summaryrefslogtreecommitdiff
path: root/source4/auth
AgeCommit message (Collapse)AuthorFilesLines
2026-01-15s4:auth: Implement ‘krb5 acceptor report canonical client name’ option ↵Jennifer Sutton1-0/+4
for Heimdal Adjust tests to match the new behaviour. The implementation is simply to set a flag that is already present in upstream Heimdal. Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2026-01-07lib: Don't call a function to initialize an empty DATA_BLOBVolker Lendecke3-5/+5
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-11-13s4:kdc always include the PACGary Lockyer1-0/+13
Set the heimdal always_include_pac configuration flag, based on the samba kdc always include pac option Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Thu Nov 13 23:12:55 UTC 2025 on atb-devel-224
2025-10-17Add missing include needed for cmocka.hAndreas Schneider1-0/+1
This will be required in future. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-10-10s4:kdc:sdb Support Windows flexible cert mappingsGary Lockyer1-1/+3
Extract certificate mappings from the altSecurityIdentities attribute and populate the new sdb_certificate_mappings element of sdb Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-09-16s4:auth:sam Fix key trust attribute nameGary Lockyer1-1/+1
Use the correct attribute name for the key trust credentials, msDS-KeyCredentialLink. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-09-11s4:auth: Fix 'no delegation' logic in gensec_gssapi_start()Andreas Schneider1-1/+1
This fixes samba4.ntvfs.cifs.krb5.base.lock test with MIT Kerberos. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15912 Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-09-11s4:auth: Fix trailing white spaces in gensec_gssapi.cAndreas Schneider1-121/+121
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org>
2025-07-29s4:kdc Support for key trust authenticationGary Lockyer1-1/+3
Extract the public kes from msDS-KeyCredentialLink and populate the sdb structure. These values can then be passed to Kergeros to allow key trust authentication. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Tue Jul 29 05:31:10 UTC 2025 on atb-devel-224
2025-04-03s4:auth/ntlm: let auth_winbind pass WB_SAMLOGON_FOR_NETLOGONStefan Metzmacher1-0/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-04-03s4:auth: let auth_context_create_for_netlogon() remember for_netlogon = true;Stefan Metzmacher1-1/+6
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-03-06s4:auth: let auth_user_info_dc_expand_sids() add This Organization SIDStefan Metzmacher1-0/+38
We do that unless the Other Organization SID is already there. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Thu Mar 6 17:35:50 UTC 2025 on atb-devel-224
2025-02-22s4:auth: avoid talloc_reference in claims_data_encoded_claims_set()Stefan Metzmacher1-8/+6
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-14s4:auth: simplify authsam_make_user_info_dc()Stefan Metzmacher1-8/+17
By using (struct auth_SidAttr) {} we don't leave uninitialized memory if struct auth_SidAttr changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: let authsam_make_user_info_dc() use helper variables for the rodcsidStefan Metzmacher1-3/+7
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: let authsam_make_user_info_dc() use helper variables for the groupsidStefan Metzmacher1-2/+8
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: let auth_domain_admin_user_info_dc() use talloc_zero_array(struct ↵Stefan Metzmacher1-1/+7
auth_SidAttr) This means we won't leave uninitialized memory if struct auth_SidAttr changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: simplify auth_anonymous_user_info_dc()Stefan Metzmacher1-2/+4
By using (struct auth_SidAttr) {} we don't leave uninitialized memory if struct auth_SidAttr changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: simplify auth_system_user_info_dc()Stefan Metzmacher1-2/+4
By using (struct auth_SidAttr) {} we don't leave uninitialized memory if struct auth_SidAttr changes. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: let auth_generate_security_token() use ↵Stefan Metzmacher1-46/+14
auth_user_info_dc_expand_sids() for device_info This means we'll also expand local groups for the device, which was missing before. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth: split auth_user_info_dc_expand_sids() out of ↵Stefan Metzmacher1-71/+140
auth_generate_security_token() This way we'll be able to reuse it for the device sids in the next commit. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:auth/ntlm: simplifiy logic in name_to_ntstatus_check_password()Stefan Metzmacher1-2/+4
Using (struct auth_SidAttr) {} means we won't leave uninitialized memory arround if struct auth_SidAttr will change in the following commits. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-01-15s4:auth/ntlm: let authsam_check_password_internals() add NETLOGON_NTLMV2_ENABLEDStefan Metzmacher1-0/+1
Windows returns NETLOGON_NTLMV2_ENABLED in all netr_LogonSamLogon* response messages. Even if NTLMv1 was actually used and also for password authentication. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15783 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-12-05gensec: add GENSEC_FEATURE_NO_DELEGATION flag to avoid GSS_C_DELEG[_POLICY]_FLAGStefan Metzmacher1-0/+4
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-10-02auth4: Fix CID 1034877 Resource leakVolker Lendecke1-0/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Wed Oct 2 14:19:08 UTC 2024 on atb-devel-224
2024-07-02s4:auth: Correct order of parameters in documentationJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-07-02s4:auth: Use appropriate type for userAccountControl flagsJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-06-11s4:auth: Handle expired accounts in authsam_account_ok() (CID 1603594)Jo Sutton1-1/+1
We check the ACB_PW_EXPIRED bit to determine whether the account is expired. Since ACB_PW_EXPIRED can’t be represented in a 16‐bit integer, we must increase the width of acct_flags so as not to lose that bit. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-06-11s4:auth: Add temporary memory context to authsam_reread_user_logon_data()Jo Sutton1-2/+9
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-06-11s4:auth: Add common out path to authsam_reread_user_logon_data()Jo Sutton1-7/+9
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-06-10s4-auth: Use consistant externally-supplied time in auth stackAndrew Bartlett3-10/+21
This makes the time during authentication stay consistent in the KDC and follows the fake time when we are testing gMSA accounts. By having the account expiry follow exactly the same clock as the password expiry we can hope for less supprises. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-06-10s4-auth: Use msDS-User-Account-Control-Computed for PW expiry checkAndrew Bartlett1-1/+1
This centralises the check rather than checking the time in multiple spots. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-06-10s4-auth: Update comment to mention 60mins in the NTLM grace periodAndrew Bartlett1-3/+3
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-05-22s4:libnet_export_keytab: add only_current_keys optionStefan Metzmacher1-1/+2
By default we also export on the old and older passwords... In order to do a kinit with a keytab it might we useful to include only the current keys. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16s4:auth: Accept previous gMSA password for NTLM authentication five minutes ↵Jo Sutton1-4/+22
after a password change gMSA password changes are usually triggered when the DC needs to fetch the account’s keys and notices they are out of date. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16s4:auth: Let dsdb gMSA time influence NTLM previous password allowed periodJo Sutton1-3/+6
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07s4:gensec_gssapi: make use of gensec_kerberos_possible()Stefan Metzmacher1-29/+13
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-04-24s4:kdc: Pass ldb context into samba_kdc_message2entry_keys()Jo Sutton1-0/+2
This ldb context can be used to query the current gMSA time. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-24s4:auth: Export AES128 gMSA keys along with AES256 keys by defaultJo Sutton1-1/+1
This is what an existing test expects. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:gensec_gssapi: implement channel binding supportStefan Metzmacher2-2/+76
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23Fix a few "might be uninitialized" errorsVolker Lendecke1-1/+1
I've seen them with clang Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Apr 23 19:02:10 UTC 2024 on atb-devel-224
2024-04-21s4:dsdb: Make use of DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS search flagJo Sutton1-5/+6
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21s4:auth: Update error messagesJo Sutton1-2/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21s4:auth: Allocate strings on shorter‐lived memory contextJo Sutton1-4/+4
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-21s4:auth: Fix grammar in error messageJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-14s4-auth/kerberos: Report errors observed during ↵Andrew Bartlett1-0/+1
smb_krb5_remove_obsolete_keytab_entries() Previously any errors noticed during the main loop would be ignored. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Mar 14 23:16:16 UTC 2024 on atb-devel-224
2024-03-14s4-auth/kerberos: Do not add true duplicates to exported keytabAndrew Bartlett2-3/+130
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-14s4-auth/kerberos: Note the good possability that the msDS-KeyVersionNumber ↵Andrew Bartlett1-0/+4
is wrong Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-14auth/credentials: Cope with GMSA 5min password preview in ↵Andrew Bartlett1-0/+1
cli_credentials_set_gmsa_passwords() This is unused in Samba currently, but is a subtle race that will be difficult to debug if this is ever used, so this makes things easier for some future developer. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-03-14s4-libnet: Add export of gMSA keys to "samba-tool domain exportkeytab"Andrew Bartlett1-0/+191
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 19:02:03 +0000