2005-06-03 18:32:10 +04:00
/*
* Copyright ( c ) 1999 - 2001 , 2003 , PADL Software Pty Ltd .
2009-05-26 06:31:39 +04:00
* Copyright ( c ) 2004 - 2009 , Andrew Bartlett < abartlet @ samba . org > .
2005-06-03 18:32:10 +04:00
* Copyright ( c ) 2004 , Stefan Metzmacher < metze @ samba . org >
* All rights reserved .
*
* Redistribution and use in source and binary forms , with or without
* modification , are permitted provided that the following conditions
* are met :
*
* 1. Redistributions of source code must retain the above copyright
* notice , this list of conditions and the following disclaimer .
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice , this list of conditions and the following disclaimer in the
* documentation and / or other materials provided with the distribution .
*
* 3. Neither the name of PADL Software nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission .
*
* THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ` ` AS IS ' ' AND
* ANY EXPRESS OR IMPLIED WARRANTIES , INCLUDING , BUT NOT LIMITED TO , THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED . IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT , INDIRECT , INCIDENTAL , SPECIAL , EXEMPLARY , OR CONSEQUENTIAL
* DAMAGES ( INCLUDING , BUT NOT LIMITED TO , PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES ; LOSS OF USE , DATA , OR PROFITS ; OR BUSINESS INTERRUPTION )
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY , WHETHER IN CONTRACT , STRICT
* LIABILITY , OR TORT ( INCLUDING NEGLIGENCE OR OTHERWISE ) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE , EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE .
*/
# include "includes.h"
2010-11-11 06:09:41 +03:00
# include "kdc/kdc-glue.h"
2010-01-28 09:27:11 +03:00
# include "kdc/db-glue.h"
2023-10-10 05:19:47 +03:00
# include "kdc/pac-glue.h"
2013-11-06 01:39:42 +04:00
# include "auth/auth_sam.h"
2017-02-21 04:07:54 +03:00
# include "auth/common_auth.h"
2023-06-16 02:01:04 +03:00
# include "auth/authn_policy.h"
2013-11-06 01:39:42 +04:00
# include <ldb.h>
2014-05-08 19:13:04 +04:00
# include "sdb.h"
# include "sdb_hdb.h"
2017-02-21 04:07:54 +03:00
# include "dsdb/samdb/samdb.h"
# include "param/param.h"
# include "../lib/tsocket/tsocket.h"
2017-04-04 02:57:01 +03:00
# include "librpc/gen_ndr/ndr_winbind_c.h"
# include "lib/messaging/irpc.h"
2022-02-21 10:45:45 +03:00
# include "hdb.h"
2022-03-02 00:00:17 +03:00
# include <kdc-audit.h>
2023-06-15 02:24:27 +03:00
# include <kdc-plugin.h>
2008-08-08 04:35:57 +04:00
2022-09-09 13:32:57 +03:00
# undef DBGC_CLASS
# define DBGC_CLASS DBGC_KERBEROS
2009-07-16 06:47:57 +04:00
static krb5_error_code hdb_samba4_open ( krb5_context context , HDB * db , int flags , mode_t mode )
2005-06-03 18:32:10 +04:00
{
if ( db - > hdb_master_key_set ) {
2009-06-08 13:06:16 +04:00
krb5_error_code ret = HDB_ERR_NOENTRY ;
2009-07-16 06:47:57 +04:00
krb5_warnx ( context , " hdb_samba4_open: use of a master key incompatible with LDB \n " ) ;
krb5_set_error_message ( context , ret , " hdb_samba4_open: use of a master key incompatible with LDB \n " ) ;
2009-06-08 13:06:16 +04:00
return ret ;
2009-12-23 23:08:02 +03:00
}
2005-06-03 18:32:10 +04:00
return 0 ;
}
2009-07-16 06:47:57 +04:00
static krb5_error_code hdb_samba4_close ( krb5_context context , HDB * db )
2005-06-03 18:32:10 +04:00
{
return 0 ;
}
2009-07-16 06:47:57 +04:00
static krb5_error_code hdb_samba4_lock ( krb5_context context , HDB * db , int operation )
2005-06-03 18:32:10 +04:00
{
return 0 ;
}
2009-07-16 06:47:57 +04:00
static krb5_error_code hdb_samba4_unlock ( krb5_context context , HDB * db )
2005-06-03 18:32:10 +04:00
{
return 0 ;
}
2009-07-16 06:47:57 +04:00
static krb5_error_code hdb_samba4_rename ( krb5_context context , HDB * db , const char * new_name )
2005-06-03 18:32:10 +04:00
{
return HDB_ERR_DB_INUSE ;
}
2022-02-22 09:41:14 +03:00
static krb5_error_code hdb_samba4_store ( krb5_context context , HDB * db , unsigned flags , hdb_entry * entry )
2005-06-03 18:32:10 +04:00
{
return HDB_ERR_DB_INUSE ;
}
2016-01-08 04:08:18 +03:00
/*
* If we ever want kadmin to work fast , we might try and reopen the
* ldb with LDB_NOSYNC
*/
static krb5_error_code hdb_samba4_set_sync ( krb5_context context , struct HDB * db , int set_sync )
2005-06-03 18:32:10 +04:00
{
2016-01-08 04:08:18 +03:00
return 0 ;
2005-06-03 18:32:10 +04:00
}
2022-02-22 09:41:14 +03:00
static void hdb_samba4_free_entry_context ( krb5_context context , struct HDB * db , hdb_entry * entry )
{
/*
* This function is now called for every HDB entry , not just those with
* ' context ' set , so we have to check that the context is not NULL .
*/
if ( entry - > context ! = NULL ) {
2022-03-22 19:04:22 +03:00
struct samba_kdc_entry * skdc_entry =
talloc_get_type_abort ( entry - > context ,
struct samba_kdc_entry ) ;
2022-02-22 09:41:14 +03:00
/* this function is called only from hdb_free_entry().
* Make sure we neutralize the destructor or we will
* get a double free later when hdb_free_entry ( ) will
* try to call free_hdb_entry ( ) */
2022-03-22 19:04:22 +03:00
entry - > context = NULL ;
skdc_entry - > kdc_entry = NULL ;
TALLOC_FREE ( skdc_entry ) ;
2022-02-22 09:41:14 +03:00
}
}
2018-09-20 05:24:11 +03:00
static krb5_error_code hdb_samba4_fetch_fast_cookie ( krb5_context context ,
struct samba_kdc_db_context * kdc_db_ctx ,
2022-03-23 05:52:43 +03:00
hdb_entry * entry )
2018-09-20 05:24:11 +03:00
{
2023-06-09 06:46:33 +03:00
DBG_ERR ( " Looked up HDB entry for unsupported FX-COOKIE. \n " ) ;
return HDB_ERR_NOENTRY ;
2018-09-20 05:24:11 +03:00
}
2010-10-02 10:55:06 +04:00
static krb5_error_code hdb_samba4_fetch_kvno ( krb5_context context , HDB * db ,
krb5_const_principal principal ,
unsigned flags ,
2010-12-04 01:06:53 +03:00
krb5_kvno kvno ,
2022-03-23 05:57:38 +03:00
hdb_entry * entry )
2010-10-02 10:55:06 +04:00
{
struct samba_kdc_db_context * kdc_db_ctx ;
2022-03-23 06:17:01 +03:00
struct sdb_entry sentry = { } ;
2014-05-08 19:13:04 +04:00
krb5_error_code code , ret ;
2022-01-26 10:44:13 +03:00
uint32_t sflags ;
2010-10-02 10:55:06 +04:00
kdc_db_ctx = talloc_get_type_abort ( db - > hdb_db ,
struct samba_kdc_db_context ) ;
2018-09-20 05:24:11 +03:00
if ( flags & HDB_F_GET_FAST_COOKIE ) {
return hdb_samba4_fetch_fast_cookie ( context ,
kdc_db_ctx ,
2022-03-23 05:57:38 +03:00
entry ) ;
2018-09-20 05:24:11 +03:00
}
2022-01-26 10:44:13 +03:00
sflags = ( flags & SDB_F_HDB_MASK ) ;
2015-08-04 12:35:45 +03:00
ret = samba_kdc_fetch ( context ,
kdc_db_ctx ,
principal ,
2022-01-26 10:44:13 +03:00
sflags ,
2015-08-04 12:35:45 +03:00
kvno ,
2022-03-23 06:17:01 +03:00
& sentry ) ;
2015-08-04 12:35:45 +03:00
switch ( ret ) {
case 0 :
code = 0 ;
break ;
case SDB_ERR_WRONG_REALM :
/*
* If SDB_ERR_WRONG_REALM is returned we need to process the
* sdb_entry to fill the principal in the HDB entry .
*/
code = HDB_ERR_WRONG_REALM ;
break ;
case SDB_ERR_NOENTRY :
return HDB_ERR_NOENTRY ;
2017-09-21 13:02:25 +03:00
case SDB_ERR_NOT_FOUND_HERE :
2015-08-04 12:35:45 +03:00
return HDB_ERR_NOT_FOUND_HERE ;
2017-09-21 13:02:25 +03:00
default :
return ret ;
2014-05-08 19:13:04 +04:00
}
2022-03-23 06:17:01 +03:00
ret = sdb_entry_to_hdb_entry ( context , & sentry , entry ) ;
sdb_entry_free ( & sentry ) ;
2014-05-08 19:13:04 +04:00
2023-08-10 07:13:12 +03:00
if ( code = = 0 ) {
2014-05-08 19:13:04 +04:00
code = ret ;
}
return code ;
2010-10-02 10:55:06 +04:00
}
2022-05-26 07:39:20 +03:00
static krb5_error_code hdb_samba4_kpasswd_fetch_kvno ( krb5_context context , HDB * db ,
krb5_const_principal _principal ,
unsigned flags ,
krb5_kvno _kvno ,
hdb_entry * entry )
{
struct samba_kdc_db_context * kdc_db_ctx = NULL ;
krb5_error_code ret ;
krb5_principal kpasswd_principal = NULL ;
kdc_db_ctx = talloc_get_type_abort ( db - > hdb_db ,
struct samba_kdc_db_context ) ;
ret = smb_krb5_make_principal ( context , & kpasswd_principal ,
lpcfg_realm ( kdc_db_ctx - > lp_ctx ) ,
" kadmin " , " changepw " ,
NULL ) ;
if ( ret ) {
return ret ;
}
smb_krb5_principal_set_type ( context , kpasswd_principal , KRB5_NT_SRV_INST ) ;
/*
* For the kpasswd service , always ensure we get the latest kvno . This
* also means we ( correctly ) refuse RODC - issued tickets .
*/
flags & = ~ HDB_F_KVNO_SPECIFIED ;
/* Don't bother looking up a client or krbtgt. */
2023-10-17 10:18:12 +03:00
flags & = ~ ( HDB_F_GET_CLIENT | HDB_F_GET_KRBTGT ) ;
2022-05-26 07:39:20 +03:00
ret = hdb_samba4_fetch_kvno ( context , db ,
kpasswd_principal ,
flags ,
0 ,
entry ) ;
krb5_free_principal ( context , kpasswd_principal ) ;
return ret ;
}
2009-07-16 06:47:57 +04:00
static krb5_error_code hdb_samba4_firstkey ( krb5_context context , HDB * db , unsigned flags ,
2022-02-22 09:41:14 +03:00
hdb_entry * entry )
2005-06-03 18:32:10 +04:00
{
2010-01-28 09:27:11 +03:00
struct samba_kdc_db_context * kdc_db_ctx ;
2022-03-23 06:17:01 +03:00
struct sdb_entry sentry = { } ;
2014-05-08 19:13:04 +04:00
krb5_error_code ret ;
2005-06-03 18:32:10 +04:00
2010-01-28 09:27:11 +03:00
kdc_db_ctx = talloc_get_type_abort ( db - > hdb_db ,
struct samba_kdc_db_context ) ;
2007-06-14 16:19:53 +04:00
2022-03-23 06:17:01 +03:00
ret = samba_kdc_firstkey ( context , kdc_db_ctx , & sentry ) ;
2015-08-04 12:35:45 +03:00
switch ( ret ) {
case 0 :
break ;
case SDB_ERR_WRONG_REALM :
return HDB_ERR_WRONG_REALM ;
case SDB_ERR_NOENTRY :
return HDB_ERR_NOENTRY ;
2017-09-21 13:02:25 +03:00
case SDB_ERR_NOT_FOUND_HERE :
2015-08-04 12:35:45 +03:00
return HDB_ERR_NOT_FOUND_HERE ;
2017-09-21 13:02:25 +03:00
default :
return ret ;
2014-05-08 19:13:04 +04:00
}
2022-03-23 06:17:01 +03:00
ret = sdb_entry_to_hdb_entry ( context , & sentry , entry ) ;
sdb_entry_free ( & sentry ) ;
2014-05-08 19:13:04 +04:00
return ret ;
2005-06-03 18:32:10 +04:00
}
2009-07-16 06:47:57 +04:00
static krb5_error_code hdb_samba4_nextkey ( krb5_context context , HDB * db , unsigned flags ,
2022-02-22 09:41:14 +03:00
hdb_entry * entry )
2005-06-03 18:32:10 +04:00
{
2010-01-28 09:27:11 +03:00
struct samba_kdc_db_context * kdc_db_ctx ;
2022-03-23 06:17:01 +03:00
struct sdb_entry sentry = { } ;
2014-05-08 19:13:04 +04:00
krb5_error_code ret ;
2010-01-28 09:27:11 +03:00
kdc_db_ctx = talloc_get_type_abort ( db - > hdb_db ,
struct samba_kdc_db_context ) ;
2022-03-23 06:17:01 +03:00
ret = samba_kdc_nextkey ( context , kdc_db_ctx , & sentry ) ;
2015-08-04 12:35:45 +03:00
switch ( ret ) {
case 0 :
break ;
case SDB_ERR_WRONG_REALM :
return HDB_ERR_WRONG_REALM ;
case SDB_ERR_NOENTRY :
return HDB_ERR_NOENTRY ;
2017-09-21 13:02:25 +03:00
case SDB_ERR_NOT_FOUND_HERE :
2015-08-04 12:35:45 +03:00
return HDB_ERR_NOT_FOUND_HERE ;
2017-09-21 13:02:25 +03:00
default :
return ret ;
2014-05-08 19:13:04 +04:00
}
2022-03-23 06:17:01 +03:00
ret = sdb_entry_to_hdb_entry ( context , & sentry , entry ) ;
sdb_entry_free ( & sentry ) ;
2014-05-08 19:13:04 +04:00
return ret ;
2005-06-03 18:32:10 +04:00
}
2022-05-26 07:39:20 +03:00
static krb5_error_code hdb_samba4_nextkey_panic ( krb5_context context , HDB * db ,
unsigned flags ,
hdb_entry * entry )
{
DBG_ERR ( " Attempt to iterate kpasswd keytab => PANIC \n " ) ;
smb_panic ( " hdb_samba4_nextkey_panic: Attempt to iterate kpasswd keytab " ) ;
}
2009-07-16 06:47:57 +04:00
static krb5_error_code hdb_samba4_destroy ( krb5_context context , HDB * db )
2005-06-03 18:32:10 +04:00
{
talloc_free ( db ) ;
return 0 ;
}
2010-01-21 17:57:41 +03:00
static krb5_error_code
2011-04-07 13:16:55 +04:00
hdb_samba4_check_constrained_delegation ( krb5_context context , HDB * db ,
2022-02-22 09:41:14 +03:00
hdb_entry * entry ,
2010-01-21 17:57:41 +03:00
krb5_const_principal target_principal )
2009-07-18 04:15:55 +04:00
{
2023-06-20 07:40:03 +03:00
struct samba_kdc_db_context * kdc_db_ctx = NULL ;
struct samba_kdc_entry * skdc_entry = NULL ;
2009-07-18 04:15:55 +04:00
2010-01-28 09:27:11 +03:00
kdc_db_ctx = talloc_get_type_abort ( db - > hdb_db ,
struct samba_kdc_db_context ) ;
2022-02-22 09:41:14 +03:00
skdc_entry = talloc_get_type_abort ( entry - > context ,
2014-05-09 16:58:08 +04:00
struct samba_kdc_entry ) ;
2009-07-18 04:15:55 +04:00
2023-06-20 07:41:05 +03:00
return samba_kdc_check_s4u2proxy ( context , kdc_db_ctx ,
skdc_entry ,
target_principal ) ;
2009-07-18 04:15:55 +04:00
}
2023-06-20 05:22:15 +03:00
static krb5_error_code
hdb_samba4_check_rbcd ( krb5_context context , HDB * db ,
2023-10-10 05:03:22 +03:00
const hdb_entry * client_krbtgt ,
const hdb_entry * client ,
const hdb_entry * device_krbtgt ,
const hdb_entry * device ,
2023-06-20 05:22:15 +03:00
krb5_const_principal server_principal ,
krb5_const_pac header_pac ,
2023-10-10 05:03:22 +03:00
krb5_const_pac device_pac ,
2023-06-20 05:22:15 +03:00
const hdb_entry * proxy )
{
struct samba_kdc_db_context * kdc_db_ctx = NULL ;
2023-10-10 05:19:47 +03:00
struct samba_kdc_entry * client_skdc_entry = NULL ;
const struct samba_kdc_entry * client_krbtgt_skdc_entry = NULL ;
2023-06-20 05:22:15 +03:00
struct samba_kdc_entry * proxy_skdc_entry = NULL ;
2023-10-10 05:22:28 +03:00
const struct auth_user_info_dc * client_info = NULL ;
2023-10-10 05:40:13 +03:00
const struct auth_user_info_dc * device_info = NULL ;
2023-10-10 05:19:47 +03:00
struct samba_kdc_entry_pac client_pac_entry = { } ;
2023-10-10 05:41:40 +03:00
struct auth_claims auth_claims = { } ;
2023-10-10 05:12:30 +03:00
TALLOC_CTX * mem_ctx = NULL ;
krb5_error_code code ;
2023-06-20 05:22:15 +03:00
kdc_db_ctx = talloc_get_type_abort ( db - > hdb_db ,
struct samba_kdc_db_context ) ;
2023-10-10 05:19:47 +03:00
client_skdc_entry = talloc_get_type_abort ( client - > context ,
struct samba_kdc_entry ) ;
client_krbtgt_skdc_entry = talloc_get_type_abort ( client_krbtgt - > context ,
struct samba_kdc_entry ) ;
2023-06-20 05:22:15 +03:00
proxy_skdc_entry = talloc_get_type_abort ( proxy - > context ,
struct samba_kdc_entry ) ;
2023-10-10 05:12:30 +03:00
mem_ctx = talloc_new ( kdc_db_ctx ) ;
if ( mem_ctx = = NULL ) {
return ENOMEM ;
}
2023-10-10 05:19:47 +03:00
client_pac_entry = samba_kdc_entry_pac ( header_pac ,
client_skdc_entry ,
samba_kdc_entry_is_trust ( client_krbtgt_skdc_entry ) ) ;
code = samba_kdc_get_user_info_dc ( mem_ctx ,
context ,
kdc_db_ctx - > samdb ,
client_pac_entry ,
2023-10-10 05:22:28 +03:00
& client_info ,
2023-10-10 05:19:47 +03:00
NULL /* resource_groups_out */ ) ;
2023-10-10 05:12:30 +03:00
if ( code ! = 0 ) {
goto out ;
}
2023-10-10 05:41:40 +03:00
code = samba_kdc_get_claims_data ( mem_ctx ,
context ,
kdc_db_ctx - > samdb ,
client_pac_entry ,
& auth_claims . user_claims ) ;
if ( code ) {
goto out ;
}
2023-10-10 05:40:13 +03:00
if ( device ! = NULL ) {
struct samba_kdc_entry * device_skdc_entry = NULL ;
const struct samba_kdc_entry * device_krbtgt_skdc_entry = NULL ;
struct samba_kdc_entry_pac device_pac_entry = { } ;
device_skdc_entry = talloc_get_type_abort ( device - > context ,
struct samba_kdc_entry ) ;
if ( device_krbtgt ! = NULL ) {
device_krbtgt_skdc_entry = talloc_get_type_abort ( device_krbtgt - > context ,
struct samba_kdc_entry ) ;
}
device_pac_entry = samba_kdc_entry_pac ( device_pac ,
device_skdc_entry ,
samba_kdc_entry_is_trust ( device_krbtgt_skdc_entry ) ) ;
code = samba_kdc_get_user_info_dc ( mem_ctx ,
context ,
kdc_db_ctx - > samdb ,
device_pac_entry ,
& device_info ,
NULL /* resource_groups_out */ ) ;
if ( code ) {
goto out ;
}
2023-10-10 05:41:40 +03:00
code = samba_kdc_get_claims_data ( mem_ctx ,
context ,
kdc_db_ctx - > samdb ,
device_pac_entry ,
& auth_claims . device_claims ) ;
if ( code ) {
goto out ;
}
2023-10-10 05:40:13 +03:00
}
2023-10-10 05:12:30 +03:00
code = samba_kdc_check_s4u2proxy_rbcd ( context ,
2023-06-20 05:22:15 +03:00
kdc_db_ctx ,
2023-10-10 05:03:22 +03:00
client - > principal ,
2023-06-20 05:22:15 +03:00
server_principal ,
2023-10-10 05:22:28 +03:00
client_info ,
2023-10-10 05:40:13 +03:00
device_info ,
2023-10-10 05:41:40 +03:00
auth_claims ,
2023-06-20 05:22:15 +03:00
proxy_skdc_entry ) ;
2023-10-10 05:12:30 +03:00
out :
talloc_free ( mem_ctx ) ;
return code ;
2023-06-20 05:22:15 +03:00
}
2010-01-21 17:57:41 +03:00
static krb5_error_code
hdb_samba4_check_pkinit_ms_upn_match ( krb5_context context , HDB * db ,
2022-02-22 09:41:14 +03:00
hdb_entry * entry ,
2010-01-21 17:57:41 +03:00
krb5_const_principal certificate_principal )
2009-07-28 08:05:19 +04:00
{
2010-01-28 09:27:11 +03:00
struct samba_kdc_db_context * kdc_db_ctx ;
2014-05-09 16:56:22 +04:00
struct samba_kdc_entry * skdc_entry ;
2015-08-04 12:35:45 +03:00
krb5_error_code ret ;
2009-07-28 08:05:19 +04:00
2010-01-28 09:27:11 +03:00
kdc_db_ctx = talloc_get_type_abort ( db - > hdb_db ,
struct samba_kdc_db_context ) ;
2022-02-22 09:41:14 +03:00
skdc_entry = talloc_get_type_abort ( entry - > context ,
2014-05-09 16:56:22 +04:00
struct samba_kdc_entry ) ;
2009-07-28 08:05:19 +04:00
2015-08-04 12:35:45 +03:00
ret = samba_kdc_check_pkinit_ms_upn_match ( context , kdc_db_ctx ,
skdc_entry ,
certificate_principal ) ;
switch ( ret ) {
case 0 :
break ;
case SDB_ERR_WRONG_REALM :
ret = HDB_ERR_WRONG_REALM ;
break ;
case SDB_ERR_NOENTRY :
ret = HDB_ERR_NOENTRY ;
break ;
2017-09-21 13:02:25 +03:00
case SDB_ERR_NOT_FOUND_HERE :
2015-08-04 12:35:45 +03:00
ret = HDB_ERR_NOT_FOUND_HERE ;
break ;
2017-09-21 13:02:25 +03:00
default :
break ;
2015-08-04 12:35:45 +03:00
}
return ret ;
2009-07-28 08:05:19 +04:00
}
2011-04-07 13:16:55 +04:00
static krb5_error_code
2016-01-08 04:08:18 +03:00
hdb_samba4_check_client_matches_target_service ( krb5_context context , HDB * db ,
2022-02-22 09:41:14 +03:00
hdb_entry * client_entry ,
hdb_entry * server_target_entry )
2011-04-07 13:16:55 +04:00
{
2021-10-07 22:29:51 +03:00
struct samba_kdc_entry * skdc_client_entry
2022-02-22 09:41:14 +03:00
= talloc_get_type_abort ( client_entry - > context ,
2021-10-07 22:29:51 +03:00
struct samba_kdc_entry ) ;
struct samba_kdc_entry * skdc_server_target_entry
2022-02-22 09:41:14 +03:00
= talloc_get_type_abort ( server_target_entry - > context ,
2021-10-07 22:29:51 +03:00
struct samba_kdc_entry ) ;
2016-01-08 04:08:18 +03:00
return samba_kdc_check_client_matches_target_service ( context ,
skdc_client_entry ,
skdc_server_target_entry ) ;
2011-04-07 13:16:55 +04:00
}
2017-04-11 06:51:50 +03:00
static void reset_bad_password_netlogon ( TALLOC_CTX * mem_ctx ,
struct samba_kdc_db_context * kdc_db_ctx ,
struct netr_SendToSamBase * send_to_sam )
{
struct dcerpc_binding_handle * irpc_handle ;
struct winbind_SendToSam req ;
2022-11-07 19:40:07 +03:00
struct tevent_req * subreq = NULL ;
2017-04-11 06:51:50 +03:00
irpc_handle = irpc_binding_handle_by_name ( mem_ctx , kdc_db_ctx - > msg_ctx ,
" winbind_server " ,
& ndr_table_winbind ) ;
if ( irpc_handle = = NULL ) {
2023-07-21 02:44:05 +03:00
DBG_ERR ( " No winbind_server running! \n " ) ;
2017-04-11 06:51:50 +03:00
return ;
}
req . in . message = * send_to_sam ;
2022-11-07 19:40:07 +03:00
/*
* This seem to rely on the current IRPC implementation ,
* which delivers the message in the _send function .
*
* TODO : we need a ONE_WAY IRPC handle and register
* a callback and wait for it to be triggered !
*/
subreq = dcerpc_winbind_SendToSam_r_send ( mem_ctx , kdc_db_ctx - > ev_ctx ,
irpc_handle , & req ) ;
/* we aren't interested in a reply */
TALLOC_FREE ( subreq ) ;
2017-04-11 06:51:50 +03:00
}
2023-06-16 02:01:04 +03:00
# define SAMBA_HDB_AUTHN_AUDIT_INFO_OBJ "samba:authn_audit_info_obj"
# define SAMBA_HDB_CLIENT_AUDIT_INFO "samba:client_audit_info"
# define SAMBA_HDB_SERVER_AUDIT_INFO "samba:server_audit_info"
2022-12-01 05:35:56 +03:00
# define SAMBA_HDB_NT_STATUS_OBJ "samba:nt_status_obj"
# define SAMBA_HDB_NT_STATUS "samba:nt_status"
2023-06-16 02:01:04 +03:00
struct hdb_audit_info_obj {
struct authn_audit_info * audit_info ;
} ;
static void hdb_audit_info_obj_dealloc ( void * ptr )
{
struct hdb_audit_info_obj * audit_info_obj = ptr ;
if ( audit_info_obj = = NULL ) {
return ;
}
TALLOC_FREE ( audit_info_obj - > audit_info ) ;
}
/*
* Set talloc - allocated auditing information of the KDC request . On success ,
* ‘ audit_info ’ is invalidated and may no longer be used by the caller .
*/
static krb5_error_code hdb_samba4_set_steal_audit_info ( astgs_request_t r ,
const char * key ,
struct authn_audit_info * audit_info )
{
struct hdb_audit_info_obj * audit_info_obj = NULL ;
audit_info_obj = kdc_object_alloc ( sizeof ( * audit_info_obj ) ,
SAMBA_HDB_AUTHN_AUDIT_INFO_OBJ ,
hdb_audit_info_obj_dealloc ) ;
if ( audit_info_obj = = NULL ) {
return ENOMEM ;
}
/*
* Steal a handle to the audit information onto the NULL context —
* Heimdal will be responsible for the deallocation of the object .
*/
audit_info_obj - > audit_info = talloc_steal ( NULL , audit_info ) ;
heim_audit_setkv_object ( ( heim_svc_req_desc ) r , key , audit_info_obj ) ;
heim_release ( audit_info_obj ) ;
return 0 ;
}
/*
* Set talloc - allocated client auditing information of the KDC request . On
* success , ‘ client_audit_info ’ is invalidated and may no longer be used by the
* caller .
*/
krb5_error_code hdb_samba4_set_steal_client_audit_info ( astgs_request_t r ,
struct authn_audit_info * client_audit_info )
{
return hdb_samba4_set_steal_audit_info ( r ,
SAMBA_HDB_CLIENT_AUDIT_INFO ,
client_audit_info ) ;
}
static const struct authn_audit_info * hdb_samba4_get_client_audit_info ( hdb_request_t r )
{
const struct hdb_audit_info_obj * audit_info_obj = NULL ;
audit_info_obj = heim_audit_getkv ( ( heim_svc_req_desc ) r , SAMBA_HDB_CLIENT_AUDIT_INFO ) ;
if ( audit_info_obj = = NULL ) {
return NULL ;
}
return audit_info_obj - > audit_info ;
}
/*
* Set talloc - allocated server auditing information of the KDC request . On
* success , ‘ server_audit_info ’ is invalidated and may no longer be used by the
* caller .
*/
krb5_error_code hdb_samba4_set_steal_server_audit_info ( astgs_request_t r ,
struct authn_audit_info * server_audit_info )
{
return hdb_samba4_set_steal_audit_info ( r ,
SAMBA_HDB_SERVER_AUDIT_INFO ,
server_audit_info ) ;
}
static const struct authn_audit_info * hdb_samba4_get_server_audit_info ( hdb_request_t r )
{
const struct hdb_audit_info_obj * audit_info_obj = NULL ;
audit_info_obj = heim_audit_getkv ( ( heim_svc_req_desc ) r , SAMBA_HDB_SERVER_AUDIT_INFO ) ;
if ( audit_info_obj = = NULL ) {
return NULL ;
}
return audit_info_obj - > audit_info ;
}
2022-12-01 05:35:56 +03:00
struct hdb_ntstatus_obj {
NTSTATUS status ;
krb5_error_code current_error ;
} ;
/*
* Add an NTSTATUS code to a Kerberos request . ‘ error ’ is the error value we
* want to return to the client . When it comes time to generating the error
* request , we shall compare this error value to whatever error we are about to
* return ; if the two match , we shall replace the ‘ e - data ’ field in the reply
* with the NTSTATUS code .
*/
krb5_error_code hdb_samba4_set_ntstatus ( astgs_request_t r ,
const NTSTATUS status ,
const krb5_error_code error )
{
struct hdb_ntstatus_obj * status_obj = NULL ;
status_obj = kdc_object_alloc ( sizeof ( * status_obj ) ,
SAMBA_HDB_NT_STATUS_OBJ ,
NULL ) ;
if ( status_obj = = NULL ) {
return ENOMEM ;
}
* status_obj = ( struct hdb_ntstatus_obj ) {
. status = status ,
. current_error = error ,
} ;
heim_audit_setkv_object ( ( heim_svc_req_desc ) r , SAMBA_HDB_NT_STATUS , status_obj ) ;
heim_release ( status_obj ) ;
return 0 ;
}
2023-05-17 06:47:18 +03:00
static krb5_error_code hdb_samba4_make_nt_status_edata ( const NTSTATUS status ,
const uint32_t flags ,
krb5_data * edata_out )
{
const uint32_t status_code = NT_STATUS_V ( status ) ;
const uint32_t zero = 0 ;
KERB_ERROR_DATA error_data ;
krb5_data e_data ;
krb5_error_code ret ;
size_t size ;
/* The raw KERB-ERR-TYPE-EXTENDED structure. */
uint8_t data [ 12 ] ;
PUSH_LE_U32 ( data , 0 , status_code ) ;
PUSH_LE_U32 ( data , 4 , zero ) ;
PUSH_LE_U32 ( data , 8 , flags ) ;
e_data = ( krb5_data ) {
. data = & data ,
. length = sizeof ( data ) ,
} ;
error_data = ( KERB_ERROR_DATA ) {
. data_type = kERB_ERR_TYPE_EXTENDED ,
. data_value = & e_data ,
} ;
ASN1_MALLOC_ENCODE ( KERB_ERROR_DATA ,
edata_out - > data , edata_out - > length ,
& error_data ,
& size , ret ) ;
if ( ret ) {
return ret ;
}
if ( size ! = edata_out - > length ) {
/* Internal ASN.1 encoder error */
krb5_data_free ( edata_out ) ;
return KRB5KRB_ERR_GENERIC ;
}
return 0 ;
}
static krb5_error_code hdb_samba4_set_edata_from_ntstatus ( hdb_request_t r , const NTSTATUS status )
{
const KDC_REQ * req = kdc_request_get_req ( ( astgs_request_t ) r ) ;
krb5_error_code ret = 0 ;
krb5_data e_data ;
uint32_t flags = 1 ;
if ( req - > msg_type = = krb_tgs_req ) {
/* This flag is used to indicate a TGS-REQ. */
flags | = 2 ;
}
ret = hdb_samba4_make_nt_status_edata ( status , flags , & e_data ) ;
if ( ret ) {
return ret ;
}
ret = kdc_set_e_data ( ( astgs_request_t ) r , e_data ) ;
if ( ret ) {
krb5_data_free ( & e_data ) ;
}
return ret ;
}
static NTSTATUS hdb_samba4_get_ntstatus ( hdb_request_t r )
{
struct hdb_ntstatus_obj * status_obj = NULL ;
status_obj = heim_audit_getkv ( ( heim_svc_req_desc ) r , SAMBA_HDB_NT_STATUS ) ;
if ( status_obj = = NULL ) {
return NT_STATUS_OK ;
}
if ( r - > error_code ! = status_obj - > current_error ) {
/*
* The error code has changed from what we expect . Consider the
* NTSTATUS to be invalidated .
*/
return NT_STATUS_OK ;
}
return status_obj - > status ;
}
2023-06-15 02:24:27 +03:00
static krb5_error_code hdb_samba4_tgs_audit ( const struct samba_kdc_db_context * kdc_db_ctx ,
const hdb_entry * entry ,
hdb_request_t r )
{
TALLOC_CTX * frame = talloc_stackframe ( ) ;
2023-06-16 02:01:04 +03:00
const struct authn_audit_info * server_audit_info = NULL ;
2023-06-15 02:24:27 +03:00
struct tsocket_address * remote_host = NULL ;
struct samba_kdc_entry * client_entry = NULL ;
struct dom_sid sid_buf = { } ;
const char * account_name = NULL ;
const char * domain_name = NULL ;
const struct dom_sid * sid = NULL ;
size_t sa_socklen = 0 ;
NTSTATUS auth_status = NT_STATUS_OK ;
krb5_error_code ret = 0 ;
krb5_error_code final_ret = 0 ;
/* Have we got a status code indicating an error? */
auth_status = hdb_samba4_get_ntstatus ( r ) ;
if ( ! NT_STATUS_IS_OK ( auth_status ) ) {
/*
* Include this status code in the ‘ e - data ’ field of the reply .
*/
ret = hdb_samba4_set_edata_from_ntstatus ( r , auth_status ) ;
if ( ret ) {
final_ret = ret ;
}
} else if ( entry = = NULL ) {
auth_status = NT_STATUS_NO_SUCH_USER ;
} else if ( r - > error_code ) {
/*
* Don ’ t include a status code in the reply . Just log the
* request as being unsuccessful .
*/
auth_status = NT_STATUS_UNSUCCESSFUL ;
}
switch ( r - > addr - > sa_family ) {
case AF_INET :
sa_socklen = sizeof ( struct sockaddr_in ) ;
break ;
# ifdef HAVE_IPV6
case AF_INET6 :
sa_socklen = sizeof ( struct sockaddr_in6 ) ;
break ;
# endif
}
ret = tsocket_address_bsd_from_sockaddr ( frame , r - > addr ,
sa_socklen ,
& remote_host ) ;
if ( ret ! = 0 ) {
remote_host = NULL ;
/* Ignore the error. */
}
2023-06-16 02:01:04 +03:00
server_audit_info = hdb_samba4_get_server_audit_info ( r ) ;
2023-06-15 02:24:27 +03:00
if ( entry ! = NULL ) {
client_entry = talloc_get_type_abort ( entry - > context ,
struct samba_kdc_entry ) ;
ret = samdb_result_dom_sid_buf ( client_entry - > msg , " objectSid " , & sid_buf ) ;
if ( ret ) {
/* Ignore the error. */
} else {
sid = & sid_buf ;
}
account_name = ldb_msg_find_attr_as_string ( client_entry - > msg , " sAMAccountName " , NULL ) ;
domain_name = lpcfg_sam_name ( kdc_db_ctx - > lp_ctx ) ;
}
log_authz_event ( kdc_db_ctx - > msg_ctx ,
kdc_db_ctx - > lp_ctx ,
remote_host ,
NULL /* local */ ,
2023-06-16 02:01:04 +03:00
server_audit_info ,
2023-06-15 02:24:27 +03:00
r - > sname ,
" TGS-REQ with Ticket-Granting Ticket " ,
domain_name ,
account_name ,
sid ,
lpcfg_netbios_name ( kdc_db_ctx - > lp_ctx ) ,
krb5_kdc_get_time ( ) ,
auth_status ) ;
talloc_free ( frame ) ;
if ( final_ret ) {
r - > error_code = final_ret ;
}
return final_ret ;
}
2022-02-21 10:28:42 +03:00
static krb5_error_code hdb_samba4_audit ( krb5_context context ,
HDB * db ,
2022-02-22 09:41:14 +03:00
hdb_entry * entry ,
2022-02-21 10:28:42 +03:00
hdb_request_t r )
2013-11-06 01:39:42 +04:00
{
struct samba_kdc_db_context * kdc_db_ctx = talloc_get_type_abort ( db - > hdb_db ,
struct samba_kdc_db_context ) ;
auth: keep track of lastLogon and lastLogonTimestamp
lastLogon is supposed to be updated for every interactive or kerberos
login, and (according to testing against Windows2012r2) when the bad
password count is non-zero but the lockout time is zero. It is not
replicated.
lastLogonTimestamp is updated if the old value is more than 14 -
random.choice([0, 1, 2, 3, 4, 5]) days old, and it is replicated. The
14 in this calculation is the default, stored as
"msDS-LogonTimeSyncInterval", which we offer no interface for
changing.
The authsam_zero_bad_pwd_count() function is a convenient place to
update these values, as it is called upon a successful logon however
that logon is performed. That makes the function's name inaccurate, so
we rename it authsam_logon_success_accounting(). It also needs to be
told whet5her the login is interactive.
The password_lockout tests are extended to test lastLogon and
lasLogonTimestamp.
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Ralph Boehme <slow@samba.org>
2015-10-23 06:57:56 +03:00
struct ldb_dn * domain_dn = ldb_get_default_basedn ( kdc_db_ctx - > samdb ) ;
2022-02-21 10:28:42 +03:00
heim_object_t auth_details_obj = NULL ;
const char * auth_details = NULL ;
2022-02-21 10:45:45 +03:00
char * etype_str = NULL ;
2022-02-21 10:28:42 +03:00
heim_object_t hdb_auth_status_obj = NULL ;
int hdb_auth_status ;
heim_object_t pa_type_obj = NULL ;
const char * pa_type = NULL ;
struct auth_usersupplied_info ui ;
size_t sa_socklen = 0 ;
2023-06-15 02:24:27 +03:00
const KDC_REQ * req = kdc_request_get_req ( ( astgs_request_t ) r ) ;
2023-05-17 06:38:09 +03:00
krb5_error_code final_ret = 0 ;
2023-05-17 06:47:18 +03:00
NTSTATUS edata_status ;
2023-06-15 02:24:27 +03:00
if ( req - > msg_type = = krb_tgs_req ) {
return hdb_samba4_tgs_audit ( kdc_db_ctx , entry , r ) ;
}
2023-06-20 02:15:50 +03:00
if ( r - > error_code = = KRB5KDC_ERR_PREAUTH_REQUIRED ) {
/* Let’ s not log PREAUTH_REQUIRED errors. */
return 0 ;
}
2023-05-17 06:47:18 +03:00
edata_status = hdb_samba4_get_ntstatus ( r ) ;
2022-02-21 10:28:42 +03:00
2022-03-02 00:00:17 +03:00
hdb_auth_status_obj = heim_audit_getkv ( ( heim_svc_req_desc ) r , KDC_REQUEST_KV_AUTH_EVENT ) ;
2022-02-21 10:28:42 +03:00
if ( hdb_auth_status_obj = = NULL ) {
/* No status code found, so just return. */
return 0 ;
}
hdb_auth_status = heim_number_get_int ( hdb_auth_status_obj ) ;
2023-05-08 03:58:46 +03:00
pa_type_obj = heim_audit_getkv ( ( heim_svc_req_desc ) r , KDC_REQUEST_KV_PA_NAME ) ;
2022-02-21 10:28:42 +03:00
if ( pa_type_obj ! = NULL ) {
pa_type = heim_string_get_utf8 ( pa_type_obj ) ;
}
2022-03-02 00:00:17 +03:00
auth_details_obj = heim_audit_getkv ( ( heim_svc_req_desc ) r , KDC_REQUEST_KV_PKINIT_CLIENT_CERT ) ;
2022-02-22 05:48:12 +03:00
if ( auth_details_obj ! = NULL ) {
auth_details = heim_string_get_utf8 ( auth_details_obj ) ;
} else {
2022-03-02 00:00:17 +03:00
auth_details_obj = heim_audit_getkv ( ( heim_svc_req_desc ) r , KDC_REQUEST_KV_GSS_INITIATOR ) ;
2022-02-21 10:45:45 +03:00
if ( auth_details_obj ! = NULL ) {
auth_details = heim_string_get_utf8 ( auth_details_obj ) ;
2022-02-22 05:48:12 +03:00
} else {
2022-03-02 00:00:17 +03:00
heim_object_t etype_obj = heim_audit_getkv ( ( heim_svc_req_desc ) r , KDC_REQUEST_KV_PA_ETYPE ) ;
2022-02-22 05:48:12 +03:00
if ( etype_obj ! = NULL ) {
int etype = heim_number_get_int ( etype_obj ) ;
krb5_error_code ret = krb5_enctype_to_string ( r - > context , etype , & etype_str ) ;
if ( ret = = 0 ) {
auth_details = etype_str ;
} else {
auth_details = " unknown enctype " ;
}
2022-02-21 10:45:45 +03:00
}
}
}
2022-02-21 10:28:42 +03:00
2017-02-21 04:07:54 +03:00
/*
* Forcing this via the NTLM auth structure is not ideal , but
* it is the most practical option right now , and ensures the
* logs are consistent , even if some elements are always NULL .
*/
2022-02-21 10:28:42 +03:00
ui = ( struct auth_usersupplied_info ) {
2017-02-21 04:07:54 +03:00
. was_mapped = true ,
. client = {
2022-02-21 10:28:42 +03:00
. account_name = r - > cname ,
2017-02-21 04:07:54 +03:00
. domain_name = NULL ,
} ,
. service_description = " Kerberos KDC " ,
2016-01-08 04:08:18 +03:00
. auth_description = " Unknown Auth Description " ,
. password_type = auth_details ,
2023-06-15 02:24:27 +03:00
. logon_id = generate_random_u64 ( ) ,
2017-02-21 04:07:54 +03:00
} ;
2022-02-21 10:28:42 +03:00
switch ( r - > addr - > sa_family ) {
2017-02-21 04:07:54 +03:00
case AF_INET :
sa_socklen = sizeof ( struct sockaddr_in ) ;
break ;
# ifdef HAVE_IPV6
case AF_INET6 :
sa_socklen = sizeof ( struct sockaddr_in6 ) ;
break ;
# endif
}
switch ( hdb_auth_status ) {
2022-03-02 00:10:08 +03:00
default :
2017-02-21 04:07:54 +03:00
{
TALLOC_CTX * frame = talloc_stackframe ( ) ;
2023-05-17 06:05:44 +03:00
struct samba_kdc_entry * p = talloc_get_type_abort ( entry - > context ,
struct samba_kdc_entry ) ;
2017-02-21 04:07:54 +03:00
struct dom_sid * sid
= samdb_result_dom_sid ( frame , p - > msg , " objectSid " ) ;
const char * account_name
= ldb_msg_find_attr_as_string ( p - > msg , " sAMAccountName " , NULL ) ;
const char * domain_name = lpcfg_sam_name ( p - > kdc_db_ctx - > lp_ctx ) ;
struct tsocket_address * remote_host ;
2016-01-08 04:08:18 +03:00
const char * auth_description = NULL ;
2023-06-16 02:01:04 +03:00
const struct authn_audit_info * client_audit_info = NULL ;
const struct authn_audit_info * server_audit_info = NULL ;
2017-02-21 04:07:54 +03:00
NTSTATUS status ;
int ret ;
2022-02-21 12:29:12 +03:00
bool rwdc_fallback = false ;
2017-02-21 04:07:54 +03:00
2022-02-21 10:28:42 +03:00
ret = tsocket_address_bsd_from_sockaddr ( frame , r - > addr ,
2017-02-21 04:07:54 +03:00
sa_socklen ,
& remote_host ) ;
if ( ret ! = 0 ) {
ui . remote_host = NULL ;
} else {
ui . remote_host = remote_host ;
}
ui . mapped . account_name = account_name ;
ui . mapped . domain_name = domain_name ;
2016-01-08 04:08:18 +03:00
if ( pa_type ! = NULL ) {
auth_description = talloc_asprintf ( frame ,
" %s Pre-authentication " ,
pa_type ) ;
if ( auth_description = = NULL ) {
auth_description = pa_type ;
}
} else {
auth_description = " Unknown Pre-authentication " ;
}
ui . auth_description = auth_description ;
2022-03-02 00:10:08 +03:00
if ( hdb_auth_status = = KDC_AUTH_EVENT_CLIENT_AUTHORIZED ) {
2022-07-06 02:11:43 +03:00
struct netr_SendToSamBase * send_to_sam = NULL ;
/*
* TODO : We could log the AS - REQ authorization success here as
* well . However before we do that , we need to pass
* in the PAC here or re - calculate it .
*/
2022-07-01 06:04:41 +03:00
status = authsam_logon_success_accounting ( kdc_db_ctx - > samdb , p - > msg ,
2022-11-07 19:21:44 +03:00
domain_dn , true , frame , & send_to_sam ) ;
2022-07-01 06:04:41 +03:00
if ( NT_STATUS_EQUAL ( status , NT_STATUS_ACCOUNT_LOCKED_OUT ) ) {
2023-05-17 06:47:18 +03:00
edata_status = status ;
2023-06-14 02:37:03 +03:00
r - > error_code = final_ret = KRB5KDC_ERR_CLIENT_REVOKED ;
2022-07-01 06:04:41 +03:00
rwdc_fallback = kdc_db_ctx - > rodc ;
} else if ( ! NT_STATUS_IS_OK ( status ) ) {
2023-08-14 01:50:37 +03:00
r - > error_code = final_ret = KRB5KDC_ERR_CLIENT_REVOKED ;
2022-07-01 06:04:41 +03:00
rwdc_fallback = kdc_db_ctx - > rodc ;
2023-05-17 06:47:18 +03:00
} else {
if ( r - > error_code = = KRB5KDC_ERR_NEVER_VALID ) {
2023-06-14 02:58:13 +03:00
edata_status = status = NT_STATUS_TIME_DIFFERENCE_AT_DC ;
} else {
status = krb5_to_nt_status ( r - > error_code ) ;
2023-05-17 06:47:18 +03:00
}
if ( kdc_db_ctx - > rodc & & send_to_sam ! = NULL ) {
reset_bad_password_netlogon ( frame , kdc_db_ctx , send_to_sam ) ;
}
2022-07-06 02:11:43 +03:00
}
2023-06-14 06:51:09 +03:00
/* This is the final success */
2022-03-15 05:34:34 +03:00
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_VALIDATED_LONG_TERM_KEY ) {
/*
* This was only a pre - authentication success ,
* but we didn ' t reach the final
* KDC_AUTH_EVENT_CLIENT_AUTHORIZED ,
* so consult the error code .
*/
if ( r - > error_code = = 0 ) {
DBG_ERR ( " ERROR: VALIDATED_LONG_TERM_KEY "
" with error=0 => INTERNAL_ERROR \n " ) ;
status = NT_STATUS_INTERNAL_ERROR ;
2023-06-14 02:37:03 +03:00
r - > error_code = final_ret = KRB5KRB_ERR_GENERIC ;
2022-03-16 11:21:03 +03:00
} else if ( ! NT_STATUS_IS_OK ( p - > reject_status ) ) {
status = p - > reject_status ;
2022-03-15 05:34:34 +03:00
} else {
status = krb5_to_nt_status ( r - > error_code ) ;
}
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_PREAUTH_SUCCEEDED ) {
/*
* This was only a pre - authentication success ,
* but we didn ' t reach the final
* KDC_AUTH_EVENT_CLIENT_AUTHORIZED ,
* so consult the error code .
*/
if ( r - > error_code = = 0 ) {
DBG_ERR ( " ERROR: PREAUTH_SUCCEEDED "
" with error=0 => INTERNAL_ERROR \n " ) ;
status = NT_STATUS_INTERNAL_ERROR ;
2023-06-14 02:37:03 +03:00
r - > error_code = final_ret = KRB5KRB_ERR_GENERIC ;
2022-03-16 11:21:03 +03:00
} else if ( ! NT_STATUS_IS_OK ( p - > reject_status ) ) {
status = p - > reject_status ;
2022-03-15 05:34:34 +03:00
} else {
status = krb5_to_nt_status ( r - > error_code ) ;
}
2023-06-20 02:20:44 +03:00
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_CLIENT_FOUND ) {
/*
* We found the client principal ,
* but we didn ’ t reach the final
* KDC_AUTH_EVENT_CLIENT_AUTHORIZED ,
* so consult the error code .
*/
if ( r - > error_code = = 0 ) {
DBG_ERR ( " ERROR: CLIENT_FOUND "
" with error=0 => INTERNAL_ERROR \n " ) ;
status = NT_STATUS_INTERNAL_ERROR ;
r - > error_code = final_ret = KRB5KRB_ERR_GENERIC ;
} else if ( ! NT_STATUS_IS_OK ( p - > reject_status ) ) {
status = p - > reject_status ;
} else {
status = krb5_to_nt_status ( r - > error_code ) ;
}
2022-03-02 00:10:08 +03:00
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_CLIENT_TIME_SKEW ) {
status = NT_STATUS_TIME_DIFFERENCE_AT_DC ;
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_WRONG_LONG_TERM_KEY ) {
2022-07-09 06:54:52 +03:00
status = authsam_update_bad_pwd_count ( kdc_db_ctx - > samdb , p - > msg , domain_dn ) ;
if ( NT_STATUS_EQUAL ( status , NT_STATUS_ACCOUNT_LOCKED_OUT ) ) {
2023-05-17 06:47:18 +03:00
edata_status = status ;
2023-06-14 02:37:03 +03:00
r - > error_code = final_ret = KRB5KDC_ERR_CLIENT_REVOKED ;
2022-07-09 06:54:52 +03:00
} else {
status = NT_STATUS_WRONG_PASSWORD ;
}
2022-02-21 12:29:12 +03:00
rwdc_fallback = kdc_db_ctx - > rodc ;
2022-02-17 09:12:10 +03:00
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_HISTORIC_LONG_TERM_KEY ) {
/*
* The pre - authentication succeeds with a password
* from the password history , so we don ' t
* update the badPwdCount , but still return
* PREAUTH_FAILED and need to forward to
2023-08-02 11:47:30 +03:00
* a RWDC in order to produce an authoritative
2022-02-17 09:12:10 +03:00
* response for the client .
*/
status = NT_STATUS_WRONG_PASSWORD ;
rwdc_fallback = kdc_db_ctx - > rodc ;
2022-03-02 00:00:17 +03:00
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_CLIENT_LOCKED_OUT ) {
2023-05-17 06:47:18 +03:00
edata_status = status = NT_STATUS_ACCOUNT_LOCKED_OUT ;
2022-02-21 12:29:12 +03:00
rwdc_fallback = kdc_db_ctx - > rodc ;
2022-03-02 00:10:08 +03:00
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_CLIENT_NAME_UNAUTHORIZED ) {
if ( pa_type ! = NULL & & strncmp ( pa_type , " PK-INIT " , strlen ( " PK-INIT " ) ) = = 0 ) {
status = NT_STATUS_PKINIT_NAME_MISMATCH ;
} else {
status = NT_STATUS_ACCOUNT_RESTRICTION ;
}
2022-02-21 12:29:12 +03:00
rwdc_fallback = kdc_db_ctx - > rodc ;
2022-03-02 00:00:17 +03:00
} else if ( hdb_auth_status = = KDC_AUTH_EVENT_PREAUTH_FAILED ) {
2022-02-22 05:48:12 +03:00
if ( pa_type ! = NULL & & strncmp ( pa_type , " PK-INIT " , strlen ( " PK-INIT " ) ) = = 0 ) {
status = NT_STATUS_PKINIT_FAILURE ;
} else {
status = NT_STATUS_GENERIC_COMMAND_FAILED ;
}
2022-02-21 12:29:12 +03:00
rwdc_fallback = kdc_db_ctx - > rodc ;
2016-01-08 04:08:18 +03:00
} else {
2022-03-02 00:10:08 +03:00
DBG_ERR ( " Unhandled hdb_auth_status=%d => INTERNAL_ERROR \n " ,
hdb_auth_status ) ;
2016-01-08 04:08:18 +03:00
status = NT_STATUS_INTERNAL_ERROR ;
2023-06-14 02:37:03 +03:00
r - > error_code = final_ret = KRB5KRB_ERR_GENERIC ;
2017-04-04 02:57:01 +03:00
}
2023-05-17 06:47:18 +03:00
if ( ! NT_STATUS_IS_OK ( edata_status ) ) {
krb5_error_code code ;
code = hdb_samba4_set_edata_from_ntstatus ( r , edata_status ) ;
if ( code ) {
r - > error_code = final_ret = code ;
}
}
2022-02-21 12:29:12 +03:00
if ( rwdc_fallback ) {
/*
* Forward the request to an RWDC in order
* to give an authoritative answer to the client .
*/
auth_description = talloc_asprintf ( frame ,
" %s,Forward-To-RWDC " ,
ui . auth_description ) ;
if ( auth_description ! = NULL ) {
ui . auth_description = auth_description ;
}
final_ret = HDB_ERR_NOT_FOUND_HERE ;
}
2023-06-16 02:01:04 +03:00
client_audit_info = hdb_samba4_get_client_audit_info ( r ) ;
server_audit_info = hdb_samba4_get_server_audit_info ( r ) ;
2017-02-21 04:07:54 +03:00
log_authentication_event ( kdc_db_ctx - > msg_ctx ,
kdc_db_ctx - > lp_ctx ,
2022-02-21 10:28:42 +03:00
& r - > tv_start ,
2017-02-21 04:07:54 +03:00
& ui ,
status ,
domain_name ,
account_name ,
2023-06-15 08:07:05 +03:00
sid ,
2023-06-16 02:01:04 +03:00
client_audit_info ,
server_audit_info ) ;
2022-03-15 05:34:34 +03:00
if ( final_ret = = KRB5KRB_ERR_GENERIC & & socket_wrapper_enabled ( ) ) {
/*
* If we ' re running under make test
* just panic
*/
DBG_ERR ( " Unexpected situation => PANIC \n " ) ;
smb_panic ( " hdb_samba4_audit: Unexpected situation " ) ;
}
2017-02-21 04:07:54 +03:00
TALLOC_FREE ( frame ) ;
break ;
}
2022-03-02 00:00:17 +03:00
case KDC_AUTH_EVENT_CLIENT_UNKNOWN :
2017-02-21 04:07:54 +03:00
{
struct tsocket_address * remote_host ;
int ret ;
TALLOC_CTX * frame = talloc_stackframe ( ) ;
2022-02-21 10:28:42 +03:00
ret = tsocket_address_bsd_from_sockaddr ( frame , r - > addr ,
2017-02-21 04:07:54 +03:00
sa_socklen ,
& remote_host ) ;
if ( ret ! = 0 ) {
ui . remote_host = NULL ;
} else {
ui . remote_host = remote_host ;
}
2016-01-08 04:08:18 +03:00
if ( pa_type = = NULL ) {
pa_type = " AS-REQ " ;
}
ui . auth_description = pa_type ;
2022-02-21 12:29:12 +03:00
/* Note this is not forwarded to an RWDC */
2017-02-21 04:07:54 +03:00
log_authentication_event ( kdc_db_ctx - > msg_ctx ,
kdc_db_ctx - > lp_ctx ,
2022-02-21 10:28:42 +03:00
& r - > tv_start ,
2017-02-21 04:07:54 +03:00
& ui ,
NT_STATUS_NO_SUCH_USER ,
NULL , NULL ,
2023-06-15 08:07:05 +03:00
NULL ,
NULL /* client_audit_info */ ,
NULL /* server_audit_info */ ) ;
2017-02-21 04:07:54 +03:00
TALLOC_FREE ( frame ) ;
break ;
}
2013-11-06 01:39:42 +04:00
}
2022-02-21 10:45:45 +03:00
free ( etype_str ) ;
2022-02-21 12:29:12 +03:00
return final_ret ;
2013-11-06 01:39:42 +04:00
}
2010-01-28 09:27:11 +03:00
/* This interface is to be called by the KDC and libnet_keytab_dump,
* which is expecting Samba calling conventions .
* It is also called by a wrapper ( hdb_samba4_create ) from the
* kpasswdd - > krb5 - > keytab_hdb - > hdb code */
2006-01-24 08:31:08 +03:00
2010-01-28 08:08:36 +03:00
NTSTATUS hdb_samba4_create_kdc ( struct samba_kdc_base_context * base_ctx ,
krb5_context context , struct HDB * * db )
2005-06-03 18:32:10 +04:00
{
2023-09-27 04:10:44 +03:00
struct samba_kdc_db_context * kdc_db_ctx = NULL ;
2009-11-09 13:38:49 +03:00
NTSTATUS nt_status ;
2014-01-14 02:23:04 +04:00
if ( hdb_interface_version ! = HDB_INTERFACE_VERSION ) {
krb5_set_error_message ( context , EINVAL , " Heimdal HDB interface version mismatch between build-time and run-time libraries! " ) ;
return NT_STATUS_ERROR_DS_INCOMPATIBLE_VERSION ;
}
2021-12-08 06:42:32 +03:00
* db = talloc_zero ( base_ctx , HDB ) ;
2005-06-03 18:32:10 +04:00
if ( ! * db ) {
2023-08-10 07:16:12 +03:00
krb5_set_error_message ( context , ENOMEM , " talloc_zero: out of memory " ) ;
2005-12-11 11:31:46 +03:00
return NT_STATUS_NO_MEMORY ;
2005-06-03 18:32:10 +04:00
}
( * db ) - > hdb_master_key_set = 0 ;
( * db ) - > hdb_db = NULL ;
2014-12-17 07:02:53 +03:00
( * db ) - > hdb_capability_flags = HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL ;
2005-06-05 17:11:42 +04:00
2010-09-28 07:05:37 +04:00
nt_status = samba_kdc_setup_db_ctx ( * db , base_ctx , & kdc_db_ctx ) ;
2009-11-09 13:38:49 +03:00
if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
2010-09-28 07:05:37 +04:00
talloc_free ( * db ) ;
return nt_status ;
2009-11-09 13:38:49 +03:00
}
2010-01-28 08:08:36 +03:00
( * db ) - > hdb_db = kdc_db_ctx ;
2007-06-15 04:14:11 +04:00
( * db ) - > hdb_dbc = NULL ;
2009-07-16 06:47:57 +04:00
( * db ) - > hdb_open = hdb_samba4_open ;
( * db ) - > hdb_close = hdb_samba4_close ;
2022-02-22 09:41:14 +03:00
( * db ) - > hdb_free_entry_context = hdb_samba4_free_entry_context ;
2010-10-02 10:55:06 +04:00
( * db ) - > hdb_fetch_kvno = hdb_samba4_fetch_kvno ;
2009-07-16 06:47:57 +04:00
( * db ) - > hdb_store = hdb_samba4_store ;
( * db ) - > hdb_firstkey = hdb_samba4_firstkey ;
( * db ) - > hdb_nextkey = hdb_samba4_nextkey ;
( * db ) - > hdb_lock = hdb_samba4_lock ;
( * db ) - > hdb_unlock = hdb_samba4_unlock ;
2016-01-08 04:08:18 +03:00
( * db ) - > hdb_set_sync = hdb_samba4_set_sync ;
2009-07-16 06:47:57 +04:00
( * db ) - > hdb_rename = hdb_samba4_rename ;
2005-06-03 18:32:10 +04:00
/* we don't implement these, as we are not a lockable database */
( * db ) - > hdb__get = NULL ;
( * db ) - > hdb__put = NULL ;
/* kadmin should not be used for deletes - use other tools instead */
( * db ) - > hdb__del = NULL ;
2009-07-16 06:47:57 +04:00
( * db ) - > hdb_destroy = hdb_samba4_destroy ;
2005-06-03 18:32:10 +04:00
2022-02-21 10:28:42 +03:00
( * db ) - > hdb_audit = hdb_samba4_audit ;
2011-04-07 13:16:55 +04:00
( * db ) - > hdb_check_constrained_delegation = hdb_samba4_check_constrained_delegation ;
2023-06-20 05:22:15 +03:00
( * db ) - > hdb_check_rbcd = hdb_samba4_check_rbcd ;
2009-07-28 08:05:19 +04:00
( * db ) - > hdb_check_pkinit_ms_upn_match = hdb_samba4_check_pkinit_ms_upn_match ;
2016-01-08 04:08:18 +03:00
( * db ) - > hdb_check_client_matches_target_service = hdb_samba4_check_client_matches_target_service ;
2009-07-07 06:34:55 +04:00
2005-12-11 11:31:46 +03:00
return NT_STATUS_OK ;
2005-06-03 18:32:10 +04:00
}
2022-05-26 07:39:20 +03:00
NTSTATUS hdb_samba4_kpasswd_create_kdc ( struct samba_kdc_base_context * base_ctx ,
krb5_context context , struct HDB * * db )
{
NTSTATUS nt_status ;
nt_status = hdb_samba4_create_kdc ( base_ctx , context , db ) ;
if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
return nt_status ;
}
( * db ) - > hdb_fetch_kvno = hdb_samba4_kpasswd_fetch_kvno ;
( * db ) - > hdb_firstkey = hdb_samba4_nextkey_panic ;
( * db ) - > hdb_nextkey = hdb_samba4_nextkey_panic ;
return NT_STATUS_OK ;
}