samba.git/lib/param/param_table.c, branch talloc-2.4.4

docs-xml/smbdotconf: add "client use krb5 netlogon" option

2025-01-13T23:40:30+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jennifer Sutton

param: Add "client netlogon ping protocol"

2024-11-11T14:03:04+00:00

Allow "net ads join" in environments where UDP/389 is blocked. Code
will follow.

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher

smbdotconf: add client ldap sasl wrapping = {starttls,ldaps}

2024-04-23T23:50:34+00:00

In order to use SASL authentitation within a TLS connection
we now provide "client ldap sasl wrapping = starttls" or
"client ldap sasl wrapping = ldaps".

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:ldap_server: add support for tls channel bindings

2024-04-23T23:50:34+00:00

ldap server require strong auth = allow_sasl_over_tls
is now an alias for 'allow_sasl_without_tls_channel_bindings'
and should be avoided and changed to 'yes' or
'allow_sasl_without_tls_channel_bindings'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

docs-xml: Add new parameter "acl claims evaluation"

2023-09-26T23:45:35+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall

docs-xml/smbdotconf: also allow 2012[_R2] for 'ad dc functional level'

2023-06-21T19:08:37+00:00

We may not jump to 2016 directly...

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

param: Add new parameter "ad dc functional level"

2023-05-16T23:29:32+00:00

This allows the new unsupported functional levels to be unlocked, but with an smb.conf
option that is easily seen.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

lib/util: Add "debug syslog format = always", which logs to stdout in syslog style

2023-04-06T12:51:30+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

s3-librpc: add ads.idl and convert ads_struct to talloc.

2022-12-16T20:38:32+00:00

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Jeremy Allison

dsdb: Allow password history and password changes without an NT hash

2022-06-26T22:10:29+00:00

We now allow this to be via the ENCTYPE_AES256_CTS_HMAC_SHA1_96 hash instead
which allows us to decouple Samba from the unsalted NT hash for
organisations that are willing to take this step (for user accounts).

(History checking is limited to the last three passwords only, as
ntPwdHistory is limited to NT hash values, and the PrimaryKerberosCtr4
package only stores three sets of keys.)

Since we don't store a salt per-key, but only a single salt, the check
will fail for a previous password if the account was renamed prior to a
newer password being set.

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Andrew Bartlett 
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Stefan Metzmacher