The branch, master has been updated
via 677e0fb9659abe1ad684dd980d61b88caad9f8a2 (commit)
via 180245fce0f0d73d924ca6a25db3fc78934c40d1 (commit)
from 0f38bd90722469c6dbf1bcc7f56d3fbf6db3a8e8 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 677e0fb9659abe1ad684dd980d61b88caad9f8a2
Author: Stefan Metzmacher <[EMAIL PROTECTED]>
Date: Thu Dec 4 15:40:31 2008 +0100
s4:kludge_acl: allow everybody to read the sequence number
metze
commit 180245fce0f0d73d924ca6a25db3fc78934c40d1
Author: Stefan Metzmacher <[EMAIL PROTECTED]>
Date: Thu Dec 4 15:09:21 2008 +0100
s4:kdc: allow a trusted domain to get kerberos tickets
metze
-----------------------------------------------------------------------
Summary of changes:
source4/auth/auth.h | 3 +-
source4/auth/ntlm/auth_sam.c | 3 +-
source4/auth/sam.c | 12 ++++++----
source4/dsdb/samdb/ldb_modules/kludge_acl.c | 28 ++++++++++++++++++++++++++-
source4/kdc/pac-glue.c | 3 +-
5 files changed, 40 insertions(+), 9 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source4/auth/auth.h b/source4/auth/auth.h
index af9ed52..360da50 100644
--- a/source4/auth/auth.h
+++ b/source4/auth/auth.h
@@ -204,7 +204,8 @@ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
struct ldb_message *msg,
struct ldb_message *msg_domain_ref,
const char *logon_workstation,
- const char *name_for_logs);
+ const char *name_for_logs,
+ bool allow_domain_trust);
struct auth_session_info *system_session(TALLOC_CTX *mem_ctx, struct
loadparm_context *lp_ctx);
NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_context
*sam_ctx,
const char *netbios_name,
diff --git a/source4/auth/ntlm/auth_sam.c b/source4/auth/ntlm/auth_sam.c
index d1be5b6..384d342 100644
--- a/source4/auth/ntlm/auth_sam.c
+++ b/source4/auth/ntlm/auth_sam.c
@@ -262,7 +262,8 @@ static NTSTATUS authsam_authenticate(struct auth_context
*auth_context,
msgs[0],
msgs_domain_ref[0],
user_info->workstation_name,
- user_info->mapped.account_name);
+ user_info->mapped.account_name,
+ false);
return nt_status;
}
diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index f6a998a..4b848cf 100644
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -144,7 +144,8 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
struct ldb_message *msg,
struct ldb_message *msg_domain_ref,
const char *logon_workstation,
- const char *name_for_logs)
+ const char *name_for_logs,
+ bool allow_domain_trust)
{
uint16_t acct_flags;
const char *workstation_list;
@@ -231,11 +232,12 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
return NT_STATUS_INVALID_LOGON_HOURS;
}
- if (acct_flags & ACB_DOMTRUST) {
- DEBUG(2,("sam_account_ok: Domain trust account %s denied by
server\n", name_for_logs));
- return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
+ if (!allow_domain_trust) {
+ if (acct_flags & ACB_DOMTRUST) {
+ DEBUG(2,("sam_account_ok: Domain trust account %s
denied by server\n", name_for_logs));
+ return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
+ }
}
-
if (!(logon_parameters & MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT)) {
if (acct_flags & ACB_SVRTRUST) {
DEBUG(2,("sam_account_ok: Server trust account %s
denied by server\n", name_for_logs));
diff --git a/source4/dsdb/samdb/ldb_modules/kludge_acl.c
b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
index 6acbf45..97179a8 100644
--- a/source4/dsdb/samdb/ldb_modules/kludge_acl.c
+++ b/source4/dsdb/samdb/ldb_modules/kludge_acl.c
@@ -417,6 +417,32 @@ static int kludge_acl_change(struct ldb_module *module,
struct ldb_request *req)
}
}
+static int kludge_acl_extended(struct ldb_module *module, struct ldb_request
*req)
+{
+ enum security_user_level user_type;
+
+ /* allow everybody to read the sequence number */
+ if (strcmp(req->op.extended.oid,
+ LDB_EXTENDED_SEQUENCE_NUMBER) == 0) {
+ return ldb_next_request(module, req);
+ }
+
+ user_type = what_is_user(module);
+
+ switch (user_type) {
+ case SECURITY_SYSTEM:
+ case SECURITY_ADMINISTRATOR:
+ return ldb_next_request(module, req);
+ default:
+ ldb_asprintf_errstring(module->ldb,
+ "kludge_acl_change: "
+ "attempted database modify not
permitted. "
+ "User %s is not SYSTEM or an
administrator",
+ user_name(req, module));
+ return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
+ }
+}
+
static int kludge_acl_init(struct ldb_module *module)
{
int ret, i;
@@ -494,6 +520,6 @@ _PUBLIC_ const struct ldb_module_ops
ldb_kludge_acl_module_ops = {
.modify = kludge_acl_change,
.del = kludge_acl_change,
.rename = kludge_acl_change,
- .extended = kludge_acl_change,
+ .extended = kludge_acl_extended,
.init_context = kludge_acl_init
};
diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 3f1c1fc..74bec85 100644
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -270,13 +270,14 @@ krb5_error_code samba_kdc_check_client_access(void *priv,
}
}
+ /* we allow all kinds of trusts here */
nt_status = authsam_account_ok(tmp_ctx,
private->samdb,
MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
private->msg,
private->realm_ref_msg,
workstation,
- name);
+ name, true);
free(name);
if (NT_STATUS_IS_OK(nt_status))
--
Samba Shared Repository
