samba.git/lib/param, branch master Unnamed repository; edit this file 'description' to name the repository. lib: Remove the "getwd cache" 2026-03-01T20:19:35+00:00 Volker Lendecke vl@samba.org 2026-02-16T16:40:55+00:00 5368789646793730f97b3759810c2f7a3510a95f No longer needed Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> 
No longer needed

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
loadparm: add "kdc require canonicalization" 2026-01-15T01:48:37+00:00 Douglas Bagnall douglas.bagnall@catalyst.net.nz 2025-11-26T03:48:35+00:00 d803e2055b168b1c807325b0da54d3bbf6e5570a Has no effect yet. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> 
Has no effect yet.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
loadparm: Add ‘krb5 acceptor report canonical client name’ option 2026-01-15T01:48:37+00:00 Jennifer Sutton jennifersutton@catalyst.net.nz 2026-01-06T21:21:17+00:00 b9692a8bf0d036ab8bb7e5b1a8660d16980fc147 It is enabled by default, and does nothing as of yet. Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> 
It is enabled by default, and does nothing as of yet.

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
loadparm: add "kdc name match implicit dollar without canonicalization" 2025-11-20T21:25:39+00:00 Douglas Bagnall douglas.bagnall@catalyst.net.nz 2025-11-12T03:29:13+00:00 1db071e7e21bc67c0e77dae478d333228bac153a This does nothing yet. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> 
This does nothing yet.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
config: add kdc always include pac 2025-11-13T22:09:33+00:00 Gary Lockyer gary@catalyst.net.nz 2025-10-20T00:01:14+00:00 87cdaf088debe9321e52a5dff6c5e7bd9882b76d This option over-rides the PA-PAC-REQUEST received from the client. When enabled (the default) a PAC will always be included in the response. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> 
This option over-rides the PA-PAC-REQUEST received from the client.  When
enabled (the default) a PAC will always be included in the response.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
lib: Simplify num_parameters() with ARRAY_SIZE() 2025-11-10T13:29:30+00:00 Volker Lendecke vl@samba.org 2025-10-29T12:39:38+00:00 fb2058c9ccd615e22cfad00840d2097dee6b803c Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> 
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
smbd: Fix a few possible buffer read overruns 2025-11-10T13:29:30+00:00 Volker Lendecke vl@samba.org 2025-09-13T07:11:39+00:00 fd049cd50aed17759570e312970a2ef60059f32c ... only happens with invalid smb.conf settings.... Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org> 
... only happens with invalid smb.conf settings....

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Remove previous himmelblau integration attempt 2025-11-04T09:09:40+00:00 David Mulder dmulder@samba.org 2025-08-28T19:09:36+00:00 d01fed8aa57d90ff133324b0a89cfaf228be8bab This was a project attempting to integrate Himmelblau into Samba, but it has been abandoned. Signed-off-by: David Mulder <dmulder@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): David Mulder <dmulder@samba.org> Autobuild-Date(master): Tue Nov 4 09:09:40 UTC 2025 on atb-devel-224 
This was a project attempting to integrate
Himmelblau into Samba, but it has been
abandoned.

Signed-off-by: David Mulder <dmulder@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): David Mulder <dmulder@samba.org>
Autobuild-Date(master): Tue Nov  4 09:09:40 UTC 2025 on atb-devel-224
config: add certificate backdating compensation 2025-10-10T01:27:31+00:00 Gary Lockyer gary@catalyst.net.nz 2025-08-28T23:05:10+00:00 c45247815af1a5817f1d34255aeb75e75cec82bd When preforming certificate based kerberos authentication (PKINIT) with "strong certificate binding enforcement = compatibility"", for WEAK mappings the certificate issue date must be after the date the user record was created. This parameter relaxes that constraint by allowing the certificate to have been issued up to the specified number of minutes before the user record was created. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> 
When preforming certificate based kerberos authentication (PKINIT) with
"strong certificate binding enforcement = compatibility"", for WEAK mappings
the certificate issue date must be after the date the user record was created.

This parameter relaxes that constraint by allowing the certificate to have been
issued up to the specified number of minutes before the user record was created.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
config: add strong certificate binding enforcement 2025-10-10T01:27:31+00:00 Gary Lockyer gary@catalyst.net.nz 2025-08-28T01:07:01+00:00 470ccdb340e716b8baa69049997a0d8b2432dffa This parameter controls the enforcement of Windows Certificate bindings as outlined in "KB5014754: Certificate-based authentication changes on Windows domain controllers", when preforming certificate based kerberos authentication (PKINIT) Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> 
This parameter controls the enforcement of Windows Certificate bindings as
outlined in "KB5014754: Certificate-based authentication changes on Windows
domain controllers",
when preforming certificate based kerberos authentication (PKINIT)

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>