summaryrefslogtreecommitdiff
path: root/source3/auth/auth_util.c
AgeCommit message (Collapse)AuthorFilesLines
2017-06-16auth3: prepare the logic for "map untrusted to domain = auto"Stefan Metzmacher1-3/+5
This implements the same behavior as Windows, we should pass the domain and account names given by the client directly to the auth backends, they can decide if they are able to process the authentication pass it to the next backend. BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-06-16auth3: call is_trusted_domain() as the last condition make_user_info_map()Stefan Metzmacher1-2/+4
We should avoid contacting winbind if we already know the domain is our local sam or our primary domain. BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-29rpc: Always supply both the remote and local address to the auth subsystemGary Lockyer1-3/+14
This ensures that gensec, and then the NTLM auth subsystem under it, always gets the remote and local address pointers for potential logging. The local address allows us to know which interface an authentication is on Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-03-29auth: Fill in user_info->service_description from all callersAndrew Bartlett1-5/+15
This will allow the logging code to make clear which protocol an authentication was for. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz> Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2017-02-27auth3: Simplify get_system_info3Volker Lendecke1-11/+2
We have global_sid_System, so we don't need to dom_sid_parse("S-1-5-18"); Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Feb 27 11:31:53 CET 2017 on sn-devel-144
2017-02-27auth3: Fix some whitespaceVolker Lendecke1-3/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-03auth3: Avoid some zeros footprintVolker Lendecke1-2/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2017-01-03auth3: Use "all_zero" where appropriateVolker Lendecke1-4/+3
... Saves a few bytes of footprint Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2016-12-28lib: Add lib/util_unixsids.hVolker Lendecke1-0/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Uri Simchoni <uri@samba.org>
2016-10-25smbd: in ntlm auth, do not map empty domain in case of \user@realmUri Simchoni1-3/+7
When mapping user and domain during NTLM authentication, an empty domain is mapped to the local SAM db. However, an empty domain may legitimately be used if the user field has both user and domain in upn@realm format. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12375 Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-10-13Update smbrun to allow for settings environment variables.Trever L. Adams1-2/+2
Signed-off-by: Trever L. Adams <trever.adams@gmail.com> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Oct 13 04:26:26 CEST 2016 on sn-devel-144
2016-06-30auth/wbc_auth_util: change wbcAuthUserInfo_to_netr_SamInfo* from level 3 to 6Stefan Metzmacher1-4/+9
This includes user_principal_name and dns_domain_name. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-04-12CVE-2016-2111: s3:auth: implement "raw NTLMv2 auth" checksStefan Metzmacher1-0/+15
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11749 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2015-08-21s3-auth: Fix a memory leak in make_server_info_info3()Andreas Schneider1-12/+23
We call make_server_info(NULL) and it is possible that we do not free it, because server_info is not allocated on the memory context we pass to the function. BUG: https://bugzilla.samba.org/show_bug.cgi?id=9862 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2015-08-21s3-auth: Pass nt_username to check_account()Andreas Schneider1-3/+6
We set nt_username above but do not use it in this function. BUG: https://bugzilla.samba.org/show_bug.cgi?id=9862 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2015-08-21s3-auth: Fix 'map to guest = Bad Uid' supportAndreas Schneider1-0/+8
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9862 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2015-05-13Convert all uses of uint32/16/8 to _t in source3/auth.Richard Sharpe1-3/+3
Signed-off-by: Richard Sharpe <rsharpe@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-01-14s3: auth: Plumb in the SamInfo3_handle_sids() utility function into ↵Jeremy Allison1-1/+2
passwd_to_SamInfo3(). Core fix for: https://bugzilla.samba.org/show_bug.cgi?id=11044 Based on code from Michael Zeis <mzeis.quantum@gmail.com> Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2014-10-30Don't drop any error codes just because we think there cannot be any errors ↵root1-0/+3
we didn't think of if the user asked for a level 10 log. Signed-off-by: Richard Sharpe <rsharpe@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Oct 30 09:14:51 CET 2014 on sn-devel-104
2014-06-18s3: auth: Add some const to the struct netr_SamInfo3 * arguments of ↵Jeremy Allison1-1/+1
copy_netr_SamInfo3() and make_server_info_info3() Both functions only read from the struct netr_SamInfo3 * argument. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com> Reviewed-by: Simo Sorce <idra@samba.org>
2014-04-02s3-auth: Finally change make_user_info_*() use a parent talloc contextAndrew Bartlett1-11/+20
Change-Id: Iedf516e8c24e0d18064aeedd8e287ed692d3c5b4 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
2014-02-19s3-auth: Pass mem_ctx to do_map_to_guest_server_info().Andreas Schneider1-5/+7
Change-Id: If53117023e3ab37c810193edd00a81d247fdde7a Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Feb 19 01:28:14 CET 2014 on sn-devel-104
2014-02-07param: rename lp function and variable from "adduser_script" to ↵Garming Sam1-1/+1
"add_user_script" Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2014-02-07param: rename lp function and variable from 'guestaccount' to 'guest_account'Garming Sam1-2/+2
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2014-02-05s3-auth: Add passwd_to_SamInfo3().Andreas Schneider1-71/+16
Correctly lookup users which come from smb.conf. passwd_to_SamInfo3() tries to contact winbind if the user is a domain user to get valid information about it. If winbind isn't running it will try to create everything from the passwd struct. This is not always reliable but works in most cases. It improves the current situation which doesn't talk to winbind at all. BUG: https://bugzilla.samba.org/show_bug.cgi?id=8598 Pair-Programmed-With: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Feb 5 01:40:38 CET 2014 on sn-devel-104
2014-02-05s3-auth: Pass talloc context to make_server_info_pw().Andreas Schneider1-20/+32
Pair-Programmed-With: Guenther Deschner <gd@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-02-28Fix bug #9039 'map untrusted to domain' treats WORKSTATION as bogus domain.Daniel Kobras1-1/+2
s3: never try to map global SAM name Do not treat the global SAM name as a BOGUS domain, and exempt local users from mapping, instead. This change reinstates the exact mapping behaviour of Samba 3.2 if parameter 'map untrusted to domain' is set. Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-12s3-auth: Make sure we work on valid data_blobs.Andreas Schneider1-2/+2
Found by Coverity. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2012-12-09s3-rpc_server: support AES for interactive netlogon samlogon password ↵Günther Deschner1-33/+1
decryption. Still need to fix AES support for the returned validation info. Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-11-12Use work around for 'winbind use default domain' only if it is setSumit Bose1-1/+2
Currently in smb_getpwnam() the NetBIOS domain name and the winbind separator character is always added to the user name returned by Get_Pwnam_alloc() if it does not contain the winbind separator character. As comments in the code indicates this is done as a work around if 'winbind use default domain' is set to yes in the samba configuration. This make sense if the option is set because otherwise the domain information is lost from the user name. But it causes errors if other services than winbind are used for user lookup, e.g. sssd. sssd can handle different kind of fully qualified user names as input, e.g. user@domain.name or DOM\user, but returns a canonical name, by default user@domain.name. While it would be possible to get around this issue with a special configuration either on the sssd or samba side I think the cleaner solution is to use the work around only if 'winbind use default domain' is set to yes which is what this patch does. Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Nov 12 15:54:15 CET 2012 on sn-devel-104
2012-08-09Correctly check for errors in strlower_m() returns.Jeremy Allison1-1/+3
2012-07-24lib/param: Move all enum declarations to lib/paramAndrew Bartlett1-0/+1
This is in preperation for the parameter table being made common. Andrew Bartlett Pair-Programmed-With: Andrew Tridgell <tridge@samba.org>
2012-07-19s3-auth Use correct RID for domain guests primary groupAndrew Bartlett1-1/+1
This was incorrect in commit 9dd7e7fc2d6d1aa7f3c3b741ac134e087ce808fd as the RID was from the BUILTIN domain, but this creates a guest account token for the real domain. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Jul 19 05:56:28 CEST 2012 on sn-devel-104
2012-07-19Revert "s3:auth make sure the primary group sid is usable"Andrew Bartlett1-30/+13
This reverts commit 00089fd74af740f832573d904312854e494a869e. The issue with this patch, which I did sign off on, is that for the domain member case, we already know that the SID is reasonable and valid, and we indeed rely on that, because we keep it as an additonal group anyway. The primary group is not so special that we need to do extra validation. Calling this function may put a user into the domain 'domain users' group, even if they are not in that group to start with. Andrew Bartlett
2012-07-18loadparm: make the source3/ lp_ functions take an explicit TALLOC_CTX *.Rusty Russell1-4/+4
They use talloc_tos() internally: hoist that up to the callers, some of whom don't want to us talloc_tos(). A simple patch, but hits a lot of files. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
2012-06-19s3-auth: make_new_system_info_session() now does not query nssAndrew Bartlett1-1/+3
This is important in some situations where these queries might be costly LDAP queries and is just not required for the system token. This is because the system token should be just the NT AUTHORITY\SYSTEM user and just enough unix info to allow the token to be used. Andrew Bartlett Signed-off-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Tue Jun 19 13:34:28 CEST 2012 on sn-devel-104
2012-06-19s3-auth: make_new_system_info_session() not query passdbAndrew Bartlett1-47/+39
This is important in some situations where these queries might be costly LDAP queries and is just not required for the system token. This is because the system token should be just the NT AUTHORITY\SYSTEM user and just enough unix info to allow the token to be used. We query only NSS to get the name of sec_initial_uid() Signed-off-by: Andreas Schneider <asn@samba.org>
2012-06-19s3-auth: inline make_session_info functions into only callersAndrew Bartlett1-74/+35
With the split up to handle system specially, there is no need for these static helper functions any more. Andrew Bartlett Signed-off-by: Andreas Schneider <asn@samba.org>
2012-06-19auth: Use only security_token_is_system to determine that a user is SYSTEMAndrew Bartlett1-4/+0
This removes the duplication on how to detect that a user is system in Samba now that the smbd system account is also only SID_NT_SYSTEM we can use the same check everywhere. Andrew Bartlett Signed-off-by: Andreas Schneider <asn@samba.org>
2012-06-19s3-auth: Fix system token as just being SID_NT_SYSTEMAndrew Bartlett1-0/+3
This removes the SID matching the sec_initial_uid(). Andrew Bartlett Signed-off-by: Andreas Schneider <asn@samba.org>
2012-06-15s3-auth: Fix system info3 return to be just SID_NT_SYSTEMAndrew Bartlett1-11/+17
The SID for the SYSTEM token should be a fixed value, and not the administrator. Note however that it will be replaced by the SID of sec_initial_uid() by the create_local_token() code. Fixing this requires fixes the other parts of the code that cannot cope with a token of just SID_NT_SYSTEM. Andrew Bartlett
2012-06-15s3-auth: Fix system token generation not to dereference pointer as an integerAndrew Bartlett1-1/+1
This continues on from commit caaebb455cf955f66c2f662c53998c480cb2d6c9 which is marked as being part of bug #8944, ldapsam:trusted and ipasam and an additional fix for bug #8567 (0528cb5f3a15b72dcb34ece21a3ffb3e7b8d6eb9). The problem here was that the primary_gid was simply the pointer result of dom_sid_parse_talloc() cast to a uint32_t (found by the IRIX cc on the build farm). Andrew Bartlett
2012-06-15s3-auth: Give the SYSTEM token all privilegesAndrew Bartlett1-0/+4
2012-05-15s3-auth: Rename to init_system_session_info().Andreas Schneider1-1/+1
Autobuild-User: Andreas Schneider <asn@cryptomilk.org> Autobuild-Date: Tue May 15 13:56:00 CEST 2012 on sn-devel-104
2012-05-15s3-auth: Don't lookup the system user in pdb.Andreas Schneider1-4/+95
This fixes bug #8944, ldapsam:trusted and ipasam. It is an additional fix for bug #8567 (0528cb5f3a15b72dcb34ece21a3ffb3e7b8d6eb9).
2012-05-04s3: remove some unused codeVolker Lendecke1-27/+0
2012-05-02s3:passdb: rename sids_to_unix_ids() --> sids_to_unixids() for consistencyMichael Adam1-1/+1
2012-05-02s3-passdb: Use struct unixid in sids_to_unix_idsAndrew Bartlett1-6/+7
This avoids the union in the struct wbcUnixId and moves us to using only struct unixid internally. Andrew Bartlett Signed-off-by: Michael Adam <obnox@samba.org>
2012-03-13s3-rpc: Decrypt with the proper session key in CreateTrustedDomainEx2.Alexander Bokovoy1-0/+28
On LSA and SAMR pipes session_key is truncated to 16 byte when doing encryption/decryption. However, this was not done for trusted domain-related modifying operations. As result, Samba 4 client libraries do not work against Samba 3 while working against Windows 2008 r2. Solved this by introducing "session_extract_session_key()" function that allows to specify intent of use of the key. Signed-off-by: Andreas Schneider <asn@samba.org> Autobuild-User: Andreas Schneider <asn@cryptomilk.org> Autobuild-Date: Tue Mar 13 12:23:44 CET 2012 on sn-devel-104
2012-03-08s3-auth: Follow auth_ntlmssp and use auth4_context for Session SetupAndrew Bartlett1-10/+10
This patch ensures consistency in behaviour between NTLMSSP and NTLM session setup handlers. By calling the same layer that auth_ntlmssp calls, we can not only allow redirection of all authentication to the AD DC, we ensure that map to guest and username map handling is consistent, even in the file server alone. Andrew Bartlett
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-14 06:58:18 +0000