summaryrefslogtreecommitdiff
path: root/source3/libads
Commit message (Collapse)AuthorAgeFilesLines
* s3:ldap: Fix join with don't exists machine accountEvgeny Sinelnikov2019-09-111-2/+3
| | | | | | | | | | | | | | | | | Add check for requested replies of existing machine object during join machine to domain. This solves regression fail during join with error: "None of the information to be translated has been translated." https://bugzilla.samba.org/show_bug.cgi?id=14007 Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Wed Sep 4 17:02:37 UTC 2019 on sn-devel-184 (cherry picked from commit ad4ef1657e9b2a088a3bfadcce196cfcceead1dc)
* s3:ldap: Leave add machine code early for pre-existing accountsGuenther Deschner2019-04-091-1/+9
| | | | | | | | | | | | | | This avoids numerous LDAP constraint violation errors when we try to re-precreate an already existing machine account. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13861 Pair-Programmed-With: Andreas Schneider <asn@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 2044ca0e20bd3180720a82506b3af041d14b5c68)
* s3:libads: Make sure we can lookup KDCs which are not configuredAndreas Schneider2019-04-091-2/+10
| | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13861 Pair-Programmed-With: Guenther Deschner <gd@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit c016afc832543514ebf7ecda1fbe6b272ea533d6)
* s3:libads: Print more information when LDAP failsAndreas Schneider2019-04-091-2/+10
| | | | | | | | | | | | Currently we just get an error but don't know what exactly we tried to do in 'net ads join -d10'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13861 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 40669e3739eb5cde135c371e2c8134d3f11a16a5)
* s3:libads: Free addr before we free the contextAndreas Schneider2018-08-231-1/+1
| | | | | | | | | | | | | | | | Introduced by dbdbd4875ecac3e7334750f46f1f494b7afe6628 CID 1438395 BUG: https://bugzilla.samba.org/show_bug.cgi?id=13567 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Aug 14 22:02:06 CEST 2018 on sn-devel-144 (cherry picked from commit 9eccf6a16f5b198181a4fa80b835b1a65b40ed76)
* s3:libads: Fix memory leaks in ads_krb5_chg_password()Andreas Schneider2018-08-231-0/+2
| | | | | | | | | | | | Found by covscan. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13567 Pair-Programmed-With: Justin Stephenson <jstephen@redhat.com> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Justin Stephenson <jstephen@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit dbdbd4875ecac3e7334750f46f1f494b7afe6628)
* Fix some incorrect debug messages that look to be copy-paste issues.Richard Sharpe2018-05-031-3/+3
| | | | | | | | Signed-off-by: Richard Sharpe <realrichardsharpe@gmail.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu May 3 08:16:26 CEST 2018 on sn-devel-144
* libsmb: Give namequery.c its own headerVolker Lendecke2018-04-112-0/+2
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libads: Fix CID 1349423 Resource leakVolker Lendecke2018-03-291-1/+2
| | | | | | | | | | get_sorted_dc_list should already take care, but this way it's safer Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Mar 29 03:45:00 CEST 2018 on sn-devel-144
* libads: Fix 1433611 Resource leakVolker Lendecke2018-03-291-0/+1
| | | | | | | Not really a memleak due to the passed-in talloc ctx, but this way it's cleaner Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* libads: Fix CID 1433606 Dereference before null checkVolker Lendecke2018-03-291-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s3:libads: Fix size types in kerberos functionsAndreas Schneider2018-03-201-5/+5
| | | | | | | This fixes compilation with -Wstrict-overflow=2 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s3:libads: 'net ads keytab create' shouldn't write SPN(s)Noel Power2018-03-021-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | Modify default behaviour of 'net ads keytab create' The change modifies the behaviour of 'net ads keytab create' such that only the keytab file is modified. The current behaviour doesn't make sense, existing SPN(s) pulled from the computer AD object have the format 'serviceclass/host:port/servicename'. 'ads_keytab_create_default' calls ads_keytab_add_entry passing 'serviceclass' for each SPN retrieved from the AD. For each serviceclass passed in a new pair of SPN(s) is generated as follows i) long form 'param/full_qualified_dns' ii) short form 'param/netbios_name' This doesn't make sense as we are creating a new SPN(s) from an existing one probably replacing the existing host with the 'client' machine. If the keytab file exists then additionally each kerberos principal in the keytab file is parsed to strip out the primary, then 'ads_keytab_add_entry' is called which then tries by default to generate a SPN from any primary that doesn't end in '$'. By default those SPNs are then added to the AD computer account for the client running the command. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: add param to prevent writing spn(s) to adsNoel Power2018-03-022-8/+9
| | | | | | | | | | | | | | | 'net ads keytab add' currently in addition to adding to the keytab file this command also can update AD computer objects via ldap. This behaviour isn't very intuitive or expected given the command name. By default we shouldn't write to the ADS. Prepare to change the default behaviour by modifying the function 'ads_keytab_add_entry' to take a paramater to modify the existing behaviour to optionally update the AD (or not). Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: Allow 'net ads keytab add' handle Windows SPN(s) part 2Noel Power2018-03-021-9/+25
| | | | | | | | | | | | | | | | | | This patch addresses how the windows SPN is written to the AD. If a legacy service (e.g. cifs, http etc.) is passed as param to 'net ads keytab add param' then windows SPNs are generated from 'param' as follows i) long form 'param/full_qualified_dns' ii) short form 'param/netbios_name' If the SPN is a is a Windows SPN (e.g. conforming to format 'serviceclass/host:port') then this is the SPN that is passed to the AD. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: Allow 'net ads keytab add' handle Windows SPN(s) part 1Noel Power2018-03-021-10/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch addresses how the windows SPN is converted into a kerberos priniciple to be written to the keytab file. A followup patch will deal with writing Window SPN(s) to the AD. Before this change 'net ads keytab add' handled three scenarios a) 'net ads keytab add param' is passed a fully qualified kerberos principal (identified by the presence of '@' in param) In this scenario the keytab file alone is updated with the principal contained in 'param'. b) 'net ads keytab add param'; is passed a machine name (identified by the paramater ending with '$'). In this case the machine name is converted to a kerberos principal with according to the recipe 'param@realm' where realm is determined by lp_realm(). c) 'net ads keytab add param' is passed a service (e.g. nfs, http etc.) In this scenario the param containing the service is first converted to into 2 kerberos principals (long and short forms) according to the following recipe i) long form: 'param/fully_qualified_dns@realm' ii) short form: 'param/netbios_name@realm' where 'fully_qualified_dns is retrieved from 'dNSHostName' attribute of 'this' machines computer account on the AD. The principals are written to the keytab file Secondly 2 windows SPNs are generated from 'param' as follows i) long form 'param/full_qualified_dns' ii) short form 'param/netbios_name' These SPNs are written to the AD computer account object After this change a) & b) & c) will retain legacy behaviour except in the case of c) where if the 'param' passed to c) is a Windows SPN (e.g. conforming to format 'serviceclass/host:port' i) 'param' will get converted to a kerberos principal (just a single one) with the following recipe: 'serviceclass/host@realm' which will be written to the keytab file. The SPN written to the AD is created as before and the legacy behaviour is preserved. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:utils: add new 'net ads setspn delete' subcommandNoel Power2018-03-022-0/+100
| | | | | | | | | | | | | | | | | This patch adds 'delete' to the 'net ads setspn' subcommand (see https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731241(v=ws.11) Usage: net ads setspn delete <computer> <SPN> Note: <computer> is optional, if not specified the computer account associated with value returned by lp_netbios_name() is used instead. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:utils: add new 'net ads setspn add' subcommandNoel Power2018-03-022-1/+80
| | | | | | | | | | | | | | | | | This patch adds 'add' to the 'net ads setspn' subcommand (see https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731241(v=ws.11) Usage: net ads setspn add <computer> <SPN> Note: <computer> is optional, if not specified the computer account associated with value returned by lp_netbios_name() is used instead. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:utils: add new 'net ads setspn list' subcommandNoel Power2018-03-022-0/+57
| | | | | | | | | | | | | | | | | | | | This patch adds basic functionality not unlike the setspn.exe command that is provided by windows for adminsistering SPN on the AD. (see https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731241(v=ws.11) Only the basic list operation (that corresponds to the -l switch for setspn.exe is implemented) Usage: net ads setspn list <computer> Note: <computer> is optional, if not specified the computer account associated with value returned by lp_netbios_name() is used instead. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: change ads_add_service_principal_name implementationNoel Power2018-03-023-49/+98
| | | | | | | | | | | | | | | | | Previously the function 'ads_add_service_principal_name' created the SPNs based on the machine_name and dns name passed to the function. In order to prepare for a future patch that will also need to write SPN(s) to the AD computer account, the function implementation will need to be changed. Instead of the function creating the SPN(s) it will now take the list SPN(s) to write to the AD 'machine_name' account as an input param instead. The name of the function has been changed to 'ads_add_service_principal_names' to reflect this. Additionally client code now needs to construct the SPNs to be passed into the function. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: Add a basic Windows SPN parser.Noel Power2018-03-022-0/+113
| | | | | | | | (see https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx) Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: Clean up code a little rename 'ads_get_samaccountname()'Noel Power2018-03-023-12/+22
| | | | | | | | | | | | | | Function 'ads_get_samaccountname()' basically returns the machine_name passed as an input param (appended with '$') if it exists on the ad. The function really is testing for the existence of the samaccountname and is not really 'getting' it. This is also the way it is used. Renaming this function to 'ads_has_samaccountname()' better reflects what it is actually doing and how clients calling the code use it. It also makes the client code using calling this function less confusing. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: ads_get_dnshostname & ads_get_samaccountname don't use paramNoel Power2018-03-021-2/+2
| | | | | | | | | | Both ads_get_dnshostname() & ads_get_samaccountname() are passed a param machinename as a argument. Instead of using 'machinename' these functions are erroneously using lp_netbiosname() instead. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* libads: Fix the build --without-adsVolker Lendecke2018-02-061-0/+4
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org> Autobuild-User(master): David Disseldorp <ddiss@samba.org> Autobuild-Date(master): Tue Feb 6 02:47:44 CET 2018 on sn-devel-144
* s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't ↵Jeremy Allison2018-01-261-0/+9
| | | | | | | | | | | | | | | own it here. Thanks to Isaac Boukris <iboukris@gmail.com> for finding the issue and testing this fix. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13244 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Jan 26 02:25:20 CET 2018 on sn-devel-144
* s3:libads: net ads keytab list fails with "Key table name malformed"Noel Power2017-11-291-1/+5
| | | | | | | | | | | When keytab_name is NULL don't call smb_krb5_kt_open use ads_keytab_open instead, this function will determine the correct keytab to use. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13166 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3:libads: Fix changing passwords with KerberosAndreas Schneider2017-08-111-1/+1
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12956 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
* s3:libads: make use of secrets_*_password_change() in ↵Stefan Metzmacher2017-06-271-16/+90
| | | | | | | | | ads_change_trust_account_password() BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:secrets: move kerberos_secrets_*salt related functions to ↵Stefan Metzmacher2017-06-272-100/+0
| | | | | | | | | | | | machine_account_secrets.c These don't use any krb5_context related functions and they just work on secrets.tdb, so they really belong to machine_account_secrets.c. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: remove unused kerberos_fetch_salt_princ_for_host_princ()Stefan Metzmacher2017-06-272-10/+0
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: make use of kerberos_secrets_fetch_salt_princ() in ↵Stefan Metzmacher2017-06-271-6/+8
| | | | | | | | | ads_keytab_add_entry() BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: provide a simpler kerberos_fetch_salt_princ() functionStefan Metzmacher2017-06-272-3/+9
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: remove kerberos_secrets_fetch_salting_principal() fallbackStefan Metzmacher2017-06-271-33/+4
| | | | | | | | | | | | | | | | | | The handling for per encryption type salts was removed in Samba 3.0.23a (Jul 21, 2006). It's very unlikely that someone has such an installation that got constantly upgraded over 10 years with an automatic password change nor rejoin. It also means that the KDC only has salt-less arcfour-hmac-md5 key together with the salted des keys. So there would only be a problem if the client whould try to use a des key to contact the smb server. Having this legacy code adds quite some complexity for no good reason. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s3:libads: remove unused kerberos_secrets_store_salting_principal()Stefan Metzmacher2017-06-272-75/+0
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* libads: Decide to have no fallback optionGarming Sam2017-05-301-0/+5
| | | | | | | | | | Before this change, it would always possibly choose another server at random despite later using the original principal when it got back to the connection initialization in the the winbind connection manager. This caused bizarre authentication failures. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libads: Check cldap flags in libads/ldapGarming Sam2017-05-303-1/+52
| | | | | | | | Pass down request flags and check they are respected with the response flags. Otherwise, error out and pretend the connection never happened. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libads: abstract out SASL wrapping codeAlexander Bokovoy2017-05-175-180/+207
| | | | | | | | | | | | | | Prepare for rebasing libads on top of libsmbldap. To make libads using 'struct smbldap_state' instead of direct LDAP structure, we need to abstract out libads logic from connection handling. SASL wrapping does not really depend on availability of LDAP handle and does not need direct access to ADS_STRUCT. As result, we'll be able to move SASL wrapping code under smbldap once the latter is able to pass settings that libads passes to the SASL wrapping. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* auth: Add logging of service authorizationAndrew Bartlett2017-03-291-0/+3
| | | | | | | | In ntlm_auth.c and authdata.c, the session info will be incomplete Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
* s3:libads: Remove obsolete smb_krb5_get_ntstatus_from_init_creds()Andreas Schneider2017-03-221-169/+0
| | | | | | | | | | | There is no way we can get a better error code out of this. The original function called was krb5_get_init_creds_opt_get_error() which has been deprecated in 2008. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12708 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org>
* s3:libads: Correctly handle the keytab kerberos methodsAndreas Schneider2017-03-141-12/+57
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org>
* Correct "ommited" typos.Chris Lamb2017-03-131-1/+1
| | | | | | | Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* libads: convert to use smb_gss_krb5_import_credAlexander Bokovoy2017-03-081-1/+1
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611 Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s3-libads: Do not leak the msg on errorAndreas Schneider2017-03-081-3/+5
| | | | | | | | | | | | ldap_search_ext_s manpage states: Note that res parameter of ldap_search_ext_s should be freed with ldap_msgfree() regardless of return value of these functions. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Wed Mar 8 14:59:35 CET 2017 on sn-devel-144
* s3:libads: remove unused fallback to gss_acquire_cred()Stefan Metzmacher2017-03-061-27/+0
| | | | | | | | | | | Heimdal and all supported versions of MIT krb5 prove gss_krb5_import_cred(), so we don't need an #ifdef here. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Mon Mar 6 11:44:54 CET 2017 on sn-devel-144
* s3:libads: add more debugging to ads_sasl_spnego_bind()Stefan Metzmacher2017-02-241-1/+25
| | | | | | | | | Any fallbacks to other authentication methods should be logged. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* Correct "occured" typos.Chris Lamb2017-02-221-1/+1
| | | | | | Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s3:libads: use trust_pw_new_value() for krb5 machine passwordsStefan Metzmacher2017-02-211-3/+6
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=12262 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* libads: Use "all_zero" where appropriateVolker Lendecke2017-01-031-24/+6
| | | | | | | ... Saves a few bytes of footprint Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s3:libads: Include system /etc/krb5.conf if we use MIT KerberosAndreas Schneider2016-12-021-6/+19
| | | | | | | | | | | | | | The system /etc/krb5.conf defines some defaults like: default_ccache_name = KEYRING:persistent:%{uid} We need to respect that so should include it in our own created krb5.conf file. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12441 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
* s3-libads: Fix canonicalization support with MIT KerberosAndreas Schneider2016-12-021-1/+12
| | | | | | | | | | | | This allows to authenticate using user@DOMAIN against an AD DC. https://bugzilla.samba.org/show_bug.cgi?id=12457 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Dec 2 00:23:02 CET 2016 on sn-devel-144
View Lorry Controller Status