samba-mirror/auth/credentials/credentials_gmsa.c

/*
   Unix SMB/CIFS implementation.

   User credentials handling for Group Managed Service Accounts

   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2023

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "librpc/gen_ndr/ndr_gmsa.h" /* for struct MANAGEDPASSWORD_BLOB */
#include "auth/credentials/credentials.h"
#include "auth/credentials/credentials_internal.h"
#include "lib/util/charset/charset.h"
#include "lib/crypto/gkdi.h"
/*
 * All current callers set "for_keytab = true", but if we start using
 * this for getting a TGT we need the logic to ignore a very new
 * key
 */
NTSTATUS cli_credentials_set_gmsa_passwords(struct cli_credentials *creds,
					    const DATA_BLOB *managed_password_blob,
					    bool for_keytab,
					    const char **error_string)
{
	struct MANAGEDPASSWORD_BLOB managed_password;
	DATA_BLOB managed_pw_utf16;
	DATA_BLOB previous_managed_pw_utf16;
	enum ndr_err_code ndr_err;
	TALLOC_CTX *frame = talloc_stackframe();
	bool only_use_previous_pw;

	/*
	 * Group Managed Service Accounts are type
	 * UF_WORKSTATION_TRUST_ACCOUNT and will follow those salting
	 * rules
	 */
	cli_credentials_set_secure_channel_type(creds, SEC_CHAN_WKSTA);

	ndr_err = ndr_pull_struct_blob_all(managed_password_blob,
					   frame,
					   &managed_password,
					   (ndr_pull_flags_fn_t)ndr_pull_MANAGEDPASSWORD_BLOB);
	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
		*error_string = talloc_asprintf(creds,
						"Failed to parse msDS-ManagedPassword "
						"as MANAGEDPASSWORD_BLOB");
		TALLOC_FREE(frame);
		return NT_STATUS_ILL_FORMED_PASSWORD;
	}

	/*
	 * We check if this is 'for keytab' as a keytab wants to know
	 * about a near-future password as it will be on disk for some
	 * time
	 */
	only_use_previous_pw =
		managed_password.passwords.query_interval != NULL
		&& *managed_password.passwords.query_interval <= gkdi_max_clock_skew
		&& for_keytab == false;

	/*
	 * We look at the old password first as we might bail out
	 * early if the new password is "too fresh"
	 */
	if (managed_password.passwords.previous) {
		previous_managed_pw_utf16
			= data_blob_const(managed_password.passwords.previous,
					  utf16_len(managed_password.passwords.previous));

		cli_credentials_set_old_utf16_password(creds, &previous_managed_pw_utf16);

		if (only_use_previous_pw) {
			/* We are in the 5 mins where we know the next
			 * password, but it will not be available yet, just
			 * use the old password for now.
			 */
			cli_credentials_set_utf16_password(creds, &previous_managed_pw_utf16,
							   CRED_SPECIFIED);

			/*
			 * We are done, the new password is of no
			 * interest to us
			 */
			TALLOC_FREE(frame);
			return NT_STATUS_OK;
		}

	}

	if (only_use_previous_pw) {
		*error_string = talloc_asprintf(creds,
						"No old password but new password is too new "
						"(< 5min) in msDS-ManagedPassword "
						"MANAGEDPASSWORD_BLOB");
		TALLOC_FREE(frame);
		return NT_STATUS_ILL_FORMED_PASSWORD;
	}

	if (managed_password.passwords.current == NULL) {
		*error_string = talloc_asprintf(creds,
						"Failed to find new password in msDS-ManagedPassword "
						"MANAGEDPASSWORD_BLOB");
		TALLOC_FREE(frame);
		return NT_STATUS_ILL_FORMED_PASSWORD;
	}

	managed_pw_utf16
		= data_blob_const(managed_password.passwords.current,
				  utf16_len(managed_password.passwords.current));

	cli_credentials_set_utf16_password(creds, &managed_pw_utf16,
					   CRED_SPECIFIED);

	TALLOC_FREE(frame);
	return NT_STATUS_OK;
}