samba.git/source3/utils/net.c, branch master

s3:utils: 'net ads kerberos kinit' should use also default ccache name from krb5.conf

2026-02-05T19:59:36+00:00

This is re-introducing the behavior from samba-4.20 where both these
commands operated on the same ccache (default_ccache_name in
[libdefaults] section of krb5.conf)

 'net ads kerberos kinit -P'
 'klist'

 With samba-4.21 it no longer works, 'net ads kerberos kinit -P'
 fallbacks to 'MEMORY:net' (which is of a very limited use, ticket
 cannot be used by other process) and klist finds no ticket.

 The order is changed from:

    --use-krb5-ccache
    env "KRB5CCNAME"
    "MEMORY:net"

to ("MEMORY:net" is removed):

    --use-krb5-ccache
    env "KRB5CCNAME"
    default_ccache_name

'--use-krb5-ccache=MEMORY:net' can be used to validate the credentials.

Use smb_force_krb5_cc_default_name() instead of krb5_cc_default_name()
because of commit:
1ca6fb5 make sure krb5_cc_default[_name]() is no longer used directly

Signed-off-by: Pavel Filipenský 
Reviewed-by: Andreas Schneider

s3-net: properly setup krb5 ccache name via --use-krb5-ccache

2026-01-05T14:35:43+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider

s3:net: Pass down the server from cmdline to sync_pw2keytabs()

2025-09-05T13:38:33+00:00

This makes sure that during 'net ads join' the keytab create code
- sync_pw2keytabs() talks to the same DC at what the machine account
was created.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15905

Signed-off-by: Andreas Schneider 
Signed-off-by: Pavel Filipenský 
Pair-Programmed-With: Pavel Filipenský 

Reviewed-by: Alexander Bokovoy 

Autobuild-User(master): Pavel Filipensky 
Autobuild-Date(master): Fri Sep  5 13:38:33 UTC 2025 on atb-devel-224

s3-net: fix "net ads kerberos" krb5ccname handling

2025-07-24T17:31:14+00:00

We can only rely on KRB5CCNAME being set, --use-krb5-ccname content is
not available.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider 

Autobuild-User(master): Günther Deschner 
Autobuild-Date(master): Thu Jul 24 17:31:14 UTC 2025 on atb-devel-224

sync machine password to keytab: handle FreeIPA use case

2024-09-13T13:16:09+00:00

FreeIPA uses own procedure to retrieve keytabs and during the setup of
Samba on FreeIPA client the keytab is already present, only machine
account needs to be set in the secrets database.

'sync machine password to keytab' option handling broke this use case by
always attempting to contact a domain controller and failing to do so
(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199).

The original synchronizing machine account password to keytab feature
did not have a mechanism to disable its logic at all.

Signed-off-by: Alexander Bokovoy 
Reviewed-by: Pavel Filipenský 

Autobuild-User(master): Alexander Bokovoy 
Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224

s3: Sync machine account password in secrets_{prepare,finish}_password_change

2024-07-26T17:12:36+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=6750

Signed-off-by: Pavel Filipenský 
Reviewed-by: Stefan Metzmacher

lib: Use cli_credentials_add_gensec_features in a few places

2024-06-04T07:11:35+00:00

Capture a common pattern

Signed-off-by: Volker Lendecke 
Reviewed-by: Andrew Bartlett

s3:net: finally remove net_context->opt_{user_specified,user_name,password}

2024-05-14T10:18:31+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s3:net: remove unused net_context->smb_encrypt

2024-05-14T10:18:31+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

s3:net: remove unused net_context->opt_kerberos

2024-05-14T10:18:31+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider