samba.git/source3/libads/sasl.c, branch talloc-2.3.0

libads: Add kerberos tracing

2018-12-19T20:49:29+00:00

Replace kerberos context initialization from
raw krb5_init_context() to smb_krb5_init_context_basic()
which is adding common tracing as well.

Signed-off-by: Swen Schillig 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Christof Schmitt

libads: abstract out SASL wrapping code

2017-05-17T21:02:09+00:00

Prepare for rebasing libads on top of libsmbldap.

To make libads using 'struct smbldap_state' instead of direct LDAP
structure, we need to abstract out libads logic from connection
handling. SASL wrapping does not really depend on availability of LDAP
handle and does not need direct access to ADS_STRUCT. As result, we'll
be able to move SASL wrapping code under smbldap once the latter is able
to pass settings that libads passes to the SASL wrapping.

Signed-off-by: Alexander Bokovoy 
Reviewed-by: Jeremy Allison

libads: convert to use smb_gss_krb5_import_cred

2017-03-08T17:00:12+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12611

Signed-off-by: Alexander Bokovoy 
Reviewed-by: Stefan Metzmacher

s3:libads: remove unused fallback to gss_acquire_cred()

2017-03-06T10:44:54+00:00

Heimdal and all supported versions of MIT krb5 prove gss_krb5_import_cred(),
so we don't need an #ifdef here.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Alexander Bokovoy 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Mon Mar  6 11:44:54 CET 2017 on sn-devel-144

s3:libads: add more debugging to ads_sasl_spnego_bind()

2017-02-24T17:40:15+00:00

Any fallbacks to other authentication methods should be logged.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme

s3:libads: don't use MEMORY:ads_sasl_spnego_bind nor set "KRB5CCNAME"

2016-10-12T22:35:21+00:00

Most callers just set "KRB5CCNAME", but leave ads->auth.ccache_name = NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12369

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Günther Deschner 
Reviewed-by: Uri Simchoni 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Thu Oct 13 00:35:21 CEST 2016 on sn-devel-144

s3:libads: don't use MEMORY:ads_sasl_gssapi_do_bind nor set "KRB5CCNAME"

2016-10-12T18:54:09+00:00

Most callers just set "KRB5CCNAME", but leave ads->auth.ccache_name = NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12369

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Günther Deschner 
Reviewed-by: Uri Simchoni

libads: ensure the right ccache is used during spnego bind

2016-07-12T01:23:33+00:00

When doing spnego sasl bind:
1. Try working without kinit only if a password is not
   provided
2. When using kinit, ensure the KRB5CCNAME env var is set
   to a private memory ccache, so that the bind is on behalf
   of the requested user.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12007

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Uri Simchoni 

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Tue Jul 12 03:23:33 CEST 2016 on sn-devel-144

libads: ensure the right ccache is used during gssapi bind

2016-07-11T21:46:17+00:00

When doing gssapi sasl bind:
1. Try working without kinit only if a password is not
   provided
2. When using kinit, ensure the KRB5CCNAME env var is set
   to a private memory ccache, so that the bind is on behalf
   of the requested user.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12007

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Uri Simchoni

s3-libads: fix a memory leak in ads_sasl_spnego_bind()

2016-07-05T18:55:08+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12006

Signed-off-by: Uri Simchoni 
Signed-off-by: Richard Sharpe 
Signed-off-by: Andreas Schneider