1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Commit Graph

1068 Commits

Author SHA1 Message Date
Gerald Carter
3b35519857 sanity checks from Ken Cross
(This used to be commit ec26877f0b)
2003-01-21 01:20:48 +00:00
Gerald Carter
9eeab10e54 [merge]
* removed unused variable from rpcclient code
* added container option to net command (patch from SuSE)
* Makefile patch for examples/VFS from SuSE
(This used to be commit 25a9681ddd)
2003-01-15 16:10:57 +00:00
Gerald Carter
43e4cae106 * removed unused variable from rpcclient code
* added container option to net command (patch from SuSE)
* Makefile patch for examples/VFS from SuSE
(This used to be commit 4a6d8280ea)
2003-01-15 16:07:14 +00:00
Andrew Bartlett
22d6569ed5 Patch from Nik Conwell <nik@bu.edu>. Don't reference free()ed data when trying
to figure out if we have got our ticket yet.

Andrew Bartlett
(This used to be commit a66ced2cf6)
2003-01-11 03:29:31 +00:00
Andrew Bartlett
634c54310c Merge from HEAD - make Samba compile with -Wwrite-strings without additional
warnings.  (Adds a lot of const).

Andrew Bartlett
(This used to be commit 3a7458f947)
2003-01-03 08:28:12 +00:00
Andrew Bartlett
6d66fb308a BIG patch...
This patch makes Samba compile cleanly with -Wwrite-strings.
 - That is, all string literals are marked as 'const'.  These strings are
always read only, this just marks them as such for passing to other functions.

What is most supprising is that I didn't need to change more than a few lines of code (all
in 'net', which got a small cleanup of net.h and extern variables).  The rest
is just adding a lot of 'const'.

As far as I can tell, I have not added any new warnings - apart from making all
of tdbutil.c's function const (so they warn for adding that const string to
struct).

Andrew Bartlett
(This used to be commit 92a777d0ea)
2003-01-02 09:07:17 +00:00
Jeremy Allison
944fb243eb Catching up with old patches. Add define for VERITAS quota support.
Check return in ldap.
Jeremy.
(This used to be commit e789edbb28)
2002-12-30 23:55:58 +00:00
Jeremy Allison
64501e44ee Catching up with old patches. Add define for VERITAS quota support.
Check return in ldap.
Jeremy.
(This used to be commit 66eff26fc9)
2002-12-30 23:55:53 +00:00
Jeremy Allison
7f23546730 Forward port the change to talloc_init() to make all talloc contexts
named. Ensure we can query them.
Jeremy.
(This used to be commit 842e08e52a)
2002-12-20 20:23:06 +00:00
Jeremy Allison
ef8bd7c4f7 Forward port the change to talloc_init() to make all talloc contexts
named. Ensure we can query them.
Jeremy.
(This used to be commit 09a218a9f6)
2002-12-20 20:21:31 +00:00
Jim McDonough
81a2a30739 More printer publishing code.
- Add published attribute to info2, needed for win clients to work properly
- Return proper info on getprinter 7

This means you can now look at the sharing tab of a printer and get correct
info about whether it is published or not, and change it.
(This used to be commit d57bddc9b2)
2002-12-13 19:01:27 +00:00
Jim McDonough
bfd8043a40 More printer publishing code.
- Add published attribute to info2, needed for win clients to work properly
- Return proper info on getprinter 7

This means you can now look at the sharing tab of a printer and get correct
info about whether it is published or not, and change it.
(This used to be commit adda04379e)
2002-12-13 18:56:48 +00:00
Jim McDonough
26236b30d0 More printer data to publish
(This used to be commit 6e2f0c4e30)
2002-12-05 19:13:40 +00:00
Jim McDonough
90d9cf973e More printer data to publish
(This used to be commit 82f3a786bf)
2002-12-05 19:13:20 +00:00
Jim McDonough
2e2f58fded Stop using hardcoded key/value strings, be more forgiving of dsspooler/dsdriver info existence.
(This used to be commit 59ced15a1b)
2002-12-03 19:42:39 +00:00
Jim McDonough
2e6c2a1456 Stop using hardcoded key/value strings, be more forgiving of dsspooler/dsdriver info existence.
(This used to be commit ca8735532c)
2002-12-03 19:41:43 +00:00
Gerald Carter
3ab6fcc5c6 [merge from APP_HEAD]
90% fix for CR 1076.  The password server parameter will no take things
like

        password server = DC1 *

which means to contact DC1 first and the go to auto lookup if it
fails.


jerry
(This used to be commit 016ef8b36b)
2002-11-23 14:52:34 +00:00
Gerald Carter
191dff2d27 [merge from APP_HEAD]
90% fix for CR 1076.  The password server parameter will no take things
like

        password server = DC1 *

which means to contact DC1 first and the go to auto lookup if it
fails.


jerry
(This used to be commit c31a17889e)
2002-11-23 14:27:56 +00:00
Jim McDonough
713b2f0b47 Don't pass a function to ADS_ERR_OK().
(This used to be commit a148e4c290)
2002-11-18 20:46:20 +00:00
Jim McDonough
bf909c0c36 Don't pass a function to ADS_ERR_OK().
(This used to be commit dff4c93d85)
2002-11-18 20:45:46 +00:00
Jim McDonough
e4201bec14 Next step of printer publishing.
net ads printer publish <printername> [servername]
Will retreive the DsSpooler and DsDriver info by rpc for a remote server
then publish it.

Next comes doing it within smbd
(This used to be commit 8f047a4492)
2002-11-18 19:59:58 +00:00
Jim McDonough
bbd3e4b40a Next step of printer publishing.
net ads printer publish <printername> [servername]
Will retreive the DsSpooler and DsDriver info by rpc for a remote server
then publish it.

Next comes doing it within smbd
(This used to be commit 64951938cc)
2002-11-18 19:50:36 +00:00
Andrew Bartlett
c64d762997 Updates from HEAD:
- const for PACKS() in lanman.c
 - change auth to 'account before password'
 - add help to net rpc {vampire,samsync}
 - configure updates for sun workshop cc
 - become_root() around pdb_ calls in auth_util for guest login.

Andrew Bartlett
(This used to be commit 43e90eb6e3)
2002-11-15 21:43:57 +00:00
Andrew Bartlett
77d0ff6357 Include the hostname we are trying to match with $@, to allow easier debugging.
(This used to be commit f5d8afc626)
2002-11-15 21:25:40 +00:00
Jeremy Allison
2f194322d4 Removed global_myworkgroup, global_myname, global_myscope. Added liberal
dashes of const. This is a rather large check-in, some things may break.
It does compile though :-).
Jeremy.
(This used to be commit f755711df8)
2002-11-12 23:20:50 +00:00
Jeremy Allison
250c980119 Removed global_myworkgroup, global_myname, global_myscope. Added liberal
dashes of const. This is a rather large check-in, some things may break.
It does compile though :-).
Jeremy.
(This used to be commit 82b8f749a3)
2002-11-12 23:15:52 +00:00
Jeremy Allison
f48a8615d6 After the lord mayors parade......
Janitor for tridge :-).
Jeremy.
(This used to be commit 76cdfbd510)
2002-11-10 03:07:19 +00:00
Andrew Tridgell
a46d452926 make sure that if kerberos fails we can fall back on NTLMSSP for SASL
(This used to be commit 69dba08c40)
2002-11-10 00:35:04 +00:00
Tim Potter
ab1cf8d1cf Merge of get_dc_list() api change from HEAD.
(This used to be commit 6ba7847ce2)
2002-11-06 05:14:15 +00:00
Tim Potter
ea24bb2da8 Merge of get_dc_list() api change. This was slightly more intrusive
than the version in APPLIANCE so watch out for boogs.
(This used to be commit 1e054e3db6)
2002-11-06 01:29:07 +00:00
Jim McDonough
69a2042dc6 Re-enable use of existing kerberos tickets.
(This used to be commit 6ec5dce698)
2002-10-31 19:20:33 +00:00
Jim McDonough
3b3c7914e2 Take out gcb2gtype and gtype2gcb fns. They were using symbols not defined
in 3.0 (new SAM in HEAD).  Nobody was referencing these fns...
(This used to be commit 386cc92dfa)
2002-10-30 20:31:02 +00:00
Jim McDonough
4a7c48aaf0 Merge from HEAD:
GUID formatting on ads dump
Allow rc4-hmac when available
.NET likes both forms of servicePrincipalName in machine account record
(This used to be commit 89e3a3da5d)
2002-10-29 14:47:11 +00:00
Jeremy Allison
515e6a268e Merge tridge's blank password fix from HEAD.
Jeremy.
(This used to be commit eadfd312ba)
2002-10-24 01:05:30 +00:00
Andrew Tridgell
306e4cbead fixed a possible segv when dealing with a blank password
(This used to be commit d5d0d0de50)
2002-10-23 00:02:26 +00:00
Jim McDonough
e042a93cce Format objectGUIDs on ads dumps.
(This used to be commit 7eaf7e7115)
2002-10-18 20:11:29 +00:00
Andrew Tridgell
aadae4f84a only set UF_USE_DES_KEY_ONLY if we are using krb5 libraries that can't
do type 23
(This used to be commit c0612272e8)
2002-10-04 07:47:42 +00:00
Andrew Tridgell
14f65fb897 support all permitted encoding types in tickets. This allows us to
decode a type 23 ticket when the machine account is setup for non-DES
tickets
(This used to be commit 144d4429d7)
2002-10-04 07:41:56 +00:00
Andrew Tridgell
fa066fdde3 .NET likes both forms of servicePrincipalName in the machine account
record
(This used to be commit 8ff6d40d7f)
2002-10-03 14:23:06 +00:00
Gerald Carter
f2d1f19a66 syncing up with HEAD. Seems to be a lot of differences creeping in
(i ignored the new SAMBA stuff, but the rest of this looks like it should
have been merged already).
(This used to be commit 3de09e5cf1)
2002-10-01 18:26:00 +00:00
Andrew Bartlett
ad8a22e570 Updates from Samba HEAD:
- Fix segfaults in the 'net ads' commands when no password is provided
 - Readd --with-ldapsam for 2.2 compatability.  This conditionally compiles the
   old options, but the actual code is available on all ldap systems.
 - Fix shadow passwords (as per work with vl)
 - Fix sending plaintext passwords to unicode servers (again vl)
 - Add a bit of const to secrets.c functions
 - Fix some spelling and grammer by vance.
 - Document the -r option in smbgroupedit.

There are more changes in HEAD, I'm only merging the changes I've been involved
with.

Andrew Bartlett
(This used to be commit 83973c3893)
2002-10-01 13:10:57 +00:00
cvs2svn Import User
6007a592b2 This commit was manufactured by cvs2svn to create branch 'SAMBA_3_0'.(This used to be commit eb5ce70e2f) 2002-10-01 01:06:38 +00:00
Andrew Bartlett
4e73790e3a Try to compile as much as possible with only ldap, but not kerberos.
(This used to be commit 9615ab10c0)
2002-09-28 14:42:32 +00:00
Andrew Bartlett
8b197158c9 Add the beginings of sam_ads to the tree.
This module, primarilly the work of "Stefan (metze) Metzmacher"
<metze@metzemix.de>, uses the Active Directory schema to store the
user/group/other information.  I've been testing it against a real AD server,
and it is intended to work with OpenLDAP as well.

I've moved a few functions around in our other libads code, which has made it
easier to tap into that existing code.

Also, I've made some changes to the SAM interface, I hope there are not too
many objections...   To ensure we don't get silly bugs in the skel module, it
is now in the default compile.  This way you should not forget to update it :-)

Andrew Bartlett
(This used to be commit 24fb0cde2f)
2002-09-28 12:27:04 +00:00
Andrew Bartlett
bc828246db This needs to be #ifdef HAVE_LDAP.
(This used to be commit 2b54a2fc2c)
2002-09-28 00:47:06 +00:00
Andrew Bartlett
7e4afe5381 Move a number of ADS related functions out into utility libs, so that things
like metze's sam_ads can also use them.

Also add error checking etc to a few more functions.

Andrew Bartlett
(This used to be commit c864edf4fb)
2002-09-27 12:23:47 +00:00
Andrew Bartlett
55b6cebbd4 Some small cleanups to the libads code (mainly error checking), and give a
sane prototype for the push_utf8_allocate code.

Andrew Bartlett
(This used to be commit ce00a3238e)
2002-09-27 03:05:20 +00:00
Gerald Carter
a834a73e34 sync'ing up for 3.0alpha20 release
(This used to be commit 65e7b5273b)
2002-09-25 15:19:00 +00:00
cvs2svn Import User
3054ef8a6e This commit was manufactured by cvs2svn to create branch 'SAMBA_3_0'.(This used to be commit 9a5541595f) 2002-09-25 12:59:48 +00:00
Andrew Bartlett
b06d2abe74 Another patch from metze, towards his work on sam_ads.
See mx-ldap.sf.net for his current progress.
(This used to be commit 9c62d1312f)
2002-09-25 09:40:45 +00:00
Andrew Bartlett
6f67ae667a Avoid a segfault in net join when you have not done an kinit, and it's falling
back to NTLMSSP.  We need to get the password out of the user, and this
eventually does.

Andrew Bartlett
(This used to be commit bb518a3bae)
2002-09-25 09:32:08 +00:00
Andrew Tridgell
b33681fc0b Add clock skew handling to our kerberos code. This allows us to cope with
the DC being out of sync with the local machine.
(This used to be commit 0d28d76947)
2002-09-17 12:12:50 +00:00
Andrew Tridgell
fffd0eb142 another const cleanup
(This used to be commit 443d5ebafa)
2002-09-17 12:07:47 +00:00
Andrew Bartlett
7a76d0e854 Seems I missed commiting this when I added the rest of metze's ADS patch.
Oh well, here it is...

Andrew Bartlett
(This used to be commit 7c2a667640)
2002-09-06 13:46:36 +00:00
Andrew Bartlett
eec38ee3bb Patch from "Stefan (metze) Metzmacher" <metze@metzemix.de>
to extend the ADS_STATUS system to include NTSTATUS, and to provide a better
general infrustructure for his sam_ads work.

I've also added some extra failure mode DEBUG()s to parts of the code.

NOTE:  The ADS_ERR_OK() macro is rather sensitive to braketing issues - without
the final set of brakets, the test is essentially inverted - causing some
intersting 'error = success' messages...

Andrew Bartlett
(This used to be commit 5b9a7ab901)
2002-09-06 11:46:59 +00:00
Andrew Bartlett
4aad4d7c73 Add some DEBUG()s to some libads failure modes.
(This used to be commit ad3c8da13b)
2002-09-06 10:39:34 +00:00
Andrew Tridgell
dcd0291694 convert the LDAP/SASL code to use GSS-SPNEGO if possible
we now do this:

- look for suported SASL mechanisms on the LDAP server
- choose GSS-SPNEGO if possible
- within GSS-SPNEGO choose KRB5 if we can do a kinit
- otherwise use NTLMSSP

This change also means that we no longer rely on having a gssapi
library to do ADS.

todo:
- add TLS/SSL support over LDAP
- change to using LDAP/SSL for password change in ADS
(This used to be commit b04e91f660)
2002-08-30 06:59:57 +00:00
Herb Lewis
2d05704d0e fix irix compile errors - cannot initialize array in declaration statement
with non-const values - strsep not defined
(This used to be commit a5c59b2cd1)
2002-08-20 18:43:59 +00:00
Jelmer Vernooij
b2edf254ed sync 3.0 branch with head
(This used to be commit 3928578b52)
2002-08-17 17:00:51 +00:00
Andrew Tridgell
4361b5cea5 when using netbios lookup methods make sure we try any BDCs even if
we get a response from WINS for a PDC, if the PDC isn't responding.
(This used to be commit 57916316ff)
2002-08-06 05:11:57 +00:00
Andrew Tridgell
74c8441e9d fixed a memory corruption bug in ads_try_dns()
(This used to be commit 2ee0abb50f)
2002-08-06 03:26:58 +00:00
Andrew Tridgell
ab9ff0fa73 This fixes a number of ADS problems, particularly with netbiosless
setups.

- split up the ads structure into logical pieces. This makes it much
  easier to keep things like the authentication realm and the server
  realm separate (they can be different).

- allow ads callers to specify that no sasl bind should be performed
(used by "net ads info" for example)

- fix an error with handing ADS_ERROR_SYSTEM() when errno is 0

- completely rewrote the code for finding the LDAP server. Now try DNS
  methods first, and try all DNS servers returned from the SRV DNS
  query, sorted by closeness to our interfaces (using the same sort code
  as we use in replies from WINS servers). This allows us to cope with
  ADS DCs that are down, and ensures we don't pick one that is on the
  other side of the country unless absolutely necessary.

- recognise dnsRecords as binary when displaying them

- cope with the realm not being configured in smb.conf (work it out
  from the LDAP server)

- look at the trustDirection when looking up trusted domains and don't
  include trusts that trust our domains but we don't trust
  theirs.

- use LDAP to query the alternate (netbios) name for a realm, and make
  sure that both and long and short forms of the name are accepted by
  winbindd. Use the short form by default for listing users/groups.

- rescan the list of trusted domains every 5 minutes in case new trust
  relationships are added while winbindd is running

- include transient trust relationships (ie. C trusts B, B trusts A,
  so C trusts A) in winbindd.

- don't do a gratuituous node status lookup when finding an ADS DC (we
  don't need it and it could fail)

- remove unused sid_to_distinguished_name function

- make sure we find the allternate name of our primary domain when
  operating with a netbiosless ADS DC (using LDAP to do the lookup)

- fixed the rpc trusted domain enumeration to support up to approx
  2000 trusted domains (the old limit was 3)

- use the IP for the remote_machine (%m) macro when the client doesn't
  supply us with a name via a netbios session request (eg. port 445)

- if the client uses SPNEGO then use the machine name from the SPNEGO
  auth packet for remote_machine (%m) macro

- add new 'net ads workgroup' command to find the netbios workgroup
  name for a realm
(This used to be commit e358d7b24c)
2002-08-05 02:47:46 +00:00
Andrew Bartlett
056f849f0c Now that I got the function arguments sane, remove the silly (void **) casts
from some of the callers.

Andrew Bartlett
(This used to be commit eb3354aa6c)
2002-08-04 01:16:37 +00:00
Andrew Tridgell
55c978d85e net ads info now reports the IP of the LDAP server as well as its name - very useful in scripts
(This used to be commit fc0d5479b5)
2002-07-30 15:34:10 +00:00
Andrew Tridgell
2edcc96c11 a couple more minor tweaks. This now allows us to operate in ADS mode
without any 'realm =' or 'ads server =' options at all, as long as DNS
is working right.
(This used to be commit d3fecdd042)
2002-07-30 13:27:42 +00:00
Andrew Bartlett
29075c97d3 More fixes towards warnings on the IRIX compiler
(and yes, some of these are real bugs)

In particular, the samr code was doing an &foo of various types, to a function
that assumed uint32.  If time_t isn't 32 bits long, that broke.

They are assignment compatible however, so use that and an intermediate
variable.

Andrew Bartlett
(This used to be commit 30d0998c8c)
2002-07-20 13:02:47 +00:00
Andrew Tridgell
e90b652848 updated the 3.0 branch from the head branch - ready for alpha18
(This used to be commit 03ac082dcb)
2002-07-15 10:35:28 +00:00
cvs2svn Import User
ec167dc9cc This commit was manufactured by cvs2svn to create branch 'SAMBA_3_0'.(This used to be commit b8d39651fb) 2002-07-14 22:15:21 +00:00
Andrew Tridgell
695b346ab5 fix setting machine passwords in the case where a user account of the
same name as the machine name exists. (we ended up setting the users
password, not the machines password!)
(This used to be commit fe1e6233c6)
2002-07-12 02:28:27 +00:00
Andrew Tridgell
5d82785756 this implements a completely new strategy for fetching group
membership from an ADS server. We now use a 'member' query on the
group and do a separate call to convert the resulting distinguished
name to a name, rid etc. This is *much* faster for very large numbers
of groups (on a quantum test system with 10000 groups it drops the
time from an hour to about 35 seconds).

strangely enough, this actually *increases* the amount of ldap
traffic, its just that the MS LDAP server answers these queries much
faster.
(This used to be commit 5538048e4f)
2002-07-11 05:28:08 +00:00
Andrew Tridgell
8fb570e6e0 this fixes the ads dump code
a char** isn't quite the same thing as a struct berval**  :)
(This used to be commit a92834ea94)
2002-07-11 03:41:09 +00:00
Andrew Tridgell
5ae8fa2df1 make sure we disable referrals in all ldap searches - they are badly
broken
(This used to be commit 022073d140)
2002-07-09 15:06:51 +00:00
Jim McDonough
83060558c9 Fix length in snprintf invocation to account for "dn:" in sasl gssapi bind.
Also remove unused line which incremented pointer by the wrong length anyway.

Provided by Anthony Liguori (aliguori@us.ibm.com).
(This used to be commit 47b7a3e0f3)
2002-07-08 20:46:54 +00:00
Andrew Bartlett
21b9280cf5 Kill off const warnings - add a pile of const to various places.
(This used to be commit 1de04ec473)
2002-07-08 02:14:57 +00:00
Andrew Tridgell
9930b0b065 used findstatic.pl to make some variables static and remove some dead
code
(This used to be commit 91ad9041e9)
2002-07-01 09:12:41 +00:00
Andrew Tridgell
859b135773 ads_mod_ber should be static, not public
this fixes the huge number of struct berval warnings on non-ads
compiles
(This used to be commit e7f588d815)
2002-07-01 07:30:40 +00:00
Jim McDonough
f90e74afba Const cleanup...should only be 2 warnings left from calling lib/util_str.c
str_list_copy().  Perhaps its proto should be fixed.
(This used to be commit b81bc2b34b)
2002-06-28 19:25:11 +00:00
Jim McDonough
f0a0c6955b Reduce compiler warnings.
(This used to be commit b361089360)
2002-06-26 17:27:30 +00:00
Andrew Bartlett
0327428f27 Break up samba's object dependencies, and its prototype includes.
Now smbclient, net, and swat use their own proto files - now the global
proto.h

The change to libads/kerberos.c was to break up the dependency on secrets.c -
we want to be able to write an ADS client that doesn't need local secrets.

I have other breakups in the works - I will remove the dependency of
rpc_parse on passdb (and therefore secrets.c) shortly.

(NOTE:  This patch does *not* break up includes.h, or other such forbidden
actions).

Andrew Bartlett
(This used to be commit edb41dad2d)
2002-06-25 02:29:09 +00:00
Jim McDonough
24b67730bf Support utf8 on the wire for ads ldap. DN's are converted, as well as strings,
though it is up to the calling function to decide whether values are
strings or not.  Attributes are not converted at this point, though support
for it would be simple.

I have tested it with users and groups using non-ascii chars, and if the
check for alphanumeric user/domain names is removed form sesssetup.c, even
a user with accented chars can connect, or even login (via winbind).

I have also simplified the interfaces to ads_mod_*, though we will probably
want to expand this by a few functions in the near future.  We just had
too many ways to do the same thing...
(This used to be commit f924cb5358)
2002-06-24 17:50:02 +00:00
Andrew Tridgell
d53b9f113a fixed a spelling mistake
(This used to be commit 5a04ea1f0c)
2002-06-03 02:46:25 +00:00
Andrew Bartlett
31cda568c0 This is meant to be accessed via the helper fn, not directly.
(This used to be commit b84882a628)
2002-05-17 14:35:54 +00:00
Jim McDonough
2503dc8eb8 Add ads group account add function.
(This used to be commit 180311a48c)
2002-05-09 23:44:46 +00:00
Andrew Tridgell
fc78c773f8 fixed trust relationships in ADS winbindd after breaking them with my BDC changes ...
(This used to be commit 8096032663)
2002-04-19 03:00:29 +00:00
Andrew Tridgell
c0a9919430 fixed the fallback to a BDC for ADS connections
(This used to be commit 3e58a1ee83)
2002-04-18 06:56:44 +00:00
Andrew Tridgell
f6929068a1 by using a prompter function we can avoid the bug in the MIT kerberos
libraries with handling blank passwords.
(This used to be commit 59d755ffb5)
2002-04-15 04:55:37 +00:00
Jim McDonough
69f41523b3 A few more updates:
- Add doxygen comments
- remove server sort control (ms implementation was not reliable)
- rename ads_do_search_all2() to ads_do_search_all_fn()
(This used to be commit 7aa5fa6172)
2002-04-10 13:28:03 +00:00
Jim McDonough
40260fdaf9 Several updates to get server side sorting going:
- Added sort control to ads_do_paged_search.  It allows a char * to be passed
  as the sort key.  If NULL, no sort is done.
- fixed a bug in the processing of controls (loop wasn't incremented properly)
- Added ads_do_search_all2, which funs a function that is passed in against
  each entry.  No ldapmessage structures are returned.  Allows results to
  be processed as the come in on each page.

I'd like ads_do_search_all2 to replace ads_do_search_all, but there's some
work to be done in winbindd_ads.c first.

Also, perhaps now we can do async ldap searches?  Allow us to process a
page while the server retrieves the next one?
(This used to be commit 95bec4c8ba)
2002-04-05 19:26:52 +00:00
Jim McDonough
f21ccff91f Try harder next time to not duplicate function...take ads_err2string back
out since it's already in ads_errstr() in ads_status.c
(This used to be commit 0475126ffb)
2002-04-04 03:03:00 +00:00
Jim McDonough
3f31475eeb Contains functions to manage/view AD user accounts via ldap. Initially has fns
to find and add a user.
(This used to be commit 773303a284)
2002-04-04 02:51:02 +00:00
Jim McDonough
417b1ce487 Add ads_err2string() function for generating error strings from an ADS_STATUS.
I've got the cases besides gssapi...anyone know how to get those?
(This used to be commit c937e13522)
2002-04-04 02:49:30 +00:00
Jim McDonough
2ed1dfcf4e Added ads_process_results(), which takes a function that is called for each
entry returned from a search, and applies it to the results.  Re-structured
ads_dump to use this, plus changed the ber_free in ads_dump from (b,1) to
(b,0), in accordance with openldap manpages.  Also allows proper free of
result using ldap_msgfree afterwards, so you can do something with the
results after an ads_dump.
(This used to be commit f01f02fc56)
2002-03-29 21:06:33 +00:00
Jim McDonough
90ada79bbf Whoops, left the paged control not critical in the paged search...kind of
defeats the purpose.
(This used to be commit 71806c49b3)
2002-03-27 03:09:50 +00:00
Jim McDonough
1a06eeb6da Add server control to prevent referrals in paged searches. This keeps
the scope limited to the domain at hand, and also keeps the openldap
libs happy, since they don't currently chase referrals and return
server controls properly at the same time.
(This used to be commit 2bebc8a391)
2002-03-27 02:58:58 +00:00
Tim Potter
ce236d1dbf Stomped on some header file version numbers that have crept back in.
(This used to be commit e66bdf1229)
2002-03-22 06:24:38 +00:00
Andrew Tridgell
b462700e53 added a ads_do_search_all() call, which is a more convenient interface
to paged searches. This makes updating winbindd to used paged searches
trivial.
(This used to be commit 514c11b4e3)
2002-03-19 22:14:53 +00:00
Andrew Tridgell
f464ceb109 fixed paged controls on my box. The problem seems to be incorrect
referrals parsing in the openldap libs. By disabling referrals we get
valid controls back and the cookies work.
(This used to be commit 8bf487ddff)
2002-03-19 12:58:38 +00:00
Jim McDonough
0640a5ceeb This adds the Paged Result Control to ads searching. The new function, ads_do_paged_search, is the same as ads_do_search, but it also contains a count of records returned in this page, and a cookie for resuming, to be passed back. The cookie must start off NULL, and when it returns as NULL, the search is done.
(This used to be commit 9afba67f9a)
2002-03-14 17:48:26 +00:00
Andrew Tridgell
2001b83faa detect SIZELIMIT_EXCEEDED in ldap queries and truncate
the problem is, how the heck do we properly handle these? Jerry?

It seems that the Win2000 ADS server only returns a max of 1000 records!
(This used to be commit 9338964720)
2002-03-13 06:43:52 +00:00
Andrew Tridgell
bd3a6e6cc9 put in the ADS DNS hack, but commented out
(This used to be commit 3396a671c5)
2002-03-11 04:06:30 +00:00
Andrew Tridgell
1975b3e4a2 forgotten file, oops
(This used to be commit 98196e79b7)
2002-03-10 06:56:59 +00:00
Andrew Tridgell
cfbbf73677 yipee! Finally put in the patch from Alexey Kotovich
<a.kotovich@sam-solutions.net> that adds the security decsriptor code
for ADS workstation accounts

thanks for your patience Cat, and thanks to Andrew Bartlett for
extensive reviews and suggestions about this code.
(This used to be commit 6891393b5d)
2002-03-10 01:54:44 +00:00
Herb Lewis
23e6fc25e2 fix for IRIX compile error
(This used to be commit 2d620909f9)
2002-03-04 01:07:02 +00:00
Jim McDonough
9fc99e3c55 Fix LDAP modification operation. Cut and paste error: was LDAP_MOD_ADD, should be LDAP_MOD_REPLACE. Caught by Alexey Kotovich.
(This used to be commit be48a05ed9)
2002-02-13 15:00:39 +00:00
Jim McDonough
d6b82723a0 talloc'ify ads modify functions.
(This used to be commit e097666499)
2002-02-12 18:22:47 +00:00
Jim McDonough
a346cfb467 talloc'ify ads modify functions. Also add more complete berval support.
(This used to be commit 1f186c60ad)
2002-02-12 18:22:33 +00:00
Jim McDonough
ad6dfee741 Update for new ads modlist structure passing
(This used to be commit 6169b668fe)
2002-02-11 15:48:01 +00:00
Jim McDonough
d2b65dcbff Add ability to extend ads modification list on the fly. Also add some malloc checks and return ADS_ERROR(LDAP_NO_MEMORY) if they fail.
(This used to be commit 81d76f05d8)
2002-02-11 15:47:02 +00:00
Andrew Tridgell
fb444a546e when a trusted domain is down an ADS server will return a success on a
get trusted domains query but leave the domain SID blank - we need to
fail the add of the trusted domain in winbindd in that case
(This used to be commit 24c7e7a384)
2002-02-07 02:44:37 +00:00
Jim McDonough
9aa88da9d5 Fix ldapmod list overrun check. Also better document and format ldap control for permissive modify.
(This used to be commit 01e7f7c3d9)
2002-02-06 02:28:46 +00:00
Jim McDonough
55b92fdebc Update for function name changes, plus do some of the optional attributes on printer modify, now that the ldap control is working.
(This used to be commit 76afc886a8)
2002-02-02 22:07:22 +00:00
Jim McDonough
81b54940b7 merge in some changes from Alexey Kotovich. Return ADS_STATUS instead of BOOLs. Add support for bervals in mod lists. Also put undocumented AD ldap control in to allow modifications when an attribute does not yet exist.
(This used to be commit 1a2d27b21e)
2002-02-02 22:06:10 +00:00
Jim McDonough
bb8349735f Minor bug fixes, plus support to remove a printer. Commented out optional attributes until a method for checking for their existence is done.
(This used to be commit 538c19a698)
2002-02-02 02:04:01 +00:00
Jim McDonough
0c63216603 Fix build errors on non-ldap systems...change function parms from LDAPMod ** to void **
(This used to be commit 9467792843)
2002-02-01 17:13:39 +00:00
Jim McDonough
aa8ebe3956 Fix file header description and copyright (from cut-and-paste laziness)
(This used to be commit 146c731c35)
2002-02-01 16:58:01 +00:00
Jim McDonough
ecc2e1e3b8 Module for ADS operations on a printer object in the directory. Initially it creates and modifies a printQueue object in the directory
(This used to be commit b14e638aeb)
2002-02-01 16:15:53 +00:00
Jim McDonough
9e75e5c1f0 Add functions for modifying an entry in ADS. Needed for printer publishing.
(This used to be commit 3d8d8cef64)
2002-02-01 16:14:33 +00:00
Tim Potter
cd68afe312 Removed version number from file header.
Changed "SMB/Netbios" to "SMB/CIFS" in file header.
(This used to be commit 6a58c9bd06)
2002-01-30 06:08:46 +00:00
Jim McDonough
de260eadf9 Enable net ads commands to use existing tickets if the user doesn't specify a username on the commandline. Also don't continue past the kinit if a password is entered and fails because existing tickets would be used, which may not be desired if the username was specified.
(This used to be commit 7e5d7dfa83)
2002-01-25 22:07:46 +00:00
Andrew Tridgell
9f85d4ad5f much better support for organisational units in ADS join
(This used to be commit 7e876057d5)
2002-01-16 02:22:30 +00:00
Martin Pool
6059f40763 Move local variable to avoid warning when compiled without GSSAPI.
(This used to be commit 312c6d906e)
2002-01-14 06:34:53 +00:00
Andrew Bartlett
4acb3125cd Fix up 'net ads join' to delete and rejoin if the account already exists.
This fixes up a problem where a machine would join (or downgrade by trust
password change) to NT4 membership and not be able to regain full ADS
membership until a 'net ads leave'.

Andrew Bartlett
(This used to be commit ab8ff85f03)
2002-01-11 04:50:45 +00:00
Andrew Tridgell
9e0297b3ed added nTSecurityDescriptor field to host acct dump
(This used to be commit f383e19e09)
2002-01-03 11:59:33 +00:00
Andrew Bartlett
b5666e2874 Fix up C99 comment.
// -> /* */
(This used to be commit a308abbab7)
2002-01-01 02:31:32 +00:00
Andrew Tridgell
162a6606bd cope with systems that don't have full gssapi libs
(This used to be commit c4d928e55f)
2001-12-31 14:31:13 +00:00
Andrew Bartlett
8536aa5ef3 Allow this to build without LDAP, as per the example below it.
Andrew Bartlett
(This used to be commit f60e445001)
2001-12-31 11:14:38 +00:00
Andrew Bartlett
436595a386 Fix the compile on systems without a full kerberos kit.
Andrew Bartlett
(This used to be commit 33ae29028b)
2001-12-30 06:20:23 +00:00
Andrew Bartlett
34037e2479 Make Samba compile on RH 6.2 again.
We now include the libber.h file if required, but currently we just don't use
ldap.  (I'll chase this up).

In the meantime, I've moved the ads_status code about, its now in its own file,
and has a couple of #ifdefs to allow smbd to link - becouse the lack of LDAP
caused HAVE_ADS to be undefined. (I hope its not too ugly).

Andrew Bartlett
(This used to be commit 14407c87e2)
2001-12-30 05:59:43 +00:00
Andrew Tridgell
401c7495ea added ads_domain_sid() function
(This used to be commit ff002a458a)
2001-12-20 23:35:14 +00:00
Andrew Tridgell
db54a8c041 forgot to commit this file from remus
(This used to be commit 7984ae0121)
2001-12-20 07:46:24 +00:00
Andrew Tridgell
6c7e9dfb29 net ads password and net ads chostpass commands from Remus Koos
(This used to be commit 412e79c448)
2001-12-20 03:54:52 +00:00
Andrew Tridgell
1f31ace6cb much better ADS error handling system
(This used to be commit 05a90a2884)
2001-12-19 12:21:12 +00:00
Andrew Tridgell
105fe2a32e we only have gss_ fns on a krb5 capable box
(This used to be commit 344b786efe)
2001-12-19 09:58:52 +00:00
Andrew Tridgell
a062e58d9e - added initial support for trusted domains in winbindd_ads
- gss error code patch from a.bokovoy@sam-solutions.net
- better sid dumping in ads_dump
- fixed help in wbinfo
(This used to be commit ee1c3e1f04)
2001-12-19 08:44:23 +00:00
Andrew Tridgell
48c45486e3 allow selection of the organisational unit when joining a realm
(This used to be commit f1231c2b54)
2001-12-17 11:16:22 +00:00
Andrew Tridgell
d58b1b5981 better error handling
(This used to be commit ed6279481b)
2001-12-13 11:30:13 +00:00
Andrew Tridgell
75a6ac48a0 try the PDC for our workgroup if we can't find the ldap server
(This used to be commit fc9fd2ca19)
2001-12-13 11:29:49 +00:00
Andrew Tridgell
66d964c9fc allow overriding the local time in kerberos_kinit_password()
(This used to be commit cb9dbcef7c)
2001-12-11 05:15:52 +00:00
Andrew Tridgell
3d27d7b9f7 moved ccache location change into winbindd code
(This used to be commit be254eb13c)
2001-12-10 22:10:31 +00:00
Andrew Tridgell
e051c2c430 make sid_binstring available without HAVE_ADS
(This used to be commit 4a6d297686)
2001-12-10 00:39:01 +00:00
Andrew Tridgell
bc26ea1e5c fixed used of string after free
(This used to be commit f7ead035eb)
2001-12-09 00:45:51 +00:00
Andrew Tridgell
35eb6be4ea fix a DEBUG() line
(This used to be commit 18da530293)
2001-12-08 12:00:27 +00:00
Andrew Tridgell
5d378a280f added internal sasl/gssapi code. This means we are no longer dependent on cyrus-sasl which makes the code much less fragile. Also added code to auto-determine the server name or realm
(This used to be commit 435fdf276a)
2001-12-08 11:18:56 +00:00
Andrew Tridgell
44384354d8 put the winbindd krb5 credentials cache in the lock directory
this prevents it clobbering the users cache
(This used to be commit 3de552f365)
2001-12-06 07:33:35 +00:00
Andrew Tridgell
d412f66cd8 added a propoer kerberos_kinit_password call
contribution from remus@snapserver.com

thanks!
(This used to be commit 3ace8f1fcc)
2001-12-06 05:41:53 +00:00
Andrew Tridgell
410dfc917f fixed a minor password memory leak
(This used to be commit 5985d7e6ee)
2001-12-05 10:44:30 +00:00
Andrew Tridgell
6194d6a541 fix link error
(This used to be commit 58e93a8b7d)
2001-12-05 10:35:25 +00:00
Andrew Tridgell
8aa0a817c1 handle ldap server down better
(This used to be commit 0d85815c99)
2001-12-05 10:14:22 +00:00
Andrew Tridgell
9421ad4a7a added a REALLY gross hack into kerberos_kinit_password so that
winbindd can do a kinit
this will be removed once we have code that gets a tgt
and puts it in a place where cyrus-sasl can see it
(This used to be commit 7d94f1b736)
2001-12-05 09:46:53 +00:00
Andrew Tridgell
5d41807f4d added timeouts and retries to ldap operations
(This used to be commit 4f004eb54d)
2001-12-05 09:19:25 +00:00
Andrew Tridgell
addea9645d moved the sequence number fetch into the backend, and fetch the
sequence number via ldap when using ads
(This used to be commit 9a084f0bb9)
2001-12-05 07:52:44 +00:00
Andrew Tridgell
0799c44680 paranoia fixes in based ldap routines for potential memory leaks
(This used to be commit 13b933104e)
2001-12-05 07:35:57 +00:00
Andrew Tridgell
5f76385e70 more memory leak fixes
(This used to be commit eb6f0e91dd)
2001-12-05 06:26:56 +00:00
Andrew Tridgell
19c0459153 added functions that convert a ads binary blob to a string (for
searching on SID)
(This used to be commit 31d6d049b3)
2001-12-05 04:44:34 +00:00
Andrew Tridgell
3ec4a4def3 added ads_search_dn() and ads_pull_sids()
(This used to be commit bc83d55f44)
2001-12-04 12:08:16 +00:00
Andrew Tridgell
2285b99cb1 added a basic ADS backend to winbind. More work needed, but at
least basic operations work
(This used to be commit 88241cab98)
2001-12-03 06:04:18 +00:00
Andrew Tridgell
3a921f37b7 ads->realm must not be NULL
perhaps we should just fail ads_init() in this case?
(This used to be commit 2a4ce3de6a)
2001-11-29 08:22:45 +00:00
Andrew Tridgell
090acb27c3 define LDAP_PORT when not available
(This used to be commit 5a5f140f84)
2001-11-29 06:38:54 +00:00
Andrew Bartlett
fe64484824 Make better use of the ads_init() function to get the kerberos relam etc.
This allows us to use automagically obtained values in future, and the value
from krb5.conf now.

Also fix mem leaks etc.

Andrew Bartlett
(This used to be commit 8f9ce71781)
2001-11-29 06:21:56 +00:00
Andrew Tridgell
f6b962fba3 fixed some krb5 ifdefs
(This used to be commit 23ef22f117)
2001-11-28 23:54:07 +00:00
Herb Lewis
3a193f1597 add .po32 files to ignore list
(This used to be commit 5f625f2877)
2001-11-28 19:49:43 +00:00
Andrew Tridgell
eec9e8a052 fix a bunch of places where we can double-free a cli structure
(This used to be commit e2ba2383c9)
2001-11-28 03:56:30 +00:00
Andrew Tridgell
cb697dd72a added "net ads user" and "net ads group" commands
(This used to be commit f482583139)
2001-11-25 01:31:07 +00:00
Andrew Tridgell
3906f9dff6 added "net ads status" command
(This used to be commit ae0eabd04c)
2001-11-25 01:06:56 +00:00
Andrew Tridgell
f2e969268d better auto-selection of realm and ldap server
(This used to be commit 69d256af46)
2001-11-25 00:08:48 +00:00
Andrew Tridgell
ad2974cd05 added "net join" command
this completes the first stage of the smbd ADS support
(This used to be commit 058a5aee90)
2001-11-24 14:16:41 +00:00
Tim Potter
2025ef4c18 Ignore *.po files.
(This used to be commit 5d343b4065)
2001-11-23 00:08:12 +00:00
Andrew Tridgell
6464bb0ae5 added the beginnings of ADS support in smbd
(This used to be commit c7f6116919)
2001-11-20 08:54:15 +00:00