CVE-2020-25717: Add FreeIPA domain controller role
authorAlexander Bokovoy <ab@samba.org>
Wed, 11 Nov 2020 16:50:45 +0000 (18:50 +0200)
committerPavel Filipenský <pfilipensky@samba.org>
Wed, 18 Jan 2023 12:00:51 +0000 (13:00 +0100)
commit3ba91474a529dd2307ba6db5456dcb418fd7b7bd
treef2faa11094acfe6817bae04e396641f0beadad33
parent840442362fd042f35446c3ab4ab1068efe12b73a
CVE-2020-25717: Add FreeIPA domain controller role

As we want to reduce use of 'classic domain controller' role but FreeIPA
relies on it internally, add a separate role to mark FreeIPA domain
controller role.

It means that role won't result in ROLE_STANDALONE.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Alexander Bokovoy <ab@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
[abartlet@samba.org Backported due to conflict with DEBUG
 statements and IPA branding changes in comments]
21 files changed:
docs-xml/smbdotconf/security/serverrole.xml
lib/param/loadparm_server_role.c
lib/param/param_table.c
lib/param/util.c
libcli/netlogon/netlogon.c
libds/common/roles.h
source3/auth/auth.c
source3/auth/auth_sam.c
source3/include/smb_macros.h
source3/lib/netapi/joindomain.c
source3/param/loadparm.c
source3/passdb/lookup_sid.c
source3/passdb/machine_account_secrets.c
source3/registry/reg_backend_prod_options.c
source3/rpc_server/dssetup/srv_dssetup_nt.c
source3/smbd/server.c
source3/winbindd/winbindd_misc.c
source3/winbindd/winbindd_util.c
source4/auth/ntlm/auth.c
source4/kdc/kdc-heimdal.c
source4/rpc_server/samr/dcesrv_samr.c