summaryrefslogtreecommitdiff
path: root/source3/auth/proto.h
Commit message (Collapse)AuthorAgeFilesLines
* s3-auth: Finally change make_user_info_*() use a parent talloc contextAndrew Bartlett2014-04-021-7/+14
| | | | | | Change-Id: Iedf516e8c24e0d18064aeedd8e287ed692d3c5b4 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
* s3-auth: Pass mem_ctx to do_map_to_guest_server_info().Andreas Schneider2014-02-191-3/+5
| | | | | | | | Change-Id: If53117023e3ab37c810193edd00a81d247fdde7a Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Feb 19 01:28:14 CET 2014 on sn-devel-104
* s3-auth: Pass mem_ctx to auth_check_ntlm_password().Andreas Schneider2014-02-191-3/+5
| | | | | | | | | | Coverity-Id: 1168009 BUG: https://bugzilla.samba.org/show_bug.cgi?id=8598 Signed-off-by: Andreas Schneider <asn@samba.org> Change-Id: Ie01674561a6a75239a13918d3190c2f21c3efc7a Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3-auth: Pass mem_ctx to make_server_info_sam().Andreas Schneider2014-02-191-2/+3
| | | | | | | | | | Coverity-Id: 1168009 BUG: https://bugzilla.samba.org/show_bug.cgi?id=8598 Signed-off-by: Andreas Schneider <asn@samba.org> Change-Id: Ie614b0654c3a7eec1ebb10dbb9763696eec795bd Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3-auth: Pass talloc context to make_server_info_pw().Andreas Schneider2014-02-051-3/+4
| | | | | | | Pair-Programmed-With: Guenther Deschner <gd@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3-auth: Add passwd_to_SamInfo3().Andreas Schneider2014-02-051-0/+4
| | | | | | | | | | | | | First this function tries to contacts winbind if the user is a domain user to get valid information about it. If winbind isn't running it will try to create everything from the passwd struct. This is not always reliable but works in most cases. It improves the current situation which doesn't talk to winbind at all. Pair-Programmed-With: Guenther Deschner <gd@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3-auth: remove crypto from serverinfo_to_SamInfoX calls.Günther Deschner2012-12-091-6/+0
| | | | | | | | | All crypto is dealt with within the netlogon samlogon server now. Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3-rpc_server: support AES for interactive netlogon samlogon password ↵Günther Deschner2012-12-091-2/+1
| | | | | | | | | | | decryption. Still need to fix AES support for the returned validation info. Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3:auth: use const in smb_pam_xxx_session()Gregor Beck2012-10-191-2/+2
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Signed-off-by: Michael Adam <obnox@samba.org>
* s3:auth: remove duplicate propotypes for smb_pam_claim_session and ↵Michael Adam2012-10-191-2/+0
| | | | | | smb_pam_close_session Signed-off-by: Michael Adam <obnox@samba.org>
* s3-smbd: Create a shortcut for building the token of a user by SID for ↵Andrew Bartlett2012-08-101-0/+1
| | | | | | | | | | | | | posix_acls When a user owns a file, but does not have specific permissions on that file, we need to make up the user permissions. This change ensures that the first thing that we do is to look up the SID, and confirm it is a user. Then, we avoid the getpwnam() and directly create the token via the SID. Andrew Bartlett Signed-off-by: Jeremy Allison <jra@samba.org>
* s3-auth: Remove auth_netlogondAndrew Bartlett2012-06-161-2/+0
| | | | | | | | | | | | | | | | | auth_netlogond was an important module in the development of the combined Samba 4.0, and was the first module to link smbd with the AD authentication store, showing that it was possible for NTLM authentication to be offloaded to the AD server components. We now have auth_samba4, which provides the full GENSEC stack to smbd, which also matches exactly the group membership and privileges assignment and which is supported and tested as part of the official Samba 4.0 release configuration. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Jun 16 10:13:20 CEST 2012 on sn-devel-104
* s3-auth: Rename to init_system_session_info().Andreas Schneider2012-05-151-1/+1
| | | | | Autobuild-User: Andreas Schneider <asn@cryptomilk.org> Autobuild-Date: Tue May 15 13:56:00 CEST 2012 on sn-devel-104
* s3:auth: remove unused auth_server.cStefan Metzmacher2012-05-151-4/+0
| | | | metze
* s3: remove some unused codeVolker Lendecke2012-05-041-1/+0
|
* s3-rpc: Decrypt with the proper session key in CreateTrustedDomainEx2.Alexander Bokovoy2012-03-131-0/+1
| | | | | | | | | | | | | | | | On LSA and SAMR pipes session_key is truncated to 16 byte when doing encryption/decryption. However, this was not done for trusted domain-related modifying operations. As result, Samba 4 client libraries do not work against Samba 3 while working against Windows 2008 r2. Solved this by introducing "session_extract_session_key()" function that allows to specify intent of use of the key. Signed-off-by: Andreas Schneider <asn@samba.org> Autobuild-User: Andreas Schneider <asn@cryptomilk.org> Autobuild-Date: Tue Mar 13 12:23:44 CET 2012 on sn-devel-104
* s3-auth: Remove single-implementation plugin layerAndrew Bartlett2012-03-081-0/+40
| | | | | | | | The ->get_ntlm_challenge and ->check_ntlm_password elements of struct auth_context were only ever initialised to a single value. Make it easier to follow by just calling the function directly. Andrew Bartlett
* s3-auth: Remove security=share (depricated since 3.6).Andrew Bartlett2012-03-041-12/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch removes security=share, which Samba implemented by matching the per-share password provided by the client in the Tree Connect with a selection of usernames supplied by the client, the smb.conf or guessed from the environment. The rationale for the removal is that for the bulk of security=share users, we just we need a very simple way to run a 'trust the network' Samba server, where users mark shares as guest ok. This is still supported, and the smb.conf options are documented at https://wiki.samba.org/index.php/Public_Samba_Server At the same time, this closes the door on one of the most arcane areas of Samba authentication. Naturally, full user-name/password authentication remain available in security=user and above. This includes documentation updates for username and only user, which now only do a small amount of what they used to do. Andrew Bartlett -------------- / \ / REST \ / IN \ / PEACE \ / \ | SEC_SHARE | | security=share | | | | | | 5 March | | | | 2012 | *| * * * | * _________)/\\_//(\/(/\)/\//\/\///|_)_______
* s3-auth: Provide helper routine to check password and return session_infoAndrew Bartlett2012-02-241-0/+5
|
* s3-auth: Add a way to get an auth4_context from the auth stackAndrew Bartlett2012-02-241-0/+1
| | | | | | | | This will allow us to use the same layer that auth_ntlmssp does in the non-SPNEGO session setup, which will in turn make the authentication code more consistent in the AD server case. Andrew Bartlett
* auth: Reorder arguments to generate_session_infoAndrew Bartlett2012-02-181-2/+2
| | | | | | | | | This matches check_ntlm_password() and generate_session_info_pac() Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Sat Feb 18 02:19:35 CET 2012 on sn-devel-104
* s3-auth Hook checking passwords and generating session_info via the ↵Andrew Bartlett2012-02-171-1/+24
| | | | | | | | | | | | | | auth4_context This avoids creating a second auth_context, as it is a private pointer in the auth4_context that has already been passed in, and makes the gensec_ntlmssp code agnostic to the type of authentication backend behind it. This will in turn allow the ntlmssp server code to be further merged. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s3-auth Add const to make_user_info_mapAndrew Bartlett2012-02-081-2/+2
|
* s3-auth use gensec directly rather than via auth_generic_stateAndrew Bartlett2012-01-051-5/+1
| | | | | | | | | This is possible because the s3 gensec modules are started as normal gensec modules, so we do not need a wrapper any more. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s3-auth Add TALLOC_CTX * to auth_generic_prepare()Andrew Bartlett2012-01-051-1/+1
| | | | | | | | | This makes the long term owner of this memory more clear. So far only the clear cases have been moved from NULL however. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s3-auth: Remove protype for already-removed auth_ntlmssp_startAndrew Bartlett2011-12-281-1/+0
|
* s3-auth rename auth_ntlmssp_prepare() -> auth_generic_prepare()Andrew Bartlett2011-12-221-1/+1
| | | | | | | | | This function handles more than NTLMSSP now, at least when we are an AD DC and so changing the name may avoid some confusion in the future. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s3-auth rename auth_ntlmssp_state -> auth_generic_stateAndrew Bartlett2011-12-221-4/+4
| | | | | | | | | This structure handles more than NTLMSSP now, at least when we are an AD DC and so changing the name may avoid some confusion in the future. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s3-auth remove auth_ntlmssp_session_info()Andrew Bartlett2011-10-211-3/+0
| | | | | | | | Instead, call gensec_session_info() directly. Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s3-auth: remove dead prototype.Günther Deschner2011-10-171-1/+0
| | | | Guenther
* selftest: test plugin_s4_dc against all ncacn_np testsAndrew Bartlett2011-08-031-0/+2
| | | | | | | Changes to the s3 epmapper behaviour seem to have fixed the rest of these tests. Andrew Bartlett
* s3-auth rename auth_ntlmssp_steal_session_info()Andrew Bartlett2011-08-031-3/+3
| | | | | | | | There is no longer any theft of memory as the underlying routines now produce a new auth_session_info for this caller, allocating it on the supplied memory context. Andrew Bartlett
* s3-auth Add function to start any GENSEC mech by OIDAndrew Bartlett2011-08-031-3/+4
| | | | Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth set session_info->sanitized_username in create_local_token()Andrew Bartlett2011-08-031-0/+1
| | | | | | | | | | | Rather than passing this value around the callers, and eventually setting it in register_existing_vuid(), we simply pass it to create_local_token(). This also removes the need for auth_ntlmssp_get_username(). Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-ntlmssp Split auth_ntlmssp_start into two functionsAndrew Bartlett2011-08-031-1/+2
| | | | | | | | | This helps map on to the GENSEC semantics better, and ensures that the full set of desired features are set before the mechanism starts. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth Move map to guest to directly after the check_password callsAndrew Bartlett2011-08-031-0/+4
| | | | | | | | | This means we no longer need two different map to guest functions and have consistent logic with fewer layering violations. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth inline make_auth_session_info into only callerAndrew Bartlett2011-07-201-1/+0
|
* s3-auth Use the common auth_session_infoAndrew Bartlett2011-07-201-11/+11
| | | | | | | | | | | This patch finally has the same structure being used to describe the authorization data of a user across the whole codebase. This will allow of our session handling to be accomplished with common code. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth remove unused copy_serverinfoAndrew Bartlett2011-07-201-2/+0
| | | | Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth Use struct auth3_session_info outside the auth subsystemAndrew Bartlett2011-07-201-7/+9
| | | | | | | | | | | | | | | This seperation between the structure used inside the auth modules and in the wider codebase allows for a gradual migration from struct auth_serversupplied_info -> struct auth_session_info (from auth.idl) The idea here is that we keep a clear seperation between the structure before and after the local groups, local user lookup and the session key modifications have been processed, as the lack of this seperation has caused issues in the past. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth Add struct auth3_session_info to aid transition to auth_session infoAndrew Bartlett2011-07-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | This will allow a gradual conversion of the required elements from the current struct auth_serversupplied_info. This commit adds the structure definition and some helper functions to copy between the two structures. At this stage these structures and functions are IDENTICAL to the existing code, and so show the past history of that code. The plan is to slowly modify them over the course of the patch series, so that the changes being made a clear. By using a seperate structure to auth_serversupplied_info we can remove elements that are not needed after the authentication, and we can choose a layout that best reflects the needs of runtime users, rather than the internals of the authentication subsystem. By eventually using the auth_session_info from auth.idl, we will gain a single session authorization structure across the whole codebase, allowing more code to be shared, and a much more transparent process for forwarding authorization credentials over the named pipe proxy. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth Add const to indicate input elementsAndrew Bartlett2011-07-201-2/+2
| | | | Signed-off-by: Andrew Tridgell <tridge@samba.org>
* s3-auth: Pass the remote_address down to user_info.Andreas Schneider2011-07-041-2/+14
| | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* s3-auth: Added remote_address to ntlmssp server.Andreas Schneider2011-07-041-1/+2
| | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* s3:auth/proto.h: add _AUTH_PROTO_H_ guardMichael Adam2011-05-311-0/+5
|
* s3:auth/proto.h: add GPL/Copyright headerMichael Adam2011-05-311-0/+31
|
* s3-auth: Make server_info const in create_local_token()Andrew Bartlett2011-04-061-1/+1
| | | | | | | | | | | Andreas Schneider <asn@samba.org> correctly points out that this input parameter should now be const, and that found a bug where I used then used it incorrectly as a talloc context. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Wed Apr 6 00:33:31 CEST 2011 on sn-devel-104
* s3-auth use create_local_token() to transform server_info -> session_infoAndrew Bartlett2011-04-051-8/+12
| | | | | | | | | | | | | | | | | | Before a auth_serversupplied_info struct can be used for authorization, the local groups and privileges must be calculated. create_local_token() now copies the server_info, and then sets the calulated token and unix groups. Soon, it will also transform the result into an expanded struct auth_session_info. Until then, the variable name (server_info vs session_info provides a clue to the developer about what information has been entered in the structure). By moving the calls to create_local_token within the codebase, we remove duplication, and ensure that the session key (where modified) is consistently copied into the new structure. Andrew Bartlett
* s3-auth consolidate create_local_token() into make_server_info_krb5()Andrew Bartlett2011-04-041-2/+2
| | | | | | | This ensures that all callers don't need to each add builtin groups and privileges to the user's token Andrew Bartlett
* s3-prototyes: user_in_netgroup and user_in_list moved to auth, out of smbd.Günther Deschner2011-03-301-0/+2
| | | | Guenther
View Lorry Controller Status