summaryrefslogtreecommitdiff
path: root/library
AgeCommit message (Collapse)AuthorFilesLines
2022-09-28Fix issues found by CoveritySumit Bose2-1/+7
2022-09-27adenroll: set password via LDAP instead KerberosSumit Bose2-11/+141
Use LDAP add/mod operation instead of Kerberos to set the machine account password. There was an issue in AD where if PacRequestorEnforcement was set to '2' setting the machine account password via Kerberos would be rejected. This is already fixed on the AD side bit this patch which was created with the help of David Mulder <dmulder@suse.com> might still be useful if setting the machine account password with Kerberos might fail. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2039349 Resolves: https://gitlab.freedesktop.org/realmd/adcli/-/issues/27
2022-09-26disco: fall back to LDAPS if CLDAP ping was not successfulSumit Bose4-20/+224
If the --use-ldaps option is used and there is no reply on the CLDAP 389/udp port adcli will try to send the request to the LDAPS port 636/tcp. Resolves: https://gitlab.freedesktop.org/realmd/adcli/-/issues/31
2022-09-16adenroll: write SID before secret to Samba's dbSumit Bose1-7/+7
Looks like 'net changesecretpw' expects the SID entry to be present to work correctly. This patch will set the SID before trying to set the machine account password. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1991619
2022-01-11library: include endian.h for le32tohHenning Schild1-0/+1
linking against musl libc we need to include that specifically, actually also according to "man 3 endian".
2021-06-14Add delattr optionSumit Bose2-0/+70
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1690920
2021-06-14Add setattr optionSumit Bose2-1/+172
With the new option common LDAP attributes can be set. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1690920
2021-06-14entry: add passwd-user sub-commandSumit Bose2-0/+141
The new command allows to set or reset a user password with the help of an account privileged to set the password. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1952828
2021-06-11adcli_entry: add entry_attrs with userAccountControl attributeSumit Bose1-2/+6
2021-06-11library: move UAC flags to a more common header fileSumit Bose2-8/+8
2021-06-03Fix for dont-expire-password option and joinSumit Bose1-1/+2
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1769644
2021-06-02Add dont-expire-password optionSumit Bose2-1/+47
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1769644
2021-06-02coverity: add missing NULL checksSumit Bose2-0/+9
2021-04-06configure: update some macros for autoconf-2.71Sumit Bose1-1/+1
2021-02-20Add account-disable optionSumit Bose2-5/+41
A new option was added to 'adcli update' toggle the ACCOUNTDISABLE flag of AD's userAccountControl LDAP attribute to disable or enable the given host account. 'adcli join' will automatically enable the host account. Resolves: https://gitlab.freedesktop.org/realmd/adcli/-/issues/21
2020-11-12service-account: add random suffix to account nameSumit Bose1-0/+79
Add a random component to the default managed service account name to avoid name collisions. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
2020-11-12enroll: allow fqdn for locate_computer_accountSumit Bose1-14/+31
Make it possible to find existing manages service account by the fully-qualified name. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
2020-11-12enroll: make adcli_enroll_add_keytab_for_service_account publicSumit Bose2-6/+9
Determine keytab name more early to catch errors more early. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
2020-11-12enroll: more filters for random charactersSumit Bose1-3/+27
Make handling of random strings more flexible. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
2020-11-12enroll: use 'computer' or 'service' in debug messagesSumit Bose1-43/+72
Use proper account type in debug messages. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
2020-11-12computer: add create-msa sub-commandSumit Bose1-25/+139
Add new sub-command to create a managed service account in AD. This can be used if LDAP access to AD is needed but the host is already joined to a different domain. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
2020-11-12enroll: add is_service memberSumit Bose2-0/+21
Add helpers to indicate a managed service account. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
2020-11-11doc: explain required AD permissionsSumit Bose1-12/+18
When using a restricted account with adcli some operations might fail because the account might not have all required permissions. The man page is extended and now explains which permissions are needed under given circumstances. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1852080 Resolves: https://gitlab.freedesktop.org/realmd/adcli/-/issues/20
2020-10-20join/update: set dNSHostName if not setSumit Bose1-4/+12
If during a join or update an existing AD computer object does not have the dNSHostName attribute set it will be set with the current hostname. This is important for cases where the user doing the join or update only has "Validated write to service principal name" for the computer object. The validated write with fully-qualified names can only be successful if dNSHostName is set, see [MS-ADTS] section 3.1.1.5.3.1.1.4 "Validated Writes - servicePrincipalName" for details. Resolves https://bugzilla.redhat.com/show_bug.cgi?id=1734764
2020-02-23discovery fixSumit Bose1-0/+1
Do not continue processing on closed connection. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1802258
2019-12-19add option use-ldapsSumit Bose2-9/+74
In general using the LDAP port with GSS-SPNEGO should satifiy all requirements an AD DC should have for authentication on an encrypted LDAP connection. But if e.g. the LDAP port is blocked by a firewall using the LDAPS port with TLS encryption might be an alternative. For this use case the --use-ldaps option is added. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1762420
2019-12-19Use GSS-SPNEGO if availableSumit Bose2-1/+37
Currently adcli uses the GSSAPI SASL mechanism for LDAP authentication and to establish encryption. While this works in general it does not handle some of the more advanced features which can be required by AD DCs. The GSS-SPNEGO mechanism can handle them and is used with this patch by adcli if the AD DC indicates that it supports it. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1762420
2019-11-28add description option to join and updateSumit Bose2-0/+33
This new option allows to set the description LDAP attribute for the AD computer object. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1737342
2019-11-28tools: add show-computer commandSumit Bose2-18/+65
The show-computer command prints the LDAP attributes of the related computer object from AD. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1737342
2019-08-26Do not use arcfour-hmac-md5 when discovering the saltSumit Bose1-1/+20
Since the arcfour-hmac-md5 encryption types does not use salts it cannot be used to discover the right salt. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1683745
2019-08-23Fix for issue found by CoveritySumit Bose1-1/+4
Related to https://gitlab.freedesktop.org/realmd/adcli/issues/3
2019-06-14adenroll: use only enctypes permitted by Kerberos configSumit Bose1-3/+19
Realted to https://gitlab.freedesktop.org/realmd/adcli/issues/3
2019-06-14adenroll: add adcli_enroll_get_permitted_keytab_enctypes with testsSumit Bose3-0/+131
The new call does not only return the current encryption types set in AD or a default list but filters them with the list of permitted encryption types on the client. This makes sure the client can create and use the keys. Related to https://gitlab.freedesktop.org/realmd/adcli/issues/3
2019-06-14adconn: add adcli_conn_set_krb5_contextSumit Bose2-0/+16
Related to https://gitlab.freedesktop.org/realmd/adcli/issues/3
2019-06-14adenroll: make sure only allowed enctypes are used in FIPS modeSumit Bose1-1/+35
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1717355
2019-04-15library: add missing strdupSumit Bose1-1/+2
In add_server_side_service_principals _adcli_strv_add_unique is called which only adds a string to a list without copying to. Since the original list will be freed later the value must be copied. This issue was introduce with 972f1a2f35829ed89f5353bd204683aa9ad6a2d2 and hence Related to https://bugzilla.redhat.com/show_bug.cgi?id=1630187
2019-03-22library: make sure server side SPNs are preservedSumit Bose1-0/+46
adcli should not delete service principal names (SPNs) unexpectedly. If a SPN was added on the server while presetting a host or updating an existing entry and upcoming adcli join or update should preserver this change. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1630187
2019-03-22library: _adcli_krb5_build_principal allow principals as namesSumit Bose1-4/+8
Make _adcli_krb5_build_principal a bit more robust by checking if the given name already contains a realm suffix. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1630187
2019-03-22library: make _adcli_strv_has_ex publicSumit Bose2-1/+5
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1630187
2019-03-22ensure_keytab_principals: do not leak memory when called twiceSumit Bose1-11/+21
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1630187
2019-03-22library: return error if no matching key was foundSumit Bose1-3/+2
To avoid a misleading debug message indicating success a proper erro code should be returned the no matching key was found when trying to copy an keytab entry for a new principal. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1644311
2019-03-22join: always add service principalsSumit Bose1-6/+30
If currently --service-name is given during the join only the service names given by this option are added as service principal names. As a result the default 'host' service principal name might be missing which might cause issues e.g. with SSSD and sshd. The patch makes sure the default service principals 'host' and 'RestrictedKrbHost' are always added during join. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1644311
2019-03-22create-user: try to find NIS domain if neededSumit Bose2-0/+46
Related to https://gitlab.freedesktop.org/realmd/adcli/issues/2
2019-03-15library: use getaddrinfo with AI_CANONNAME to find a FQDNSumit Bose1-1/+29
Currently adcli creates service principals only with a short name if the hostname of the client is a short name. This would fail is Kerberos/GSSAPI clients will use the fully-qualified domain name (FQDN) to access the host. With this patch adcli tries to expand the short name by calling getaddrinfo with the AI_CANONNAME hint. Related to https://gitlab.freedesktop.org/realmd/adcli/issues/1
2019-03-15Increment kvno after password change with user credsSumit Bose1-0/+4
Originally only the host credential part was fixed in the context of https://bugs.freedesktop.org/show_bug.cgi?id=91185. This patch adds the fix to the case when user credentials are used. Related to https://bugzilla.redhat.com/show_bug.cgi?id=1642546
2019-01-15adenroll: use _adcli_strv_add_unique for service principalsSumit Bose1-23/+8
Check if service principals is already in the list before adding it. Related to https://gitlab.freedesktop.org/realmd/adcli/issues/16
2019-01-15adutil: add _adcli_strv_add_uniqueSumit Bose2-9/+61
_adcli_strv_add_unique checks is the new value already exists in the strv before adding it. Check can be done case-sensitive or not. Related to https://gitlab.freedesktop.org/realmd/adcli/issues/16
2019-01-08Make 'adcli info' DC location mechanism more compliant with [MS-ADTS] and ↵Alexey A Nikitin1-52/+94
[MS-NRPC] AD specifications say that DC locator must attempt to find a suitable DC for the client. That means going through all of the DCs in SRV RRs one by one until one of them answers. The problem with adcli's original behavior is that it queries only five DCs from SRV, ever. This becomes a problem if for any reason there is a large number of DCs in the domain from which the client cannot get a CLDAP response.
2018-10-22Fix for issues found by CoveritySumit Bose1-6/+6
2018-10-22Do not depend on default_realm in krb5.confSumit Bose1-1/+3
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-29 04:48:46 +0000