sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Code
137,001 Commits 60 Branches 1,145 Tags 452 MiB
d393fd4693
Commit Graph

2176 Commits

Author SHA1 Message Date
Volker Lendecke
d393fd4693 auth: Simplify smb_krb5_send_to_kdc_state_destructor() 
Replace a call to dbwrap_fetch_locked() with the higherlevel
dbwrap_delete().

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-03-12 13:31:31 +00:00
Jo Sutton
e1d27ba545 s4:dsdb: Add to ‘user_attrs’ attributes required for Group Managed Service Accounts 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-02-16 02:41:36 +00:00
Jo Sutton
75d9f5332d s4:auth: Fix code spelling 
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2024-02-08 02:48:44 +00:00
Joseph Sutton
dac9cd0085 s4:auth: Clarify comment about requiring FAST armor 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-12-21 20:21:34 +00:00
Joseph Sutton
235b518ccf s4:auth: Fix code spelling 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-12-08 02:28:33 +00:00
Andrew Bartlett
c49fd98ed7 s4-auth/kerberos: Use FAST credentials for armor if specified in cli_credentials 
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2023-11-29 03:11:34 +00:00
Andreas Schneider
9621a3d7a6 Use python.h from libreplace 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15513

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-11-20 15:37:33 +00:00
Joseph Sutton
1c1d402f36 s4:auth: Add comment about claims going ignored for SamLogon 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-11-07 21:54:32 +00:00
Joseph Sutton
bafd63bef3 s4:auth: Remove trailing whitespace 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-11-07 21:54:32 +00:00
Joseph Sutton
b06751389d s4:auth: Comment about claims in the security token 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-11-01 20:10:45 +00:00
Joseph Sutton
ebbba22cfb s4:auth: Remove trailing whitespace 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-11-01 20:10:45 +00:00
Joseph Sutton
915b40521e s4:auth: Check that the PAC is not NULL before dereferencing it 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-11-01 20:10:45 +00:00
Joseph Sutton
b55049711e s4:auth: Fix code spelling 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-25 22:23:37 +00:00
Joseph Sutton
eaffadb828 s4:kdc: Add a flag indicating that the device should be added to Authenticated Users 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-24 00:54:31 +00:00
Joseph Sutton
fc2f886441 s4:kdc: Add a flag indicating that the device should be added to the default groups 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-24 00:54:31 +00:00
Joseph Sutton
7728a0622e s4:kdc: Make a copy of the device SIDs to be placed in the security token 
We shall need to add extra SIDs on the end.

View with ‘git show -b’.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-24 00:54:31 +00:00
Joseph Sutton
fa68f26167 s4:auth: Remove event context on failure 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-13 02:18:31 +00:00
Joseph Sutton
79a9a07c79 s4:auth: Fix resource leak (CID 1107222) 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-13 02:18:31 +00:00
Joseph Sutton
e09bf1bc9e s4:auth: Explicitly initialize claims structures 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-12 23:13:32 +00:00
Joseph Sutton
3e5aba62ec s4:auth: Have claims_data_encoded_claims_set() return a reference to the encoded claims 
Having the lifetime of the encoded claims be tied in a predictable
fashion to a caller‐controlled memory context is less prone to error.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-12 23:13:32 +00:00
Joseph Sutton
2f9d2ff895 s4:kdc: Add parameters for claims and device info to authn_policy_authenticate_to_service() 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-01 22:45:38 +00:00
Joseph Sutton
8a5921d974 s4:auth: Add parameters for claims and device info to auth_generate_security_token() 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-01 22:45:38 +00:00
Joseph Sutton
a2b6c2199f s4:auth: Reformat function calls 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-01 22:45:38 +00:00
Joseph Sutton
4f0ba2b0bf s4:auth: Rename parameter to match function implementation 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-01 22:45:38 +00:00
Joseph Sutton
c829dd1ba8 s4:dsdb: Add parameters for claims and device SIDs to security_token_create() 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-01 22:45:38 +00:00
Joseph Sutton
d30a612410 s4:auth: Ensure that some parameters are not NULL 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-10-01 22:45:38 +00:00
Joseph Sutton
4839adf9da s4:auth: Add functions to convert between different claims formats 
The new ‘claims_data’ structure can store claims in three different
representations — as an encoded blob, as a CLAIMS_SET structure, or as a
series of CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 claims. Given a set of
claims, the accompanying functions provide a way to convert them into
the desired format.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Joseph Sutton
58aa8d99c4 s4:auth: Include missing headers 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Joseph Sutton
5e164cc2d6 s4:kdc: Move encode_claims_set() into the auth_session subsystem 
Some functions in the auth_session subsystem will need to be able to
call encode_claims_set(). Moving said function lets them do that whilst
avoiding circular dependencies and additional public dependencies.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Joseph Sutton
ab227bbe8e s4:auth: Fix ‘user_info_dc_out’ leak 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Joseph Sutton
0a9f248642 s4:auth: Return a talloc‐allocated resource groups structure 
Future callers will rely on resource_groups_out being talloc‐allocated.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Joseph Sutton
219ee05d6e s4:auth: Introduce helper variable ‘resource_groups_in’ 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Joseph Sutton
842f845c8a s4:auth: Make returning resource groups the last thing we do 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Joseph Sutton
c94db7d2e8 s4:auth: Correct error message 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Joseph Sutton
e6bb3a347f s4:auth: Use Anonymous and System SID constants 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-27 02:43:28 +00:00
Andrew Bartlett
f1fcbc0f10 s4-auth: pass lp_ctx to auth_generate_session_info() where possible 
For non-testing callers of auth_generate_session_info(), passing
lp_ctx will allow us to correctly set a flag indicating if claims
should be evaluated.

For testing applications, the default will allow safe operation
inspecting the SID list.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
 2023-09-26 23:45:35 +00:00
Joseph Sutton
187d74d9c0 lib:krb5_wrap: Remove Heimdal‐only krb5_princ_component() implementation 
This implementation is no longer called: using a variable of static
storage duration as a conduit for return values is only asking for
trouble.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-14 21:35:29 +00:00
Joseph Sutton
229d26e25e lib:krb5_wrap: Add Heimdal‐specific smb_krb5_princ_component() implementation 
This implementation doesn’t rely on a variable of static storage
duration being used as a conduit for the return value.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-14 21:35:29 +00:00
Joseph Sutton
eec9e54592 lib:krb5_wrap: Add smb_krb5_princ_component() 
For now this function is a mere wrapper round krb5_princ_component(),
but one whose interface allows for a more sensible implementation.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-14 21:35:29 +00:00
Joseph Sutton
c4933dd4b7 s4:auth: Fix leaks 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-14 21:35:29 +00:00
Joseph Sutton
8b2e14052c s4:auth: Check return values of talloc functions 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-14 21:35:29 +00:00
Joseph Sutton
354eff14eb s4:auth: Fix code spelling 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-09-11 02:42:41 +00:00
Joseph Sutton
e9e2dfa535 s4:auth: Check return value of talloc_new() 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-08-14 04:57:34 +00:00
Joseph Sutton
45ca5e23b8 s4:auth: Fix leaks 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-08-14 04:57:34 +00:00
Joseph Sutton
18569f81c0 s4:auth: Add missing space to error message 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-08-14 04:57:34 +00:00
Joseph Sutton
939bd3d9a5 s4:auth: Fix code spelling 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-08-14 04:57:34 +00:00
Joseph Sutton
e663c1d96b s4:auth: Correct condition and remove redundant check 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-08-08 04:39:38 +00:00
Joseph Sutton
c590d8d3a3 s4:auth: Check return value of talloc_reference() 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-08-08 04:39:38 +00:00
Joseph Sutton
703978c776 s4:auth: Fix leaks 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-08-08 04:39:38 +00:00
Joseph Sutton
731e233aca s4:auth: Add missing newlines to logging messages 
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
 2023-08-08 04:39:36 +00:00