summaryrefslogtreecommitdiff
path: root/auth
Commit message (Collapse)AuthorAgeFilesLines
...
* auth/gensec: reset existing context on gensec_start_mech()Stefan Metzmacher2017-05-211-0/+8
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: make gensec_start_mech() staticStefan Metzmacher2017-05-212-2/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: add some basic doxygen comments for gensec_{want,have}_feature()Stefan Metzmacher2017-05-211-0/+43
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: always announce GENSEC_FEATURE_SIGN_PKT_HEADER support.Stefan Metzmacher2017-05-211-0/+14
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: call gensec_verify_features() also after update_recv() in ↵Stefan Metzmacher2017-05-211-0/+13
| | | | | | | | | | | | gensec_update_ev() This is no a real problem until now, because the only backends with update_send()/recv() are "schannel" (which only supports AUTH_LEVEL_{INTEGRITY,PRIVACY}) and "naclrpc_as_system" (which doesn't support any protection beside using unix domain sockets). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: fix gensec_update_ev() argument order for the SPNEGO_FALLBACK caseStefan Metzmacher2017-05-211-3/+3
| | | | | | | | | | | This went unnoticed so long as we don't use -Wc++-compat and gensec_update_ev() used the sync update() hook for all NTLMSSP and Kerberos. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12788 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python3: Use "y#" instead of "s#" for binary data in PyArg_ParseTuplePetr Viktorin2017-05-191-2/+4
| | | | | | | | | | | | | | | | | The "s#" format code for PyArg_ParseTupleAndKeywords and Py_BuildValue converts a char* and size to/from Python str (with utf-8 encoding under Python 3). In some cases, we want bytes (str on Python 2, bytes on 3) instead. The code for this is "y#" in Python 3, but that is not available in 2. Introduce a PYARG_BYTES_LEN macro that expands to "s#" or "y#", and use that in: - credentials.get_ntlm_response (for input and output) - ndr_unpack argument in PIDL generated code Signed-off-by: Petr Viktorin <pviktori@redhat.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* gensec: Add a TALLOC_CTX * to gensec_register().Jeremy Allison2017-05-137-9/+11
| | | | | | | | Pass in the TALLOC_CTX * from the module init to remove another talloc_autofree_context() use. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* lib: modules: Change XXX_init interface from XXX_init(void) to ↵Jeremy Allison2017-04-228-14/+15
| | | | | | | | | | | | | | | | | | | | XXX_init(TALLOC_CTX *) Not currently used - no logic changes inside. This will make it possible to pass down a long-lived talloc context from the loading function for modules to use instead of having them internally all use talloc_autofree_context() which is a hidden global. Updated all known module interface numbers, and added a WHATSNEW. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144
* build: correct package dependenciesJan Engelhardt2017-04-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | The wscript_build files convey what header files belong to which logical package. For example, # lib/util/wscript_build: bld.SAMBA_LIBRARY('samba-util', public_headers='... data_blob.h ...' # auth/credentials/wscript_build: bld.SAMBA_LIBRARY('samba-credentials', public_headers='credentials.h', Now, credentials.h #includes <util/data_blob.h> and therefore, samba-credentials.pc must have a Requires: samba-util. Similarly for other parts. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* whitespace: auth_log.c C code conventionsGarming Sam2017-03-291-29/+29
| | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz>
* pycredentials: Add bindings for get_ntlm_response()Andrew Bartlett2017-03-291-0/+65
| | | | | | This should make testing of SamLogon from python practical Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* heimdal: Pass extra information to hdb_auth_status() to log success and failuresAndrew Bartlett2017-03-292-3/+12
| | | | | | | | | | We now pass on the original client name and the client address to allow consistent audit logging in Samba across multiple protocols. We use config->db[0] to find the first database to record incorrect users. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* auth: Add hooks for notification of authentication events over the message busAndrew Bartlett2017-03-294-14/+80
| | | | | | | | This will allow tests to be written to confirm the correct events are triggered. We pass in a messaging context from the callers Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* auth_log: Improve commentAndrew Bartlett2017-03-291-1/+1
| | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* auth_log: Prepared to allow logging JSON events to a server over the message busAndrew Bartlett2017-03-292-3/+83
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* s4-messaging: split up messaging into a smaller library for send onlyAndrew Bartlett2017-03-291-1/+1
| | | | | | | This will help avoid a dep loop when the low-level auth code relies on the message code to deliver authentication messages Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* auth_log: Add JSON logging of Authorisation and AuthenticationsGary Lockyer2017-03-293-48/+558
| | | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Pair-Programmed: Andrew Bartlett <abartlet@samba.org>
* auth: Log the transport connection for the authorizationAndrew Bartlett2017-03-294-0/+23
| | | | | | | We also log if a simple bind was over TLS, as this particular case matters to a lot of folks Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* auth_log: Split up auth/authz logging levels and handle anonymous betterAndrew Bartlett2017-03-291-6/+24
| | | | | | | | | | | | We typically do not want a lot of logging of anonymous access, as this is often simple a preperation for authenticated access, so we make that level 5. Bad passwords remain at level 2, successful password authentication is level 3 and successful authorization (eg kerberos login to SMB) is level 4. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* auth_log: Also log the final type of authentication (ntlmssp,krb5)Andrew Bartlett2017-03-298-3/+51
| | | | | | | | | Administrators really care about how their users were authenticated, so make this clear. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* auth_log: Expand to include the type of password used (eg ntlmv2)Andrew Bartlett2017-03-291-3/+42
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* auth: Add logging of service authorizationAndrew Bartlett2017-03-294-2/+94
| | | | | | | | In ntlm_auth.c and authdata.c, the session info will be incomplete Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* auth: Always supply both the remote and local address to the auth subsystemAndrew Bartlett2017-03-291-0/+1
| | | | | | | | | | | This ensures that gensec, and then the NTLM auth subsystem under it, always gets the remote and local address pointers for potential logging. The local address allows us to know which interface an authentication is on Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* auth: Generate a human readable Authentication log message.Gary Lockyer2017-03-293-3/+170
| | | | | | | | | Add a human readable authentication log line, to allow verification that all required details are being passed. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* auth: Add "auth_description" to allow logs to distinguish simple bind (etc)Andrew Bartlett2017-03-292-0/+2
| | | | | | | | | This will allow the authentication log to indicate clearly how the password was supplied to the server. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* gensec: Pass service_description into auth_usersuppliedinfo during NTLMSSPAndrew Bartlett2017-03-292-0/+4
| | | | | | | | | This allows the GENSEC service description to be read at authentication time for logging, eg that the user authenticated to the SAMR server Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* gensec: Add gensec_{get,set}_target_service_description()Andrew Bartlett2017-03-292-0/+46
| | | | | | | | | | This allows a free text description of what the server-side service is for logging purposes where the various services may be using the same Kerberos service or not use Kerberos. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* s4-netlogon: Remember many more details in the auth_usersupplied info for ↵Andrew Bartlett2017-03-291-0/+9
| | | | | | | | | | future logs This will allow a very verbose JSON line to be logged that others can audit from in the future Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* auth: Add SID_NT_NTLM_AUTHENTICATION / S-1-5-64-10 to the token during NTLM authAndrew Bartlett2017-03-272-0/+2
| | | | | | | | | So far this is only on the AD DC Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* auth: remove unused USER_INFO_LOCAL_SAM_ONLY/AUTH_METHOD_LOCAL_SAM definesStefan Metzmacher2017-03-241-3/+1
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: let auth4_context->check_ntlm_password() return pauthoritativeStefan Metzmacher2017-03-242-0/+4
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* python: wscript_build: Build some modules for Python 3Lumir Balhar2017-03-101-6/+6
| | | | | | | | | Update a few wscript_build files to build Python 3-compatible modules for Python 3. Signed-off-by: Lumir Balhar <lbalhar@redhat.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* python: samba.credentials: Port pycredentials.c to Python3-compatible form.Lumir Balhar2017-03-101-7/+17
| | | | | | | | | Port Python bindings of samba.credentials module to Python3-compatible form using macros from py3compat.h. Signed-off-by: Lumir Balhar <lbalhar@redhat.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
* credentials_krb5: convert to use smb_gss_krb5_import_credAlexander Bokovoy2017-03-081-9/+13
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611 Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* gensec:spnego: Add debug message for the failed principalStefan Metzmacher2017-03-021-5/+53
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12557 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/credentials: try to use kerberos with the machine account unless we're ↵Stefan Metzmacher2017-02-241-1/+16
| | | | | | | | | in an AD domain BUG: https://bugzilla.samba.org/show_bug.cgi?id=12587 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* Correct "intialise" typos.Chris Lamb2017-02-221-1/+1
| | | | | | Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* Correct "overriden" typos.Chris Lamb2017-02-221-1/+1
| | | | | | Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* ntlmssp: fix compilation with -O2 -fno-inlineDouglas Bagnall2017-02-101-0/+4
| | | | | | | | | | | Without inlining the function, GCC doesn't know that gensec_ntlmssp->ntlmssp_state->role always has a valid value. With inlining, this is obviously redundant but GCC clearly knows enough to detect this and elide the default case. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: fix mem leak & use appropriate free functionAurelien Aptel2017-02-011-1/+1
| | | | | | | | | | | coverity fix. cli_credentials_set_principal does a strdup, we want to free 'name' regardless of the result in 'ok'. Signed-off-by: Aurelien Aptel <aaptel@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* auth/gensec: convert external.c to provide update_send/recvStefan Metzmacher2017-01-122-7/+49
| | | | Signed-off-by: Stefan Metzmacher <metze@samba.org>
* auth/gensec: convert ncalrpc.c to provide update_send/recvStefan Metzmacher2017-01-121-6/+73
| | | | Signed-off-by: Stefan Metzmacher <metze@samba.org>
* auth/gensec: convert schannel.c to provide update_send/recvStefan Metzmacher2017-01-121-4/+69
| | | | Signed-off-by: Stefan Metzmacher <metze@samba.org>
* auth/gensec: remove unused prototype headersStefan Metzmacher2017-01-121-3/+0
| | | | Signed-off-by: Stefan Metzmacher <metze@samba.org>
* credentials: Create a smb_gss_krb5_copy_ccache() functionAndreas Schneider2017-01-121-4/+129
| | | | | | | | This sets the default principal on the copied ccache if it hasn't been set yet. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* wscript: remove executable bits for all wscript* filesStefan Metzmacher2017-01-113-0/+0
| | | | | | | | | | These files should not be executable. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Wed Jan 11 20:21:01 CET 2017 on sn-devel-144
* auth/credentials: Always set the the realm if we set the principal from the ↵Andreas Schneider2017-01-101-3/+17
| | | | | | | | | | ccache This fixes a bug in gensec_gssapi_client_start() where an invalid realm is used to get a Kerberos ticket. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* auth/credentials: remove const where we always return a talloc stringStefan Metzmacher2017-01-102-9/+9
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/credentials: Add missing error code check for MIT KerberosAndreas Schneider2016-12-241-1/+5
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
View Lorry Controller Status