()
to ensure that LM passwords are not returned to the application logic
if LM authentication is disabled.

The objectClass module has been modified to allow the
clearTextPassword attribute to pass down the stack.

Andrew Bartlett
2008-10-16 12:48:16 +11:00
Günther Deschner
11ecd5acfd s4: merge from s3 samr.idl.
Guenther
2008-10-15 17:42:33 +02:00
Jelmer Vernooij
9565999755 Fix include paths to new location of libutil. 2008-10-11 21:31:42 +02:00
Jelmer Vernooij
6925202bde Move source4/lib/crypto to lib/crypto. 2008-09-24 15:30:23 +02:00
Simo Sorce
508527890a Merge ldb_search() and ldb_search_exp_fmt() into a simgle function.
The previous ldb_search() interface made it way too easy to leak results,
and being able to use a printf-like expression turns to be really useful.
2008-09-23 18:17:46 -04:00
Andrew Bartlett
c39d1b829b Remove unused parameter from decode_pw_buffer and fail on invalid
UTF-16 input

The input checking is important, as otherwise we could set the wrong
password.

Andrew Bartlett
2008-09-22 17:50:43 -07:00
Andrew Bartlett
d626a26374 Rename structures to better match the names in the WSPP IDL.
The 'comment' element in a number of domain structures is called
oem_information.  This was picked up actually because with OpenLDAP
doing the schema checking, it noticed that 'comment' was not a valid
attribute.

The rename tries to keep this consistant in both the LDB mappings and
IDL, so we don't make the same mistake in future.

This has no real schema impact, as this value isn't actually used for
anything, as 'comment' was not used in the provision.

Andrew Bartlett
(This used to be commit 65dc0d5365)
2008-07-21 13:42:07 +10:00
Jelmer Vernooij
21fc767378 Specify event_context to ldb_wrap_connect explicitly.
(This used to be commit b4e1ae07a2)
2008-04-17 12:23:44 +02:00
Andrew Bartlett
9a6422b695 Rework our SAMR test and SAMR server.
Now that we don't create users/domain groups/aliases in the builtin
domain, we hit some bugs in the server-side implementation of the
enumeration functions.

In essence, it turns out to be: don't treat 0 as a special case.

Also, fix up the PDC name to always be returned.  I'm sure nothing
actually uses it, particularly for BUILTIN...

Andrew Bartlett
(This used to be commit 353bb79f56)
2008-03-14 12:26:03 +11:00
Andrew Bartlett
80f7e9e081 Rework SAMR functions to avoid gendb_search()
The gendb_*() API does not return error codes, and mixes error returns
with the count of returned entries.

Andrew Bartlett
(This used to be commit facbc8dfa5)
2008-03-13 17:26:01 +11:00
Andrew Bartlett
0c88240236 Rework to have member server 'domains' be CN=NETBIOSNAME
This reworks quite a few parts of our provision system to use
CN=NETBIOSNAME as the domain for member servers.

This makes it clear that these domains are not in the DNS structure,
while complying with our own schema (found by OpenLDAP's schema
validation).

Andrew Bartlett
(This used to be commit bda6a38b05)
2008-03-13 11:36:58 +11:00
Andrew Bartlett
227cecadf9 Check for and reject invalid account flags.
(lest we have an account set with 0 flags)

Andrew Bartlett
(This used to be commit 7a46e72f8d)
2008-02-28 10:05:32 +11:00
Andrew Bartlett
5043215f21 Generate ACB_PW_EXPIRED correctly
More correctly handle expired passwords, and do not expire machine accounts.

Test that the behaviour is consistant with windows, using the RPC-SAMR test.

Change NETLOGON to directly query the userAccountControl, just because
we don't want to do the extra expiry processing here.

Andrew Bartlett
(This used to be commit acda1f69bc)
2008-02-28 08:50:00 +11:00
Andrew Bartlett
5df2ac18e7 Print out the reason we can't delete the user in SAMR.
We need to be far more granular bout this - in particular, we need a
decide LDAP -> NTSTATUS conversion.

Andrew Bartlett
(This used to be commit 30fc3752c7)
2008-01-16 15:48:28 +11:00
Jelmer Vernooij
0500b87092 r26540: Revert my previous commit after concerns raised by Andrew.
(This used to be commit 6ac86f8be7)
2007-12-21 05:52:06 +01:00
Jelmer Vernooij
3e75f222bc r26539: Remove unnecessary statics.
(This used to be commit e53e79eebe)
2007-12-21 05:52:05 +01:00
Jelmer Vernooij
6c77f353d3 r26328: remove more uses of global_loadparm.
(This used to be commit 40ae12c086)
2007-12-21 05:48:41 +01:00
Jelmer Vernooij
41db2ab12c r26319: Split encoding functions out of libcli_ldap.
(This used to be commit 95a6ef7fc8)
2007-12-21 05:48:33 +01:00
Jelmer Vernooij
2f5ca872a8 r26313: Fix more uses of static loadparm.
(This used to be commit 6fd0d9d3b7)
2007-12-21 05:48:25 +01:00
Jelmer Vernooij
57f20ccd24 r26296: Store loadparm context in DCE/RPC server context.
(This used to be commit fc1f4d2d65)
2007-12-21 05:48:13 +01:00
Jelmer Vernooij
509e82e402 r26272: Remove global_loadparm in some more places.
(This used to be commit 1ab76ecc53)
2007-12-21 05:47:55 +01:00
Jelmer Vernooij
43696d2752 r26252: Specify loadparm_context explicitly when creating sessions.
(This used to be commit 7280c1e941)
2007-12-21 05:47:29 +01:00
Jelmer Vernooij
f4a1083cf9 r26227: Make loadparm_context part of a server task, move loadparm_contexts further up the call stack.
(This used to be commit 0721a07aad)
2007-12-21 05:47:04 +01:00
Andrew Bartlett
25143a2648 r26135: Remove samdb_add(), samdb_delete() and samdb_modify(), which were just
wrappers to ldb_add() etc.  samdb_replace() remains, as it sets flags on
all entries as 'replace'.

Andrew Bartlett
(This used to be commit 09c0faa5b7)
2007-12-21 05:46:17 +01:00
Jelmer Vernooij
ca0b72a1fd r26003: Split up DB_WRAP, as first step in an attempt to sanitize dependencies.
(This used to be commit 56dfcb4f2f)
2007-12-21 05:45:40 +01:00
Jelmer Vernooij
05e7c48146 r25553: Convert to standard bool type.
(This used to be commit b7371f1a19)
2007-10-10 15:07:54 -05:00
Jelmer Vernooij
37d53832a4 r25398: Parse loadparm context to all lp_*() functions.
(This used to be commit 3fcc960839)
2007-10-10 15:07:25 -05:00
Andrew Bartlett
6a30131b8b r25052: This missing 'break' caused problems on 32 bit platforms only, due to
alignment of the union.

Sorry for the time it took to test and fix this.

Andrew Bartlett
(This used to be commit 5b893fc6f5)
2007-10-10 15:05:51 -05:00
Jelmer Vernooij
ffeee68e4b r25026: Move param/param.h out of includes.h
(This used to be commit abe8349f9b)
2007-10-10 15:05:38 -05:00
Andrew Bartlett
7c81e6d21c r24973: Try to make it really clear we are dealing with 64 bit numbers here.
Andrew Bartlett
(This used to be commit 9aae9b1d24)
2007-10-10 15:03:43 -05:00
Andrew Bartlett
466bd44a46 r24942: Patch from Matthias Wallnöfer <mwallnoefer@yahoo.de> and a testsuite
to prove it is correct.

This should fix bug #4824: User Manager for Domains - Account Expires.

Thanks!

Andrew Bartlett
(This used to be commit e5f0744d62)
2007-10-10 15:03:41 -05:00
Andrew Bartlett
d7f84b51f9 r24611: Following up on the re-opening of bug 4817 is it pretty clear that
machine accounts are not subject to password policy in Win2k3 R2 (at
least in terms of password quality).

In testing this, I found that Win2k3 R2 has changed the way the old
ChangePassword RPC call is handled - the 'cross-checks' between new LM
and NT passwords are not required.

Andrew Bartlett
(This used to be commit 417ea885b4)
2007-10-10 15:02:23 -05:00
Andrew Bartlett
bd705012b8 r24082: Following the removal of a fanstsy condition from the SAMR testsuite,
allow the server side to enumerate all domain controllers and domain
members...

Andrew Bartlett
(This used to be commit d42150ff0a)
2007-10-10 15:01:24 -05:00
Andrew Bartlett
008b840760 r24080: Set the primary group (matching windows) when creating new users in
SAMR.  This can't be done in the ldb templates code, as it doesn't
happen over direct LDAP.

As noted in bug #4829.

Andrew Bartlett
(This used to be commit 3bfa6dbf7d)
2007-10-10 15:01:23 -05:00
Andrew Bartlett
fe60cd993d r24059: Fix bug 4822 reported by Matthias Wallnöfer <mwallnoefer@yahoo.de>.
Any SAMR client (usrmgr.exe in this case) that attempted to set a
property to a zero length string found instead the the old value was
kept.

In fixing this, rework the macros to be cleaner (add the
always-present .string) to every macro, and remove the use of the
samdb_modify() and samdb_replace() wrappers where possible.

Andrew Bartlett
(This used to be commit b05fe69304)
2007-10-10 15:01:20 -05:00
Andrew Bartlett
41ab04e37c r24053: Ensure we filter EnumDomainUsers with the supplied mask.
Should fix another part (list of domains in usrmgr incorrectly
including accounts) of bug #4815 by mwallnoefer@yahoo.de.

Andrew Bartlett
(This used to be commit 7f7e4fe298)
2007-10-10 15:01:19 -05:00
Andrew Bartlett
32d55960b5 r24052: Fix some of the NT4 usrmgr.exe portions of bug 4815.
- The icons in usermgr were incorrect, because the acct_flags were
   not filled in (due to missing attribute in ldb query)

 - The Full name was missing, and the description used as the full
   name (due to missing attributes in ldb query and incorrect IDL)

To prove the correctness of these fixes, I added a substantial new
test to RPC-SAMR-USERS, to ensure cross-consistancy between
QueryDisplayInfo and QueryUserInfo on each user.

This showed that for some reason, we must add ACB_NORMAL to the
acct_flags on level 2 queries (for machine trust accounts)...

Getting this right is important, because Samba3's RPC winbind methods
uses these queries.

Andrew Bartlett
(This used to be commit 9475d94a61)
2007-10-10 15:01:19 -05:00
Andrew Bartlett
1cc770fc58 r23815: Thanks to Matthias Wallnoefer <mwallnoefer@yahoo.de> for pointing out
that we had the wrong objectClass for OU=Domain
Controllers,${DOMAINDN} (was CN=Domain Controllers,${DOMAINDN})

This fixes both the SAMR server and the LDIF templates.

Andrew Bartlett
(This used to be commit 625a9e6c04)
2007-10-10 14:59:22 -05:00
Andrew Tridgell
0479a2f1cb r23792: convert Samba4 to GPLv3
There are still a few tidyups of old FSF addresses to come (in both s3
and s4). More commits soon.
(This used to be commit fcf38a38ac)
2007-10-10 14:59:12 -05:00
Andrew Bartlett
c74ad3546c r23365: Try to make Windows Vista join again. On my new test environment, it
wants to check for an existing domain join account, and fails.  This
test shows that we need to return NT_STATUS_NONE_MAPPED when nothing
matches.  (not yet tested if this helps vista).

Andrew Bartlett
(This used to be commit 7f3671bf11)
2007-10-10 14:53:12 -05:00
Stefan Metzmacher
3b14713f6d r21362: rename:
"ntPwdHash" => "unicodePwd"
"lmPwdHash" => "dBCSPwd"
"sambaLMPwdHistory" => "lmPwdHistory"
"sambaNTPwdHistory" => "ntPwdHistory"

Note: you need to reprovision after this change!

metze
(This used to be commit dc4242c09c)
2007-10-10 14:48:20 -05:00
Jelmer Vernooij
64e88a8ccf r20850: Prefix all server calls with dcesrv_
(This used to be commit 76c78b0339)
2007-10-10 14:43:39 -05:00
Andrew Bartlett
d471e52d23 r20149: Remove the smb.conf distinction between PDC and BDC. Now the correct
way to setup a Samba4 DC is to set 'server role = domain controller'.

We use the fSMORoleOwner attribute in the base DN to determine the PDC.

This patch is quite large, as I have corrected a number of places that
assumed taht we are always the PDC, or that used the smb.conf
lp_server_role() to determine that.

Also included is a warning fix in the SAMR code, where the IDL has
seperated a couple of types for group display enumeration.

We also now use the ldb database to determine if we should run the
global catalog service.

In the near future, I will complete the DRSUAPI
DsGetDomainControllerInfo server-side on the same basis.

Andrew Bartlett
(This used to be commit 67d8365e83)
2007-10-10 14:29:15 -05:00
Simo Sorce
ea212eb00f r20034: Start using ldb_search_exp_fmt()
(This used to be commit 4f07542143)
2007-10-10 14:28:51 -05:00
Simo Sorce
9ae017588c r19903: This is a cut&paste error for sure
there is no ongoing transaction in this code
(This used to be commit 93b738b111)
2007-10-10 14:28:34 -05:00
Stefan Metzmacher
304653e052 r19902: give better errors...
metze
(This used to be commit b4d7d49c27)
2007-10-10 14:28:33 -05:00
Simo Sorce
a9e31b33b5 r19832: better prototypes for the linearization functions:
- ldb_dn_get_linearized
  returns a const string

- ldb_dn_alloc_linearized
  allocs astring with the linearized dn
(This used to be commit 3929c086d5)
2007-10-10 14:28:22 -05:00
Simo Sorce
4889eb9f7a r19831: Big ldb_dn optimization and interfaces enhancement patch
This patch changes a lot of the code in ldb_dn.c, and also
removes and add a number of manipulation functions around.

The aim is to avoid validating a dn if not necessary as the
validation code is necessarily slow. This is mainly to speed up
internal operations where input is not user generated and so we
can assume the DNs need no validation. The code is designed to
keep the data as a string if possible.

The code is not yet 100% perfect, but pass all the tests so far.
A memleak is certainly present, I'll work on that next.

Simo.
(This used to be commit a580c871d3)
2007-10-10 14:28:22 -05:00
Rafal Szczesniak
6c4bc15f3b r19256: add missing infolevel and fields to SetUserInfo call
that's why ntsrv and win2k3 srv could pass the net test
and we could not...

rafal
(This used to be commit 60ade8ddbd)
2007-10-10 14:20:58 -05:00