r23680: Make it easier to setup a domain member server - the 'server role'

will now control the auth methods, but an override is still available,
ex:

auth methods:domain controller = <methods>

Andrew Bartlett
(This used to be commit b7e727186ed8eda6a68c873e089f655dc24fe8ae)

diff --git a/source4/auth/auth.c b/source4/auth/auth.c
index 9100891d5248d0dfb9c3327a06bb2fa39d3275f8..8a933c7dd0716103ce37e723ea8cfe0c853014de 100644 (file)
--- a/source4/auth/auth.c
+++ b/source4/auth/auth.c
@@ -348,11 +348,12 @@ NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
 
 /***************************************************************************
  Make a auth_info struct for the auth subsystem
+ - Allow the caller to specify the methods to use
 ***************************************************************************/
-NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx, const char **methods, 
-                            struct event_context *ev,
-                            struct messaging_context *msg,
-                            struct auth_context **auth_ctx)
+NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods, 
+                                    struct event_context *ev,
+                                    struct messaging_context *msg,
+                                    struct auth_context **auth_ctx)
 {
        int i;
        struct auth_context *ctx;
@@ -406,6 +407,30 @@ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx, const char **methods,
 
        return NT_STATUS_OK;
 }
+/***************************************************************************
+ Make a auth_info struct for the auth subsystem
+ - Uses default auth_methods, depending on server role and smb.conf settings
+***************************************************************************/
+NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx, 
+                            struct event_context *ev,
+                            struct messaging_context *msg,
+                            struct auth_context **auth_ctx)
+{
+       const char **auth_methods = NULL;
+       switch (lp_server_role()) {
+       case ROLE_STANDALONE:
+               auth_methods = lp_parm_string_list(-1, "auth methods", "standalone", NULL);
+               break;
+       case ROLE_DOMAIN_MEMBER:
+               auth_methods = lp_parm_string_list(-1, "auth methods", "member server", NULL);
+               break;
+       case ROLE_DOMAIN_CONTROLLER:
+               auth_methods = lp_parm_string_list(-1, "auth methods", "domain controller", NULL);
+               break;
+       }
+       return auth_context_create_methods(mem_ctx, auth_methods, ev, msg, auth_ctx);
+}
+
 
 /* the list of currently registered AUTH backends */
 static struct auth_backend {

diff --git a/source4/auth/auth_simple.c b/source4/auth/auth_simple.c
index 59e1280ee5c6708925f5fae220f156bfe9942bea..5e1bcc2b8c21c9c3918a6f35869d80530656c891 100644 (file)
--- a/source4/auth/auth_simple.c
+++ b/source4/auth/auth_simple.c
@@ -48,7 +48,7 @@ _PUBLIC_ NTSTATUS authenticate_username_pw(TALLOC_CTX *mem_ctx,
                return NT_STATUS_NO_MEMORY;
        }
 
-       nt_status = auth_context_create(tmp_ctx, lp_auth_methods(),
+       nt_status = auth_context_create(tmp_ctx, 
                                        ev, msg,
                                        &auth_context);
        if (!NT_STATUS_IS_OK(nt_status)) {

diff --git a/source4/auth/ntlmssp/ntlmssp_server.c b/source4/auth/ntlmssp/ntlmssp_server.c
index 93103b9cbd6099bd1e5597a9665f7201671f75ba..4bb37abefca489efb269a6c42b9afdbe3e82e876 100644 (file)
--- a/source4/auth/ntlmssp/ntlmssp_server.c
+++ b/source4/auth/ntlmssp/ntlmssp_server.c
@@ -835,7 +835,7 @@ NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_security)
                gensec_ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
        }
 
-       nt_status = auth_context_create(gensec_ntlmssp_state, lp_auth_methods(), 
+       nt_status = auth_context_create(gensec_ntlmssp_state, 
                                        gensec_security->event_ctx,
                                        gensec_security->msg_ctx,
                                        &gensec_ntlmssp_state->auth_context);

diff --git a/source4/param/loadparm.c b/source4/param/loadparm.c
index 9bcf9aada7e3381958f27a151e4a06465f28c680..8371b94a5033e87849a3e363197501702cb863f3 100644 (file)
--- a/source4/param/loadparm.c
+++ b/source4/param/loadparm.c
@@ -398,7 +398,6 @@ static struct parm_struct parm_table[] = {
        {"Security Options", P_SEP, P_SEPARATOR},
        
        {"security", P_ENUM, P_GLOBAL, &Globals.security, NULL, enum_security, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER},
-       {"auth methods", P_LIST, P_GLOBAL, &Globals.AuthMethods, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER},
        {"encrypt passwords", P_BOOL, P_GLOBAL, &Globals.bEncryptPasswords, NULL, NULL, FLAG_BASIC | FLAG_ADVANCED | FLAG_WIZARD | FLAG_DEVELOPER},
        {"null passwords", P_BOOL, P_GLOBAL, &Globals.bNullPasswords, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER},
        {"obey pam restrictions", P_BOOL, P_GLOBAL, &Globals.bObeyPamRestrictions, NULL, NULL, FLAG_ADVANCED | FLAG_DEVELOPER},
@@ -609,7 +608,9 @@ static void init_globals(void)
        do_parameter("dcerpc endpoint servers", "epmapper srvsvc wkssvc rpcecho samr netlogon lsarpc spoolss drsuapi winreg dssetup unixinfo", NULL);
        do_parameter("server services", "smb rpc nbt wrepl ldap cldap web kdc drepl winbind", NULL);
        do_parameter("ntptr providor", "simple_ldb", NULL);
-       do_parameter("auth methods", "anonymous sam_ignoredomain", NULL);
+       do_parameter("auth methods:domain controller", "anonymous sam_ignoredomain", NULL);
+       do_parameter("auth methods:member server", "anonymous sam winbind", NULL);
+       do_parameter("auth methods:standalone", "anonymous sam_ignoredomain", NULL);
        do_parameter("private dir", dyn_PRIVATE_DIR, NULL);
        do_parameter("sam database", "sam.ldb", NULL);
        do_parameter("secrets database", "secrets.ldb", NULL);

diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 4e699cdc4968d114ba217180ea89b5ed759bf7f4..d0cadefb84f295da58c4e1d169b58bb4a9dd98e2 100644 (file)
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -431,7 +431,7 @@ static NTSTATUS dcesrv_netr_LogonSamLogon_base(struct dcesrv_call_state *dce_cal
                }
 
                /* TODO: we need to deny anonymous access here */
-               nt_status = auth_context_create(mem_ctx, lp_auth_methods(),
+               nt_status = auth_context_create(mem_ctx, 
                                                dce_call->event_ctx, dce_call->msg_ctx,
                                                &auth_context);
                NT_STATUS_NOT_OK_RETURN(nt_status);
@@ -457,7 +457,7 @@ static NTSTATUS dcesrv_netr_LogonSamLogon_base(struct dcesrv_call_state *dce_cal
        case 6:
 
                /* TODO: we need to deny anonymous access here */
-               nt_status = auth_context_create(mem_ctx, lp_auth_methods(),
+               nt_status = auth_context_create(mem_ctx, 
                                                dce_call->event_ctx, dce_call->msg_ctx,
                                                &auth_context);
                NT_STATUS_NOT_OK_RETURN(nt_status);

diff --git a/source4/scripting/ejs/smbcalls_auth.c b/source4/scripting/ejs/smbcalls_auth.c
index 7b9fe2fc17644ec898d1383710476c44e8ec15c6..5509e78357c9c065ffc678127140c38113ad9ed7 100644 (file)
--- a/source4/scripting/ejs/smbcalls_auth.c
+++ b/source4/scripting/ejs/smbcalls_auth.c
@@ -56,7 +56,7 @@ static int ejs_doauth(MprVarHandle eid,
                msg = messaging_client_init(tmp_ctx, ev);
        }
 
-       nt_status = auth_context_create(tmp_ctx, auth_types, ev, msg, &auth_context);
+       nt_status = auth_context_create_methods(tmp_ctx, auth_types, ev, msg, &auth_context);
        if (!NT_STATUS_IS_OK(nt_status)) {
                mprSetPropertyValue(auth, "result", mprCreateBoolVar(False));
                mprSetPropertyValue(auth, "report", mprString("Auth System Failure"));

diff --git a/source4/selftest/Samba4.pm b/source4/selftest/Samba4.pm
index e7daf7aece672fc200cd91ab6288bb360f117ef6..07ed12a80f8be2a0b38d3b49d116ba9560c535ca 100644 (file)
--- a/source4/selftest/Samba4.pm
+++ b/source4/selftest/Samba4.pm
@@ -276,8 +276,6 @@ sub provision($$$$$$)
        mkdir($_, 0777) foreach ($privatedir, $etcdir, $piddir, $ncalrpcdir, $lockdir, 
                $tmpdir);
 
-       my $auth_methods = "anonymous sam_ignoredomain";
-       $auth_methods = "anonymous sam winbind" if $server_role eq "member server";
 
        my $localdomain = $domain;
        $localdomain = $netbiosname if $server_role eq "member server";
@@ -304,7 +302,6 @@ sub provision($$$$$$)
        panic action = $srcdir/script/gdb_backtrace \%PID% \%PROG%
        wins support = yes
        server role = $server_role
-       auth methods = $auth_methods
        max xmit = 32K
        server max protocol = SMB2
        notify:inotify = false

diff --git a/source4/smb_server/smb/negprot.c b/source4/smb_server/smb/negprot.c
index bd6a0d63a362948a47c6057a3584f60fbdd0f728..6295337ba91a0c41425c8a6ee452b2c1c41dd89d 100644 (file)
--- a/source4/smb_server/smb/negprot.c
+++ b/source4/smb_server/smb/negprot.c
@@ -44,7 +44,7 @@ static NTSTATUS get_challenge(struct smbsrv_connection *smb_conn, uint8_t buff[8
 
        DEBUG(10, ("get challenge: creating negprot_global_auth_context\n"));
 
-       nt_status = auth_context_create(smb_conn, lp_auth_methods(), 
+       nt_status = auth_context_create(smb_conn, 
                                        smb_conn->connection->event.ctx,
                                        smb_conn->connection->msg_ctx,
                                        &smb_conn->negotiate.auth_context);

diff --git a/source4/smb_server/smb/sesssetup.c b/source4/smb_server/smb/sesssetup.c
index 2e9403b10ae722c949a579a1cf07c68126637f39..532869f862c7a619582b0391eb11f874ebbc806d 100644 (file)
--- a/source4/smb_server/smb/sesssetup.c
+++ b/source4/smb_server/smb/sesssetup.c
@@ -243,7 +243,7 @@ static void sesssetup_nt1(struct smbsrv_request *req, union smb_sesssetup *sess)
                }
 
                /* TODO: should we use just "anonymous" here? */
-               status = auth_context_create(req, lp_auth_methods(), 
+               status = auth_context_create(req, 
                                             req->smb_conn->connection->event.ctx,
                                             req->smb_conn->connection->msg_ctx,
                                             &auth_context);