samba.git/source4/libcli/ldap, branch master

ldb: add "policy hints" controls to be used by password_hash module

2026-01-15T01:48:37+00:00

These won't have any effect yet, but soon they will allow a privileged
account to perform a password reset that respects constraints on
password history, age, and length, as if the reset was an ordinary
password change (that is, where the user provides the old password).

A normal user can't reset their own password using this, if the
organisation is using a remote service (e.g. Entra ID or Keycloak) to
manage passwords, that service can use a policy hints control to
ensure it follows AD password policy.

Entra ID Self Service Password Reset (SSPR) uses the deprecated OID.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12020

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer

lib: Don't call a function to initialize an empty DATA_BLOB

2026-01-07T09:57:40+00:00

Signed-off-by: Volker Lendecke 
Reviewed-by: Anoop C S

dsdb: Prepare to handle smartcard password rollover

2024-06-10T04:27:30+00:00

We do this by allowing the password change control to indicate
that the password is to be randomised, bypassing the quality
checks (as true random passwords often fail these) and
re-randomising with the same code as is used for the KDC.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Jo Sutton

s4:libcli: Add more controls to our list of known controls

2024-05-16T02:11:36+00:00

Signed-off-by: Jo Sutton 
Reviewed-by: Andrew Bartlett

s4:libcli: Fix code spelling

2024-05-16T02:11:36+00:00

Signed-off-by: Jo Sutton 
Reviewed-by: Andrew Bartlett

s4:libcli/ldap: add support for ADS_AUTH_SASL_{STARTTLS,LDAPS}

2024-04-23T23:50:34+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:libcli/ldap: add tls channel binding support for ldap_bind_sasl()

2024-04-23T23:50:34+00:00

We still allow 'ldap_testing:tls_channel_bindings = no' and
'ldap_testing:channel_bound = no' for testing
the old behavior in order to have expected failures in our tests.

And we have 'ldap_testing:forced_channel_binding = somestring'
in order to force invalid bindings.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:libcli/ldap: make use of tstream_tls_params_client_lpcfg()

2024-04-23T23:50:33+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:libcli/ldap: force GSS-SPNEGO in ldap_bind_sasl()

2024-04-23T23:50:33+00:00

There's no point in asking the server for supportedSASLMechanisms,
every server (we care about) supports GSS-SPNEGO.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4:libcli/ldap: fix no memory error code in ldap_bind_sasl()

2024-04-23T23:50:33+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett