samba.git/auth, branch master

auth: Check return of talloc_strdup() for NULL

2026-03-31T09:18:43+00:00

Signed-off-by: Pavel Filipenský 
Reviewed-by: Andreas Schneider 

Autobuild-User(master): Pavel Filipensky 
Autobuild-Date(master): Tue Mar 31 09:18:43 UTC 2026 on atb-devel-224

auth: Call talloc_keep_secret() for sensitive memory

2026-03-31T08:15:33+00:00

Signed-off-by: Pavel Filipenský 
Reviewed-by: Andreas Schneider

auth: Call ZERO_ARRAY()/ZERO_STRUCT() for sensitive variables on stack

2026-03-31T08:15:33+00:00

Signed-off-by: Pavel Filipenský 
Reviewed-by: Andreas Schneider

auth: Remove talloc_set_name_const() if talloc_keep_secret() changes the talloc name

2026-03-25T21:16:35+00:00

Signed-off-by: Pavel Filipenský 

Autobuild-User(timing): Pavel Filipensky 
Autobuild-Date(timing): Wed Mar 25 21:16:35 UTC 2026 on atb-devel-224

auth/credentials: Add talloc_keep_secret() to zero out old_password

2026-03-25T20:10:37+00:00

Signed-off-by: Pavel Filipenský

auth/credentials: Check talloc_strdup() for NULL

2026-03-25T20:10:37+00:00

Return false if talloc_strdup() fails.

Signed-off-by: Pavel Filipenský

auth/credentials: Fix regression with --use-kerberos=desired for smbclient

2026-02-17T15:03:39+00:00

As part of the gse_krb5 processing the following call chain

gensec_gse_client_start()
  ---> gensec_kerberos_possible()
         ---> cli_credentials_authentication_requested()

gensec_kerberos_possible()  will always fail when
cli_credentials_get_kerberos_state() returns CRED_USE_KERBEROS_DESIRED

It seems since use kerberos == desired is the default that it isn't
necessary to see if credentials were modified to indicated authentication
was requested. gensec_kerberos_possible() should afaics return true
if kerberos is desired OR required (regardless of whether credentials
were requested)

This commit removes the knownfail associated with this bug.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15789
Signed-off-by: 
Reviewed-by: Andreas Schneider

auth: Align integer types

2026-02-15T10:42:34+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

auth: Avoid a DEBUGADD in kerberos_decode_pac()

2026-02-15T10:42:34+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

auth: Refactor check_pac_checksum to improve readability

2026-02-15T10:42:34+00:00

Use ARRAY_SIZE over terminating array element. Easier to read for me.

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S