samba.git/source4/auth, branch talloc-2.3.1

auth: Simplify session generation

2019-11-06T20:36:34+00:00

We don't need to parse a text sid, we have those as binary available

Signed-off-by: Volker Lendecke 
Reviewed-by: Jeremy Allison

s4:auth: kinit_to_ccache() should always use the canonicalized principal

2019-09-24T18:30:37+00:00

We should always use krb5_get_init_creds_opt_set_canonicalize()
and krb5_get_init_creds_opt_set_win2k() for heimdal
and expect the client principal to be changed.

There's no reason to have a different logic between MIT and Heimdal.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14124

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Guenther Deschner

s4:auth: use the correct client realm in gensec_gssapi_update_internal()

2019-09-24T18:30:37+00:00

The function gensec_gssapi_client_creds() may call kinit and gets
a TGT for the user. The principal provided by the user may not
be canonicalized. The user may use 'given.last@example.com'
but that may be mapped to glast@AD.EXAMPLE.PRIVATE in the background.

It means we should use client_realm = AD.EXAMPLE.PRIVATE
instead of client_realm = EXAMPLE.COM

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14124

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Guenther Deschner

s4/auth/kerberos: clang: Fix Value stored to 'code' is never read

2019-07-24T04:19:27+00:00

Fixes:

source4/auth/kerberos/kerberos_util.c:645:3: warning: Value stored to 'code' is never read <--[clang]
                code = 0;
                ^      ~
1 warning generated.

Signed-off-by: Noel Power 
Reviewed-by: Gary Lockyer

s4/auth/kerberos: clang: Fix 'value stored to 'ret' is never read '

2019-07-24T04:19:27+00:00

Fixes:

source4/auth/kerberos/kerberos_pac.c:116:2: warning: Value stored to 'ret' is never read <--[clang]
        ret = smb_krb5_make_pac_checksum(mem_ctx,
        ^     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.

Signed-off-by: Noel Power 
Reviewed-by: Gary Lockyer

s4/auth/py: avoid null deref with bad python arguments

2019-07-22T22:20:26+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

s4/gensec/py: avoid null deref with bad python arguments

2019-07-22T22:20:26+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

s4/auth/pygensec: don't segfault when reporting bad types

2019-07-22T22:20:26+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett

s4/auth/gensec: clang: Fix 'initialization value is never read'

2019-07-11T04:08:13+00:00

Fixes:

source4/auth/gensec/gensec_gssapi.c:431:11: warning: Value stored to 'nt_status' during its initialization is never read <--[clang]
        NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
                 ^~~~~~~~~   ~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.

Signed-off-by: Noel Power 
Reviewed-by: Gary Lockyer

py3: Remove duplicated PyUnicode_Check() after the py3 compat macros were removed

2019-06-24T18:48:53+00:00

This came about because in py2 we had to check for strings and unicode.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Noel Power 

Autobuild-User(master): Noel Power 
Autobuild-Date(master): Mon Jun 24 18:48:53 UTC 2019 on sn-devel-184