sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-23 09:57:40 +03:00
Code

r17897: Store the uid in the memory creds. Don't request the

Browse Source 
krb5 refresh creds when doing cached NTLM auth, request
the memory creds instead.
Jeremy.
This commit is contained in:
Jeremy Allison 2006-08-28 23:01:30 +00:00 committed by Gerald (Jerry) Carter
parent 8b6f5937db
commit 310ac0b226
4 changed files with 27 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
source/nsswitch/winbindd_ccache_access.c
View File

@ -29,7 +29,7 @@
#define DBGC_CLASS DBGC_WINBIND
static BOOL client_can_access_ccache_entry(uid_t client_uid,
struct WINBINDD_CCACHE_ENTRY *entry)
struct WINBINDD_MEMORY_CREDS *entry)
{
if (client_uid == entry->uid || client_uid == 0) {
DEBUG(10, ("Access granted to uid %d\n", client_uid));
@ -190,7 +190,7 @@ enum winbindd_result winbindd_dual_ccache_ntlm_auth(struct winbindd_domain *doma
struct winbindd_cli_state *state)
{
NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
struct WINBINDD_CCACHE_ENTRY *entry;
struct WINBINDD_MEMORY_CREDS *entry;
DATA_BLOB initial, challenge, auth;
fstring name_domain, name_user;
uint32 initial_blob_len, challenge_blob_len, extra_len;
@ -229,15 +229,15 @@ enum winbindd_result winbindd_dual_ccache_ntlm_auth(struct winbindd_domain *doma
goto process_result;
}
entry = get_ccache_by_username(state->request.data.ccache_ntlm_auth.user);
if (entry == NULL || entry->cred_ptr == NULL) {
entry = find_memory_creds_by_name(state->request.data.ccache_ntlm_auth.user);
if (entry == NULL || entry->nt_hash == NULL || entry->lm_hash == NULL) {
DEBUG(10,("winbindd_dual_ccache_ntlm_auth: could not find "
"credentials for user %s\n",
state->request.data.ccache_ntlm_auth.user));
goto process_result;
}
DEBUG(10,("winbindd_dual_ccache_ntlm_auth: found ccache [%s]\n", entry->ccname));
DEBUG(10,("winbindd_dual_ccache_ntlm_auth: found ccache [%s]\n", entry->username));
if (!client_can_access_ccache_entry(state->request.data.ccache_ntlm_auth.uid, entry)) {
goto process_result;
@ -258,7 +258,7 @@ enum winbindd_result winbindd_dual_ccache_ntlm_auth(struct winbindd_domain *doma
result = NT_STATUS_NO_MEMORY;
} else {
result = do_ntlm_auth_with_hashes(name_user, name_domain,
entry->cred_ptr->lm_hash, entry->cred_ptr->nt_hash,
entry->lm_hash, entry->nt_hash,
initial, challenge, &auth);
}

24
source/nsswitch/winbindd_cred_cache.c
View File

@ -35,7 +35,7 @@ static struct WINBINDD_CCACHE_ENTRY *ccache_list;
Find an entry by name.
****************************************************************/
struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
{
struct WINBINDD_CCACHE_ENTRY *entry;
@ -307,7 +307,7 @@ static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
Find an entry on the list by name.
***********************************************************/
static struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
{
struct WINBINDD_MEMORY_CREDS *p;
@ -411,7 +411,7 @@ static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CR
Store credentials in memory in a list.
*************************************************************/
static NTSTATUS winbindd_add_memory_creds_internal(const char *username, const char *pass, BOOL store_pass)
static NTSTATUS winbindd_add_memory_creds_internal(const char *username, uid_t uid, const char *pass, BOOL store_pass)
{
/* Shortcut to ensure we don't store if no mlock. */
#if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
@ -420,8 +420,20 @@ static NTSTATUS winbindd_add_memory_creds_internal(const char *username, const c
NTSTATUS status;
struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
if (uid == (uid_t)-1) {
DEBUG(0,("winbindd_add_memory_creds_internal: invalid uid for user %s.\n",
username ));
return NT_STATUS_INVALID_PARAMETER;
}
if (memcredp) {
/* Already exists. Increment the reference count and replace stored creds. */
if (uid != memcredp->uid) {
DEBUG(0,("winbindd_add_memory_creds_internal: uid %u for user %s doesn't "
"match stored uid %u. Replacing.\n",
(unsigned int)uid, username, (unsigned int)memcredp->uid ));
memcredp->uid = uid;
}
memcredp->ref_count++;
DEBUG(10,("winbindd_add_memory_creds_internal: ref count for user %s is now %d\n",
username, memcredp->ref_count ));
@ -440,9 +452,11 @@ static NTSTATUS winbindd_add_memory_creds_internal(const char *username, const c
status = store_memory_creds(memcredp, pass, store_pass);
if (!NT_STATUS_IS_OK(status)) {
talloc_destroy(memcredp);
return status;
}
memcredp->uid = uid;
memcredp->ref_count = 1;
DLIST_ADD(memory_creds_list, memcredp);
@ -460,7 +474,7 @@ static NTSTATUS winbindd_add_memory_creds_internal(const char *username, const c
and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
*************************************************************/
NTSTATUS winbindd_add_memory_creds(const char *username, const char *pass)
NTSTATUS winbindd_add_memory_creds(const char *username, uid_t uid, const char *pass)
{
struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
BOOL store_pass = False;
@ -470,7 +484,7 @@ NTSTATUS winbindd_add_memory_creds(const char *username, const char *pass)
store_pass = True;
}
status = winbindd_add_memory_creds_internal(username, pass, store_pass);
status = winbindd_add_memory_creds_internal(username, uid, pass, store_pass);
if (!NT_STATUS_IS_OK(status)) {
return status;
}

1
source/nsswitch/winbindd_nss.h
View File

@ -459,6 +459,7 @@ struct winbindd_response {
struct WINBINDD_MEMORY_CREDS {
struct WINBINDD_MEMORY_CREDS *next, *prev;
const char *username; /* lookup key. */
uid_t uid;
int ref_count;
size_t len;
unsigned char *nt_hash; /* Base pointer for the following 2 */

1
source/nsswitch/winbindd_pam.c
View File

@ -1271,6 +1271,7 @@ process_result:
/* Store in-memory creds for single-signon using ntlm_auth. */
result = winbindd_add_memory_creds(state->request.data.auth.user,
get_uid_from_state(state),
state->request.data.auth.pass);
if (!NT_STATUS_IS_OK(result)) {