samba.git/auth, branch talloc-2.1.14

build: Move --without-json-audit and json lib detection to lib/audit_logging

2018-06-25T21:01:20+00:00

This is the common location of the audit logging code now

Signed-off-by: Andrew Bartlett 
Reviewed-by: Ralph Boehme

auth: For NTLM and KDC authentication, log the authentication duration

2018-06-25T06:32:14+00:00

This is not a general purpose profiling solution, but these JSON logs are already being
generated and stored, so this is worth adding.

Some administrators are very keen to know how long authentication
takes, particularly due to long replication transactions in other
processes.

This complements a similar patch set to log the transaction duration.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Gary Lockyer

lib audit_logging: re-factor and add functions.

2018-06-01T06:28:26+00:00

Re-factor the common calls to json_dumps DEBUGC and audit_message_send
into a separate function.
Add functions to retrieve json object and json array elements

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

auth_log: Rename the json variables

2018-05-16T02:07:16+00:00

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

auth_log: tidy up code formatting

2018-05-16T02:07:16+00:00

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

auth_log: Use common code from audit_logging

2018-05-16T02:07:16+00:00

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

auth/ntlmssp: fix handling of GENSEC_FEATURE_LDAP_STYLE as a server

2018-05-16T01:26:03+00:00

This fixes "NTLMSSP NTLM2 packet check failed due to invalid signature!"
error messages, which were generated if the client only sends
NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL on an LDAP
connection.

This fixes a regession in the combination of commits
77adac8c3cd2f7419894d18db735782c9646a202 and
3a0b835408a6efa339e8b34333906bfe3aacd6e3.

We need to evaluate GENSEC_FEATURE_LDAP_STYLE at the end
of the authentication (as a server, while we already
do so at the beginning as a client).

As a reminder I introduced GENSEC_FEATURE_LDAP_STYLE
(as an internal flag) in order to let us work as a
Windows using NTLMSSP for LDAP. Even if only signing is
negotiated during the authentication the following PDUs
will still be encrypted if NTLMSSP is used. This is exactly the
same as if the client would have negotiated NTLMSSP_NEGOTIATE_SEAL.
I guess it's a bug in Windows, but we have to reimplement that
bug. Note this only applies to NTLMSSP and only to LDAP!
Signing only works fine for LDAP with Kerberos
or DCERPC and NTLMSSP.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Wed May 16 03:26:03 CEST 2018 on sn-devel-144

auth/ntlmssp: add ntlmssp_client:ldap_style_send_seal option

2018-05-15T22:13:19+00:00

This will be used to similate a Windows client only
using NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL
on an LDAP connection, which is indicated internally by
GENSEC_FEATURE_LDAP_STYLE.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

build: Make --with-json-audit the default

2018-05-15T01:36:08+00:00

Thanks to Rowland for a clear description of the behaviour for the smb.conf manpage.

This means that those not wanting to link to libarchive will just need to
build --without-json-audit.

In general, we prefer that optional libraries be required by default
so that they are not accidentially missed, particularly in packages.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher 
Reviewed-by: Gary Lockyer

auth/credentials/test: py2/py3 compat always decode result of b64encode

2018-05-12T22:24:35+00:00

Signed-off-by: Noel Power 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Sun May 13 00:24:35 CEST 2018 on sn-devel-144