docs-xml: Add new parameter "acl claims evaluation"

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/docs-xml/smbdotconf/security/aclclaimsevaluation.xml b/docs-xml/smbdotconf/security/aclclaimsevaluation.xml
new file mode 100644 (file)
index 0000000..ab72617
--- /dev/null
+++ b/docs-xml/smbdotconf/security/aclclaimsevaluation.xml
@@ -0,0 +1,42 @@
+<samba:parameter name="acl claims evaluation"
+                 context="G"
+                 type="enum"
+                 enumlist="enum_acl_claims_evaluation"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+       <para>This option controls the way Samba handles evaluation of
+       security descriptors in Samba, with regards to Active
+       Directory Claims.  AD Claims, introduced with Windows 2012,
+       are essentially administrator-defined key-value pairs that can
+       be set both in Active Directory (communicated via the Kerberos
+       PAC) and in the security descriptor themselves.
+       </para>
+
+       <para>Active Directory claims are new with Samba 4.20.
+       Because the claims are evaluated against a very flexible
+       expression language within the security descriptor, this option provides a mechanism
+       to disable this logic if required by the administrator.</para>
+
+       <para>This default behaviour is that claims evaluation is
+       enabled in the AD DC only.  Additionally, claims evaluation on
+       the AD DC is only enabled if the DC functional level
+       is 2012 or later.  See <smbconfoption name="ad dc functional
+       level"/>.</para>
+
+       <para>Possible values are :</para>
+       <itemizedlist>
+         <listitem>
+           <para><constant>AD DC only</constant>: Enabled for the Samba AD
+           DC (for DC functional level 2012 or higher).</para>
+         </listitem>
+         <listitem>
+           <para><constant>never</constant>: Disabled in all cases.
+           This option disables some but not all of the
+           Authentication Policies and Authentication Policy Silos features of
+           the Windows 2012R2 functional level in the AD DC.</para>
+         </listitem>
+       </itemizedlist>
+</description>
+
+<value type="default">AD DC only</value>
+</samba:parameter>

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index 447087911b59b9f8f0c79c2b8fa9c4bd4ff89bf6..9a7ae4f95fe8344b42e27d878fb89ad7071b7b98 100644 (file)
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -3156,6 +3156,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
                                  "ad dc functional level",
                                  "2008_R2");
 
+       lpcfg_do_global_parameter(lp_ctx,
+                                 "acl claims evaluation",
+                                 "AD DC only");
+
        for (i = 0; parm_table[i].label; i++) {
                if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) {
                        lp_ctx->flags[i] |= FLAG_DEFAULT;

diff --git a/lib/param/loadparm.h b/lib/param/loadparm.h
index 06e40f25c84fee54ec48f04605888918246aa6ae..0bf4c173652c2ac0bac9aacddb2d0f370c878e0b 100644 (file)
--- a/lib/param/loadparm.h
+++ b/lib/param/loadparm.h
@@ -258,6 +258,12 @@ enum store_nt_hash {
        NT_HASH_STORE_ALWAYS
 };
 
+/* Controlling the storage of the NT password has on the AD DC */
+enum acl_claims_evaluation {
+       ACL_CLAIMS_EVALUATION_AD_DC_ONLY,
+       ACL_CLAIMS_EVALUATION_NEVER
+};
+
 /*
  * Default passwd chat script.
  */

diff --git a/lib/param/param_table.c b/lib/param/param_table.c
index 948550e6171cee55ea4f8a8d075db6ba5c1bce00..ce591560ba832a3f3c19e0e25e6b16e26b0a3843 100644 (file)
--- a/lib/param/param_table.c
+++ b/lib/param/param_table.c
@@ -439,6 +439,12 @@ static const struct enum_list enum_ad_functional_level[] = {
        {-1, NULL}
 };
 
+static const struct enum_list enum_acl_claims_evaluation[] = {
+       {ACL_CLAIMS_EVALUATION_AD_DC_ONLY, "AD DC only"},
+       {ACL_CLAIMS_EVALUATION_NEVER, "never"},
+       {-1, NULL}
+};
+
 /* Note: We do not initialise the defaults union - it is not allowed in ANSI C
  *
  * NOTE: Handling of duplicated (synonym) parameters:

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 238b725e278f01e7d20beba6a284a8d50f8c2910..1c36445891265b2a3a45718b4181947d2b68e870 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -997,6 +997,8 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
 
        Globals.ad_dc_functional_level = DS_DOMAIN_FUNCTION_2008_R2,
 
+       Globals.acl_claims_evaluation = ACL_CLAIMS_EVALUATION_AD_DC_ONLY;
+
        /* Now put back the settings that were set with lp_set_cmdline() */
        apply_lp_set_cmdline();
 }