mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
b6c4c08536
This is required in order to support netr_SamInfo6 and PAC_UPN_DNS_INFO correctly. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
115 lines
3.4 KiB
Plaintext
115 lines
3.4 KiB
Plaintext
#include "idl_types.h"
|
|
|
|
/*
|
|
Authentication IDL structures
|
|
|
|
These are NOT public network structures, but it is helpful to define
|
|
these things in IDL. They may change without ABI breakage or
|
|
warning.
|
|
|
|
*/
|
|
|
|
import "misc.idl", "security.idl", "lsa.idl", "krb5pac.idl";
|
|
[
|
|
pyhelper("librpc/ndr/py_auth.c"),
|
|
helper("../librpc/ndr/ndr_auth.h"),
|
|
helpstring("internal Samba authentication structures")
|
|
]
|
|
|
|
interface auth
|
|
{
|
|
typedef [public] enum {
|
|
SEC_AUTH_METHOD_UNAUTHENTICATED = 0,
|
|
SEC_AUTH_METHOD_NTLM = 1,
|
|
SEC_AUTH_METHOD_KERBEROS = 2
|
|
} auth_method;
|
|
|
|
/* This is the parts of the session_info that don't change
|
|
* during local privilage and group manipulations */
|
|
typedef [public] struct {
|
|
[unique,charset(UTF8),string] char *account_name;
|
|
[unique,charset(UTF8),string] char *user_principal_name;
|
|
boolean8 user_principal_constructed;
|
|
[unique,charset(UTF8),string] char *domain_name;
|
|
[unique,charset(UTF8),string] char *dns_domain_name;
|
|
|
|
[unique,charset(UTF8),string] char *full_name;
|
|
[unique,charset(UTF8),string] char *logon_script;
|
|
[unique,charset(UTF8),string] char *profile_path;
|
|
[unique,charset(UTF8),string] char *home_directory;
|
|
[unique,charset(UTF8),string] char *home_drive;
|
|
[unique,charset(UTF8),string] char *logon_server;
|
|
|
|
NTTIME last_logon;
|
|
NTTIME last_logoff;
|
|
NTTIME acct_expiry;
|
|
NTTIME last_password_change;
|
|
NTTIME allow_password_change;
|
|
NTTIME force_password_change;
|
|
|
|
uint16 logon_count;
|
|
uint16 bad_password_count;
|
|
|
|
uint32 acct_flags;
|
|
|
|
uint8 authenticated;
|
|
} auth_user_info;
|
|
|
|
/* This information is preserved only to assist torture tests */
|
|
typedef [public] struct {
|
|
/* Number SIDs from the DC netlogon validation info */
|
|
uint32 num_dc_sids;
|
|
[size_is(num_dc_sids)] dom_sid dc_sids[*];
|
|
} auth_user_info_torture;
|
|
|
|
typedef [public] struct {
|
|
[unique,charset(UTF8),string] char *unix_name;
|
|
|
|
/*
|
|
* For performance reasons we keep an alpha_strcpy-sanitized version
|
|
* of the username around as long as the global variable current_user
|
|
* still exists. If we did not do keep this, we'd have to call
|
|
* alpha_strcpy whenever we do a become_user(), potentially on every
|
|
* smb request. See set_current_user_info in source3.
|
|
*/
|
|
[unique,charset(UTF8),string] char *sanitized_username;
|
|
} auth_user_info_unix;
|
|
|
|
/* This is the interim product of the auth subsystem, before
|
|
* privileges and local groups are handled */
|
|
typedef [public] struct {
|
|
uint32 num_sids;
|
|
[size_is(num_sids)] dom_sid sids[*];
|
|
auth_user_info *info;
|
|
[noprint] DATA_BLOB user_session_key;
|
|
[noprint] DATA_BLOB lm_session_key;
|
|
} auth_user_info_dc;
|
|
|
|
typedef [public] struct {
|
|
security_token *security_token;
|
|
security_unix_token *unix_token;
|
|
auth_user_info *info;
|
|
auth_user_info_unix *unix_info;
|
|
[value(NULL), ignore] auth_user_info_torture *torture;
|
|
|
|
/* This is the final session key, as used by SMB signing, and
|
|
* (truncated to 16 bytes) encryption on the SAMR and LSA pipes
|
|
* when over ncacn_np.
|
|
* It is calculated by NTLMSSP from the session key in the info3,
|
|
* and is set from the Kerberos session key using
|
|
* krb5_auth_con_getremotesubkey().
|
|
*
|
|
* Bottom line, it is not the same as the session keys in info3.
|
|
*/
|
|
|
|
[noprint] DATA_BLOB session_key;
|
|
|
|
[value(NULL), ignore] cli_credentials *credentials;
|
|
} auth_session_info;
|
|
|
|
typedef [public] struct {
|
|
auth_session_info *session_info;
|
|
[noprint] DATA_BLOB exported_gssapi_credentials;
|
|
} auth_session_info_transport;
|
|
}
|