summaryrefslogtreecommitdiff
path: root/source4/dsdb/common
AgeCommit message (Collapse)AuthorFilesLines
2026-04-08dsdb: use wellknow object IDs for new user and computer objectsBjörn Jacke1-6/+13
this allows redirusr and redircmp to work as expected BUG: https://bugzilla.samba.org/show_bug.cgi?id=9143 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Bjoern Jacke <bjacke@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Apr 8 15:41:21 UTC 2026 on atb-devel-224
2026-02-25dsdb: Simplify samdb_cn_to_lDAPDisplayName()Volker Lendecke1-9/+1
Use GUID_buf_string(), dom_sid_str_buf() and talloc_asprintf_addbuf() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2026-02-25dsdb: Simplify drs_ObjectIdentifier_to_debug_string()Volker Lendecke1-13/+10
Use GUID_buf_string(), dom_sid_str_buf() and talloc_asprintf_addbuf() Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2026-02-25dsdb: Simplify samdb_dn_to_dns_domain() with talloc_asprintf_addbuf()Volker Lendecke1-11/+9
Only check for NULL once Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Martin Schwenke <martin@meltin.net>
2025-10-10s4:dsdb:audit_log log auth info changesGary Lockyer1-0/+12
Log changes to altSecurityIdentities, dNSHostName, msDS-additionalDnsHostNames and servicePrincipal name in the same way that changes to mdDS-keyCredentialLink changes are logged. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-02-22s4:dsdb/common: add dsdb_trust_get_claims_tf_policy()Stefan Metzmacher1-0/+110
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22s4:dsdb/common: let dsdb_trust_merge_forest_info() handle SCANNER and BINARY ↵Stefan Metzmacher1-0/+50
records Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22s4:dsdb/common: let dsdb_trust_normalize_forest_info_step2() handle SCANNER ↵Stefan Metzmacher1-0/+93
and BINARY records Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22s4:dsdb/common: let dsdb_trust_normalize_forest_info_step1() handle BINARY ↵Stefan Metzmacher1-0/+27
and SCANNER records Note for scanner records we need to filter out duplicates, but binary records may exist multiple times. Review with: git show -w Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22s4:dsdb/common: let dsdb_trust_forest_info_add_record() handle BINARY and ↵Stefan Metzmacher1-7/+38
SCANNER records Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22s4:dsdb/util_trusts: convert most functions from lsa_ForestTrustInformation ↵Stefan Metzmacher1-68/+67
to lsa_ForestTrustInformation2 We use trust_forest_info_lsa_{1to2,2to1}() where needed. This will make it possible to support FOREST_TRUST_BINARY_DATA and FOREST_TRUST_SCANNER_INFO later. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22s4:dsdb/common: add dsdb_trust_default_forest_info()Stefan Metzmacher1-0/+58
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22dsdb:util_trusts: replace dsdb_trust_find_tln[_ex]_match() with ↵Stefan Metzmacher1-90/+8
trust_forest_info_tln[_ex]_match() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22dsdb:util_trusts: remove unused dsdb_trust_forest_info_{from,to}_lsa()Stefan Metzmacher1-229/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-22dsdb:util_trusts: make use of trust_forest_info_to_lsa()Stefan Metzmacher1-1/+2
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-14s4:dsdb/common: simplify the logic in dsdb_expand_nested_groups()Stefan Metzmacher1-2/+4
By using (struct auth_SidAttr) {} we make sure struct auth_SidAttr can change without leaving uninitialized memory. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-14s4:dsdb/common: use talloc_zero() in samdb_result_dom_sid_attrs()Stefan Metzmacher1-1/+1
This means struct auth_SidAttr can change without leaving uninitialized memory. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-02-08s4:dsdb/common: check for valid netbios name length for trustsStefan Metzmacher1-0/+8
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2025-02-04s3,s4: Make case spelling of sAMAccountName consistentPavel Filipenský1-2/+2
Signed-off-by: Pavel Filipenský <pfilipensky@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2025-01-29dsdb:util_trusts: remove unused copy of dns_cmp()Stefan Metzmacher1-174/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2025-01-08s4:dsdb: fix logic of dsdb_trust_routing_by_name()Stefan Metzmacher1-13/+13
We need to use the longest dnsname match as possible. If we are the domain samba.example.com and have a trust to example.com, a routing request for dc.samba.example.com should return the tdo for samba.example.com instead of example.com. I reproduced the problem with the following diff: > diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm > index 15d7692b5d64..6e9595b784c4 100644 > --- a/selftest/target/Samba.pm > +++ b/selftest/target/Samba.pm > @@ -564,7 +564,7 @@ sub realm_to_ip_mappings > 'samba2000.example.com' => 'dc5', > 'samba2003.example.com' => 'dc6', > 'samba2008r2.example.com' => 'dc7', > - 'addom.samba.example.com' => 'addc', > + 'addom.samba2008r2.example.com' => 'addc', > 'addom2.samba.example.com' => 'addcsmb1', > 'sub.samba.example.com' => 'localsubdc', > 'chgdcpassword.samba.example.com' => 'chgdcpass', > diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm > index 0e4cf50235c3..6bca0cfd0c89 100755 > --- a/selftest/target/Samba4.pm > +++ b/selftest/target/Samba4.pm > @@ -2631,7 +2631,7 @@ sub setup_fl2008r2dc > return undef; > } > > - $env = $self->setup_trust($env, $ad_dc_vars, "forest", ""); > + $env = $self->setup_trust($env, $ad_dc_vars, "forest", "--skip-validation"); > if (!defined $env) { > return undef; > } > @@ -2843,7 +2843,7 @@ sub _setup_ad_dc > $server = "addc"; > } > if (!defined($dom)) { > - $dom = "addom.samba.example.com"; > + $dom = "addom.samba2008r2.example.com"; > } > my $env = $self->provision_ad_dc($path, $server, "ADDOMAIN", > $dom, and running: make -j testenv SELFTEST_TESTENV="fl2008r2dc:local" Inside the testenv: bin/smbclient //addc.addom.samba2008r2.example.com/netlogon \ -U$TRUST_USERNAME@$TRUST_REALM%$TRUST_PASSWORD \ --use-kerberos=required \ -c 'ls' It lets the KDC of ADDOM.SAMBA2008R2.EXAMPLE.COM to generate a (referral) ticket for krbtgt/SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA2008R2.EXAMPLE.COM instead of cifs/addc.addom.samba2008r2.example.com@ADDOM.SAMBA2008R2.EXAMPLE.COM As ADDOM.SAMBA2008R2.EXAMPLE.COM has a forest trust (without msDS-TrustForestTrustInfo) to SAMBA2008R2.EXAMPLE.COM dsdb_trust_update_best_tln() overwrote the best match of addom.samba2008r2.example.com with samba2008r2.example.com. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15778 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Jan 8 04:14:47 UTC 2025 on atb-devel-224
2024-10-30s4:dsdb/common: dsdb_trust_get_incoming_passwords only needs a const ldb_messageStefan Metzmacher1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-10-30s4:dsdb/common: samdb_confirm_rodc_allowed_to_repl_to() only needs a const sidStefan Metzmacher1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-07-02s4:dsdb: Remove unnecessary MIN()Jo Sutton1-1/+1
Since we have ensured that val->length >= sizeof(hash->hash), MIN(val->length, sizeof(hash->hash)) will here always be equal to sizeof(hash->hash). Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-07-02s4:dsdb: Use appropriate type for userAccountControl flagsJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Martin Schwenke <martin@meltin.net>
2024-06-10dsdb: Prepare to handle smartcard password rolloverAndrew Bartlett1-0/+10
We do this by allowing the password change control to indicate that the password is to be randomised, bypassing the quality checks (as true random passwords often fail these) and re-randomising with the same code as is used for the KDC. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-06-10dsdb: Make argument order of dsdb_update_gmsa_{entry_,}keys() consistant ↵Andrew Bartlett1-1/+1
with other uses Other functions in this file are TALLOC_CTX, struct ldb_context *, not the other way around. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-05-22ldb-samba: use ldb_comparison_fold_utf8()Douglas Bagnall1-3/+3
This means ldb-samba/dsdb comparisons will be case-insensitive for non-ASCII UTF-8 characters (within the bounds of the 16-bit casefold table). And they will remain transitive. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16s4:dsdb: Make map containing default attribute values staticJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16s4:dsdb: Do not set lockoutTime for trust accountsJo Sutton1-1/+3
This matches the behaviour of Windows. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-16s4:dsdb: Add userAccountControl helper functionJo Sutton1-0/+10
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07s4:dsdb:util_trusts: simplify the NULL case in dns_cmpDouglas Bagnall1-5/+11
In this comparison function a NULL string is treated as the ancestor of all names, but you need to look hard to see that. By pulling the logic for NULLs to the front, hopefully we have to look less hard. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-07s4:dsdb:util_trusts: describe dns_cmp return valuesDouglas Bagnall1-0/+16
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23Fix a few "might be uninitialized" errorsVolker Lendecke1-1/+1
I've seen them with clang Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Tue Apr 23 19:02:10 UTC 2024 on atb-devel-224
2024-04-23s4:dsdb: fix spelling in commentDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-21s4:dsdb: Implement DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS search flagJo Sutton1-52/+97
View with ‘git show -b’. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-03-28s4-dsdb: Populate new GKDI root keys from the server configuration objectAndrew Bartlett1-3/+3
This honours MS-GKDI 3.1.4.1.1 Creating a New Root Key Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2024-03-05lib/ldb-samba: Align py_ldb_set_opaque_integer() with pyldb_set_opaque() and ↵Andrew Bartlett1-7/+7
use "unsigned long long" We need to change the internal types assumed in Samba for the opaque integers to "unsigned long long" as this is what ldb.set_opaque() will create, and we want to move to this interface rather than have a duplicate. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-02-16s4:dsdb: Fix grammarJo Sutton1-1/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Feb 16 03:47:12 UTC 2024 on atb-devel-224
2024-02-16s4:dsdb: Add function to create a GMSA password update requestJo Sutton1-0/+62
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Remove unused includesJo Sutton1-7/+0
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Add dsdb_werror() macroJo Sutton1-0/+3
This works like dsdb_module_werror(), but does not require an ldb module to work. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Add search flag indicating that gMSA passwords are to be updatedJo Sutton1-0/+1
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Include missing headersJo Sutton1-0/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Remove unused ‘domain_dn’ parameterJo Sutton1-4/+4
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Remove reference to now‐gone lmNewHash parameterJo Sutton1-10/+8
This parameter was removed in commit 75c54d54ad9fdff7098c1b4f11252528f35ea658. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Split out function to create a ‘password set’ ldb requestJo Sutton1-24/+51
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Allocate NT hash on to more appropriate memory contextJo Sutton1-1/+1
The NT hash should live at least as long as the message to which it is added. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Undefine helper macroJo Sutton1-0/+2
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16s4:dsdb: Add helper functions to get GKDI root key DNsJo Sutton1-0/+83
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 09:03:08 +0000