summaryrefslogtreecommitdiff
path: root/source4/auth
Commit message (Collapse)AuthorAgeFilesLines
* s4:auth_sam: allow logons with an empty domain nameStefan Metzmacher2018-02-271-6/+10
| | | | | | | | | | | | | | It turns out that an empty domain name maps to the local SAM. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13206 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Feb 23 04:08:26 CET 2018 on sn-devel-144 (cherry picked from commit 57762229da971e837b923f09ca01bad6151f9419)
* s4/auth_winbind: ask for validation level 6Stefan Metzmacher2018-02-111-1/+1
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13260 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit e1ba81996033e7c2cfeba13124ee7f404ded2031)
* s4:auth_winbind: remove unused 'winbind_wbclient' backendStefan Metzmacher2017-12-131-108/+0
| | | | | | | | | | This is no longer useful as it doesn't support async requests. It could be readded using pthreadpool_tevent_job_send() and wbcCtxAuthenticateUserEx() if required. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth_winbind: remove unused 'winbind_rodc' backendStefan Metzmacher2017-12-131-55/+0
| | | | | | | | This is no longer useful as the 'winbind' backend also handles the rodc case now. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth_sam: remove unused 'sam_failtrusts' backendStefan Metzmacher2017-12-131-96/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth/ntlm: remove lpcfg_auth_methods() handlingStefan Metzmacher2017-12-131-33/+7
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth/ntlmssp: add support for using "winbind" as DCStefan Metzmacher2017-08-071-16/+1
| | | | | | | This adds support for trusted domains to the auth stack on AD DCs. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:auth: use "sam winbind" for the netlogon serverStefan Metzmacher2017-08-071-7/+4
| | | | | | | | This adds authentication support for trusted domains to the netlogon server. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:auth/ntlm: provide auth_check_password_wrapper_send/recv to auth4_contextStefan Metzmacher2017-08-071-11/+72
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:auth_winbind: implement async authentication via IRPCStefan Metzmacher2017-08-071-41/+137
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* debug: new debug class for kerberosAndrew Bartlett2017-06-301-1/+1
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s4:auth/ntlm: allow auth_operations to specify check_password_send/recv()Stefan Metzmacher2017-06-272-1/+60
| | | | | | | | | | This prepares real async handling in the backends. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Jun 27 21:09:08 CEST 2017 on sn-devel-144
* s4:auth/ntlm: introduce auth_check_password_next()Stefan Metzmacher2017-06-271-54/+44
| | | | | | | | | This prepares real async handling in the backends. Check with git show -w. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:auth/ntlm: move auth_check_password_wrapper() further downStefan Metzmacher2017-06-271-37/+37
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:auth_winbind: rename 's' to 'state' in winbind_check_password()Stefan Metzmacher2017-06-271-19/+19
| | | | | | | | | This prepares the conversion to winbind_check_password_send/recv() where the internal state is called 'winbind_check_password_state' as 'state'. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:auth_winbind: remove a block nesting level and fix indentationRalph Boehme2017-06-271-27/+27
| | | | | | | | The previous commit removed the condition from the block. No change in behaviour, best viewed with git show -w. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:auth_winbind: fix error checking in winbind_check_password()Stefan Metzmacher2017-06-271-4/+6
| | | | | | | | We need to handle every error instead of just NT_STATUS_NO_SUCH_USER, the callers also doesn't require NT_STATUS_NOT_IMPLEMENTED anymore. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4:dsdb/samdb: pass an existing 'struct ldb_context' to ↵Stefan Metzmacher2017-06-261-2/+2
| | | | | | | | | | | crack_auto_name_to_nt4_name() There's no point in creating a temporary ldb_context as the only callers already have a valid struct ldb_context for the local sam. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/samdb: pass an existing 'struct ldb_context' to crack_name_to_nt4_name()Stefan Metzmacher2017-06-262-4/+2
| | | | | | | | | There's no point in creating a temporary ldb_context as all direct callers already have a valid struct ldb_context for the local sam. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth/unix_token: remove unused tevent_context from ↵Stefan Metzmacher2017-06-262-5/+4
| | | | | | | auth_session_info_fill_unix() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth/unix_token: remove unused tevent_context from ↵Stefan Metzmacher2017-06-261-2/+1
| | | | | | | security_token_to_unix_token() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec_gssapi: fix CID 1409781: Possible Control flow issues (DEADCODE)Stefan Metzmacher2017-06-161-1/+4
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:auth: make authenticate_ldap_simple_bind*() use auth_check_password_send/recvStefan Metzmacher2017-06-151-82/+77
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth: add authenticate_ldap_simple_bind_send/recvStefan Metzmacher2017-06-152-0/+72
| | | | | | | TODO: we need to make the backend async. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth/gensec: let GENSEC_FEATURE_SESSION_KEY result in GSS_C_INTEG_FLAGStefan Metzmacher2017-06-151-0/+3
| | | | | | | | | | | | | | | | This is important to allow the 'new_spnego' with mech_list protection to work for a SMB session setup. This is not strictly needed as we always announce GENSEC_FEATURE_SESSION_KEY in gensec_gssapi_have_feature(), but it's better to send GSS_C_INTEG_FLAG over the wire. This may prevent a ticket from a Samba client to an SMB server (particularly a DC) being misused to connect to the LDAP server on that DC, as the LDAP server will require GSSAPI signing of the connection. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth: use talloc_reparent() in samba_server_gensec_krb5_start()Stefan Metzmacher2017-05-301-1/+1
| | | | | | | | | | This matches logic of samba_server_gensec_start() and avoids warnings like this: WARNING: talloc_steal with references at ../source4/auth/samba_server_gensec.c:150 reference at ../auth/gensec/gensec_start.c:586 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* netlogon: Implement SendToSam along with its winbind forwardingGarming Sam2017-05-303-6/+81
| | | | | | | | | | | This allows you to forward bad password count resets to 0. Currently, there is a missing access check for the RODC to ensure it only applies to cached users (msDS-Allowed-Password-Replication-Group). (further patches still need to address forcing a RWDC contact) Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth_sam: Make auth_sam_trigger_repl_secret more genericGarming Sam2017-05-301-5/+10
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* rodc: Set non-authoritative for RODC bad passwordsGarming Sam2017-05-301-1/+5
| | | | | | | | This requires as a pre-requisite that the auth stack is not run twice. We remove the knownfail introduced in the earlier patch. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth_winbind: Allow badPwdCount to be set to 0 with this auth methodGarming Sam2017-05-303-29/+68
| | | | | | | | | We rely on the other SAM modules to increment the badPwdCount locally, but we must reset to 0 if the remote sends a success (to override our failure). Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth4: Add authoritative flag to check_passwordGarming Sam2017-05-307-15/+32
| | | | | Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth: add samba_server_gensec_krb5_start()Stefan Metzmacher2017-05-212-0/+52
| | | | | | | | | This will be used by the dns services to only allow spnego/krb5. This makes sure the accepting backend doesn't require any RPC or IPC communication for now. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth: split out a samba_server_gensec_start_settings() helper functionStefan Metzmacher2017-05-211-2/+32
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec_krb5: add simple gensec_krb5_update_send/recv() wrapper functionsStefan Metzmacher2017-05-211-17/+69
| | | | | | | TODO: we still need to make the internal async. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec_gssapi: add simple gensec_gssapi_update_send/recv() wrapper functionsStefan Metzmacher2017-05-211-19/+71
| | | | | | | TODO: we still need to make the internal async. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec_gssapi: always announce GENSEC_FEATURE_SIGN_PKT_HEADERStefan Metzmacher2017-05-211-9/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* gensec: Add a TALLOC_CTX * to gensec_register().Jeremy Allison2017-05-132-5/+5
| | | | | | | | Pass in the TALLOC_CTX * from the module init to remove another talloc_autofree_context() use. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
* s4: auth: Remove a talloc_autofree_context() use.Jeremy Allison2017-05-111-1/+6
| | | | | | | | | Use NULL here, not the autofree context for this static pointer. The destructor prevents freeing this memory anyway. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4: auth: Add TALLOC_CTX * to auth_register()Jeremy Allison2017-05-117-12/+13
| | | | | | | | Use the talloc context passed into all modules. Remove one more talloc_autofree_context(). Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4-auth: remove some dead prototypesGünther Deschner2017-05-101-7/+0
| | | | | | | Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* lib: modules: Change XXX_init interface from XXX_init(void) to ↵Jeremy Allison2017-04-2210-18/+18
| | | | | | | | | | | | | | | | | | | | XXX_init(TALLOC_CTX *) Not currently used - no logic changes inside. This will make it possible to pass down a long-lived talloc context from the loading function for modules to use instead of having them internally all use talloc_autofree_context() which is a hidden global. Updated all known module interface numbers, and added a WHATSNEW. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144
* password-lockout: Allow RODC to ensure lockout and lockout resetGarming Sam2017-04-131-13/+66
| | | | | | | Prior to this, the modification of lockoutTime triggered referrals. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* sam.c: Make NTLM login set logonCount when unsetGarming Sam2017-04-131-0/+10
| | | | | | | | Previously, it only bothered if it was being incremented. Now on first logon, it should turn the unset logonCount to 0. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth4: use "sam winbind_rodc sam_failtrusts" for the netlogon authenticationStefan Metzmacher2017-04-101-1/+34
| | | | | | | | | | | We should not do anonymous authentication nor a fallback that ignores the domain part. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12710 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth4: remove unused map_user_info[_cracknames]()Stefan Metzmacher2017-04-101-259/+0
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12709 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth4: avoid map_user_info() in auth_check_password_send()Stefan Metzmacher2017-04-101-10/+25
| | | | | | | | | | | | | | | | The cracknames call is done in the "sam" backend now. In order to support trusted domains correctly, the backends need to get the raw values from the client. This is the important change in order to no longer silently map users from trusted domains to local users. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12709 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth4: improve authsam_want_check for upn authenticationStefan Metzmacher2017-04-101-20/+103
| | | | | | | | | | | | | We need to check if the upn suffix is within our forest. The check if it's within our domain is done in authsam_check_password_internals() after calling crack_name_to_nt4_name(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12709 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth4: let authsam_check_password_internals use crack_name_to_nt4_name() for ↵Stefan Metzmacher2017-04-101-0/+38
| | | | | | | | | | | | | upn's Currently the caller does this before calling the auth backends, but that should change in order to support trusted domains correctly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12709 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth4: use "anonymous sam winbind sam_ignoredomain" with ROLE_DOMAIN_MEMBERStefan Metzmacher2017-04-101-1/+1
| | | | | | | | | | | We hopefully remove this role in future, but for now we should do this correct and fallback to sam_ignoredomain at the end of the auth chain. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12709 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth4: use "anonymous sam winbind_rodc sam_failtrusts sam_ignoredomain" as AD_DCStefan Metzmacher2017-04-101-1/+14
| | | | | | | | | | | | It's better to consistently fail authentications for users of trusted domains (on a RWDC) with NT_STATUS_NO_TRUST_LSA_SECRET, instead of silently mapping them to local users, by accident. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12709 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status