2003-06-30 21:24:59 +04:00
/*
2002-01-30 09:08:46 +03:00
Unix SMB / CIFS implementation .
2000-05-09 15:43:00 +04:00
2001-11-23 03:14:04 +03:00
Winbind daemon - pam auth funcions
2000-05-09 15:43:00 +04:00
Copyright ( C ) Andrew Tridgell 2000
2001-08-23 06:55:42 +04:00
Copyright ( C ) Tim Potter 2001
2002-02-05 12:40:36 +03:00
Copyright ( C ) Andrew Bartlett 2001 - 2002
2006-02-04 01:19:41 +03:00
Copyright ( C ) Guenther Deschner 2005
2000-05-09 15:43:00 +04:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation ; either version 2 of the License , or
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
along with this program ; if not , write to the Free Software
Foundation , Inc . , 675 Mass Ave , Cambridge , MA 0213 9 , USA .
*/
2003-11-12 04:51:10 +03:00
# include "includes.h"
2000-05-09 15:43:00 +04:00
# include "winbindd.h"
2002-07-15 14:35:28 +04:00
# undef DBGC_CLASS
# define DBGC_CLASS DBGC_WINBIND
2006-02-04 01:19:41 +03:00
static NTSTATUS append_info3_as_txt ( TALLOC_CTX * mem_ctx ,
struct winbindd_cli_state * state ,
NET_USER_INFO_3 * info3 )
{
fstring str_sid ;
state - > response . data . auth . info3 . logon_time =
nt_time_to_unix ( & ( info3 - > logon_time ) ) ;
state - > response . data . auth . info3 . logoff_time =
nt_time_to_unix ( & ( info3 - > logoff_time ) ) ;
state - > response . data . auth . info3 . kickoff_time =
nt_time_to_unix ( & ( info3 - > kickoff_time ) ) ;
state - > response . data . auth . info3 . pass_last_set_time =
nt_time_to_unix ( & ( info3 - > pass_last_set_time ) ) ;
state - > response . data . auth . info3 . pass_can_change_time =
nt_time_to_unix ( & ( info3 - > pass_can_change_time ) ) ;
state - > response . data . auth . info3 . pass_must_change_time =
nt_time_to_unix ( & ( info3 - > pass_must_change_time ) ) ;
state - > response . data . auth . info3 . logon_count = info3 - > logon_count ;
state - > response . data . auth . info3 . bad_pw_count = info3 - > bad_pw_count ;
2006-02-07 20:18:29 +03:00
state - > response . data . auth . info3 . user_rid = info3 - > user_rid ;
state - > response . data . auth . info3 . group_rid = info3 - > group_rid ;
2006-02-04 01:19:41 +03:00
sid_to_string ( str_sid , & ( info3 - > dom_sid . sid ) ) ;
fstrcpy ( state - > response . data . auth . info3 . dom_sid , str_sid ) ;
state - > response . data . auth . info3 . num_groups = info3 - > num_groups ;
state - > response . data . auth . info3 . user_flgs = info3 - > user_flgs ;
state - > response . data . auth . info3 . acct_flags = info3 - > acct_flags ;
state - > response . data . auth . info3 . num_other_sids = info3 - > num_other_sids ;
unistr2_to_ascii ( state - > response . data . auth . info3 . user_name ,
& info3 - > uni_user_name , - 1 ) ;
unistr2_to_ascii ( state - > response . data . auth . info3 . full_name ,
& info3 - > uni_full_name , - 1 ) ;
unistr2_to_ascii ( state - > response . data . auth . info3 . logon_script ,
& info3 - > uni_logon_script , - 1 ) ;
unistr2_to_ascii ( state - > response . data . auth . info3 . profile_path ,
& info3 - > uni_profile_path , - 1 ) ;
unistr2_to_ascii ( state - > response . data . auth . info3 . home_dir ,
& info3 - > uni_home_dir , - 1 ) ;
unistr2_to_ascii ( state - > response . data . auth . info3 . dir_drive ,
& info3 - > uni_dir_drive , - 1 ) ;
unistr2_to_ascii ( state - > response . data . auth . info3 . logon_srv ,
& info3 - > uni_logon_srv , - 1 ) ;
unistr2_to_ascii ( state - > response . data . auth . info3 . logon_dom ,
& info3 - > uni_logon_dom , - 1 ) ;
return NT_STATUS_OK ;
}
2002-08-17 21:00:51 +04:00
static NTSTATUS append_info3_as_ndr ( TALLOC_CTX * mem_ctx ,
struct winbindd_cli_state * state ,
NET_USER_INFO_3 * info3 )
{
prs_struct ps ;
uint32 size ;
if ( ! prs_init ( & ps , 256 /* Random, non-zero number */ , mem_ctx , MARSHALL ) ) {
return NT_STATUS_NO_MEMORY ;
}
2005-09-30 21:13:37 +04:00
if ( ! net_io_user_info3 ( " " , info3 , & ps , 1 , 3 , False ) ) {
2002-08-17 21:00:51 +04:00
prs_mem_free ( & ps ) ;
return NT_STATUS_UNSUCCESSFUL ;
}
size = prs_data_size ( & ps ) ;
2004-12-07 21:25:53 +03:00
state - > response . extra_data = SMB_MALLOC ( size ) ;
2002-08-17 21:00:51 +04:00
if ( ! state - > response . extra_data ) {
prs_mem_free ( & ps ) ;
return NT_STATUS_NO_MEMORY ;
}
2004-05-07 22:14:38 +04:00
memset ( state - > response . extra_data , ' \0 ' , size ) ;
2003-02-15 01:55:46 +03:00
prs_copy_all_data_out ( state - > response . extra_data , & ps ) ;
2002-08-17 21:00:51 +04:00
state - > response . length + = size ;
prs_mem_free ( & ps ) ;
return NT_STATUS_OK ;
}
2004-04-06 20:44:24 +04:00
static NTSTATUS check_info3_in_group ( TALLOC_CTX * mem_ctx ,
NET_USER_INFO_3 * info3 ,
const char * group_sid )
{
2004-10-01 07:28:39 +04:00
DOM_SID require_membership_of_sid ;
2004-04-06 20:44:24 +04:00
DOM_SID * all_sids ;
size_t num_all_sids = ( 2 + info3 - > num_groups2 + info3 - > num_other_sids ) ;
size_t i , j = 0 ;
/* Parse the 'required group' SID */
if ( ! group_sid | | ! group_sid [ 0 ] ) {
/* NO sid supplied, all users may access */
return NT_STATUS_OK ;
}
2004-10-01 07:28:39 +04:00
if ( ! string_to_sid ( & require_membership_of_sid , group_sid ) ) {
2004-04-23 05:20:23 +04:00
DEBUG ( 0 , ( " check_info3_in_group: could not parse %s as a SID! " ,
2004-04-06 20:44:24 +04:00
group_sid ) ) ;
return NT_STATUS_INVALID_PARAMETER ;
}
2004-12-07 21:25:53 +03:00
all_sids = TALLOC_ARRAY ( mem_ctx , DOM_SID , num_all_sids ) ;
2004-04-06 20:44:24 +04:00
if ( ! all_sids )
return NT_STATUS_NO_MEMORY ;
/* and create (by appending rids) the 'domain' sids */
sid_copy ( & all_sids [ 0 ] , & ( info3 - > dom_sid . sid ) ) ;
if ( ! sid_append_rid ( & all_sids [ 0 ] , info3 - > user_rid ) ) {
DEBUG ( 3 , ( " could not append user's primary RID 0x%x \n " ,
info3 - > user_rid ) ) ;
return NT_STATUS_INVALID_PARAMETER ;
}
j + + ;
sid_copy ( & all_sids [ 1 ] , & ( info3 - > dom_sid . sid ) ) ;
if ( ! sid_append_rid ( & all_sids [ 1 ] , info3 - > group_rid ) ) {
DEBUG ( 3 , ( " could not append additional group rid 0x%x \n " ,
info3 - > group_rid ) ) ;
return NT_STATUS_INVALID_PARAMETER ;
}
j + + ;
for ( i = 0 ; i < info3 - > num_groups2 ; i + + ) {
sid_copy ( & all_sids [ j ] , & ( info3 - > dom_sid . sid ) ) ;
2004-09-02 01:28:42 +04:00
if ( ! sid_append_rid ( & all_sids [ j ] , info3 - > gids [ i ] . g_rid ) ) {
2004-04-06 20:44:24 +04:00
DEBUG ( 3 , ( " could not append additional group rid 0x%x \n " ,
2004-09-02 01:28:42 +04:00
info3 - > gids [ i ] . g_rid ) ) ;
2004-04-06 20:44:24 +04:00
return NT_STATUS_INVALID_PARAMETER ;
}
j + + ;
}
/* Copy 'other' sids. We need to do sid filtering here to
prevent possible elevation of privileges . See :
http : //www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
*/
2004-08-18 20:15:21 +04:00
for ( i = 0 ; i < info3 - > num_other_sids ; i + + ) {
2004-04-06 20:44:24 +04:00
sid_copy ( & all_sids [ info3 - > num_groups2 + i + 2 ] ,
2004-09-02 01:28:42 +04:00
& info3 - > other_sids [ i ] . sid ) ;
2004-04-06 20:44:24 +04:00
j + + ;
}
for ( i = 0 ; i < j ; i + + ) {
fstring sid1 , sid2 ;
DEBUG ( 10 , ( " User has SID: %s \n " ,
sid_to_string ( sid1 , & all_sids [ i ] ) ) ) ;
2004-10-01 07:28:39 +04:00
if ( sid_equal ( & require_membership_of_sid , & all_sids [ i ] ) ) {
2004-04-06 20:44:24 +04:00
DEBUG ( 10 , ( " SID %s matches %s - user permitted to authenticate! \n " ,
2004-10-01 07:28:39 +04:00
sid_to_string ( sid1 , & require_membership_of_sid ) , sid_to_string ( sid2 , & all_sids [ i ] ) ) ) ;
2004-04-06 20:44:24 +04:00
return NT_STATUS_OK ;
}
}
/* Do not distinguish this error from a wrong username/pw */
return NT_STATUS_LOGON_FAILURE ;
}
2006-02-04 01:19:41 +03:00
static struct winbindd_domain * find_auth_domain ( struct winbindd_cli_state * state ,
const char * domain_name )
2005-06-09 02:10:34 +04:00
{
struct winbindd_domain * domain ;
if ( IS_DC ) {
domain = find_domain_from_name_noinit ( domain_name ) ;
if ( domain = = NULL ) {
2006-02-04 01:19:41 +03:00
DEBUG ( 3 , ( " Authentication for domain [%s] refused "
2005-06-09 02:10:34 +04:00
" as it is not a trusted domain \n " ,
domain_name ) ) ;
}
return domain ;
}
if ( is_myname ( domain_name ) ) {
DEBUG ( 3 , ( " Authentication for domain %s (local domain "
" to this server) not supported at this "
" stage \n " , domain_name ) ) ;
return NULL ;
}
return find_our_domain ( ) ;
}
static void set_auth_errors ( struct winbindd_response * resp , NTSTATUS result )
{
resp - > data . auth . nt_status = NT_STATUS_V ( result ) ;
fstrcpy ( resp - > data . auth . nt_status_string , nt_errstr ( result ) ) ;
/* we might have given a more useful error above */
if ( * resp - > data . auth . error_string = = ' \0 ' )
fstrcpy ( resp - > data . auth . error_string ,
get_friendly_nt_error_msg ( result ) ) ;
resp - > data . auth . pam_error = nt_status_to_pam ( result ) ;
}
2006-02-04 01:19:41 +03:00
static NTSTATUS fillup_password_policy ( struct winbindd_domain * domain ,
struct winbindd_cli_state * state )
{
struct winbindd_methods * methods ;
NTSTATUS status = NT_STATUS_UNSUCCESSFUL ;
SAM_UNK_INFO_1 password_policy ;
methods = domain - > methods ;
status = methods - > password_policy ( domain , state - > mem_ctx , & password_policy ) ;
if ( NT_STATUS_IS_ERR ( status ) ) {
return status ;
}
state - > response . data . auth . policy . min_length_password =
password_policy . min_length_password ;
state - > response . data . auth . policy . password_history =
password_policy . password_history ;
state - > response . data . auth . policy . password_properties =
password_policy . password_properties ;
state - > response . data . auth . policy . expire =
nt_time_to_unix_abs ( & ( password_policy . expire ) ) ;
state - > response . data . auth . policy . min_passwordage =
nt_time_to_unix_abs ( & ( password_policy . min_passwordage ) ) ;
return NT_STATUS_OK ;
}
static NTSTATUS get_max_bad_attempts_from_lockout_policy ( struct winbindd_domain * domain ,
TALLOC_CTX * mem_ctx ,
uint16 * max_allowed_bad_attempts )
{
struct winbindd_methods * methods ;
NTSTATUS status = NT_STATUS_UNSUCCESSFUL ;
SAM_UNK_INFO_12 lockout_policy ;
* max_allowed_bad_attempts = 0 ;
methods = domain - > methods ;
status = methods - > lockout_policy ( domain , mem_ctx , & lockout_policy ) ;
if ( NT_STATUS_IS_ERR ( status ) ) {
return status ;
}
* max_allowed_bad_attempts = lockout_policy . bad_attempt_lockout ;
return NT_STATUS_OK ;
}
2006-02-27 19:39:56 +03:00
static NTSTATUS get_pwd_properties ( struct winbindd_domain * domain ,
TALLOC_CTX * mem_ctx ,
uint32 * password_properties )
{
struct winbindd_methods * methods ;
NTSTATUS status = NT_STATUS_UNSUCCESSFUL ;
SAM_UNK_INFO_1 password_policy ;
* password_properties = 0 ;
methods = domain - > methods ;
status = methods - > password_policy ( domain , mem_ctx , & password_policy ) ;
if ( NT_STATUS_IS_ERR ( status ) ) {
return status ;
}
* password_properties = password_policy . password_properties ;
return NT_STATUS_OK ;
}
2006-02-04 01:19:41 +03:00
static const char * generate_krb5_ccache ( TALLOC_CTX * mem_ctx ,
const char * type ,
uid_t uid ,
BOOL * internal_ccache )
{
/* accept KCM, FILE and WRFILE as krb5_cc_type from the client and then
* build the full ccname string based on the user ' s uid here -
* Guenther */
const char * gen_cc = NULL ;
* internal_ccache = True ;
if ( uid = = - 1 ) {
goto memory_ccache ;
}
if ( ! type | | type [ 0 ] = = ' \0 ' ) {
goto memory_ccache ;
}
if ( strequal ( type , " FILE " ) ) {
gen_cc = talloc_asprintf ( mem_ctx , " FILE:/tmp/krb5cc_%d " , uid ) ;
} else if ( strequal ( type , " WRFILE " ) ) {
gen_cc = talloc_asprintf ( mem_ctx , " WRFILE:/tmp/krb5cc_%d " , uid ) ;
# ifdef WITH_KCM
} else if ( strequal ( type , " KCM " ) ) {
gen_cc = talloc_asprintf ( mem_ctx , " KCM:%d " , uid ) ;
# endif
} else {
DEBUG ( 10 , ( " we don't allow to set a %s type ccache \n " , type ) ) ;
goto memory_ccache ;
}
* internal_ccache = False ;
goto done ;
memory_ccache :
gen_cc = talloc_strdup ( mem_ctx , " MEMORY:winbind_cache " ) ;
done :
if ( gen_cc = = NULL ) {
DEBUG ( 0 , ( " out of memory \n " ) ) ;
return NULL ;
}
DEBUG ( 10 , ( " using ccache: %s %s \n " , gen_cc , * internal_ccache ? " (internal) " : " " ) ) ;
return gen_cc ;
}
static uid_t get_uid_from_state ( struct winbindd_cli_state * state )
{
uid_t uid = - 1 ;
uid = state - > request . data . auth . uid ;
if ( uid < 0 ) {
DEBUG ( 1 , ( " invalid uid: '%d' \n " , uid ) ) ;
return - 1 ;
}
return uid ;
}
static void setup_return_cc_name ( struct winbindd_cli_state * state , const char * cc )
{
const char * type = state - > request . data . auth . krb5_cc_type ;
state - > response . data . auth . krb5ccname [ 0 ] = ' \0 ' ;
if ( type [ 0 ] = = ' \0 ' ) {
return ;
}
if ( ! strequal ( type , " FILE " ) & &
# ifdef WITH_KCM
! strequal ( type , " KCM " ) & &
# endif
! strequal ( type , " WRFILE " ) ) {
DEBUG ( 10 , ( " won't return krbccname for a %s type ccache \n " ,
type ) ) ;
return ;
}
fstrcpy ( state - > response . data . auth . krb5ccname , cc ) ;
}
2003-06-30 21:24:59 +04:00
/**********************************************************************
2006-02-04 01:19:41 +03:00
Authenticate a user with a clear text password using Kerberos and fill up
ccache if required
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static NTSTATUS winbindd_raw_kerberos_login ( struct winbindd_domain * domain ,
struct winbindd_cli_state * state ,
NET_USER_INFO_3 * * info3 )
{
# ifdef HAVE_KRB5
NTSTATUS result = NT_STATUS_UNSUCCESSFUL ;
krb5_error_code krb5_ret ;
DATA_BLOB tkt , session_key_krb5 ;
DATA_BLOB ap_rep , session_key ;
PAC_DATA * pac_data = NULL ;
PAC_LOGON_INFO * logon_info = NULL ;
char * client_princ = NULL ;
char * client_princ_out = NULL ;
char * local_service = NULL ;
const char * cc = NULL ;
const char * principal_s = NULL ;
const char * service = NULL ;
char * realm = NULL ;
fstring name_domain , name_user ;
time_t ticket_lifetime = 0 ;
time_t renewal_until = 0 ;
uid_t uid = - 1 ;
ADS_STRUCT * ads ;
time_t time_offset = 0 ;
BOOL internal_ccache = True ;
ZERO_STRUCT ( session_key ) ;
ZERO_STRUCT ( session_key_krb5 ) ;
ZERO_STRUCT ( tkt ) ;
ZERO_STRUCT ( ap_rep ) ;
ZERO_STRUCTP ( info3 ) ;
* info3 = NULL ;
/* 1st step:
* prepare a krb5_cc_cache string for the user */
uid = get_uid_from_state ( state ) ;
if ( uid = = - 1 ) {
DEBUG ( 0 , ( " no valid uid \n " ) ) ;
}
cc = generate_krb5_ccache ( state - > mem_ctx ,
state - > request . data . auth . krb5_cc_type ,
state - > request . data . auth . uid ,
& internal_ccache ) ;
if ( cc = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
/* 2nd step:
* get kerberos properties */
if ( domain - > private_data ) {
ads = ( ADS_STRUCT * ) domain - > private_data ;
time_offset = ads - > auth . time_offset ;
}
/* 3rd step:
* do kerberos auth and setup ccache as the user */
parse_domain_user ( state - > request . data . auth . user , name_domain , name_user ) ;
realm = domain - > alt_name ;
strupper_m ( realm ) ;
principal_s = talloc_asprintf ( state - > mem_ctx , " %s@%s " , name_user , realm ) ;
if ( principal_s = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
service = talloc_asprintf ( state - > mem_ctx , " krbtgt/%s@%s " , realm , realm ) ;
if ( service = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
/* if this is a user ccache, we need to act as the user to let the krb5
* library handle the chown , etc . */
/************************ NON-ROOT **********************/
if ( ! internal_ccache ) {
seteuid ( uid ) ;
DEBUG ( 10 , ( " winbindd_raw_kerberos_login: uid is %d \n " , uid ) ) ;
}
krb5_ret = kerberos_kinit_password ( principal_s ,
state - > request . data . auth . pass ,
time_offset ,
& ticket_lifetime ,
& renewal_until ,
cc ,
True ,
WINBINDD_PAM_AUTH_KRB5_RENEW_TIME ) ;
if ( krb5_ret ) {
DEBUG ( 1 , ( " winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d) \n " ,
principal_s , error_message ( krb5_ret ) , krb5_ret ) ) ;
result = krb5_to_nt_status ( krb5_ret ) ;
goto done ;
}
/* does http_timestring use heimdals libroken strftime?? - Guenther */
DEBUG ( 10 , ( " got TGT for %s in %s (valid until: %s (%d), renewable till: %s (%d)) \n " ,
principal_s , cc ,
http_timestring ( ticket_lifetime ) , ( int ) ticket_lifetime ,
http_timestring ( renewal_until ) , ( int ) renewal_until ) ) ;
client_princ = talloc_strdup ( state - > mem_ctx , global_myname ( ) ) ;
if ( client_princ = = NULL ) {
result = NT_STATUS_NO_MEMORY ;
goto done ;
}
strlower_m ( client_princ ) ;
local_service = talloc_asprintf ( state - > mem_ctx , " HOST/%s@%s " , client_princ , lp_realm ( ) ) ;
if ( local_service = = NULL ) {
DEBUG ( 0 , ( " winbindd_raw_kerberos_login: out of memory \n " ) ) ;
result = NT_STATUS_NO_MEMORY ;
goto done ;
}
krb5_ret = cli_krb5_get_ticket ( local_service ,
time_offset ,
& tkt ,
& session_key_krb5 ,
0 ,
cc ) ;
if ( krb5_ret ) {
DEBUG ( 1 , ( " winbindd_raw_kerberos_login: failed to get ticket for: %s \n " ,
local_service ) ) ;
result = krb5_to_nt_status ( krb5_ret ) ;
goto done ;
}
if ( ! internal_ccache ) {
seteuid ( 0 ) ;
}
/************************ NON-ROOT **********************/
result = ads_verify_ticket ( state - > mem_ctx ,
lp_realm ( ) ,
& tkt ,
& client_princ_out ,
& pac_data ,
& ap_rep ,
& session_key ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 0 , ( " winbindd_raw_kerberos_login: ads_verify_ticket failed: %s \n " ,
nt_errstr ( result ) ) ) ;
goto done ;
}
DEBUG ( 10 , ( " winbindd_raw_kerberos_login: winbindd validated ticket of %s \n " ,
2006-02-09 13:17:38 +03:00
local_service ) ) ;
2006-02-04 01:19:41 +03:00
if ( ! pac_data ) {
DEBUG ( 3 , ( " winbindd_raw_kerberos_login: no pac data \n " ) ) ;
result = NT_STATUS_INVALID_PARAMETER ;
goto done ;
}
logon_info = get_logon_info_from_pac ( pac_data ) ;
if ( logon_info = = NULL ) {
DEBUG ( 1 , ( " winbindd_raw_kerberos_login: no logon info \n " ) ) ;
result = NT_STATUS_INVALID_PARAMETER ;
goto done ;
}
/* last step:
* put results together */
* info3 = & logon_info - > info3 ;
/* if we had a user's ccache then return that string for the pam
* environment */
if ( ! internal_ccache ) {
setup_return_cc_name ( state , cc ) ;
result = add_ccache_to_list ( principal_s ,
cc ,
service ,
state - > request . data . auth . user ,
NULL ,
state - > request . data . auth . pass ,
uid ,
time ( NULL ) ,
ticket_lifetime ,
renewal_until ,
lp_winbind_refresh_tickets ( ) ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " winbindd_raw_kerberos_login: failed to add ccache to list: %s \n " ,
nt_errstr ( result ) ) ) ;
}
}
result = NT_STATUS_OK ;
done :
data_blob_free ( & session_key ) ;
data_blob_free ( & session_key_krb5 ) ;
data_blob_free ( & ap_rep ) ;
data_blob_free ( & tkt ) ;
SAFE_FREE ( client_princ_out ) ;
if ( ! internal_ccache ) {
seteuid ( 0 ) ;
}
return result ;
# else
return NT_STATUS_NOT_SUPPORTED ;
# endif /* HAVE_KRB5 */
}
2000-05-09 15:43:00 +04:00
2005-06-20 17:42:29 +04:00
void winbindd_pam_auth ( struct winbindd_cli_state * state )
2005-06-09 02:10:34 +04:00
{
struct winbindd_domain * domain ;
fstring name_domain , name_user ;
/* Ensure null termination */
state - > request . data . auth . user
[ sizeof ( state - > request . data . auth . user ) - 1 ] = ' \0 ' ;
/* Ensure null termination */
state - > request . data . auth . pass
[ sizeof ( state - > request . data . auth . pass ) - 1 ] = ' \0 ' ;
DEBUG ( 3 , ( " [%5lu]: pam auth %s \n " , ( unsigned long ) state - > pid ,
state - > request . data . auth . user ) ) ;
/* Parse domain and username */
2006-02-13 18:12:22 +03:00
if ( ! parse_domain_user ( state - > request . data . auth . user ,
name_domain , name_user ) ) {
set_auth_errors ( & state - > response , NT_STATUS_NO_SUCH_USER ) ;
DEBUG ( 5 , ( " Plain text authentication for %s returned %s "
" (PAM: %d) \n " ,
state - > request . data . auth . user ,
state - > response . data . auth . nt_status_string ,
state - > response . data . auth . pam_error ) ) ;
request_error ( state ) ;
return ;
}
2005-06-09 02:10:34 +04:00
2006-02-04 01:19:41 +03:00
domain = find_auth_domain ( state , name_domain ) ;
2005-06-09 02:10:34 +04:00
if ( domain = = NULL ) {
set_auth_errors ( & state - > response , NT_STATUS_NO_SUCH_USER ) ;
DEBUG ( 5 , ( " Plain text authentication for %s returned %s "
" (PAM: %d) \n " ,
state - > request . data . auth . user ,
state - > response . data . auth . nt_status_string ,
state - > response . data . auth . pam_error ) ) ;
2005-06-20 17:42:29 +04:00
request_error ( state ) ;
return ;
2005-06-09 02:10:34 +04:00
}
2005-06-20 17:42:29 +04:00
sendto_domain ( state , domain ) ;
2005-06-09 02:10:34 +04:00
}
2006-02-04 01:19:41 +03:00
NTSTATUS winbindd_dual_pam_auth_cached ( struct winbindd_domain * domain ,
struct winbindd_cli_state * state ,
NET_USER_INFO_3 * * info3 )
2000-05-09 15:43:00 +04:00
{
2006-02-04 01:19:41 +03:00
NTSTATUS result = NT_STATUS_LOGON_FAILURE ;
uint16 max_allowed_bad_attempts ;
2001-11-05 03:21:17 +03:00
fstring name_domain , name_user ;
2006-02-04 01:19:41 +03:00
DOM_SID sid ;
enum SID_NAME_USE type ;
uchar new_nt_pass [ NT_HASH_LEN ] ;
const uint8 * cached_nt_pass ;
NET_USER_INFO_3 * my_info3 ;
time_t kickoff_time , must_change_time ;
* info3 = NULL ;
ZERO_STRUCTP ( info3 ) ;
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached \n " ) ) ;
/* Parse domain and username */
parse_domain_user ( state - > request . data . auth . user , name_domain , name_user ) ;
if ( ! lookup_cached_name ( state - > mem_ctx ,
name_domain ,
name_user ,
& sid ,
& type ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached: no such user in the cache \n " ) ) ;
return NT_STATUS_NO_SUCH_USER ;
}
if ( type ! = SID_NAME_USER ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached: not a user (%s) \n " , sid_type_lookup ( type ) ) ) ;
return NT_STATUS_LOGON_FAILURE ;
}
result = winbindd_get_creds ( domain ,
state - > mem_ctx ,
& sid ,
& my_info3 ,
& cached_nt_pass ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached: failed to get creds: %s \n " , nt_errstr ( result ) ) ) ;
return result ;
}
* info3 = my_info3 ;
E_md4hash ( state - > request . data . auth . pass , new_nt_pass ) ;
dump_data ( 100 , ( const char * ) new_nt_pass , NT_HASH_LEN ) ;
dump_data ( 100 , ( const char * ) cached_nt_pass , NT_HASH_LEN ) ;
if ( ! memcmp ( cached_nt_pass , new_nt_pass , NT_HASH_LEN ) ) {
/* User *DOES* know the password, update logon_time and reset
* bad_pw_count */
my_info3 - > user_flgs | = LOGON_CACHED_ACCOUNT ;
if ( my_info3 - > acct_flags & ACB_AUTOLOCK ) {
return NT_STATUS_ACCOUNT_LOCKED_OUT ;
}
if ( my_info3 - > acct_flags & ACB_DISABLED ) {
return NT_STATUS_ACCOUNT_DISABLED ;
}
if ( my_info3 - > acct_flags & ACB_WSTRUST ) {
return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT ;
}
if ( my_info3 - > acct_flags & ACB_SVRTRUST ) {
return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT ;
}
if ( my_info3 - > acct_flags & ACB_DOMTRUST ) {
return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT ;
}
2006-02-22 23:40:24 +03:00
2006-02-04 01:19:41 +03:00
if ( ! ( my_info3 - > acct_flags & ACB_NORMAL ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x \n " ,
my_info3 - > acct_flags ) ) ;
return NT_STATUS_LOGON_FAILURE ;
}
2006-02-22 23:40:24 +03:00
2006-02-04 01:19:41 +03:00
kickoff_time = nt_time_to_unix ( & my_info3 - > kickoff_time ) ;
if ( kickoff_time ! = 0 & & time ( NULL ) > kickoff_time ) {
return NT_STATUS_ACCOUNT_EXPIRED ;
}
must_change_time = nt_time_to_unix ( & my_info3 - > pass_must_change_time ) ;
if ( must_change_time ! = 0 & & must_change_time < time ( NULL ) ) {
return NT_STATUS_PASSWORD_EXPIRED ;
}
/* FIXME: we possibly should handle logon hours as well (does xp when
* offline ? ) see auth / auth_sam . c : sam_account_ok for details */
unix_to_nt_time ( & my_info3 - > logon_time , time ( NULL ) ) ;
my_info3 - > bad_pw_count = 0 ;
result = winbindd_update_creds_by_info3 ( domain ,
state - > mem_ctx ,
state - > request . data . auth . user ,
state - > request . data . auth . pass ,
my_info3 ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 1 , ( " failed to update creds: %s \n " , nt_errstr ( result ) ) ) ;
return result ;
}
return NT_STATUS_OK ;
}
/* User does *NOT* know the correct password, modify info3 accordingly */
/* failure of this is not critical */
result = get_max_bad_attempts_from_lockout_policy ( domain , state - > mem_ctx , & max_allowed_bad_attempts ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
" Won't be able to honour account lockout policies \n " ) ) ;
}
/* increase counter */
2006-02-27 19:39:56 +03:00
my_info3 - > bad_pw_count + + ;
if ( max_allowed_bad_attempts = = 0 ) {
goto failed ;
2006-02-04 01:19:41 +03:00
}
/* lockout user */
if ( my_info3 - > bad_pw_count > = max_allowed_bad_attempts ) {
2006-02-27 19:39:56 +03:00
uint32 password_properties ;
result = get_pwd_properties ( domain , state - > mem_ctx , & password_properties ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached: failed to get password properties. \n " ) ) ;
}
if ( ( my_info3 - > user_rid ! = DOMAIN_USER_RID_ADMIN ) | |
( password_properties & DOMAIN_LOCKOUT_ADMINS ) ) {
my_info3 - > acct_flags | = ACB_AUTOLOCK ;
}
2006-02-04 01:19:41 +03:00
}
2006-02-27 19:39:56 +03:00
failed :
2006-02-04 01:19:41 +03:00
result = winbindd_update_creds_by_info3 ( domain ,
state - > mem_ctx ,
state - > request . data . auth . user ,
NULL ,
my_info3 ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 0 , ( " winbindd_dual_pam_auth_cached: failed to update creds %s \n " ,
nt_errstr ( result ) ) ) ;
}
return NT_STATUS_LOGON_FAILURE ;
}
NTSTATUS winbindd_dual_pam_auth_kerberos ( struct winbindd_domain * domain ,
struct winbindd_cli_state * state ,
NET_USER_INFO_3 * * info3 )
{
struct winbindd_domain * contact_domain ;
fstring name_domain , name_user ;
NTSTATUS result ;
DEBUG ( 10 , ( " winbindd_dual_pam_auth_kerberos \n " ) ) ;
/* Parse domain and username */
parse_domain_user ( state - > request . data . auth . user , name_domain , name_user ) ;
/* what domain should we contact? */
if ( IS_DC ) {
if ( ! ( contact_domain = find_domain_from_name ( name_domain ) ) ) {
DEBUG ( 3 , ( " Authentication for domain for [%s] -> [%s] \\ [%s] failed as %s is not a trusted domain \n " ,
state - > request . data . auth . user , name_domain , name_user , name_domain ) ) ;
result = NT_STATUS_NO_SUCH_USER ;
goto done ;
}
} else {
if ( is_myname ( name_domain ) ) {
DEBUG ( 3 , ( " Authentication for domain %s (local domain to this server) not supported at this stage \n " , name_domain ) ) ;
result = NT_STATUS_NO_SUCH_USER ;
goto done ;
}
contact_domain = find_domain_from_name ( name_domain ) ;
if ( contact_domain = = NULL ) {
DEBUG ( 3 , ( " Authentication for domain for [%s] -> [%s] \\ [%s] failed as %s is not a trusted domain \n " ,
state - > request . data . auth . user , name_domain , name_user , name_domain ) ) ;
contact_domain = find_our_domain ( ) ;
}
}
set_dc_type_and_flags ( contact_domain ) ;
if ( ! contact_domain - > active_directory ) {
DEBUG ( 3 , ( " krb5 auth requested but domain is not Active Directory \n " ) ) ;
return NT_STATUS_INVALID_LOGON_TYPE ;
}
result = winbindd_raw_kerberos_login ( contact_domain , state , info3 ) ;
done :
return result ;
}
NTSTATUS winbindd_dual_pam_auth_samlogon ( struct winbindd_domain * domain ,
struct winbindd_cli_state * state ,
NET_USER_INFO_3 * * info3 )
{
2005-09-30 21:13:37 +04:00
struct rpc_pipe_client * netlogon_pipe ;
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
uchar chal [ 8 ] ;
2002-01-01 07:50:45 +03:00
DATA_BLOB lm_resp ;
DATA_BLOB nt_resp ;
2003-05-08 12:02:52 +04:00
int attempts = 0 ;
2003-06-30 21:24:59 +04:00
unsigned char local_lm_response [ 24 ] ;
unsigned char local_nt_response [ 24 ] ;
2004-01-05 07:10:28 +03:00
struct winbindd_domain * contact_domain ;
2006-02-04 01:19:41 +03:00
fstring name_domain , name_user ;
2003-09-08 17:53:19 +04:00
BOOL retry ;
2006-02-04 01:19:41 +03:00
NTSTATUS result ;
NET_USER_INFO_3 * my_info3 ;
2002-01-01 07:50:45 +03:00
2006-02-04 01:19:41 +03:00
ZERO_STRUCTP ( info3 ) ;
2002-08-17 21:00:51 +04:00
2006-02-04 01:19:41 +03:00
* info3 = NULL ;
2002-08-17 21:00:51 +04:00
2006-02-04 01:19:41 +03:00
my_info3 = TALLOC_ZERO_P ( state - > mem_ctx , NET_USER_INFO_3 ) ;
if ( my_info3 = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
2000-05-09 15:43:00 +04:00
2006-02-04 01:19:41 +03:00
DEBUG ( 10 , ( " winbindd_dual_pam_auth_samlogon \n " ) ) ;
2000-05-09 15:43:00 +04:00
/* Parse domain and username */
2002-01-10 13:23:54 +03:00
2003-07-09 20:44:47 +04:00
parse_domain_user ( state - > request . data . auth . user , name_domain , name_user ) ;
2000-05-09 15:43:00 +04:00
2003-06-30 21:24:59 +04:00
/* do password magic */
2004-09-30 04:49:41 +04:00
2004-07-14 08:36:01 +04:00
generate_random_buffer ( chal , 8 ) ;
2004-09-30 04:49:41 +04:00
if ( lp_client_ntlmv2_auth ( ) ) {
DATA_BLOB server_chal ;
DATA_BLOB names_blob ;
DATA_BLOB nt_response ;
DATA_BLOB lm_response ;
2005-06-09 02:10:34 +04:00
server_chal = data_blob_talloc ( state - > mem_ctx , chal , 8 ) ;
2004-09-30 04:49:41 +04:00
/* note that the 'workgroup' here is a best guess - we don't know
the server ' s domain at this point . The ' server name ' is also
dodgy . . .
*/
names_blob = NTLMv2_generate_names_blob ( global_myname ( ) , lp_workgroup ( ) ) ;
2002-01-01 07:50:45 +03:00
2004-09-30 04:49:41 +04:00
if ( ! SMBNTLMv2encrypt ( name_user , name_domain ,
state - > request . data . auth . pass ,
& server_chal ,
& names_blob ,
& lm_response , & nt_response , NULL ) ) {
data_blob_free ( & names_blob ) ;
data_blob_free ( & server_chal ) ;
DEBUG ( 0 , ( " winbindd_pam_auth: SMBNTLMv2encrypt() failed! \n " ) ) ;
result = NT_STATUS_NO_MEMORY ;
goto done ;
}
data_blob_free ( & names_blob ) ;
data_blob_free ( & server_chal ) ;
2005-06-09 02:10:34 +04:00
lm_resp = data_blob_talloc ( state - > mem_ctx , lm_response . data ,
lm_response . length ) ;
nt_resp = data_blob_talloc ( state - > mem_ctx , nt_response . data ,
nt_response . length ) ;
2004-09-30 04:49:41 +04:00
data_blob_free ( & lm_response ) ;
data_blob_free ( & nt_response ) ;
} else {
if ( lp_client_lanman_auth ( )
& & SMBencrypt ( state - > request . data . auth . pass ,
chal ,
local_lm_response ) ) {
2005-06-09 02:10:34 +04:00
lm_resp = data_blob_talloc ( state - > mem_ctx ,
2004-09-30 04:49:41 +04:00
local_lm_response ,
sizeof ( local_lm_response ) ) ;
} else {
lm_resp = data_blob ( NULL , 0 ) ;
}
SMBNTencrypt ( state - > request . data . auth . pass ,
chal ,
local_nt_response ) ;
2005-06-09 02:10:34 +04:00
nt_resp = data_blob_talloc ( state - > mem_ctx ,
2004-09-30 04:49:41 +04:00
local_nt_response ,
sizeof ( local_nt_response ) ) ;
}
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
2003-07-07 09:11:10 +04:00
/* what domain should we contact? */
2003-12-31 11:45:03 +03:00
if ( IS_DC ) {
2004-01-05 07:10:28 +03:00
if ( ! ( contact_domain = find_domain_from_name ( name_domain ) ) ) {
DEBUG ( 3 , ( " Authentication for domain for [%s] -> [%s] \\ [%s] failed as %s is not a trusted domain \n " ,
2003-12-31 11:45:03 +03:00
state - > request . data . auth . user , name_domain , name_user , name_domain ) ) ;
result = NT_STATUS_NO_SUCH_USER ;
goto done ;
}
2003-07-07 09:11:10 +04:00
2003-12-31 11:45:03 +03:00
} else {
if ( is_myname ( name_domain ) ) {
DEBUG ( 3 , ( " Authentication for domain %s (local domain to this server) not supported at this stage \n " , name_domain ) ) ;
result = NT_STATUS_NO_SUCH_USER ;
goto done ;
}
2004-01-05 07:10:28 +03:00
2005-06-09 02:10:34 +04:00
contact_domain = find_our_domain ( ) ;
2004-01-05 07:10:28 +03:00
}
2003-06-30 21:24:59 +04:00
/* check authentication loop */
2003-05-08 12:02:52 +04:00
do {
2005-06-09 02:10:34 +04:00
2006-02-04 01:19:41 +03:00
ZERO_STRUCTP ( my_info3 ) ;
2003-09-08 17:53:19 +04:00
retry = False ;
2005-06-09 02:10:34 +04:00
2005-09-30 21:13:37 +04:00
result = cm_connect_netlogon ( contact_domain , & netlogon_pipe ) ;
2003-05-08 12:02:52 +04:00
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 3 , ( " could not open handle to NETLOGON pipe \n " ) ) ;
goto done ;
}
2005-09-30 21:13:37 +04:00
result = rpccli_netlogon_sam_network_logon ( netlogon_pipe ,
2005-11-08 09:19:34 +03:00
state - > mem_ctx ,
0 ,
contact_domain - > dcname , /* server name */
name_user , /* user name */
name_domain , /* target domain */
global_myname ( ) , /* workstation */
chal ,
lm_resp ,
nt_resp ,
2006-02-04 01:19:41 +03:00
my_info3 ) ;
2003-05-08 12:02:52 +04:00
attempts + = 1 ;
2005-06-09 02:10:34 +04:00
/* We have to try a second time as cm_connect_netlogon
2003-09-24 05:22:59 +04:00
might not yet have noticed that the DC has killed
our connection . */
2005-06-09 02:10:34 +04:00
if ( NT_STATUS_EQUAL ( result , NT_STATUS_UNSUCCESSFUL ) ) {
2003-09-24 05:22:59 +04:00
retry = True ;
continue ;
2005-06-09 02:10:34 +04:00
}
2003-09-24 05:22:59 +04:00
2005-06-09 02:10:34 +04:00
/* if we get access denied, a possible cause was that we had
and open connection to the DC , but someone changed our
machine account password out from underneath us using ' net
rpc changetrustpw ' */
2003-07-03 20:23:11 +04:00
2005-06-09 02:10:34 +04:00
if ( NT_STATUS_EQUAL ( result , NT_STATUS_ACCESS_DENIED ) ) {
DEBUG ( 3 , ( " winbindd_pam_auth: sam_logon returned "
" ACCESS_DENIED. Maybe the trust account "
" password was changed and we didn't know it. "
" Killing connections to domain %s \n " ,
2003-07-03 20:23:11 +04:00
name_domain ) ) ;
2005-06-09 02:10:34 +04:00
invalidate_cm_connection ( & contact_domain - > conn ) ;
2003-09-08 17:53:19 +04:00
retry = True ;
2003-07-03 20:23:11 +04:00
}
2003-09-08 17:53:19 +04:00
} while ( ( attempts < 2 ) & & retry ) ;
2004-04-21 20:15:59 +04:00
2006-02-04 01:19:41 +03:00
* info3 = my_info3 ;
done :
return result ;
}
enum winbindd_result winbindd_dual_pam_auth ( struct winbindd_domain * domain ,
struct winbindd_cli_state * state )
{
NTSTATUS result = NT_STATUS_LOGON_FAILURE ;
fstring name_domain , name_user ;
NET_USER_INFO_3 * info3 ;
/* Ensure null termination */
state - > request . data . auth . user [ sizeof ( state - > request . data . auth . user ) - 1 ] = ' \0 ' ;
/* Ensure null termination */
state - > request . data . auth . pass [ sizeof ( state - > request . data . auth . pass ) - 1 ] = ' \0 ' ;
DEBUG ( 3 , ( " [%5lu]: dual pam auth %s \n " , ( unsigned long ) state - > pid ,
state - > request . data . auth . user ) ) ;
/* Parse domain and username */
parse_domain_user ( state - > request . data . auth . user , name_domain , name_user ) ;
DEBUG ( 10 , ( " winbindd_dual_pam_auth: domain: %s last was %s \n " , domain - > name , domain - > online ? " online " : " offline " ) ) ;
/* Check for Kerberos authentication */
if ( domain - > online & & ( state - > request . flags & WBFLAG_PAM_KRB5 ) ) {
result = winbindd_dual_pam_auth_kerberos ( domain , state , & info3 ) ;
if ( NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_kerberos succeeded \n " ) ) ;
goto process_result ;
} else {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_kerberos failed: %s \n " , nt_errstr ( result ) ) ) ;
}
if ( NT_STATUS_EQUAL ( result , NT_STATUS_NO_LOGON_SERVERS ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_kerberos setting domain to offline \n " ) ) ;
domain - > online = False ;
}
if ( state - > request . flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5 ) {
DEBUG ( 3 , ( " falling back to samlogon \n " ) ) ;
goto sam_logon ;
} else {
goto cached_logon ;
}
}
sam_logon :
/* Check for Samlogon authentication */
if ( domain - > online ) {
result = winbindd_dual_pam_auth_samlogon ( domain , state , & info3 ) ;
if ( NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_samlogon succeeded \n " ) ) ;
goto process_result ;
} else {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_samlogon failed: %s \n " , nt_errstr ( result ) ) ) ;
if ( domain - > online ) {
/* We're still online - fail. */
goto done ;
}
/* Else drop through and see if we can check offline.... */
}
}
cached_logon :
/* Check for Cached logons */
if ( ! domain - > online & & ( state - > request . flags & WBFLAG_PAM_CACHED_LOGIN ) & &
lp_winbind_offline_logon ( ) ) {
result = winbindd_dual_pam_auth_cached ( domain , state , & info3 ) ;
if ( NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached succeeded \n " ) ) ;
goto process_result ;
} else {
DEBUG ( 10 , ( " winbindd_dual_pam_auth_cached failed: %s \n " , nt_errstr ( result ) ) ) ;
goto done ;
}
}
process_result :
2003-07-03 20:23:11 +04:00
if ( NT_STATUS_IS_OK ( result ) ) {
2006-02-04 01:19:41 +03:00
2006-02-07 20:55:17 +03:00
DOM_SID user_sid ;
2006-02-04 01:19:41 +03:00
netsamlogon_cache_store ( name_user , info3 ) ;
wcache_invalidate_samlogon ( find_domain_from_name ( name_domain ) , info3 ) ;
2005-11-10 23:28:23 +03:00
2006-02-07 20:55:17 +03:00
/* save name_to_sid info as early as possible */
sid_compose ( & user_sid , & info3 - > dom_sid . sid , info3 - > user_rid ) ;
cache_name2sid ( domain , name_domain , name_user , SID_NAME_USER , & user_sid ) ;
2004-04-06 20:44:24 +04:00
/* Check if the user is in the right group */
2006-02-04 01:19:41 +03:00
if ( ! NT_STATUS_IS_OK ( result = check_info3_in_group ( state - > mem_ctx , info3 ,
2005-09-30 21:13:37 +04:00
state - > request . data . auth . require_membership_of_sid ) ) ) {
2004-04-06 20:44:24 +04:00
DEBUG ( 3 , ( " User %s is not in the required group (%s), so plaintext authentication is rejected \n " ,
state - > request . data . auth . user ,
2004-10-01 07:28:39 +04:00
state - > request . data . auth . require_membership_of_sid ) ) ;
2006-02-04 01:19:41 +03:00
goto done ;
2004-04-06 20:44:24 +04:00
}
2006-02-04 01:19:41 +03:00
if ( state - > request . flags & WBFLAG_PAM_INFO3_NDR ) {
result = append_info3_as_ndr ( state - > mem_ctx , state , info3 ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " Failed to append INFO3 (NDR): %s \n " , nt_errstr ( result ) ) ) ;
goto done ;
}
}
if ( state - > request . flags & WBFLAG_PAM_INFO3_TEXT ) {
result = append_info3_as_txt ( state - > mem_ctx , state , info3 ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " Failed to append INFO3 (TXT): %s \n " , nt_errstr ( result ) ) ) ;
goto done ;
}
}
2005-09-30 21:13:37 +04:00
2006-02-04 01:19:41 +03:00
if ( ( state - > request . flags & WBFLAG_PAM_CACHED_LOGIN ) & &
lp_winbind_offline_logon ( ) ) {
result = winbindd_store_creds ( domain ,
state - > mem_ctx ,
state - > request . data . auth . user ,
state - > request . data . auth . pass ,
info3 , NULL ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " Failed to store creds: %s \n " , nt_errstr ( result ) ) ) ;
goto done ;
}
}
result = fillup_password_policy ( domain , state ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " Failed to get password policies: %s \n " , nt_errstr ( result ) ) ) ;
goto done ;
}
}
done :
2003-04-07 11:32:51 +04:00
/* give us a more useful (more correct?) error code */
2005-09-30 21:13:37 +04:00
if ( ( NT_STATUS_EQUAL ( result , NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) | |
2006-02-04 01:19:41 +03:00
( NT_STATUS_EQUAL ( result , NT_STATUS_UNSUCCESSFUL ) ) ) ) {
2003-04-07 11:32:51 +04:00
result = NT_STATUS_NO_LOGON_SERVERS ;
}
2002-02-05 12:40:36 +03:00
state - > response . data . auth . nt_status = NT_STATUS_V ( result ) ;
2002-03-17 07:36:35 +03:00
fstrcpy ( state - > response . data . auth . nt_status_string , nt_errstr ( result ) ) ;
2004-01-05 07:10:28 +03:00
/* we might have given a more useful error above */
if ( ! * state - > response . data . auth . error_string )
fstrcpy ( state - > response . data . auth . error_string , get_friendly_nt_error_msg ( result ) ) ;
2002-02-05 12:40:36 +03:00
state - > response . data . auth . pam_error = nt_status_to_pam ( result ) ;
2002-09-25 19:19:00 +04:00
DEBUG ( NT_STATUS_IS_OK ( result ) ? 5 : 2 , ( " Plain-text authentication for user %s returned %s (PAM: %d) \n " ,
2002-02-05 12:40:36 +03:00
state - > request . data . auth . user ,
state - > response . data . auth . nt_status_string ,
state - > response . data . auth . pam_error ) ) ;
2004-04-01 16:31:50 +04:00
if ( NT_STATUS_IS_OK ( result ) & &
( state - > request . flags & WBFLAG_PAM_AFS_TOKEN ) ) {
2005-12-18 21:06:15 +03:00
char * afsname = talloc_strdup ( state - > mem_ctx ,
lp_afs_username_map ( ) ) ;
2004-04-01 16:31:50 +04:00
char * cell ;
2005-09-30 21:13:37 +04:00
if ( afsname = = NULL ) {
goto no_token ;
}
2004-04-01 16:31:50 +04:00
2005-12-18 21:06:15 +03:00
afsname = talloc_string_sub ( state - > mem_ctx ,
lp_afs_username_map ( ) ,
" %D " , name_domain ) ;
afsname = talloc_string_sub ( state - > mem_ctx , afsname ,
" %u " , name_user ) ;
afsname = talloc_string_sub ( state - > mem_ctx , afsname ,
" %U " , name_user ) ;
2004-04-01 16:31:50 +04:00
2005-02-11 13:32:46 +03:00
{
DOM_SID user_sid ;
fstring sidstr ;
2006-02-04 01:19:41 +03:00
sid_copy ( & user_sid , & info3 - > dom_sid . sid ) ;
sid_append_rid ( & user_sid , info3 - > user_rid ) ;
2005-02-11 13:32:46 +03:00
sid_to_string ( sidstr , & user_sid ) ;
2005-12-18 21:06:15 +03:00
afsname = talloc_string_sub ( state - > mem_ctx , afsname ,
" %s " , sidstr ) ;
2005-02-11 13:32:46 +03:00
}
2005-09-30 21:13:37 +04:00
if ( afsname = = NULL ) {
goto no_token ;
}
2004-04-01 16:31:50 +04:00
strlower_m ( afsname ) ;
2005-02-11 13:32:46 +03:00
DEBUG ( 10 , ( " Generating token for user %s \n " , afsname ) ) ;
2004-04-01 16:31:50 +04:00
cell = strchr ( afsname , ' @ ' ) ;
2005-09-30 21:13:37 +04:00
if ( cell = = NULL ) {
goto no_token ;
}
2004-04-01 16:31:50 +04:00
* cell = ' \0 ' ;
cell + = 1 ;
/* Append an AFS token string */
state - > response . extra_data =
afs_createtoken_str ( afsname , cell ) ;
if ( state - > response . extra_data ! = NULL )
state - > response . length + =
strlen ( state - > response . extra_data ) + 1 ;
no_token :
2006-02-20 20:59:58 +03:00
TALLOC_FREE ( afsname ) ;
2004-04-01 16:31:50 +04:00
}
2006-02-04 01:19:41 +03:00
2001-09-04 11:13:01 +04:00
return NT_STATUS_IS_OK ( result ) ? WINBINDD_OK : WINBINDD_ERROR ;
2001-08-22 06:48:16 +04:00
}
2003-06-30 21:24:59 +04:00
2006-02-04 01:19:41 +03:00
2003-06-30 21:24:59 +04:00
/**********************************************************************
Challenge Response Authentication Protocol
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2001-08-22 06:48:16 +04:00
2005-06-20 17:42:29 +04:00
void winbindd_pam_auth_crap ( struct winbindd_cli_state * state )
2001-08-22 06:48:16 +04:00
{
2005-06-09 02:10:34 +04:00
struct winbindd_domain * domain = NULL ;
const char * domain_name = NULL ;
2001-09-04 11:13:01 +04:00
NTSTATUS result ;
2005-06-09 02:10:34 +04:00
if ( ! state - > privileged ) {
char * error_string = NULL ;
DEBUG ( 2 , ( " winbindd_pam_auth_crap: non-privileged access "
" denied. ! \n " ) ) ;
DEBUGADD ( 2 , ( " winbindd_pam_auth_crap: Ensure permissions "
" on %s are set correctly. \n " ,
get_winbind_priv_pipe_dir ( ) ) ) ;
/* send a better message than ACCESS_DENIED */
error_string = talloc_asprintf ( state - > mem_ctx ,
" winbind client not authorized "
" to use winbindd_pam_auth_crap. "
" Ensure permissions on %s "
" are set correctly. " ,
get_winbind_priv_pipe_dir ( ) ) ;
fstrcpy ( state - > response . data . auth . error_string , error_string ) ;
result = NT_STATUS_ACCESS_DENIED ;
goto done ;
}
/* Ensure null termination */
state - > request . data . auth_crap . user
[ sizeof ( state - > request . data . auth_crap . user ) - 1 ] = 0 ;
state - > request . data . auth_crap . domain
[ sizeof ( state - > request . data . auth_crap . domain ) - 1 ] = 0 ;
DEBUG ( 3 , ( " [%5lu]: pam auth crap domain: [%s] user: %s \n " ,
( unsigned long ) state - > pid ,
state - > request . data . auth_crap . domain ,
state - > request . data . auth_crap . user ) ) ;
if ( * state - > request . data . auth_crap . domain ! = ' \0 ' ) {
domain_name = state - > request . data . auth_crap . domain ;
} else if ( lp_winbind_use_default_domain ( ) ) {
domain_name = lp_workgroup ( ) ;
}
if ( domain_name ! = NULL )
2006-02-04 01:19:41 +03:00
domain = find_auth_domain ( state , domain_name ) ;
2005-06-09 02:10:34 +04:00
if ( domain ! = NULL ) {
2005-06-20 17:42:29 +04:00
sendto_domain ( state , domain ) ;
return ;
2005-06-09 02:10:34 +04:00
}
result = NT_STATUS_NO_SUCH_USER ;
done :
set_auth_errors ( & state - > response , result ) ;
2005-11-11 10:03:17 +03:00
DEBUG ( 5 , ( " CRAP authentication for %s \\ %s returned %s (PAM: %d) \n " ,
state - > request . data . auth_crap . domain ,
state - > request . data . auth_crap . user ,
2005-06-09 02:10:34 +04:00
state - > response . data . auth . nt_status_string ,
state - > response . data . auth . pam_error ) ) ;
2005-06-20 17:42:29 +04:00
request_error ( state ) ;
return ;
2005-06-09 02:10:34 +04:00
}
enum winbindd_result winbindd_dual_pam_auth_crap ( struct winbindd_domain * domain ,
struct winbindd_cli_state * state )
{
NTSTATUS result ;
2001-11-05 03:21:17 +03:00
NET_USER_INFO_3 info3 ;
2005-09-30 21:13:37 +04:00
struct rpc_pipe_client * netlogon_pipe ;
2004-10-01 07:28:39 +04:00
const char * name_user = NULL ;
2004-01-05 07:10:28 +03:00
const char * name_domain = NULL ;
2002-11-13 02:20:50 +03:00
const char * workstation ;
2004-01-05 07:10:28 +03:00
struct winbindd_domain * contact_domain ;
2003-05-08 12:02:52 +04:00
int attempts = 0 ;
2003-09-08 17:53:19 +04:00
BOOL retry ;
2002-01-01 07:50:45 +03:00
DATA_BLOB lm_resp , nt_resp ;
2005-06-09 02:10:34 +04:00
/* This is child-only, so no check for privileged access is needed
anymore */
2003-03-24 12:54:13 +03:00
2002-08-17 21:00:51 +04:00
/* Ensure null termination */
2003-08-12 04:46:15 +04:00
state - > request . data . auth_crap . user [ sizeof ( state - > request . data . auth_crap . user ) - 1 ] = 0 ;
state - > request . data . auth_crap . domain [ sizeof ( state - > request . data . auth_crap . domain ) - 1 ] = 0 ;
2001-08-22 06:48:16 +04:00
2004-10-01 07:28:39 +04:00
name_user = state - > request . data . auth_crap . user ;
2002-08-17 21:00:51 +04:00
2002-01-18 05:37:55 +03:00
if ( * state - > request . data . auth_crap . domain ) {
2004-10-01 07:28:39 +04:00
name_domain = state - > request . data . auth_crap . domain ;
2002-01-18 05:37:55 +03:00
} else if ( lp_winbind_use_default_domain ( ) ) {
2004-01-05 07:10:28 +03:00
name_domain = lp_workgroup ( ) ;
2002-01-18 05:37:55 +03:00
} else {
2002-08-17 21:00:51 +04:00
DEBUG ( 5 , ( " no domain specified with username (%s) - failing auth \n " ,
2004-01-05 07:10:28 +03:00
name_user ) ) ;
result = NT_STATUS_NO_SUCH_USER ;
2002-02-05 12:40:36 +03:00
goto done ;
2002-01-18 05:37:55 +03:00
}
2003-07-22 08:31:20 +04:00
DEBUG ( 3 , ( " [%5lu]: pam auth crap domain: %s user: %s \n " , ( unsigned long ) state - > pid ,
2004-01-05 07:10:28 +03:00
name_domain , name_user ) ) ;
2003-06-30 21:24:59 +04:00
2002-08-17 21:00:51 +04:00
if ( * state - > request . data . auth_crap . workstation ) {
2004-10-01 07:28:39 +04:00
workstation = state - > request . data . auth_crap . workstation ;
2002-08-17 21:00:51 +04:00
} else {
2002-11-13 02:20:50 +03:00
workstation = global_myname ( ) ;
2002-08-17 21:00:51 +04:00
}
if ( state - > request . data . auth_crap . lm_resp_len > sizeof ( state - > request . data . auth_crap . lm_resp )
| | state - > request . data . auth_crap . nt_resp_len > sizeof ( state - > request . data . auth_crap . nt_resp ) ) {
DEBUG ( 0 , ( " winbindd_pam_auth_crap: invalid password length %u/%u \n " ,
state - > request . data . auth_crap . lm_resp_len ,
state - > request . data . auth_crap . nt_resp_len ) ) ;
result = NT_STATUS_INVALID_PARAMETER ;
2002-02-05 12:40:36 +03:00
goto done ;
2002-01-18 05:37:55 +03:00
}
2005-09-30 21:13:37 +04:00
lm_resp = data_blob_talloc ( state - > mem_ctx , state - > request . data . auth_crap . lm_resp ,
state - > request . data . auth_crap . lm_resp_len ) ;
nt_resp = data_blob_talloc ( state - > mem_ctx , state - > request . data . auth_crap . nt_resp ,
state - > request . data . auth_crap . nt_resp_len ) ;
2004-01-05 07:10:28 +03:00
2003-07-07 09:11:10 +04:00
/* what domain should we contact? */
2003-12-31 11:45:03 +03:00
if ( IS_DC ) {
2004-01-05 07:10:28 +03:00
if ( ! ( contact_domain = find_domain_from_name ( name_domain ) ) ) {
DEBUG ( 3 , ( " Authentication for domain for [%s] -> [%s] \\ [%s] failed as %s is not a trusted domain \n " ,
2004-04-06 20:44:24 +04:00
state - > request . data . auth_crap . user , name_domain , name_user , name_domain ) ) ;
2003-12-31 11:45:03 +03:00
result = NT_STATUS_NO_SUCH_USER ;
goto done ;
}
} else {
2004-01-05 07:10:28 +03:00
if ( is_myname ( name_domain ) ) {
DEBUG ( 3 , ( " Authentication for domain %s (local domain to this server) not supported at this stage \n " , name_domain ) ) ;
2003-12-31 11:45:03 +03:00
result = NT_STATUS_NO_SUCH_USER ;
goto done ;
}
2005-06-09 02:10:34 +04:00
contact_domain = find_our_domain ( ) ;
2004-01-05 07:10:28 +03:00
}
2003-05-08 12:02:52 +04:00
do {
ZERO_STRUCT ( info3 ) ;
2003-09-08 17:53:19 +04:00
retry = False ;
2003-09-06 23:49:59 +04:00
2006-02-25 00:36:40 +03:00
netlogon_pipe = NULL ;
2005-09-30 21:13:37 +04:00
result = cm_connect_netlogon ( contact_domain , & netlogon_pipe ) ;
2003-05-08 12:02:52 +04:00
if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 3 , ( " could not open handle to NETLOGON pipe (error: %s) \n " ,
nt_errstr ( result ) ) ) ;
goto done ;
}
2005-09-30 21:13:37 +04:00
result = rpccli_netlogon_sam_network_logon ( netlogon_pipe ,
2005-11-08 09:19:34 +03:00
state - > mem_ctx ,
state - > request . data . auth_crap . logon_parameters ,
contact_domain - > dcname ,
name_user ,
name_domain ,
2006-01-20 01:26:26 +03:00
/* Bug #3248 - found by Stefan Burkei. */
workstation , /* We carefully set this above so use it... */
2005-11-08 09:19:34 +03:00
state - > request . data . auth_crap . chal ,
lm_resp ,
nt_resp ,
& info3 ) ;
2003-05-08 12:02:52 +04:00
attempts + = 1 ;
2001-11-05 03:21:17 +03:00
2005-06-09 02:10:34 +04:00
/* We have to try a second time as cm_connect_netlogon
2003-09-24 05:22:59 +04:00
might not yet have noticed that the DC has killed
our connection . */
2005-06-09 02:10:34 +04:00
if ( NT_STATUS_EQUAL ( result , NT_STATUS_UNSUCCESSFUL ) ) {
2003-09-24 05:22:59 +04:00
retry = True ;
continue ;
2005-06-09 02:10:34 +04:00
}
2003-09-24 05:22:59 +04:00
/* if we get access denied, a possible cause was that we had and open
connection to the DC , but someone changed our machine account password
2003-07-03 20:23:11 +04:00
out from underneath us using ' net rpc changetrustpw ' */
2005-06-09 02:10:34 +04:00
if ( NT_STATUS_EQUAL ( result , NT_STATUS_ACCESS_DENIED ) ) {
DEBUG ( 3 , ( " winbindd_pam_auth: sam_logon returned "
" ACCESS_DENIED. Maybe the trust account "
" password was changed and we didn't know it. "
" Killing connections to domain %s \n " ,
name_domain ) ) ;
invalidate_cm_connection ( & contact_domain - > conn ) ;
2003-09-08 17:53:19 +04:00
retry = True ;
2003-07-03 20:23:11 +04:00
}
2005-06-09 02:10:34 +04:00
2003-09-08 17:53:19 +04:00
} while ( ( attempts < 2 ) & & retry ) ;
2001-10-05 04:20:06 +04:00
2002-02-05 12:40:36 +03:00
if ( NT_STATUS_IS_OK ( result ) ) {
2006-02-04 01:19:41 +03:00
2005-11-11 06:03:41 +03:00
netsamlogon_cache_store ( name_user , & info3 ) ;
2005-11-10 23:28:23 +03:00
wcache_invalidate_samlogon ( find_domain_from_name ( name_domain ) , & info3 ) ;
/* Check if the user is in the right group */
2005-09-30 21:13:37 +04:00
if ( ! NT_STATUS_IS_OK ( result = check_info3_in_group ( state - > mem_ctx , & info3 ,
state - > request . data . auth_crap . require_membership_of_sid ) ) ) {
2004-04-06 20:44:24 +04:00
DEBUG ( 3 , ( " User %s is not in the required group (%s), so plaintext authentication is rejected \n " ,
state - > request . data . auth_crap . user ,
2004-10-01 07:28:39 +04:00
state - > request . data . auth_crap . require_membership_of_sid ) ) ;
2004-04-06 20:44:24 +04:00
goto done ;
}
2003-07-07 09:11:10 +04:00
if ( state - > request . flags & WBFLAG_PAM_INFO3_NDR ) {
2005-06-09 02:10:34 +04:00
result = append_info3_as_ndr ( state - > mem_ctx , state , & info3 ) ;
2003-12-30 16:20:39 +03:00
} else if ( state - > request . flags & WBFLAG_PAM_UNIX_NAME ) {
/* ntlm_auth should return the unix username, per
' winbind use default domain ' settings and the like */
2005-09-30 21:13:37 +04:00
2003-12-30 16:20:39 +03:00
fstring username_out ;
const char * nt_username , * nt_domain ;
2005-06-09 02:10:34 +04:00
if ( ! ( nt_username = unistr2_tdup ( state - > mem_ctx , & ( info3 . uni_user_name ) ) ) ) {
2003-12-30 16:20:39 +03:00
/* If the server didn't give us one, just use the one we sent them */
2004-01-05 07:10:28 +03:00
nt_username = name_user ;
2003-12-30 16:20:39 +03:00
}
2005-09-30 21:13:37 +04:00
2005-06-09 02:10:34 +04:00
if ( ! ( nt_domain = unistr2_tdup ( state - > mem_ctx , & ( info3 . uni_logon_dom ) ) ) ) {
2003-12-30 16:20:39 +03:00
/* If the server didn't give us one, just use the one we sent them */
2004-01-05 07:10:28 +03:00
nt_domain = name_domain ;
2003-12-30 16:20:39 +03:00
}
2003-12-31 01:27:33 +03:00
fill_domain_username ( username_out , nt_domain , nt_username ) ;
2003-12-30 16:20:39 +03:00
DEBUG ( 5 , ( " Setting unix username to [%s] \n " , username_out ) ) ;
2004-12-07 21:25:53 +03:00
state - > response . extra_data = SMB_STRDUP ( username_out ) ;
2004-10-01 07:28:39 +04:00
if ( ! state - > response . extra_data ) {
2003-12-30 16:20:39 +03:00
result = NT_STATUS_NO_MEMORY ;
goto done ;
}
state - > response . length + = strlen ( state - > response . extra_data ) + 1 ;
2002-08-17 21:00:51 +04:00
}
2003-06-21 08:05:01 +04:00
2004-04-06 12:11:16 +04:00
if ( state - > request . flags & WBFLAG_PAM_USER_SESSION_KEY ) {
2005-09-30 21:13:37 +04:00
memcpy ( state - > response . data . auth . user_session_key , info3 . user_sess_key ,
sizeof ( state - > response . data . auth . user_session_key ) /* 16 */ ) ;
2002-08-17 21:00:51 +04:00
}
2003-07-07 09:11:10 +04:00
if ( state - > request . flags & WBFLAG_PAM_LMKEY ) {
2005-09-30 21:13:37 +04:00
memcpy ( state - > response . data . auth . first_8_lm_hash , info3 . lm_sess_key ,
sizeof ( state - > response . data . auth . first_8_lm_hash ) /* 8 */ ) ;
2002-08-17 21:00:51 +04:00
}
2002-02-05 12:40:36 +03:00
}
2002-01-01 07:50:45 +03:00
done :
2005-09-30 21:13:37 +04:00
2003-04-07 11:32:51 +04:00
/* give us a more useful (more correct?) error code */
2005-09-30 21:13:37 +04:00
if ( ( NT_STATUS_EQUAL ( result , NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND ) | |
2006-02-04 01:19:41 +03:00
( NT_STATUS_EQUAL ( result , NT_STATUS_UNSUCCESSFUL ) ) ) ) {
2003-04-07 11:32:51 +04:00
result = NT_STATUS_NO_LOGON_SERVERS ;
}
2004-04-06 20:44:24 +04:00
if ( state - > request . flags & WBFLAG_PAM_NT_STATUS_SQUASH ) {
result = nt_status_squash ( result ) ;
}
2005-09-30 21:13:37 +04:00
2002-02-05 12:40:36 +03:00
state - > response . data . auth . nt_status = NT_STATUS_V ( result ) ;
2004-10-01 07:28:39 +04:00
fstrcpy ( state - > response . data . auth . nt_status_string , nt_errstr ( result ) ) ;
2005-09-30 21:13:37 +04:00
2003-11-26 02:24:14 +03:00
/* we might have given a more useful error above */
2005-09-30 21:13:37 +04:00
if ( ! * state - > response . data . auth . error_string ) {
2004-10-01 07:28:39 +04:00
fstrcpy ( state - > response . data . auth . error_string , get_friendly_nt_error_msg ( result ) ) ;
2005-09-30 21:13:37 +04:00
}
2002-02-05 12:40:36 +03:00
state - > response . data . auth . pam_error = nt_status_to_pam ( result ) ;
2002-08-17 21:00:51 +04:00
DEBUG ( NT_STATUS_IS_OK ( result ) ? 5 : 2 ,
2002-09-25 19:19:00 +04:00
( " NTLM CRAP authentication for user [%s] \\ [%s] returned %s (PAM: %d) \n " ,
2004-01-05 07:10:28 +03:00
name_domain ,
name_user ,
2002-08-17 21:00:51 +04:00
state - > response . data . auth . nt_status_string ,
state - > response . data . auth . pam_error ) ) ;
2002-02-05 12:40:36 +03:00
2001-09-04 11:13:01 +04:00
return NT_STATUS_IS_OK ( result ) ? WINBINDD_OK : WINBINDD_ERROR ;
2000-05-09 15:43:00 +04:00
}
2001-05-07 08:32:40 +04:00
/* Change a user password */
2005-06-20 17:42:29 +04:00
void winbindd_pam_chauthtok ( struct winbindd_cli_state * state )
2001-05-07 08:32:40 +04:00
{
2006-02-04 01:19:41 +03:00
NTSTATUS result = NT_STATUS_UNSUCCESSFUL ;
char * oldpass ;
char * newpass = NULL ;
2001-12-05 07:17:39 +03:00
fstring domain , user ;
2005-06-09 02:10:34 +04:00
POLICY_HND dom_pol ;
2004-01-05 07:10:28 +03:00
struct winbindd_domain * contact_domain ;
2005-06-09 02:10:34 +04:00
struct rpc_pipe_client * cli ;
2006-02-04 01:19:41 +03:00
BOOL got_info = False ;
2006-02-11 02:09:00 +03:00
SAM_UNK_INFO_1 info ;
SAMR_CHANGE_REJECT reject ;
2001-05-07 08:32:40 +04:00
2003-07-22 08:31:20 +04:00
DEBUG ( 3 , ( " [%5lu]: pam chauthtok %s \n " , ( unsigned long ) state - > pid ,
2001-12-05 07:17:39 +03:00
state - > request . data . chauthtok . user ) ) ;
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
/* Setup crap */
2001-05-07 08:32:40 +04:00
2003-07-09 20:44:47 +04:00
parse_domain_user ( state - > request . data . chauthtok . user , domain , user ) ;
2003-12-31 11:45:03 +03:00
2004-01-05 07:10:28 +03:00
if ( ! ( contact_domain = find_domain_from_name ( domain ) ) ) {
2003-12-31 11:45:03 +03:00
DEBUG ( 3 , ( " Cannot change password for [%s] -> [%s] \\ [%s] as %s is not a trusted domain \n " ,
state - > request . data . chauthtok . user , domain , user , domain ) ) ;
result = NT_STATUS_NO_SUCH_USER ;
2002-02-05 12:40:36 +03:00
goto done ;
}
2001-05-07 08:32:40 +04:00
2002-01-30 06:23:40 +03:00
/* Change password */
2001-12-05 07:17:39 +03:00
oldpass = state - > request . data . chauthtok . oldpass ;
newpass = state - > request . data . chauthtok . newpass ;
2001-05-07 08:32:40 +04:00
2002-01-30 06:23:40 +03:00
/* Get sam handle */
2001-05-07 08:32:40 +04:00
2005-06-09 02:10:34 +04:00
result = cm_connect_sam ( contact_domain , state - > mem_ctx , & cli ,
& dom_pol ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
2002-02-05 12:40:36 +03:00
DEBUG ( 1 , ( " could not get SAM handle on DC for %s \n " , domain ) ) ;
goto done ;
}
2001-05-07 08:32:40 +04:00
2006-02-04 01:19:41 +03:00
result = rpccli_samr_chgpasswd3 ( cli , state - > mem_ctx , user , newpass , oldpass , & info , & reject ) ;
/* FIXME: need to check for other error codes ? */
if ( NT_STATUS_EQUAL ( result , NT_STATUS_PASSWORD_RESTRICTION ) ) {
state - > response . data . auth . policy . min_length_password =
2006-02-11 02:09:00 +03:00
info . min_length_password ;
2006-02-04 01:19:41 +03:00
state - > response . data . auth . policy . password_history =
2006-02-11 02:09:00 +03:00
info . password_history ;
2006-02-04 01:19:41 +03:00
state - > response . data . auth . policy . password_properties =
2006-02-11 02:09:00 +03:00
info . password_properties ;
2006-02-04 01:19:41 +03:00
state - > response . data . auth . policy . expire =
2006-02-11 02:09:00 +03:00
nt_time_to_unix_abs ( & info . expire ) ;
2006-02-04 01:19:41 +03:00
state - > response . data . auth . policy . min_passwordage =
2006-02-11 02:09:00 +03:00
nt_time_to_unix_abs ( & info . min_passwordage ) ;
2006-02-04 01:19:41 +03:00
state - > response . data . auth . reject_reason =
2006-02-11 02:09:00 +03:00
reject . reject_reason ;
2006-02-04 01:19:41 +03:00
got_info = True ;
} else if ( ! NT_STATUS_IS_OK ( result ) ) {
DEBUG ( 10 , ( " Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user \n " ,
nt_errstr ( result ) ) ) ;
state - > response . data . auth . reject_reason = 0 ;
result = rpccli_samr_chgpasswd_user ( cli , state - > mem_ctx , user , newpass , oldpass ) ;
}
done :
if ( NT_STATUS_IS_OK ( result ) & & ( state - > request . flags & WBFLAG_PAM_CACHED_LOGIN ) & &
lp_winbind_offline_logon ( ) ) {
NTSTATUS cred_ret ;
cred_ret = winbindd_update_creds_by_name ( contact_domain ,
state - > mem_ctx , user ,
newpass ) ;
if ( ! NT_STATUS_IS_OK ( cred_ret ) ) {
DEBUG ( 10 , ( " Failed to store creds: %s \n " , nt_errstr ( cred_ret ) ) ) ;
goto process_result ; /* FIXME: hm, risking inconsistant cache ? */
}
}
if ( ! NT_STATUS_IS_OK ( result ) & & ! got_info ) {
NTSTATUS policy_ret ;
policy_ret = fillup_password_policy ( contact_domain , state ) ;
/* failure of this is non critical, it will just provide no
* additional information to the client why the change has
* failed - Guenther */
if ( ! NT_STATUS_IS_OK ( policy_ret ) ) {
DEBUG ( 10 , ( " Failed to get password policies: %s \n " , nt_errstr ( policy_ret ) ) ) ;
goto process_result ;
}
}
process_result :
2002-02-05 12:40:36 +03:00
state - > response . data . auth . nt_status = NT_STATUS_V ( result ) ;
2002-03-17 07:36:35 +03:00
fstrcpy ( state - > response . data . auth . nt_status_string , nt_errstr ( result ) ) ;
2005-11-22 16:33:44 +03:00
fstrcpy ( state - > response . data . auth . error_string , get_friendly_nt_error_msg ( result ) ) ;
2002-02-05 12:40:36 +03:00
state - > response . data . auth . pam_error = nt_status_to_pam ( result ) ;
2002-10-26 06:20:59 +04:00
DEBUG ( NT_STATUS_IS_OK ( result ) ? 5 : 2 ,
( " Password change for user [%s] \\ [%s] returned %s (PAM: %d) \n " ,
domain ,
user ,
state - > response . data . auth . nt_status_string ,
state - > response . data . auth . pam_error ) ) ;
2005-06-20 17:42:29 +04:00
if ( NT_STATUS_IS_OK ( result ) )
request_ok ( state ) ;
else
request_error ( state ) ;
2001-05-07 08:32:40 +04:00
}
2006-02-04 01:19:41 +03:00
void winbindd_pam_logoff ( struct winbindd_cli_state * state )
{
struct winbindd_domain * domain ;
fstring name_domain , user ;
DEBUG ( 3 , ( " [%5lu]: pam logoff %s \n " , ( unsigned long ) state - > pid ,
state - > request . data . logoff . user ) ) ;
/* Ensure null termination */
state - > request . data . logoff . user
[ sizeof ( state - > request . data . logoff . user ) - 1 ] = ' \0 ' ;
state - > request . data . logoff . krb5ccname
[ sizeof ( state - > request . data . logoff . krb5ccname ) - 1 ] = ' \0 ' ;
parse_domain_user ( state - > request . data . logoff . user , name_domain , user ) ;
domain = find_auth_domain ( state , name_domain ) ;
if ( domain = = NULL ) {
set_auth_errors ( & state - > response , NT_STATUS_NO_SUCH_USER ) ;
DEBUG ( 5 , ( " Pam Logoff for %s returned %s "
" (PAM: %d) \n " ,
state - > request . data . auth . user ,
state - > response . data . auth . nt_status_string ,
state - > response . data . auth . pam_error ) ) ;
request_error ( state ) ;
return ;
}
sendto_domain ( state , domain ) ;
}
enum winbindd_result winbindd_dual_pam_logoff ( struct winbindd_domain * domain ,
struct winbindd_cli_state * state )
{
NTSTATUS result = NT_STATUS_NOT_SUPPORTED ;
struct WINBINDD_CCACHE_ENTRY * entry ;
int ret ;
DEBUG ( 3 , ( " [%5lu]: pam dual logoff %s \n " , ( unsigned long ) state - > pid ,
state - > request . data . logoff . user ) ) ;
if ( ! ( state - > request . flags & WBFLAG_PAM_KRB5 ) ) {
result = NT_STATUS_OK ;
goto process_result ;
}
# ifdef HAVE_KRB5
/* what we need here is to find the corresponding krb5 ccache name *we*
* created for a given username and destroy it ( as the user who created it ) */
entry = get_ccache_by_username ( state - > request . data . logoff . user ) ;
if ( entry = = NULL ) {
DEBUG ( 10 , ( " winbindd_pam_logoff: could not get ccname for user %s \n " ,
state - > request . data . logoff . user ) ) ;
goto process_result ;
}
DEBUG ( 10 , ( " winbindd_pam_logoff: found ccache [%s] \n " , entry - > ccname ) ) ;
if ( entry - > uid < 0 | | state - > request . data . logoff . uid < 0 ) {
DEBUG ( 0 , ( " winbindd_pam_logoff: invalid uid \n " ) ) ;
goto process_result ;
}
if ( entry - > uid ! = state - > request . data . logoff . uid ) {
DEBUG ( 0 , ( " winbindd_pam_logoff: uid's differ: %d != %d \n " ,
entry - > uid , state - > request . data . logoff . uid ) ) ;
goto process_result ;
}
if ( ! strcsequal ( entry - > ccname , state - > request . data . logoff . krb5ccname ) ) {
DEBUG ( 0 , ( " winbindd_pam_logoff: krb5ccnames differ: (daemon) %s != (client) %s \n " ,
entry - > ccname , state - > request . data . logoff . krb5ccname ) ) ;
goto process_result ;
}
seteuid ( entry - > uid ) ;
ret = ads_kdestroy ( entry - > ccname ) ;
seteuid ( 0 ) ;
if ( ret ) {
DEBUG ( 0 , ( " winbindd_pam_logoff: failed to destroy user ccache %s with: %s \n " ,
entry - > ccname , error_message ( ret ) ) ) ;
} else {
DEBUG ( 10 , ( " winbindd_pam_logoff: successfully destroyed ccache %s for user %s \n " ,
entry - > ccname , state - > request . data . logoff . user ) ) ;
remove_ccache_by_ccname ( entry - > ccname ) ;
}
result = krb5_to_nt_status ( ret ) ;
# else
result = NT_STATUS_NOT_SUPPORTED ;
# endif
process_result :
state - > response . data . auth . nt_status = NT_STATUS_V ( result ) ;
fstrcpy ( state - > response . data . auth . nt_status_string , nt_errstr ( result ) ) ;
fstrcpy ( state - > response . data . auth . error_string , get_friendly_nt_error_msg ( result ) ) ;
state - > response . data . auth . pam_error = nt_status_to_pam ( result ) ;
return NT_STATUS_IS_OK ( result ) ? WINBINDD_OK : WINBINDD_ERROR ;
}