summaryrefslogtreecommitdiff
path: root/auth/auth_sam_reply.c
Commit message (Collapse)AuthorAgeFilesLines
* auth: Fix leaksJoseph Sutton2023-05-181-13/+64
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Clear EXTRA_SIDS flag if no Extra SIDs are presentJoseph Sutton2023-03-201-0/+1
| | | | | Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Free empty SID arraysJoseph Sutton2023-02-081-1/+5
| | | | | | | | In the unlikely event that these arrays are empty, they can be freed early. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Discard non-base SIDs when creating SamInfo2Joseph Sutton2023-02-081-0/+6
| | | | | | | Our SamLogon tests are now all passing. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Correct primary group handlingJoseph Sutton2023-02-081-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Heretofore we have treated the primary group SID specially, storing it in a fixed position as the second element of the user_info_dc->sids array, and filtering out other copies in the PAC_LOGON_INFO base structure. This filtering has made it difficult to distinguish between the case where the primary group is a universal or global group, located in the base RIDs, and the case where it is a domain-local group, missing from the base RIDs; especially since the attributes of a domain-local primary group are lost by being stored in the PAC. Domain-local primary groups are normally disallowed by Windows, but are allowed by Samba, and so it is reasonable to support them with at least some measure of consistency. The second element of user_info_dc->sids is still reserved for the primary group's SID, but we no longer filter out any other copies in the array. The first two elements are no more than the SIDs of the user and the primary group respectively; and the remaining SIDs are as if taken without modification from arrays of SIDs in the PAC. user_info_dc->sids should therefore become a more faithful representation of the SIDs in the PAC. After adding resource SIDs to it with dsdb_expand_resource_groups(), we should have a result that more closely and in more cases matches that of Windows. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Make more liberal use of SID index constantsJoseph Sutton2023-02-081-2/+2
| | | | | | | | | | | Arrays of SIDs are handled not fully consistently throughout the codebase. Sometimes SIDs in the first and second positions represent a user and a primary group respectively; other times they don't mean anything in particular. Using these index constants in situations of the former sort can help to clarify our intent. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Shorten long SID flags combinationsJoseph Sutton2023-02-081-4/+2
| | | | | | | | | The combination MANDATORY | ENABLED_BY_DEFAULT | ENABLED is very commonly used, and introducing a shorter alias for it makes the code clearer. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Add resource SID compressionJoseph Sutton2023-02-081-37/+262
| | | | | | | | | | | | | The domain-local groups that are added to the PAC of a service ticket are now, if the service doesn't disclaim support for SID compression, placed into the resource groups structure in PAC_LOGON_INFO. In a TGS exchange directed to a KDC, rather than to a service, the resource groups structure is simply copied into the updated PAC without any processing being done. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Pass through entire PAC flags value in auth_user_infoJoseph Sutton2023-02-081-6/+9
| | | | | | | | | | Besides the NETLOGON_GUEST bit indicating whether the user has been authenticated, we now carry all of the other bits as well. This lets us match Windows' behaviour of simply passing these bits through to an updated PAC when processing a TGS-REQ. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Only process resource groups if NETLOGON_RESOURCE_GROUPS flag is setJoseph Sutton2023-02-081-2/+0
| | | | | | | | | | MS-PAC section 2.5 states that if the resource_groups member is non-NULL, or resource_groups.groups.count is not zero, the NETLOGON_RESOURCE_GROUPS flag MUST be set. Thus, there's no need to process resource groups if the flag is not set. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Remove early return from make_user_info_dc_pac()Joseph Sutton2023-02-081-6/+1
| | | | | | | | | 'rg' is never NULL, so this codepath is never taken. But if it were, we would return early and entirely neglect filling in the UPN_DNS_INFO from the 'pac_upn_dns_info' parameter. So remove the early return. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Exclude resource groups from a TGTJoseph Sutton2023-02-081-3/+28
| | | | | | | | | | Resource group SIDs should only be placed into a service ticket, but we were including them in all tickets. Now that we have access to the group attributes, we'll filter out any groups with SE_GROUP_RESOURCE set if we're creating a TGT. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: Store group attributes in auth_user_info_dcJoseph Sutton2023-02-081-24/+35
| | | | | | | | | | | | | | | | Group expansion, performed in dsdb_expand_nested_groups(), now incorporates a check of the type of each group. Those that are resource groups receive the SE_GROUP_RESOURCE bit in the attributes which are now carried alongside each group SID. Whereas before, in auth_convert_user_info_dc_sambaseinfo() and auth_convert_user_info_dc_saminfo6(), we invariantly used the flag combination SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED to set attributes in the PAC, we now take the correct attributes from user_info_dc. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2022-2031 auth: Add ticket type field to auth_user_info_dc and ↵Joseph Sutton2022-07-271-1/+1
| | | | | | | | | | | | | | auth_session_info This field may be used to convey whether we were provided with a TGT or a non-TGT. We ensure both structures are zeroed out to avoid incorrect results being produced by an uninitialised field. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth: Cope with NULL upn_name in PACJoseph Sutton2022-03-011-5/+7
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* Add PrimaryGroupId to group array in DC responseIsaac Boukris2019-07-031-2/+6
| | | | | | | | | | | | | | | | This is a simplified version of the original patch by: Felix Botner <botner@univention.de> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11362 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Isaac Boukris <iboukris@gmail.com> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Jul 3 13:52:55 UTC 2019 on sn-devel-184
* auth: add auth_user_info_copy() functionStefan Metzmacher2018-03-151-0/+35
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13328 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* auth/auth_sam_reply: fill user_principal_* and dns_domain_name in ↵Stefan Metzmacher2016-07-221-0/+22
| | | | | | | | | | make_user_info_dc_pac() This is required in order to support netr_SamInfo6 and PAC_UPN_DNS_INFO correctly. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* krb5pac.idl: introduce PAC_DOMAIN_GROUP_MEMBERSHIP to handle the resource groupsStefan Metzmacher2016-06-301-9/+25
| | | | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Jun 30 07:16:45 CEST 2016 on sn-devel-144
* auth/auth_sam_reply: make auth_convert_user_info_dc_sambaseinfo() a private ↵Stefan Metzmacher2016-06-301-14/+12
| | | | | | | helper Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/auth_sam_reply: do a real copy of strings in ↵Stefan Metzmacher2016-06-301-8/+17
| | | | | | | | | auth_convert_user_info_dc_sambaseinfo() That's much more expected by callers. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/auth_sam_reply: add auth_convert_user_info_dc_saminfo2() helper functionStefan Metzmacher2016-06-301-0/+26
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/auth_sam_reply: add auth_convert_user_info_dc_saminfo6() and implement ↵Stefan Metzmacher2016-06-301-25/+72
| | | | | | | level 3 as wrapper Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/auth_sam_reply: let make_user_info_dc_netlogon_validation() correctly ↵Stefan Metzmacher2016-06-301-18/+47
| | | | | | | | | | handle level 6 We need to take care of extra sids in level 3 and 6! And level 6 also includes user_principal_name and dns_domain_name. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/auth_sam_reply: add some const to input parametersStefan Metzmacher2016-06-301-6/+6
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* Remove a number of NT_STATUS_HAVE_NO_MEMORY_AND_FREE macros from the codebase.Garming Sam2014-03-051-3/+12
| | | | | | | | | | | Following the current coding guidelines, it is considered bad practice to return from within a macro and change control flow as they look like normal function calls. Change-Id: I133eb5a699757ae57b87d3bd3ebbcf5b556b0268 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* idl: Improve MS-PAC IDLSimo Sorce2011-10-241-11/+14
| | | | | | | | | | Change some misleading variable names to reflect the actual function. Add missing field name/types previously marked as unkown. Signed-off-by: Günther Deschner <gd@samba.org> Autobuild-User: Günther Deschner <gd@samba.org> Autobuild-Date: Mon Oct 24 19:19:28 CEST 2011 on sn-devel-104
* auth: Set NETLOGON_GUEST and use it to determine guest statusAndrew Bartlett2011-07-201-1/+2
| | | | | | | | | These additional measures should help ensure we do not accidentily upgrade a guest to an authenticated user in the future. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* auth: Move make_user_info_SamBaseInfo() to talloc_strdup and out of memory ↵Andrew Bartlett2011-07-201-9/+31
| | | | | | checking Signed-off-by: Andrew Tridgell <tridge@samba.org>
* auth: Split out make_user_info_SamBaseInfo and add authenticated argumentAndrew Bartlett2011-07-201-29/+55
| | | | | | | | | This will allow the source3 auth code to call this without needing to double-parse the SIDs Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* auth: Preserve guest flag on transition via netr_SamInfo3Andrew Bartlett2011-07-201-0/+3
| | | | Signed-off-by: Andrew Tridgell <tridge@samba.org>
* Add my copyrightAndrew Bartlett2011-07-201-1/+1
| | | | Signed-off-by: Andrew Tridgell <tridge@samba.org>
* auth Move auth_sam_reply into the top level.Andrew Bartlett2011-02-101-0/+390
These functions provide conversions between some netlogon.idl and auth.idl structures Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
View Lorry Controller Status