samba.git/source3/winbindd, branch talloc-2.4.4

winbindd:migrate_secrets_tdb_to_ldb() handles no client password

2025-08-26T22:42:39+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Jennifer Sutton

winbindd: CID 1508963 Fixing print statement for time_t

2025-08-26T15:40:41+00:00

Fixing DEBUG output for time_t to uintmax_t

Signed-off-by: Rabinarayan Panigrahi 
Reviewed-by: Volker Lendecke 
Reviewed-by: Martin Schwenke 
Reviewed-by: Vinit Agnihotri 

Autobuild-User(master): Volker Lendecke 
Autobuild-Date(master): Tue Aug 26 15:40:41 UTC 2025 on atb-devel-224

idmap_ad: add and use ldap_timeout and fix LDAP server failover

2025-08-13T18:30:44+00:00

The key parts are:

1. If an LDAP search fails with the hardcoded fatal error, remove the
retry. That would only retry the query against the same server, taken
from the DCINFO cache key. Instead, force a DC rediscovery.

2. Set a default ldap_timeout and pass it to tldap_search(). This
avoids tldap_search() hanging forever on a stale TCP connection.

3. The LDAP server idmap_ad is using is not necessarily the same DC
we're using for RPC, so in case we learn about a dead DC, put it in
the negative-conn-cache.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15844

Signed-off-by: Ralph Boehme 
Reviewed-by: Guenther Deschner

winbindd: use find_domain_from_name_noinit() in find_dns_domain_name()

2025-08-13T18:30:44+00:00

Avoid triggering a connection to a DC of a trusted domain.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15876

Signed-off-by: Ralph Boehme 
Reviewed-by: Guenther Deschner

nsswitch: support all known DS lookup flags in wbclient's wbcLookupDomainController()

2025-08-12T08:26:55+00:00

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider 

Autobuild-User(master): Günther Deschner 
Autobuild-Date(master): Tue Aug 12 08:26:55 UTC 2025 on atb-devel-224

s3:winbindd: Resolve dc name using CLDAP also for ROLE_IPA_DC

2025-08-05T13:51:37+00:00

server role ROLE_IPA_DC (introduced in e2d5b4d) needs special handling
in dcip_check_name().  We should resolve the DC name using:
- CLDAP in dcip_check_name_ads()
instead of:
- NETBIOS in nbt_getdc() that fails if Windows is not providing netbios.

The impacted environment has:

domain->alt_name = example.com
domain->active_directory = 1
security = USER
server role = ROLE_IPA_DC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15891

Signed-off-by: Pavel Filipenský 
Signed-off-by: Andreas Schneider 
Pair-programmed-with: Andreas Schneider 

Reviewed-by: Alexander Bokovoy

winbindd: blacklist servers returning ACCESS_DENIED/authoritative=0

2025-07-30T09:09:40+00:00

https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme 
Reviewed-by: Guenther Deschner

winbindd: always use winbind_add_failed_connection_entry() wrapper

2025-07-30T09:09:40+00:00

We should not use add_failed_connection_entry() directly.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14981

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme 
Reviewed-by: Guenther Deschner

s3:winbind: Initialize and setup idmap child in winbindd_getgrnam()

2025-07-08T07:21:26+00:00

Make sure the idmap child is initialized before delegating the name unmapping.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15882

Signed-off-by: Samuel Cabrero 
Reviewed-by: Ralph Boehme 

Autobuild-User(master): Samuel Cabrero 
Autobuild-Date(master): Tue Jul  8 07:21:26 UTC 2025 on atb-devel-224

s3:winbind: Initialize and setup idmap child in winbindd_getpwnam()

2025-07-08T06:23:37+00:00

Make sure the idmap child is initialized before delegating the name unmapping.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15882

Signed-off-by: Samuel Cabrero 
Reviewed-by: Ralph Boehme