sharpe/samba-autobuild/.git
2 years agos4:rpc_server/netlogon: initialize pointer to NULL in dcesrv_netr_LogonSamLogon_base()
Stefan Metzmacher [Thu, 7 Jan 2016 14:59:03 +0000 (15:59 +0100)]
s4:rpc_server/netlogon: initialize pointer to NULL in dcesrv_netr_LogonSamLogon_base()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: do a real copy of strings in auth_convert_user_info_dc_sambaseinfo()
Stefan Metzmacher [Thu, 7 Jan 2016 14:46:10 +0000 (15:46 +0100)]
auth/auth_sam_reply: do a real copy of strings in auth_convert_user_info_dc_sambaseinfo()

That's much more expected by callers.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: add auth_convert_user_info_dc_saminfo2() helper function
Stefan Metzmacher [Thu, 7 Jan 2016 14:23:56 +0000 (15:23 +0100)]
auth/auth_sam_reply: add auth_convert_user_info_dc_saminfo2() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: add auth_convert_user_info_dc_saminfo6() and implement level...
Stefan Metzmacher [Thu, 7 Jan 2016 14:15:14 +0000 (15:15 +0100)]
auth/auth_sam_reply: add auth_convert_user_info_dc_saminfo6() and implement level 3 as wrapper

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/wbc_auth_util: change wbcAuthUserInfo_to_netr_SamInfo* from level 3 to 6
Stefan Metzmacher [Thu, 7 Jan 2016 14:10:26 +0000 (15:10 +0100)]
auth/wbc_auth_util: change wbcAuthUserInfo_to_netr_SamInfo* from level 3 to 6

This includes user_principal_name and dns_domain_name.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/wbc_auth_util: fill in base.logon_domain in wbcAuthUserInfo_to_netr_SamInfo3()
Stefan Metzmacher [Thu, 7 Jan 2016 14:13:09 +0000 (15:13 +0100)]
auth/wbc_auth_util: fill in base.logon_domain in wbcAuthUserInfo_to_netr_SamInfo3()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: let make_user_info_dc_netlogon_validation() correctly handle...
Stefan Metzmacher [Thu, 7 Jan 2016 14:06:46 +0000 (15:06 +0100)]
auth/auth_sam_reply: let make_user_info_dc_netlogon_validation() correctly handle level 6

We need to take care of extra sids in level 3 and 6!
And level 6 also includes user_principal_name and dns_domain_name.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/kerberos: improve error message in kerberos_pac_to_user_info_dc()
Stefan Metzmacher [Thu, 7 Jan 2016 14:01:16 +0000 (15:01 +0100)]
s4:auth/kerberos: improve error message in kerberos_pac_to_user_info_dc()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth: fill user_principal_* and dns_domain_name in authsam_make_user_info_dc()
Stefan Metzmacher [Thu, 7 Jan 2016 13:55:07 +0000 (14:55 +0100)]
s4:auth: fill user_principal_* and dns_domain_name in authsam_make_user_info_dc()

This is required in order to support netr_SamInfo6 and PAC_UPN_DNS_INFO
correctly.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth: make use of lpcfg_sam_name() in authsam_get_user_info_dc_principal()
Stefan Metzmacher [Thu, 7 Jan 2016 13:52:25 +0000 (14:52 +0100)]
s4:auth: make use of lpcfg_sam_name() in authsam_get_user_info_dc_principal()

This is more generic and matches all other places.

As this is only used in the KDC it's not a real logic change.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth.idl: add user_principal_* and dns_domain_name to auth_user_info
Stefan Metzmacher [Thu, 7 Jan 2016 13:46:24 +0000 (14:46 +0100)]
auth.idl: add user_principal_* and dns_domain_name to auth_user_info

This is required in order to support netr_SamInfo6 and PAC_UPN_DNS_INFO
correctly.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agolib/param: add lpcfg_sam_dnsname() helper function
Stefan Metzmacher [Thu, 7 Jan 2016 13:40:02 +0000 (14:40 +0100)]
lib/param: add lpcfg_sam_dnsname() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py verify the logonCount values
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py verify the logonCount values

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py validate the lastLogon and lastLogonTimestamp...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py validate the lastLogon and lastLogonTimestamp interaction

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py test with all combinations of krb5, ntlmssp...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py test with all combinations of krb5, ntlmssp and lockOutObservationWindow

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py verify more fields in _readd_user()
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py verify more fields in _readd_user()

The results differ depending on Kerberos or NTLMSSP usage
and the lockOutObservationWindow.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py copy user{name,pass} from the template in...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py copy user{name,pass} from the template in insta_creds()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use creds and other_ldb as function arguments
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use creds and other_ldb as function arguments

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use userpass variables in all functions
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use userpass variables in all functions

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use other_ldb variables instead of self.ldb3
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use other_ldb variables instead of self.ldb3

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use userdn variables in all functions
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use userdn variables in all functions

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py make use of self.addCleanup() to cleanup objects
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py make use of self.addCleanup() to cleanup objects

This is easier than doing it by hand...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use _readd_user() for testuser3 too
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use _readd_user() for testuser3 too

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py pass creds as argument to _readd_user()
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py pass creds as argument to _readd_user()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py use user{name,pass,dn} variables in _readd_user()
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py use user{name,pass,dn} variables in _readd_user()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py pass username,userpass optionally to insta_creds()
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py pass username,userpass optionally to insta_creds()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py let _readd_user() return the ldb connection...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py let _readd_user() return the ldb connection as user

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py make use of the _readd_user() helper function
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py make use of the _readd_user() helper function

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py add a _readd_user() helper function
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py add a _readd_user() helper function

This is a complete copy of the code that's currently inline.
I'm doing this in multiple steps in order to keep the diff
in a reviewable state.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py make the LDAP error string checks more useful
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py make the LDAP error string checks more useful

We should first check if the error number is as expected and
then check for a specific WERROR in the error string.

We also add the full error string as msg to assertTrue(),
so we'll actually see it if the assertion is wrong.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py cross-check the lastLogon value with samr
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py cross-check the lastLogon value with samr

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: let password_lockout.py reduce the values for lockoutDuration and...
Stefan Metzmacher [Fri, 5 Feb 2016 07:37:53 +0000 (08:37 +0100)]
s4:dsdb/tests: let password_lockout.py reduce the values for lockoutDuration and lockOutObservationWindow

This reduces the runtime of the test while still producing reliable results.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/sam: update the logonCount for interactive logons
Stefan Metzmacher [Wed, 3 Feb 2016 18:33:51 +0000 (19:33 +0100)]
s4:auth/sam: update the logonCount for interactive logons

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/sam: don't update lastLogon just because it's 0 currently
Stefan Metzmacher [Wed, 3 Feb 2016 18:33:51 +0000 (19:33 +0100)]
s4:auth/sam: don't update lastLogon just because it's 0 currently

Non interactive logons doesn't trigger an update
unless the (effective) badPwdCount is not 0 and lockoutTime is 0.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/sam: only reset badPwdCount when the effetive value is not 0 already
Stefan Metzmacher [Wed, 3 Feb 2016 18:33:51 +0000 (19:33 +0100)]
s4:auth/sam: only reset badPwdCount when the effetive value is not 0 already

Non interactive logons doesn't reset badPwdCount to 0
when the effective badPwdCount is already 0
(with (badPasswordTime + lockOutObservationWindows) < now).

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb: add some const to {samdb_result,dsdb}_effective_badPwdCount()
Stefan Metzmacher [Fri, 29 Apr 2016 11:20:12 +0000 (13:20 +0200)]
s4:dsdb: add some const to {samdb_result,dsdb}_effective_badPwdCount()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotest_pkinit_heimdal.sh: add a FILE: prefix to the KRB5CCNAME variable
Stefan Metzmacher [Fri, 3 Jun 2016 16:19:40 +0000 (18:19 +0200)]
test_pkinit_heimdal.sh: add a FILE: prefix to the KRB5CCNAME variable

This makes the tests more robust.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotest_pkinit_heimdal.sh: add a helper VARIABLE to store the certificate paths
Stefan Metzmacher [Thu, 2 Jun 2016 17:23:27 +0000 (19:23 +0200)]
test_pkinit_heimdal.sh: add a helper VARIABLE to store the certificate paths

We also don't need the separation of admincert.pem and admincertupn.pem
anymore.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool: add 'samba-tool user setpassword --smartcard-required/--clear-smartcard...
Stefan Metzmacher [Thu, 2 Jun 2016 13:15:15 +0000 (15:15 +0200)]
samba-tool: add 'samba-tool user setpassword --smartcard-required/--clear-smartcard-required'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool: do a password retype validation check for 'samba-tool user setpassword'
Stefan Metzmacher [Thu, 2 Jun 2016 12:25:12 +0000 (14:25 +0200)]
samba-tool: do a password retype validation check for 'samba-tool user setpassword'

This matches the behavior of 'samba-tool user create' and 'samba-tool user password'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamba-tool: add --smartcard-required option to 'samba-tool user create'
Stefan Metzmacher [Thu, 2 Jun 2016 12:19:37 +0000 (14:19 +0200)]
samba-tool: add --smartcard-required option to 'samba-tool user create'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agosamdb.py: add smartcard_required option to newuser()
Stefan Metzmacher [Thu, 2 Jun 2016 12:17:17 +0000 (14:17 +0200)]
samdb.py: add smartcard_required option to newuser()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: don't allow interactive password logons with UF_SMARTCARD_REQUIRED
Stefan Metzmacher [Thu, 2 Jun 2016 15:47:12 +0000 (17:47 +0200)]
s4:kdc: don't allow interactive password logons with UF_SMARTCARD_REQUIRED

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth_sam: don't allow interactive logons with UF_SMARTCARD_REQUIRED
Stefan Metzmacher [Thu, 2 Jun 2016 12:14:06 +0000 (14:14 +0200)]
s4:auth_sam: don't allow interactive logons with UF_SMARTCARD_REQUIRED

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3:winbindd: pass 'interactive' down through winbindd_dual_auth_passdb()
Stefan Metzmacher [Thu, 2 Jun 2016 16:13:40 +0000 (18:13 +0200)]
s3:winbindd: pass 'interactive' down through winbindd_dual_auth_passdb()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/common: remove unused samdb_result_force_password_change()
Stefan Metzmacher [Fri, 3 Jun 2016 22:53:45 +0000 (00:53 +0200)]
s4:dsdb/common: remove unused samdb_result_force_password_change()

The logic is incomplete and the correct logic is already available
via the constructed "msDS-UserPasswordExpiryTimeComputed" attribute.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: use "msDS-UserPasswordExpiryTimeComputed" instead of samdb_result_force_passw...
Stefan Metzmacher [Fri, 3 Jun 2016 22:48:56 +0000 (00:48 +0200)]
s4:kdc: use "msDS-UserPasswordExpiryTimeComputed" instead of samdb_result_force_password_change()

The logic in samdb_result_force_password_change() is incomplete
and the correct logic is already available via the constructed
"msDS-UserPasswordExpiryTimeComputed" attribute.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server/samr: use "msDS-UserPasswordExpiryTimeComputed" instead of samdb_result...
Stefan Metzmacher [Fri, 3 Jun 2016 22:48:56 +0000 (00:48 +0200)]
s4:rpc_server/samr: use "msDS-UserPasswordExpiryTimeComputed" instead of samdb_result_force_password_change()

The logic in samdb_result_force_password_change() is incomplete
and the correct logic is already available via the constructed
"msDS-UserPasswordExpiryTimeComputed" attribute.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:auth/sam: use "msDS-UserPasswordExpiryTimeComputed" instead of samdb_result_force_...
Stefan Metzmacher [Fri, 3 Jun 2016 22:48:56 +0000 (00:48 +0200)]
s4:auth/sam: use "msDS-UserPasswordExpiryTimeComputed" instead of samdb_result_force_password_change()

The logic in samdb_result_force_password_change() is incomplete
and the correct logic is already available via the constructed
"msDS-UserPasswordExpiryTimeComputed" attribute.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agokrb5pac.idl: add PAC_CREDENTIAL related structures
Stefan Metzmacher [Mon, 2 May 2016 06:36:39 +0000 (08:36 +0200)]
krb5pac.idl: add PAC_CREDENTIAL related structures

See [MS-PAC] 2.6 PAC Credentials.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:kdc: add some const to samba_get_logon_info_pac_blob()
Stefan Metzmacher [Fri, 13 May 2016 12:20:07 +0000 (14:20 +0200)]
s4:kdc: add some const to samba_get_logon_info_pac_blob()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agoauth/auth_sam_reply: add some const to input parameters
Stefan Metzmacher [Thu, 7 Jan 2016 13:50:27 +0000 (14:50 +0100)]
auth/auth_sam_reply: add some const to input parameters

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11441

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agotsocket: Do not dereference a NULL pointer
Andreas Schneider [Wed, 22 Jun 2016 13:36:59 +0000 (15:36 +0200)]
tsocket: Do not dereference a NULL pointer

Make sure the lrbsda pointer is not allocated and we will
not end up dereferencing a NULL pointer. In practice this
can't happen, but this change links the pointer with the
code that uses it.

Found by Coverity.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Jun 30 02:53:02 CEST 2016 on sn-devel-144

2 years agos4: ldb: Ignore case of "range" in sscanf as we've already checked for its presence.
Jeremy Allison [Tue, 28 Jun 2016 22:38:22 +0000 (15:38 -0700)]
s4: ldb: Ignore case of "range" in sscanf as we've already checked for its presence.

https://bugzilla.samba.org/show_bug.cgi?id=11838

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3-winbind: Fix memory leak with each cached credential login
Andreas Schneider [Wed, 29 Jun 2016 11:38:19 +0000 (13:38 +0200)]
s3-winbind: Fix memory leak with each cached credential login

When we allow offline logon and have a lot of logins, windbind will leak
4k of memory which each log in. On systems with heavy load this can grow
quickly and the OOM killer will kill Winbind.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11999

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Jun 29 19:03:53 CEST 2016 on sn-devel-144

2 years agoselftest: Skip the samba4.raw.eas tests
Andreas Schneider [Mon, 27 Jun 2016 09:04:48 +0000 (11:04 +0200)]
selftest: Skip the samba4.raw.eas tests

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoselftest: Skip also s4 base.createx_sharemodes_dir
Andreas Schneider [Mon, 27 Jun 2016 08:14:03 +0000 (10:14 +0200)]
selftest: Skip also s4 base.createx_sharemodes_dir

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoselftest: Remove samba4.smb2.compound tests we skip
Andreas Schneider [Mon, 27 Jun 2016 07:45:19 +0000 (09:45 +0200)]
selftest: Remove samba4.smb2.compound tests we skip

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoselftest: Remove samba4 delaywrite tests we skip
Andreas Schneider [Mon, 27 Jun 2016 07:36:24 +0000 (09:36 +0200)]
selftest: Remove samba4 delaywrite tests we skip

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoselftest: Skip s4 smb2 rename tests
Andreas Schneider [Mon, 27 Jun 2016 07:08:02 +0000 (09:08 +0200)]
selftest: Skip s4 smb2 rename tests

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoselftest: Skip the Samba4 rap tests
Andreas Schneider [Mon, 27 Jun 2016 06:49:24 +0000 (08:49 +0200)]
selftest: Skip the Samba4 rap tests

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agoselftest: Skip smbtorture_s3 tests against ntvfs
Andreas Schneider [Mon, 27 Jun 2016 06:45:15 +0000 (08:45 +0200)]
selftest: Skip smbtorture_s3 tests against ntvfs

This reduces the time our testsuite is running. We are not going to
implement these features so it doesn't make sense to run the test at
all. More will follow.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2 years agos3: tdb: On some platforms pthread_mutex_trylock() returns EBUSY not EDEADLK.
Jeremy Allison [Tue, 28 Jun 2016 19:26:40 +0000 (12:26 -0700)]
s3: tdb: On some platforms pthread_mutex_trylock() returns EBUSY not EDEADLK.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Jun 29 15:14:44 CEST 2016 on sn-devel-144

2 years agos4/selftests: test net ads dns register/unregister.
Richard Sharpe [Sun, 19 Jun 2016 04:51:26 +0000 (21:51 -0700)]
s4/selftests: test net ads dns register/unregister.

Add a new test for the net ads dns commands and the needed self test
setup. Currently tests that we can register a name and that it
turns up. Also, tests that we can register with -P.

Signed-off-by: Richard Sharpe <rsharpe@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Jun 28 22:35:35 CEST 2016 on sn-devel-144

2 years agoldb: Fix CID 1362935: CHECKED_RETURN
Volker Lendecke [Tue, 28 Jun 2016 12:41:19 +0000 (14:41 +0200)]
ldb: Fix CID 1362935: CHECKED_RETURN

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2 years agolibnet: Fix CID 1362934: CHECKED_RETURN
Volker Lendecke [Tue, 28 Jun 2016 12:38:57 +0000 (14:38 +0200)]
libnet: Fix CID 1362934: CHECKED_RETURN

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2 years agos3: tldap: Make tldap_gensec_bind_send()/tldap_gensec_bind_recv() static.
Jeremy Allison [Mon, 27 Jun 2016 17:39:02 +0000 (10:39 -0700)]
s3: tldap: Make tldap_gensec_bind_send()/tldap_gensec_bind_recv() static.

Only expose a synchronous tldap_gensec_bind() call, as it can't
really be async anyway.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Tue Jun 28 11:19:33 CEST 2016 on sn-devel-144

2 years agos3: tldap: Remove asynchronous calls to gensec_update_send()/_recv() as for the spneg...
Jeremy Allison [Fri, 24 Jun 2016 18:40:10 +0000 (11:40 -0700)]
s3: tldap: Remove asynchronous calls to gensec_update_send()/_recv() as for the spnego backend they're synchronous anyway.

This should prevent nested event loops, and won't make the
code performance worse anyway.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
2 years agoselftest: test idmap backend id allocation for unknown SIDS
Ralph Boehme [Sun, 12 Jun 2016 17:03:11 +0000 (19:03 +0200)]
selftest: test idmap backend id allocation for unknown SIDS

If an SID is is not found becaues the RID doesn't exist in a domain and
the domain is configured to use a non-allocating idmap backend like
idmap_ad or idmap_rfc2307, winbindd must not return a mapping for the
SID.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11961

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2 years agoselftest: make autorid the default idmap backend in admember_rfc2307
Ralph Boehme [Fri, 24 Jun 2016 16:33:01 +0000 (18:33 +0200)]
selftest: make autorid the default idmap backend in admember_rfc2307

This is needed for a new test in the next commit. Exisiting tests aren't
affected by this, at least a private autobuild passed with this
change.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11961

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2 years agowinbindd: in wb_lookupsids return domain name if we have it
Ralph Boehme [Fri, 24 Jun 2016 13:16:42 +0000 (15:16 +0200)]
winbindd: in wb_lookupsids return domain name if we have it

When doing a SID to xid mapping for an unknown SID, the idmap child gets
passed a lsa_RefDomainList with an empty domain name (ie ""). This is
coming from LsaLookupSids() and causes the mapping request to end up in
the default idmap domain.

Example request with domain name "":

  wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs
     in: struct wbint_Sids2UnixIDs
         domains                  : *
             domains: struct lsa_RefDomainList
                 count                    : 0x00000001 (1)
                 domains                  : *
                     domains: ARRAY(1)
                         domains: struct lsa_DomainInfo
                             name: struct lsa_StringLarge
                                 length                   : 0x0000 (0)
                                 size                     : 0x0002 (2)
                                 string                   : *
                                     string                   : ''
                             sid                      : *
                                 sid                      : S-1-5-21-3152989960-574718769-2188965058
                 max_size                 : 0x00000020 (32)
         ids                      : *
             ids: struct wbint_TransIDArray
                 num_ids                  : 0x00000001 (1)
                 ids: ARRAY(1)
                     ids: struct wbint_TransID
                         type                     : ID_TYPE_NOT_SPECIFIED (0)
                         domain_index             : 0x00000000 (0)
                         rid                      : 0x000029aa (66666)
                         xid: struct unixid
                             id                       : 0xffffffff (4294967295)
                             type                     : ID_TYPE_NOT_SPECIFIED (0)

In _wbint_Sids2UnixIDs() we call idmap_find_domain_with_sid() with the
domain name "" and this triggers use of the default idmap domain which
in case of idmap_autorid will allocate an id from a idmap_autorid range.

If we know the domain, ensure we return it for SIDs were the SID was not
found but the domain of the SID was found. Callers like sids2xids depend
on the domain name and returning an empty string "" for valid domain can
trigger unwanted idmap range allocations.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11961

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2 years agowinbindd/idmap_rfc2307: fix a crash
Ralph Boehme [Fri, 24 Jun 2016 16:31:45 +0000 (18:31 +0200)]
winbindd/idmap_rfc2307: fix a crash

map->map is NULL if lookupsid failed.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11961

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2 years agos3:utils/net: Add new option 'unregister' in 'net ads dns' command.
Shyamsunder Rathi [Sun, 26 Jun 2016 23:26:53 +0000 (16:26 -0700)]
s3:utils/net: Add new option 'unregister' in 'net ads dns' command.

This new option allows DNS names to be unregistered and removes all
IP entries for a given name in the specified AD server.

Signed-off-by: Shyamsunder Rathi <shyam.rathi@nutanic.com>
Reviewed-by: Richard SHarpe <rsharpe@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Richard Sharpe <sharpe@samba.org>
Autobuild-Date(master): Mon Jun 27 20:43:26 CEST 2016 on sn-devel-144

2 years agos4:dsdb/tests: add pwdLastSet tests
Stefan Metzmacher [Fri, 27 May 2016 14:52:00 +0000 (16:52 +0200)]
s4:dsdb/tests: add pwdLastSet tests

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jun 27 08:52:48 CEST 2016 on sn-devel-144

2 years agos4:dsdb/samldb: pwdLastSet = -1 requires Unexpire-Password right
Stefan Metzmacher [Wed, 1 Jun 2016 09:13:47 +0000 (11:13 +0200)]
s4:dsdb/samldb: pwdLastSet = -1 requires Unexpire-Password right

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/samldb: fix comment "lockoutTime" reset as per MS-SAMR 3.1.1.8.10
Stefan Metzmacher [Fri, 27 May 2016 14:54:40 +0000 (16:54 +0200)]
s4:dsdb/samldb: fix comment "lockoutTime" reset as per MS-SAMR 3.1.1.8.10

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: only allow pwdLastSet as "0" or "-1"
Stefan Metzmacher [Tue, 31 May 2016 13:21:58 +0000 (15:21 +0200)]
s4:dsdb/password_hash: only allow pwdLastSet as "0" or "-1"

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:rpc_server/samr: only set pwdLastSet to "0" or "-1"
Stefan Metzmacher [Tue, 24 May 2016 06:51:45 +0000 (08:51 +0200)]
s4:rpc_server/samr: only set pwdLastSet to "0" or "-1"

The password_hash module will take care of translating "-1"
to the current time.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: allow pwdLastSet only changes
Stefan Metzmacher [Thu, 11 Feb 2016 19:07:18 +0000 (20:07 +0100)]
s4:dsdb/password_hash: allow pwdLastSet only changes

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: make it possible to specify pwdLastSet together with a passwor...
Stefan Metzmacher [Tue, 31 May 2016 13:21:58 +0000 (15:21 +0200)]
s4:dsdb/password_hash: make it possible to specify pwdLastSet together with a password change

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: handle the DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET control
Stefan Metzmacher [Tue, 31 May 2016 13:21:58 +0000 (15:21 +0200)]
s4:dsdb/password_hash: handle the DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET control

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: make the DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET code path more...
Stefan Metzmacher [Mon, 30 May 2016 15:12:51 +0000 (17:12 +0200)]
s4:dsdb/password_hash: make the DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET code path more robust

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: only set pwdLastSet if required
Stefan Metzmacher [Tue, 31 May 2016 09:44:43 +0000 (11:44 +0200)]
s4:dsdb/password_hash: only set pwdLastSet if required

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: create a shallow copy of the client message for the final...
Stefan Metzmacher [Tue, 31 May 2016 08:53:57 +0000 (10:53 +0200)]
s4:dsdb/password_hash: create a shallow copy of the client message for the final update

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: move ldb_msg_add_empty() calls to update_final_msg()
Stefan Metzmacher [Tue, 31 May 2016 08:39:23 +0000 (10:39 +0200)]
s4:dsdb/password_hash: move ldb_msg_add_empty() calls to update_final_msg()

We should only replace attributes when we're asked to do so.
Currently that's always the case, but that will change soon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: remember if we need to update the passwords and/or pwdLastSet
Stefan Metzmacher [Tue, 31 May 2016 08:09:58 +0000 (10:09 +0200)]
s4:dsdb/password_hash: remember if we need to update the passwords and/or pwdLastSet

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: call ndr_pull_supplementalCredentialsBlob in setup_io()
Stefan Metzmacher [Fri, 3 Jun 2016 14:20:39 +0000 (16:20 +0200)]
s4:dsdb/password_hash: call ndr_pull_supplementalCredentialsBlob in setup_io()

We should setup io->o.* (the old password attributes) completely in setup_io().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: move the check for old passwords into setup_io()
Stefan Metzmacher [Tue, 31 May 2016 07:43:57 +0000 (09:43 +0200)]
s4:dsdb/password_hash: move the check for old passwords into setup_io()

We get everything else of the existing object there too.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: leave the current value of pwdLastSet as 0 an add
Stefan Metzmacher [Tue, 31 May 2016 07:39:07 +0000 (09:39 +0200)]
s4:dsdb/password_hash: leave the current value of pwdLastSet as 0 an add

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: make the variable names in setup_io() more clear
Stefan Metzmacher [Wed, 25 May 2016 11:43:29 +0000 (13:43 +0200)]
s4:dsdb/password_hash: make the variable names in setup_io() more clear

We get the message from the client and (optional) the existing object.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: split out a update_final_msg() function
Stefan Metzmacher [Tue, 31 May 2016 07:25:37 +0000 (09:25 +0200)]
s4:dsdb/password_hash: split out a update_final_msg() function

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: split out a password_hash_needed() function
Stefan Metzmacher [Tue, 31 May 2016 06:16:07 +0000 (08:16 +0200)]
s4:dsdb/password_hash: split out a password_hash_needed() function

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/password_hash: use full NTTIME resolution for pwdLastSet
Stefan Metzmacher [Fri, 12 Feb 2016 12:56:26 +0000 (13:56 +0100)]
s4:dsdb/password_hash: use full NTTIME resolution for pwdLastSet

Windows does the same...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/common: add some const to helper functions
Stefan Metzmacher [Wed, 25 May 2016 14:00:29 +0000 (16:00 +0200)]
s4:dsdb/common: add some const to helper functions

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:samldb: pass down DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID with changed...
Stefan Metzmacher [Fri, 27 May 2016 14:53:48 +0000 (16:53 +0200)]
s4:samldb: pass down DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID with changed userAccountControl details

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/samdb: allocate DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID
Stefan Metzmacher [Fri, 27 May 2016 14:52:54 +0000 (16:52 +0200)]
s4:dsdb/samdb: allocate DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/samldb: add DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID when defaulting pwdLas...
Stefan Metzmacher [Thu, 11 Feb 2016 07:31:46 +0000 (08:31 +0100)]
s4:dsdb/samldb: add DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID when defaulting pwdLastSet=0

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/samdb: allocate DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID
Stefan Metzmacher [Thu, 11 Feb 2016 07:31:46 +0000 (08:31 +0100)]
s4:dsdb/samdb: allocate DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID

This will be used to let the "password_hash" module know that
the value of pwdLastSet was defaulted to 0 in the "samldb" module
on add.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos3:pdb_samba_dsdb: fix calucating of dsdb_flags
Stefan Metzmacher [Thu, 11 Feb 2016 07:59:09 +0000 (08:59 +0100)]
s3:pdb_samba_dsdb: fix calucating of dsdb_flags

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2 years agos4:dsdb/tests: use more useful userAccountControl/pwdLastSet values in the urgent_rep...
Stefan Metzmacher [Tue, 31 May 2016 22:18:05 +0000 (00:18 +0200)]
s4:dsdb/tests: use more useful userAccountControl/pwdLastSet values in the urgent_replication test

Using UF_SMARDCARD_REQUIRED has some side effects, so we better use
UF_DONT_EXPIRE_PASSWD which doesn't trigger additional actions.

Setting pwdLastSet to "1" is not allowed, only "-1" is able to change
an existing value of "0".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9654

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>