secret attribute handling

[Andrew Bartlett]

On Tue, 2010-11-09 at 20:06 +0100, Stefan (metze) Metzmacher wrote:
> Hi Tridge,
> 
> can you look at this patches?
> http://gitweb.samba.org/?p=metze/samba/wip.git;a=shortlog;h=refs/heads/master4-drsuapi
> 
> They should fix the handling of secret attributes,
> I think we currently strict some attributes when sending objects
> to replication partners.
> 
> I'm unsure about the ones with the one with REVIEW? in the commit message.
> 
> And the WHAT TODO ones, are more questions if we need to change anything
> there.

The local_password module is an unmaintained hack, aimed at allowing an
LDAP backend to avoid storing password values (required for a possible
user of Samba4 many years ago, that is no longer interested).  Please
just change it to use the same list of secret attributes. 

I think you are also correct to suggest that the operational module
should omit the secret attributes, based on the same list.  (we may need
to have a way to include that list into the different format - a startup
function that allocates the local array might work). 

We also need to look at the acl module, which currently reads the list
of secret attributes off disk.  This list should be combined with the
list in the define, to avoid missing any.  The idea with putting it on
disk was to ensure that if we changed any secret attributes but upgraded
Samba with an old DB (in the dark days before upgradeprovision), we
would still protect them.  We now have a real schema, and so are
unlikely to extend this in the same way we had in the past. 

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Cisco Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 190 bytes
Desc: This is a digitally signed message part
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20101110/33eef432/attachment.pgp>