summaryrefslogtreecommitdiff
path: root/source3/auth/auth.c
AgeCommit message (Collapse)AuthorFilesLines
2025-04-03s3:auth: remember make_auth3_context_for_netlogon() was usedStefan Metzmacher1-1/+8
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2023-07-05s3:auth: Use new debug macros for loggingAndreas Schneider1-6/+12
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-07-05s3:auth: Fix code spellingAndreas Schneider1-17/+17
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25auth: Add functionality to log client and server policy informationJoseph Sutton1-2/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25717: Add FreeIPA domain controller roleAlexander Bokovoy1-0/+3
As we want to reduce use of 'classic domain controller' role but FreeIPA relies on it internally, add a separate role to mark FreeIPA domain controller role. It means that role won't result in ROLE_STANDALONE. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-27auth3: Apply some const to auth3_context_set_challenge()Volker Lendecke1-2/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-04-19auth3: Make load_auth_module() staticVolker Lendecke1-3/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-04-19auth: Simplify DEBUG statements in make_auth3_context_for_ntlm()Volker Lendecke1-6/+9
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-01-08lib: give global_contexts.c its own header fileVolker Lendecke1-0/+1
It's a bit shocking how many references we have to global contexts. Make this a bit more obvious. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2020-01-06auth: Remove the "typedef auth_methods"Volker Lendecke1-4/+5
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-06auth3: Simplify auth_get_ntlm_challenge()Volker Lendecke1-6/+3
Use generate_random_buffer() directly on the talloc'ed buffer Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-01-06auth3: Check for talloc failureVolker Lendecke1-0/+4
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-26s3/auth: clang: Fix 'Value stored during its initialization is never read'Noel Power1-1/+1
Fixes: source3/auth/auth.c:38:35: warning: Value stored to 'entry' during its initialization is never read <--[clang] struct auth_init_function_entry *entry = auth_backends; ^~~~~ ~~~~~~~~~~~~~ 1 warning generated. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-06-13auth auth_log: csbuild unused parm unix_usernameGary Lockyer1-2/+1
Fixes csbuild errors Error: COMPILER_WARNING: auth/auth_log.c: scope_hint: In function ‘log_authentication_event_json’ auth/auth_log.c:146:14: warning: unused parameter ‘unix_username’ [-Wunused-parameter] Error: COMPILER_WARNING: auth/auth_log.c: scope_hint: In function ‘log_authentication_event_human_readable’ auth/auth_log.c:586:14: warning: unused parameter ‘unix_username’ [-Wunused-parameter] Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2019-02-20s3 auth: Create messaging and lp contexts.Gary Lockyer1-3/+15
If 'auth event notifications' are enabled create an imessaging_context and a loadparm_context that can be passed to log_authentication_event. This will allow the generated authentication messages to be tested. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-20s3:auth_winbind: remove fallback to optional backendStefan Metzmacher1-1/+1
This is not possible anymore, as the trustdomain backend was removed in commit 75c152c0d764165a4a9dd0a85390af063dd0192a. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13722 BUG: https://bugzilla.samba.org/show_bug.cgi?id=13723 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2018-06-25auth: For NTLM and KDC authentication, log the authentication durationAndrew Bartlett1-2/+14
This is not a general purpose profiling solution, but these JSON logs are already being generated and stored, so this is worth adding. Some administrators are very keen to know how long authentication takes, particularly due to long replication transactions in other processes. This complements a similar patch set to log the transaction duration. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-03-19s3:auth: rename "guest" methods to "anonymous"Stefan Metzmacher1-4/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2017-12-13s3:auth: remove lp_auth_methods() handlingStefan Metzmacher1-30/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-09-22auth3: Remove auth_domainVolker Lendecke1-2/+2
If you're a domain member, use winbind. Auth_domain is from times when we did not have winbind. It has served its purpose, but we should move on. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Sep 22 00:02:29 CEST 2017 on sn-devel-144
2017-04-22lib: modules: Change XXX_init interface from XXX_init(void) to ↵Jeremy Allison1-1/+1
XXX_init(TALLOC_CTX *) Not currently used - no logic changes inside. This will make it possible to pass down a long-lived talloc context from the loading function for modules to use instead of having them internally all use talloc_autofree_context() which is a hidden global. Updated all known module interface numbers, and added a WHATSNEW. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144
2017-04-10auth3: fallback to "sam_ignoredomain" in make_auth3_context_for_ntlm()Volker Lendecke1-3/+3
This is in the spirit of the "map untrusted to domain" parameter: We fall back to the local SAM when we get a non-authoritative NO_SUCH_USER from our domain controller. With this change we can implement "map untrusted to domain = auto". We should not strictly need 'sam' before 'winbind', but it makes it clearer to read and has the same effect. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Apr 10 05:04:03 CEST 2017 on sn-devel-144
2017-04-10auth3: merge make_auth_context_subsystem() into make_auth3_context_for_ntlm()Stefan Metzmacher1-8/+2
make_auth3_context_for_ntlm() was the only caller of make_auth_context_subsystem(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12710 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-10auth3: only use "sam_netlogon3 winbind:trustdomain" in ↵Stefan Metzmacher1-1/+30
make_auth3_context_for_netlogon If some needs the old behavior for a while, the deprecated "auth methods = guest sam winbind:trustdomain" option can be used. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12710 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-29auth: Add hooks for notification of authentication events over the message busAndrew Bartlett1-2/+3
This will allow tests to be written to confirm the correct events are triggered. We pass in a messaging context from the callers Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2017-03-29auth: Generate a human readable Authentication log message.Gary Lockyer1-1/+17
Add a human readable authentication log line, to allow verification that all required details are being passed. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-03-29auth: Add a reminder about the strings currently used for auditingAndrew Bartlett1-0/+4
We will soon have a much better replacement, but a note here may help some in the transition Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-03-24auth3: handle ROLE_ACTIVE_DIRECTORY_DC before lp_auth_methods() in ↵Stefan Metzmacher1-4/+9
make_auth_context_subsystem() "auth methods" never works as AD DC at all, so there's not really a change. This allows us to implement "auth methods" (temporary) for the auth4 stack. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 BUG: https://bugzilla.samba.org/show_bug.cgi?id=12709 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: remove unused USER_INFO_LOCAL_SAM_ONLY/AUTH_METHOD_LOCAL_SAM handlingStefan Metzmacher1-5/+0
BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: only use "[samba4:]sam" in make_auth3_context_for_winbind()Stefan Metzmacher1-1/+18
This makes the USER_INFO_LOCAL_SAM_ONLY and AUTH_METHOD_LOCAL_SAM interaction obsolete. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: let auth_check_ntlm_password() return pauthoritativeStefan Metzmacher1-17/+18
BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: make make_auth_context_subsystem() staticStefan Metzmacher1-2/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: add make_auth3_context_for_{ntlm,netlogon,winbind}Stefan Metzmacher1-0/+18
For now they'll all do the same, but that will change in the following commits. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: Remove unused make_auth_context_fixedVolker Lendecke1-19/+0
BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: Introduce auth3_context_set_challengeVolker Lendecke1-1/+13
BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: Simplify the logic in auth_check_ntlm_passwordVolker Lendecke1-29/+29
Move everything but the strict loop logic outside. This makes the loop exit condition clearer to me: Anything but NOT_IMPLEMENTED breaks the loop. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: Don't try other auth modules on any errorVolker Lendecke1-3/+1
So far if any kind of error has happened, we just tried further auth modules. An auth module should have the chance to definitely say "no, this is a valid error, no further attempts anywhere else". The protocol so far was for an auth module to return NT_STATUS_NOT_IMPLEMENTED if it wanted to pass on to other modules, but any error led to the next auth modules also being given a try. This patch makes any auth module return code except NOT_IMPLEMENTED to terminate the loop, such that every module has to explicitly request to pass on to the next module via NOT_IMPLEMENTED. All modules we reference in make_auth_context_subsystem() have code to explicitly say "not for me please" with NOT_IMPLEMENTED. This *might* break existing setups which fail in for example "guest" or "winbind" due to other reasons. I prefer it this way though, because adding another parameter like "This is a real authoritative failure, don't go looking somewhere else" will only add to the mess. But it's more a theoretical than a practical change with the default auth backends. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: Introduce make_auth_context_specificVolker Lendecke1-22/+27
Take a string instead of a string list. Simplifies make_auth_context_subsystem and later similar callers BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: Slightly simplify make_auth_context_subsystem() step2Volker Lendecke1-39/+34
Use "git show -b" to see the simple diff. BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-24auth3: Slightly simplify make_auth_context_subsystem() step1Volker Lendecke1-4/+6
BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-09auth3: Simplify auth_check_ntlm_password logic with a "goto fail"Volker Lendecke1-11/+13
No intended code change, just reformatting and a goto fail with inverted logic Best viewed with "git show -b" Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Mar 9 02:01:35 CET 2017 on sn-devel-144
2017-03-08auth3: Simplify auth_check_ntlm_password logic with a "goto fail"Volker Lendecke1-40/+43
No intended code change, just reformatting and a goto fail with inverted logic Best viewed with "git show -b" :-) Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-08auth3: Simplify auth_check_ntlm_password server_info handlingVolker Lendecke1-6/+7
Instead of directly assigning (*pserver_info), work on a local copy first and assign it once when successful Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-08auth3: Simplify auth_check_ntlm_password talloc handlingVolker Lendecke1-13/+7
Use talloc_stackframe and talloc_tos. Don't bother to talloc_free within the loop, we don't have many iterations. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-08auth3: Use talloc_move instead of _stealVolker Lendecke1-1/+1
That's the more "modern" way to steal Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-03-08auth3: Centralize auth_check_ntlm_password failure handlingVolker Lendecke1-4/+11
Preparation for simplified talloc handling. Slight behaviour change: We now ZERO_STRUCTP(pserver_info) in all failure cases. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-02-15auth3: Use NT_STATUS_EQUALVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-02-06dlist: remove unneeded type argument from DLIST_ADD_END()Michael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2014-07-04s4-auth: Do not override the NT_STATUS_NOT_IMPLEMENTED error for winbinddAndrew Bartlett1-0/+7
This changes the auth code in winbindd to use this as a flag, and to therefore contact the RW DC. Change-Id: If4164d27b57b453b398642fdf7d46d03cd0e65f2 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@samba.org>
2014-06-11auth: Provide a way to use the auth stack for winbindd authenticationAndrew Bartlett1-1/+9
This adds in flags that allow winbindd to request authentication without directly calling into the auth_sam module. That in turn will allow winbindd to call auth_samba4 and so permit winbindd operation in the AD DC. Andrew Bartlett Change-Id: I27d11075eb8e1a54f034ee2fdcb05360b4203567 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 06:21:31 +0000