samba.git/source3/libads, branch ldb-1.2.3

s3:libads: net ads keytab list fails with "Key table name malformed"

2017-12-05T09:34:27+00:00

When keytab_name is NULL don't call smb_krb5_kt_open use ads_keytab_open
instead, this function will determine the correct keytab to use.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13166

Signed-off-by: Noel Power 
Reviewed-by: Andreas Schneider 
Reviewed-by: Ralph Boehme 
(cherry picked from commit 3048ae318fc8b4d1b7663826972306372430a463)

s3:libads: Fix changing passwords with Kerberos

2017-08-28T09:04:15+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12956

Signed-off-by: Andreas Schneider 
Reviewed-by: Richard Sharpe 
(cherry picked from commit b81ca4f9dcbb378a95fb3ac31bfd9a1cbe505d7d)

s3:libads: make use of secrets_*_password_change() in ads_change_trust_account_password()

2017-06-27T14:57:46+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s3:secrets: move kerberos_secrets_*salt related functions to machine_account_secrets.c

2017-06-27T14:57:44+00:00

These don't use any krb5_context related functions and they just
work on secrets.tdb, so they really belong to machine_account_secrets.c.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s3:libads: remove unused kerberos_fetch_salt_princ_for_host_princ()

2017-06-27T14:57:44+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s3:libads: make use of kerberos_secrets_fetch_salt_princ() in ads_keytab_add_entry()

2017-06-27T14:57:44+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s3:libads: provide a simpler kerberos_fetch_salt_princ() function

2017-06-27T14:57:44+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s3:libads: remove kerberos_secrets_fetch_salting_principal() fallback

2017-06-27T14:57:44+00:00

The handling for per encryption type salts was removed in
Samba 3.0.23a (Jul 21, 2006). It's very unlikely that someone
has such an installation that got constantly upgraded over 10 years
with an automatic password change nor rejoin. It also means
that the KDC only has salt-less arcfour-hmac-md5 key together
with the salted des keys. So there would only be a problem
if the client whould try to use a des key to contact the smb server.

Having this legacy code adds quite some complexity for no
good reason.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s3:libads: remove unused kerberos_secrets_store_salting_principal()

2017-06-27T14:57:43+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

libads: Decide to have no fallback option

2017-05-30T06:06:06+00:00

Before this change, it would always possibly choose another server at
random despite later using the original principal when it got back to
the connection initialization in the the winbind connection manager.
This caused bizarre authentication failures.

Signed-off-by: Garming Sam 
Reviewed-by: Andrew Bartlett