delta/samba.git/source3/auth, branch master

auth: Return status code if configuration prohibits NTLM

2023-05-16T23:29:32+00:00

Currently, we rely on ‘stored_nt’ being NULL to give an
NT_STATUS_WRONG_PASSWORD error.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Shorten long SID flags combinations

2023-02-08T00:03:39+00:00

The combination MANDATORY | ENABLED_BY_DEFAULT | ENABLED is very
commonly used, and introducing a shorter alias for it makes the code
clearer.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s4:kdc: Add resource SID compression

2023-02-08T00:03:39+00:00

The domain-local groups that are added to the PAC of a service ticket
are now, if the service doesn't disclaim support for SID compression,
placed into the resource groups structure in PAC_LOGON_INFO.

In a TGS exchange directed to a KDC, rather than to a service, the
resource groups structure is simply copied into the updated PAC without
any processing being done.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Pass through entire PAC flags value in auth_user_info

2023-02-08T00:03:39+00:00

Besides the NETLOGON_GUEST bit indicating whether the user has been
authenticated, we now carry all of the other bits as well. This lets us
match Windows' behaviour of simply passing these bits through to an
updated PAC when processing a TGS-REQ.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Exclude resource groups from a TGT

2023-02-08T00:03:39+00:00

Resource group SIDs should only be placed into a service ticket, but we
were including them in all tickets. Now that we have access to the group
attributes, we'll filter out any groups with SE_GROUP_RESOURCE set if
we're creating a TGT.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Store group attributes in auth_user_info_dc

2023-02-08T00:03:39+00:00

Group expansion, performed in dsdb_expand_nested_groups(), now
incorporates a check of the type of each group. Those that are resource
groups receive the SE_GROUP_RESOURCE bit in the attributes which are now
carried alongside each group SID.

Whereas before, in auth_convert_user_info_dc_sambaseinfo() and
auth_convert_user_info_dc_saminfo6(), we invariantly used the flag
combination SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT |
SE_GROUP_ENABLED to set attributes in the PAC, we now take the correct
attributes from user_info_dc.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s3:auth: call wbcFreeMemory(info) in auth3_generate_session_info_pac()

2023-01-19T18:47:35+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15286

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison

lib: Remove idtree from samba_util.h

2023-01-10T00:28:37+00:00

No need to recompile the world when only a few files need this.

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

lib: Remove fstring_sub() that was used just once

2022-12-12T21:16:33+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

s3:auth_samba4: make use of imessaging_init_discard_incoming()

2022-10-13T12:30:37+00:00

Otherwise we'll generate a memory leak of imessaging_post_state/
tevent_immediate structures per incoming message!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15201

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme