summaryrefslogtreecommitdiff
path: root/source4/auth/system_session.c
AgeCommit message (Collapse)AuthorFilesLines
2025-02-14s4:auth: let auth_domain_admin_user_info_dc() use talloc_zero_array(struct ↵Stefan Metzmacher1-1/+7
auth_SidAttr) This means we won't leave uninitialized memory if struct auth_SidAttr changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: simplify auth_anonymous_user_info_dc()Stefan Metzmacher1-2/+4
By using (struct auth_SidAttr) {} we don't leave uninitialized memory if struct auth_SidAttr changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: simplify auth_system_user_info_dc()Stefan Metzmacher1-2/+4
By using (struct auth_SidAttr) {} we don't leave uninitialized memory if struct auth_SidAttr changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2023-10-01s4:auth: Reformat function callsJoseph Sutton1-8/+23
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26s4-auth: pass lp_ctx to auth_generate_session_info() where possibleAndrew Bartlett1-3/+3
For non-testing callers of auth_generate_session_info(), passing lp_ctx will allow us to correctly set a flag indicating if claims should be evaluated. For testing applications, the default will allow safe operation inspecting the SID list. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-08-14s4:auth: Check return value of talloc_new()Joseph Sutton1-0/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14s4:auth: Fix leaksJoseph Sutton1-0/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-08s4:auth: Fix leaksJoseph Sutton1-35/+140
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-18s4:auth: Fix typosJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Correct primary group handlingJoseph Sutton1-8/+11
Heretofore we have treated the primary group SID specially, storing it in a fixed position as the second element of the user_info_dc->sids array, and filtering out other copies in the PAC_LOGON_INFO base structure. This filtering has made it difficult to distinguish between the case where the primary group is a universal or global group, located in the base RIDs, and the case where it is a domain-local group, missing from the base RIDs; especially since the attributes of a domain-local primary group are lost by being stored in the PAC. Domain-local primary groups are normally disallowed by Windows, but are allowed by Samba, and so it is reasonable to support them with at least some measure of consistency. The second element of user_info_dc->sids is still reserved for the primary group's SID, but we no longer filter out any other copies in the array. The first two elements are no more than the SIDs of the user and the primary group respectively; and the remaining SIDs are as if taken without modification from arrays of SIDs in the PAC. user_info_dc->sids should therefore become a more faithful representation of the SIDs in the PAC. After adding resource SIDs to it with dsdb_expand_resource_groups(), we should have a result that more closely and in more cases matches that of Windows. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Shorten long SID flags combinationsJoseph Sutton1-16/+9
The combination MANDATORY | ENABLED_BY_DEFAULT | ENABLED is very commonly used, and introducing a shorter alias for it makes the code clearer. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Pass through entire PAC flags value in auth_user_infoJoseph Sutton1-3/+4
Besides the NETLOGON_GUEST bit indicating whether the user has been authenticated, we now carry all of the other bits as well. This lets us match Windows' behaviour of simply passing these bits through to an updated PAC when processing a TGS-REQ. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Store group attributes in auth_user_info_dcJoseph Sutton1-20/+40
Group expansion, performed in dsdb_expand_nested_groups(), now incorporates a check of the type of each group. Those that are resource groups receive the SE_GROUP_RESOURCE bit in the attributes which are now carried alongside each group SID. Whereas before, in auth_convert_user_info_dc_sambaseinfo() and auth_convert_user_info_dc_saminfo6(), we invariantly used the flag combination SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED to set attributes in the PAC, we now take the correct attributes from user_info_dc. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-07-27CVE-2022-2031 auth: Add ticket type field to auth_user_info_dc and ↵Joseph Sutton1-3/+3
auth_session_info This field may be used to convey whether we were provided with a TGT or a non-TGT. We ensure both structures are zeroed out to avoid incorrect results being produced by an uninitialised field. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2021-06-29s4:auth: Check return code of cli_credentials_set_conf()Andreas Schneider1-2/+10
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-01-12auth4: Use global_sid_AnonymousVolker Lendecke1-1/+1
dom_sid_dup() is much simpler than dom_sid_parse_talloc() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-01-12auth4: Use global_sid_SystemVolker Lendecke1-1/+1
dom_sid_dup() is much simpler than dom_sid_parse_talloc() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-10-11s4-auth: fetch possible out of memory errorBjörn Baumbach1-1/+6
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Volker Lendecke <vl@samba.org>
2018-10-11s4-auth: use TALLOC_FREE() shortcutBjörn Baumbach1-2/+1
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Volker Lendecke <vl@samba.org>
2018-10-11s4-auth: fix a typo in a commentBjörn Baumbach1-1/+1
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Volker Lendecke <vl@samba.org>
2018-05-22auth: Use DBGC_AUTH as DBGC_CLASS for AD DC auth session code.Andrew Bartlett1-0/+2
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue May 22 02:42:32 CEST 2018 on sn-devel-144
2017-05-11s4: auth: Remove a talloc_autofree_context() use.Jeremy Allison1-1/+6
Use NULL here, not the autofree context for this static pointer. The destructor prevents freeing this memory anyway. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2011-06-19s4: fix wrong index usage PRIMARY_USER_SID_INDEX when it should have been ↵Matthieu Patou1-1/+1
PRIMARY_GROUP_SID_INDEX The system account was instanciated with wrong user an group SIDs, group sid resulted being just the domain SID. Bug seems to date from fbe6d155bf177c610ee549cc534650b0f0700e8a. Andrew (B.) please check.
2011-03-22s4:auth/system_session.c - check for OOMMatthias Dieter Wallnöfer1-0/+2
Reviewed-by: Jelmer
2011-02-09s4-auth Rework auth subsystem to remove struct auth_serversupplied_infoAndrew Bartlett1-151/+163
This changes auth_serversupplied_info into the IDL-defined struct auth_user_info_dc. This then in turn contains a struct auth_user_info, which is the only part of the structure that is mainted into the struct session_info. The idea here is to avoid keeping the incomplete results of the authentication (such as session keys, lists of SID memberships etc) in a namespace where it may be confused for the finalised results. Andrew Barltett
2011-01-20s4-auth Remove special case for account_sid from auth_serversupplied_infoAndrew Bartlett1-30/+26
This makes everything reference a server_info->sids list, which is now a struct dom_sid *, not a struct dom_sid **. This is in keeping with the other sid lists in the security_token etc. In the process, I also tidy up the talloc tree (move more structures under their logical parents) and check for some possible overflows in situations with a pathological number of sids. Andrew Bartlett
2010-12-21s4-auth Remove duplicate copies of session_info creation codeAndrew Bartlett1-145/+11
We now just do or do not call into LDB based on some flags. This means there may be some more link time dependencies, but we seem to deal with those better now. Andrew Bartlett
2010-12-21s4-auth rework session_info handling not to require an auth contextAndrew Bartlett1-2/+2
This reverts a previous move to have this based around the auth subsystem, which just spread auth deps all over unrelated code. Andrew Bartlett
2010-08-23s4:security Change struct security_token->sids from struct dom_sid * to ↵Andrew Bartlett1-11/+15
struct dom_sid This makes the structure much more like NT_USER_TOKEN in the source3/ code. (The remaining changes are that privilages still need to be merged) Andrew Bartlett
2010-08-18s4:auth Change {anonymous,system}_session to use common session_info generationAndrew Bartlett1-4/+4
This also changes the primary group for anonymous to be the anonymous SID, and adds code to detect and ignore this when constructing the token. Andrew Bartlett
2010-08-18s4:auth Remove system_session_anon() from python bindingsAndrew Bartlett1-28/+3
2010-08-18s4:auth Remove the system:anonymous parameter used for the LDAP backendAndrew Bartlett1-10/+4
This isn't needed any more, and just introduces complexity.
2010-08-18s4:auth Remove special case constructor for admin_session()Andrew Bartlett1-63/+13
There isn't a good reason why this code is duplicated. Andrew Bartlett
2010-08-18s4:security Remove use of user_sid and group_sid from struct security_tokenAndrew Bartlett1-10/+5
This makes the structure more like Samba3's NT_USER_TOKEN
2010-07-16s4-loadparm: 2nd half of lp_ to lpcfg_ conversionAndrew Tridgell1-7/+7
this converts all callers that use the Samba4 loadparm lp_ calling convention to use the lpcfg_ prefix. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-07-14Fixed system_session_anon to actually make an anonymous sessionNadezhda Ivanova1-1/+1
It seems that because the flag is false, this always used the supplied credentials rhather than establish anonymous connection.
2010-05-21s4:auth Remove un-needed headers.Andrew Bartlett1-1/+0
2010-05-20s4:auth Change auth_generate_session_info to take flagsAndrew Bartlett1-6/+6
This allows us to control what groups should be added in what use cases, and in particular to more carefully control the introduction of the 'authenticated' group. In particular, in the 'service_named_pipe' protocol, we do not have control over the addition of the authenticated users group, so we key of 'is this user the anonymous SID'. This also takes more care to allocate the right length ptoken->sids Andrew Bartlett
2010-04-14s4:auth Change auth_generate_session_info to take an auth contextAndrew Bartlett1-5/+5
The auth context was in the past only for NTLM authentication, but we need a SAM, an event context and and loadparm context for calculating the local groups too, so re-use that infrustructure we already have in place. However, to avoid problems where we may not have an auth_context (in torture tests, for example), allow a simpler 'session_info' to be generated, by passing this via an indirection in gensec and an generate_session_info() function pointer in the struct auth_context. In the smb_server (for old-style session setups) we need to change the async context to a new 'struct sesssetup_context'. This allows us to use the auth_context in processing the authentication reply . Andrew Bartlett
2010-04-14s4:auth Allow the simple 'struct auth_session_info' generator for all usersAndrew Bartlett1-3/+3
This code isn't ideal, but it is better than needing to consult the main SamDB in things like a torture test. Andrew Bartlett
2010-04-11s4:auth Remove event context from anonymous_session()Andrew Bartlett1-5/+114
This should always return a simple structure with no need to consult a DB, so remove the event context, and simplfy to call helper functions that don't look at privilages. Andrew Bartlett
2010-02-25s4:auth - make some parts "signed-safe"Matthias Dieter Wallnöfer1-4/+4
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-10-23s4-dsdb: create a static system_session contextAndrew Tridgell1-5/+20
This patch adds a system_session cache, preventing us from having to recreate it on every ldb open, and allowing us to detect when the same session is being used in ldb_wrap
2009-09-09Added "admin_session" method.Nadezhda Ivanova1-0/+191
The purpose of admin_session is to be able to execute parts of provisioning as the user Administrator in order to have the correct group and owner in the security descriptors. To be used for provisioning and tests only.
2008-11-02Fix the build.Jelmer Vernooij1-0/+1
2008-04-24Add documentation to session token functions.Andrew Bartlett1-3/+4
(This used to be commit ec4a108d1d35cd4bb2170f1bb122546266b9b745)
2007-12-21r26430: require explicit specification of loadparm context.Jelmer Vernooij1-1/+1
(This used to be commit 1b947fe0e6e16318e5a8127bb4932d6b5d20bcf6)
2007-12-21r26252: Specify loadparm_context explicitly when creating sessions.Jelmer Vernooij1-5/+7
(This used to be commit 7280c1e9415daabb2712db1372e23f9846272ede)
2007-12-21r26235: Avoid global_loadparm.Jelmer Vernooij1-3/+5
(This used to be commit e9039782204389cc827e76da319d5ccf6d33be46)
2007-12-21r26234: More global_loadparm fixes.Jelmer Vernooij1-4/+4
(This used to be commit 84892d030de6266fc0f3a699cade960dd5dc37bc)
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 04:40:40 +0000