samba.git/source3/auth, branch ldb-1.2.3

auth3: prepare the logic for "map untrusted to domain = auto"

2017-06-16T01:21:29+00:00

This implements the same behavior as Windows,
we should pass the domain and account names given
by the client directly to the auth backends,
they can decide if they are able to process the
authentication pass it to the next backend.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

auth3: call is_trusted_domain() as the last condition make_user_info_map()

2017-06-16T01:21:29+00:00

We should avoid contacting winbind if we already know the domain is our
local sam or our primary domain.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s3-auth: remove some dead prototypes

2017-05-10T13:53:20+00:00

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider

lib: modules: Change XXX_init interface from XXX_init(void) to XXX_init(TALLOC_CTX *)

2017-04-21T23:17:00+00:00

Not currently used - no logic changes inside.

This will make it possible to pass down a long-lived talloc
context from the loading function for modules to use instead
of having them internally all use talloc_autofree_context()
which is a hidden global.

Updated all known module interface numbers, and added a
WHATSNEW.

Signed-off-by: Jeremy Allison 
Signed-off-by: Ralph Böhme 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144

auth3: fallback to "sam_ignoredomain" in make_auth3_context_for_ntlm()

2017-04-10T03:04:03+00:00

This is in the spirit of the "map untrusted to domain" parameter: We
fall back to the local SAM when we get a non-authoritative NO_SUCH_USER
from our domain controller. With this change we can implement
"map untrusted to domain = auto".

We should not strictly need 'sam' before 'winbind', but it makes
it clearer to read and has the same effect.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976
BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630

Signed-off-by: Volker Lendecke 
Reviewed-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Mon Apr 10 05:04:03 CEST 2017 on sn-devel-144

auth3: merge make_auth_context_subsystem() into make_auth3_context_for_ntlm()

2017-04-09T23:11:20+00:00

make_auth3_context_for_ntlm() was the only caller of
make_auth_context_subsystem().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12710

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

auth3: only use "sam_netlogon3 winbind:trustdomain" in make_auth3_context_for_netlogon

2017-04-09T23:11:20+00:00

If some needs the old behavior for a while, the deprecated
"auth methods = guest sam winbind:trustdomain" option can be used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12710

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

auth3: add "sam_netlogon3" which only reacts on lp_workgroup() as NT4 PDC/BDC

2017-04-09T23:11:20+00:00

This will be used in the s3 netlogon server in future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12710

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

auth: Add hooks for notification of authentication events over the message bus

2017-03-29T00:37:28+00:00

This will allow tests to be written to confirm the correct events are triggered.

We pass in a messaging context from the callers

Signed-off-by: Andrew Bartlett

auth: Log the transport connection for the authorization

2017-03-29T00:37:27+00:00

We also log if a simple bind was over TLS, as this particular case matters to a lot of folks

Signed-off-by: Andrew Bartlett 
Signed-off-by: Andrew Bartlett