samba.git/source3/auth/auth_generic.c, branch talloc-2.1.13

auth/common: add support for auth4_ctx->check_ntlm_password_send/recv()

2017-08-07T13:20:03+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

auth: Add hooks for notification of authentication events over the message bus

2017-03-29T00:37:28+00:00

This will allow tests to be written to confirm the correct events are triggered.

We pass in a messaging context from the callers

Signed-off-by: Andrew Bartlett

auth: Log the transport connection for the authorization

2017-03-29T00:37:27+00:00

We also log if a simple bind was over TLS, as this particular case matters to a lot of folks

Signed-off-by: Andrew Bartlett 
Signed-off-by: Andrew Bartlett

s3-auth: Log SMB authorization for bare NTLM (NTLMSSP/krb5 already done)

2017-03-29T00:37:27+00:00

gensec_session_info() is not called for bare NTLM, so we have to log manually

Signed-off-by: Andrew Bartlett 
Pair-Programmed-by: Gary Lockyer 
Signed-off-by: Gary Lockyer

auth: Always supply both the remote and local address to the auth subsystem

2017-03-29T00:37:26+00:00

This ensures that gensec, and then the NTLM auth subsystem under it, always gets the
remote and local address pointers for potential logging.

The local address allows us to know which interface an authentication is on

Signed-off-by: Andrew Bartlett 
Pair-Programmed-by: Gary Lockyer 
Signed-off-by: Gary Lockyer

s3-auth: Pass service_description into gensec via auth_generic_prepare()

2017-03-29T00:37:25+00:00

This allows the GENSEC service description to be set from the various callers
that go via this function.

The RPC service description is the name of the interface from the IDL.

Signed-off-by: Andrew Bartlett 
Pair-Programmed-by: Gary Lockyer 
Signed-off-by: Gary Lockyer

auth: Add SID_NT_NTLM_AUTHENTICATION / S-1-5-64-10 to the token during NTLM auth

2017-03-27T18:08:18+00:00

So far this is only on the AD DC

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam 
Pair-Programmed-by: Gary Lockyer 
Signed-off-by: Gary Lockyer

auth: let auth4_context->check_ntlm_password() return pauthoritative

2017-03-24T10:57:10+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

auth3: make use of make_auth3_context_for_ntlm()

2017-03-24T10:57:09+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s3: auth: Use wbcAuthenticateUserEx to prime the caches.

2016-09-28T20:45:27+00:00

Idea by Volker - use WBC_AUTH_USER_LEVEL_PAC to pass
the PAC to winbind from smbd on auth, this allows
winbind to prime the user info via netsamlogon_cache_store()
and the name2sid cache *before* smbd looks up the user.

Note that as this is merely a cache prime having
winbind not available is not an error.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11259

Signed-off-by: Jeremy Allison 
Reviewed-by: Günther Deschner 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Wed Sep 28 22:45:27 CEST 2016 on sn-devel-144