Changeset 738 for branches/samba-3.5.x/source3/winbindd

Timestamp:

Nov 12, 2012, 7:10:02 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server 3.5: update branche to 3.5.18

Location:

branches/samba-3.5.x/source3/winbindd

Files:

• idmap.c (modified) (3 diffs)
• winbindd.c (modified) (2 diffs)
• winbindd_cred_cache.c (modified) (3 diffs)
• winbindd_pam.c (modified) (4 diffs)
• winbindd_proto.h (modified) (1 diff)
• winbindd_util.c (modified) (1 diff)

branches/samba-3.5.x/source3/winbindd/idmap.c

@@ -28 +28 @@
 
 static_decl_idmap;
+
+static void idmap_init(void)
+{
+        static bool initialized;
+
+        if (initialized) {
+                return;
+        }
+
+        DEBUG(10, ("idmap_init(): calling static_init_idmap\n"));
+
+        static_init_idmap;
+
+        initialized = true;
+}
 
 /**
@@ -347 +362 @@
         char *params;
 
-        DEBUG(10, ("idmap_init_default_domain: calling static_init_idmap\n"));
-
-        static_init_idmap;
+        idmap_init();
 
         if (!parse_idmap_module(talloc_tos(), lp_idmap_backend(), &modulename,
@@ -547 +560 @@
         NTSTATUS ret = NT_STATUS_NO_MEMORY;;
 
-        static_init_idmap;
+        idmap_init();
 
         if (idmap_alloc_ctx != NULL) {

branches/samba-3.5.x/source3/winbindd/winbindd.c

@@ -567 +567 @@
         state->cmd_name = "unknown request";
         state->recv_fn = NULL;
+        state->last_access = time(NULL);
 
         /* Process command */
@@ -872 +873 @@
 
         for (state = winbindd_client_list(); state; state = state->next) {
-                if (state->response == NULL &&
+                if (state->request == NULL &&
+                    state->response == NULL &&
                     !state->pwent_state && !state->grent_state) {
                         nidle++;

branches/samba-3.5.x/source3/winbindd/winbindd_cred_cache.c

@@ -485 +485 @@
                             const char *service,
                             const char *username,
+                            const char *pass,
                             const char *realm,
                             uid_t uid,
@@ -587 +588 @@
                         DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
                 }
-                 
+
+                /*
+                 * If we're set up to renew our krb5 tickets, we must
+                 * cache the credentials in memory for the ticket
+                 * renew function (or increase the reference count
+                 * if we're logging in more than once). Fix inspired
+                 * by patch from Ian Gordon <ian.gordon@strath.ac.uk>
+                 * for bugid #9098.
+                 */
+
+                ntret = winbindd_add_memory_creds(username, uid, pass);
+                DEBUG(10, ("winbindd_add_memory_creds returned: %s\n",
+                        nt_errstr(ntret)));
+
                 return NT_STATUS_OK;
         }
@@ -669 +683 @@
                 "added ccache [%s] for user [%s] to the list\n",
                 ccname, username));
+
+        if (entry->event) {
+                /*
+                 * If we're set up to renew our krb5 tickets, we must
+                 * cache the credentials in memory for the ticket
+                 * renew function. Fix inspired by patch from
+                 * Ian Gordon <ian.gordon@strath.ac.uk> for
+                 * bugid #9098.
+                 */
+
+                ntret = winbindd_add_memory_creds(username, uid, pass);
+                DEBUG(10, ("winbindd_add_memory_creds returned: %s\n",
+                        nt_errstr(ntret)));
+        }
 
         return NT_STATUS_OK;

branches/samba-3.5.x/source3/winbindd/winbindd_pam.c

@@ -299 +299 @@
                                       &token->user_sids,
                                       &token->num_sids,
-                                      true, false);
+                                      true);
         if (!NT_STATUS_IS_OK(status)) {
                 TALLOC_FREE(frame);
@@ -657 +657 @@
                                             service,
                                             state->request->data.auth.user,
+                                            state->request->data.auth.pass,
                                             realm,
                                             uid,
@@ -1035 +1036 @@
                                                             service,
                                                             state->request->data.auth.user,
+                                                            state->request->data.auth.pass,
                                                             domain->alt_name,
                                                             uid,
@@ -2457 +2459 @@
         }
 
+        /*
+         * Remove any mlock'ed memory creds in the child
+         * we might be using for krb5 ticket renewal.
+         */
+
+        winbindd_delete_memory_creds(state->request->data.logoff.user);
+
 #else
         result = NT_STATUS_NOT_SUPPORTED;

branches/samba-3.5.x/source3/winbindd/winbindd_proto.h

@@ -217 +217 @@
                             const char *service,
                             const char *username,
+                            const char *password,
                             const char *realm,
                             uid_t uid,

branches/samba-3.5.x/source3/winbindd/winbindd_util.c

@@ -1167 +1167 @@
         }
 
-        /* Skip Domain local groups outside our domain.
-           We'll get these from the getsidaliases() RPC call. */
+        /*
+         * Before bug #7843 the "Domain Local" groups were added with a
+         * lookupuseraliases call, but this isn't done anymore for our domain
+         * so we need to resolve resource groups here.
+         *
+         * When to use Resource Groups:
+         * http://technet.microsoft.com/en-us/library/cc753670%28v=WS.10%29.aspx
+        */
         status = sid_array_from_info3(mem_ctx, info3,
                                       user_sids,
                                       &num_groups,
-                                      false, true);
+                                      false);
 
         if (!NT_STATUS_IS_OK(status)) {