sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-25 06:04:04 +03:00
Code
samba-mirror/source3/winbindd
History
Samuel Cabrero 89b914b3c5 s3:winbind: Use the canonical realm name to renew the credentials 
Consider the following AD topology where all trusts are parent-child
trusts:

                   ADOM.AFOREST.AD
		   	|
            ACHILD.ADOM.AFOREST.AD
			|
AGRANDCHILD.ACHILD.ADOM.AFOREST.AD <-- Samba joined

When logging into the Samba machine using pam_winbind with kerberos enabled
with user ACHILD\user1, the ccache content is:

	Default principal: user1@ACHILD.ADOM.AFOREST.AD

	Valid starting       Expires              Service principal
	07/06/2022 16:09:23  07/06/2022 16:14:23  krbtgt/ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD
	        renew until 07/13/2022 16:09:23
-->	07/06/2022 16:09:23  07/06/2022 16:14:23  krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD <-- NOTE this TGT ticket
	        renew until 07/13/2022 16:09:23
	07/06/2022 16:09:23  07/06/2022 16:14:23  SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD
	        renew until 07/13/2022 16:09:23

But when logging in with user ADOM\user1, the ccache content is:

	Default principal: user1@ADOM.AFOREST.AD

	Valid starting       Expires              Service principal
	07/06/2022 16:04:37  07/06/2022 16:09:37  krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD
	        renew until 07/13/2022 16:04:37
	07/06/2022 16:04:37  07/06/2022 16:09:37  SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD
	        renew until 07/13/2022 16:04:37

MIT does not store the intermediate TGTs when there is more than one hop:

	ads_krb5_cli_get_ticket: Getting ticket for service [SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD] using creds from [FILE:/tmp/krb5cc_11105] and impersonating [(null)]

	Getting credentials user1@ADOM.AFOREST.AD -> SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD using ccache FILE:/tmp/krb5cc_11105
	Starting with TGT for client realm: user1@ADOM.AFOREST.AD -> krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD

	Requesting TGT krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ADOM.AFOREST.AD using TGT krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD
	Sending request to ADOM.AFOREST.AD
	Received answer from stream 192.168.101.32:88
	TGS reply is for user1@ADOM.AFOREST.AD -> krbtgt/ACHILD.ADOM.AFOREST.AD@ADOM.AFOREST.AD with session key rc4-hmac/D88B
-->	Received TGT for offpath realm ACHILD.ADOM.AFOREST.AD <-- NOTE this TGT ticket is not stored

	Requesting TGT krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD using TGT krbtgt/ACHILD.ADOM.AFOREST.AD@ADOM.AFOREST.AD
	Sending request (1748 bytes) to ACHILD.ADOM.AFOREST.AD
	Received answer (1628 bytes) from stream 192.168.101.33:88
	TGS reply is for user1@ADOM.AFOREST.AD -> krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD with session key rc4-hmac/D015
-->	Received TGT for service realm: krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD <-- NOTE this TGT is not stored

	Requesting tickets for SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD, referrals on
	Sending request (1721 bytes) to AGRANDCHILD.ACHILD.ADOM.AFOREST.AD
	Received answer (1647 bytes) from stream 192.168.101.34:88
	TGS reply is for user1@ADOM.AFOREST.AD -> SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD with session key aes256-cts/345A
	Received creds for desired service SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD
	Storing user1@ADOM.AFOREST.AD -> SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD in FILE:/tmp/krb5cc_11105

In the case of ACHILD\user1:

	ads_krb5_cli_get_ticket: Getting ticket for service [SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD] using creds from [FILE:/tmp/krb5cc_2000] and impersonating [(null)]

	Getting credentials user1@ACHILD.ADOM.AFOREST.AD -> SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD using ccache FILE:/tmp/krb5cc_2000
	Starting with TGT for client realm: user1@ACHILD.ADOM.AFOREST.AD -> krbtgt/ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD

	Requesting TGT krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD using TGT krbtgt/ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD
	Sending request to ACHILD.ADOM.AFOREST.AD
	Received answer from stream 192.168.101.33:88
	TGS reply is for user1@ACHILD.ADOM.AFOREST.AD -> krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD with session key rc4-hmac/0F60
-->	Storing user1@ACHILD.ADOM.AFOREST.AD -> krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD in FILE:/tmp/krb5cc_2000 <-- NOTE this TGT is stored
	Received TGT for service realm: krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ACHILD.ADOM.AFOREST.AD

	Requesting tickets for SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD, referrals on
	Sending request (1745 bytes) to AGRANDCHILD.ACHILD.ADOM.AFOREST.AD
	Received answer (1675 bytes) from stream 192.168.101.34:88
	TGS reply is for user1@ACHILD.ADOM.AFOREST.AD -> SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD with session key aes256-cts/3576
	Received creds for desired service SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD
	Storing user1@ACHILD.ADOM.AFOREST.AD -> SAMBA$@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD in FILE:/tmp/krb5cc_2000

The result is that winbindd can't refresh the tickets for ADOM\user1
because the local realm is used to build the TGT service name.

	smb_krb5_renew_ticket: Using FILE:/tmp/krb5cc_11105 as ccache for client 'user1@ADOM.AFOREST.AD' and service 'krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@AGRANDCHILD.ACHILD.ADOM.AFOREST.AD'

	Retrieving user1@ADOM.AFOREST.AD -> krbtgt/AGRANDCHILD.ACHILD.ADOM.AFOREST.AD@ADOM.AFOREST.AD from FILE:/tmp/krb5cc_11105 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_11105)

The canonical realm name must be used instead:

	smb_krb5_renew_ticket: Using FILE:/tmp/krb5cc_11105 as ccache for client 'user1@ADOM.AFOREST.AD' and service 'krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD'

	Retrieving user1@ADOM.AFOREST.AD -> krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD from FILE:/tmp/krb5cc_11105 with result: 0/Success
	Get cred via TGT krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD after requesting krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD (canonicalize off)
	Sending request to ADOM.AFOREST.AD
	Received answer from stream 192.168.101.32:88
	TGS reply is for user1@ADOM.AFOREST.AD -> krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD with session key aes256-cts/8C7B
	Storing user1@ADOM.AFOREST.AD -> krbtgt/ADOM.AFOREST.AD@ADOM.AFOREST.AD in FILE:/tmp/krb5cc_11105

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14979

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Jul 12 12:38:55 UTC 2022 on sn-devel-184

(cherry picked from commit 116af0df4f74aa450cbb77c79f8cac4bfc288631)

Autobuild-User(v4-16-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-16-test): Mon Jul 18 09:40:12 UTC 2022 on sn-devel-184
2022-07-18 09:40:12 +00:00
..
idmap_hash
s3:idmap_hash: reliable return ID_TYPE_BOTH
2021-01-22 11:32:46 +00:00
idmap_ad_nss.c
winbindd/idmap: apply const to struct nss_info_methods pointers
2020-10-23 03:25:35 +00:00
idmap_ad.c
winbind: Remove an unused include
2021-08-24 17:32:29 +00:00
idmap_autorid_tdb.c
s3: safe_string: do not include string_wrappers.h
2020-08-28 00:56:34 +00:00
idmap_autorid.c
s3:winbindd: Add a sanity check for the range
2022-02-18 08:05:13 +00:00
idmap_ldap.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
idmap_nss.c
CVE-2020-25727: idmap_nss: verify that the name of the sid belongs to the configured domain
2021-11-15 18:10:28 +00:00
idmap_passdb.c
winbindd/idmap: apply const to struct idmap_methods pointers
2020-10-23 03:25:35 +00:00
idmap_proto.h
winbindd/idmap: apply const to struct idmap_methods pointers
2020-10-23 03:25:35 +00:00
idmap_rfc2307.c
idmap_rfc2307: Do not return SID from unixids_to_sids on type mismatch
2021-03-11 07:28:37 +00:00
idmap_rid.c
winbindd/idmap: apply const to struct idmap_methods pointers
2020-10-23 03:25:35 +00:00
idmap_rw.c
winbindd: allow idmap backends to mark entries with ID_[TYPE_WB_]REQUIRE_TYPE
2020-10-23 03:25:37 +00:00
idmap_rw.h
…
idmap_script.c
idmap_script: Save a few lines with str_list_add_printf()
2021-10-08 19:28:31 +00:00
idmap_tdb2.c
winbindd/idmap: apply const to struct idmap_methods pointers
2020-10-23 03:25:35 +00:00
idmap_tdb_common.c
winbindd: allow idmap backends to mark entries with ID_[TYPE_WB_]REQUIRE_TYPE
2020-10-23 03:25:37 +00:00
idmap_tdb_common.h
…
idmap_tdb.c
winbindd/idmap: apply const to struct idmap_methods pointers
2020-10-23 03:25:35 +00:00
idmap_util.c
idmap_rfc2307: Don't stop after 30 entries
2017-05-08 21:08:23 +02:00
idmap.c
winbindd/idmap: apply const to struct idmap_methods pointers
2020-10-23 03:25:35 +00:00
nss_info_template.c
lib: modules: Change XXX_init interface from XXX_init(void) to XXX_init(TALLOC_CTX *)
2017-04-22 01:17:00 +02:00
nss_info.c
winbindd/idmap: apply const to struct nss_info_methods pointers
2020-10-23 03:25:35 +00:00
wb_dsgetdcname.c
winbind: Fix an error path memleak
2019-02-27 01:35:18 +01:00
wb_getgrsid.c
winbindd: remove 'winbind trusted domains only' handling
2018-01-10 01:01:23 +01:00
wb_getpwsid.c
source3: move lib/substitute.c functions out of proto.h
2021-11-11 13:49:32 +00:00
wb_gettoken.c
Re-enable token groups fallback
2017-03-06 19:18:31 +01:00
wb_group_members.c
winbind: Remove the use of "talloc_dict"
2017-09-30 08:01:24 +02:00
wb_lookupname.c
winbind: Pass upn unmodified to lookup names
2018-05-11 09:07:36 +02:00
wb_lookupsid.c
winbindd: Use dom_sid_str_buf
2018-12-20 23:40:25 +01:00
wb_lookupsids.c
winbind: Use dom_sid_str_buf
2018-11-27 07:13:14 +01:00
wb_lookupuseraliases.c
…
wb_lookupusergroups.c
winbindd: Use dom_sid_str_buf
2018-11-02 21:21:15 +01:00
wb_next_grent.c
winbind: Remove the use of "talloc_dict"
2017-09-30 08:01:24 +02:00
wb_next_pwent.c
winbind: Go throught wb_getpwsid for listing users
2017-01-02 18:04:14 +01:00
wb_query_group_list.c
…
wb_query_user_list.c
winbind: Fix "wbint_Principals" definition
2018-11-27 07:13:14 +01:00
wb_queryuser.c
winbindd: call wb_parent_idmap_setup_send() in wb_queryuser_send()
2021-09-02 14:29:35 +00:00
wb_seqnum.c
…
wb_seqnums.c
winbindd: Use talloc_zero_array for consistency with other winbindd_domain allocators
2018-03-24 07:21:37 +01:00
wb_sids2xids.c
wb_sids2xids: defer/skip wb_lookupsids* unless we get ID_TYPE_WB_REQUIRE_TYPE
2020-10-23 04:47:26 +00:00
wb_xids2sids.c
wb_xids2sids: make use of the new wb_parent_idmap_setup_send/recv() helpers
2020-10-23 03:25:36 +00:00
winbindd_ads.c
s3:winbind: Do not use domain's private data to store the ADS_STRUCT
2022-04-15 13:46:10 +00:00
winbindd_ads.h
winbindd: Give winbindd_ads.c its own header
2017-05-17 01:47:17 +02:00
winbindd_allocate_gid.c
winbindd: Fix a startup race with allocate_gid
2021-03-24 20:31:30 +00:00
winbindd_allocate_uid.c
winbind: ensure wb_parent_idmap_setup_send() gets called in winbindd_allocate_uid_send()
2021-09-02 15:20:06 +00:00
winbindd_async.c
…
winbindd_cache.c
s3:winbind: Code cleanup for initialize_winbindd_cache()
2021-05-12 20:29:32 +00:00
winbindd_ccache_access.c
Fix spelling mistakes
2018-11-30 03:35:13 +01:00
winbindd_change_machine_acct.c
…
winbindd_check_machine_acct.c
…
winbindd_cm.c
s3:rpc_server: Activate samba-dcerpcd
2021-12-10 14:02:30 +00:00
winbindd_cred_cache.c
s3:winbind: Use the canonical realm name to renew the credentials
2022-07-18 09:40:12 +00:00
winbindd_creds.c
Fix gcc11 compiler issue "-Werror=stringop-overflow="
2021-05-07 06:23:32 +00:00
winbindd_domain_info.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
winbindd_domain.c
…
winbindd_dsgetdcname.c
winbind: Align integer types
2020-11-30 22:24:37 +00:00
winbindd_dual_ndr.c
rpc_server3: Inline pipes_struct into dcerpc_ncacn_conn
2022-01-05 00:11:38 +00:00
winbindd_dual_srv.c
rpc_server3: Remove pipes_struct->remote_address
2022-01-05 00:11:37 +00:00
winbindd_dual.c
s3:winbindd: Fix winbindd child logfile name handling
2021-10-12 08:40:34 +00:00
winbindd_endgrent.c
…
winbindd_endpwent.c
…
winbindd_getdcname.c
s3: safe_string: do not include string_wrappers.h
2020-08-28 00:56:34 +00:00
winbindd_getgrent.c
s3:winbind: Log client process name
2018-11-12 09:50:25 +01:00
winbindd_getgrgid.c
winbindd: handling missing idmap in getgrgid()
2020-02-05 17:56:58 +00:00
winbindd_getgrnam.c
s3: safe_string: do not include string_wrappers.h
2020-08-28 00:56:34 +00:00
winbindd_getgroups.c
winbindd: allow idmap backends to mark entries with ID_[TYPE_WB_]REQUIRE_TYPE
2020-10-23 03:25:37 +00:00
winbindd_getpwent.c
s3:winbind: Log client process name
2018-11-12 09:50:25 +01:00
winbindd_getpwnam.c
winbindd: Use dom_sid_str_buf
2018-12-20 23:40:25 +01:00
winbindd_getpwsid.c
winbindd: Use dom_sid_str_buf
2018-12-20 23:40:25 +01:00
winbindd_getpwuid.c
winbindd: Use dom_sid_str_buf
2018-12-20 23:40:25 +01:00
winbindd_getsidaliases.c
winbind: Simplify winbindd_getsidaliases_recv()
2021-10-08 19:28:31 +00:00
winbindd_getuserdomgroups.c
winbindd: Use dom_sid_str_buf
2018-12-07 23:29:01 +01:00
winbindd_getusersids.c
winbind: Simplify winbindd_getusersids_recv()
2021-10-08 19:28:31 +00:00
winbindd_gpupdate.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
winbindd_group.c
s3-winbindd: use fill_domain_username_talloc() in winbind.
2018-05-17 17:30:08 +02:00
winbindd_idmap.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
winbindd_irpc.c
CVE-2020-25717: s3:winbindd: make sure we default to r->out.authoritative = true
2021-11-09 19:45:32 +00:00
winbindd_list_groups.c
winbind: honor WBFLAG_FROM_NSS along with winbind enum users/groups
2018-12-22 03:11:14 +01:00
winbindd_list_users.c
winbind: honor WBFLAG_FROM_NSS along with winbind enum users/groups
2018-12-22 03:11:14 +01:00
winbindd_locator.c
winbind: add locator_child_handle() and use it instead of child->binding_handle
2018-02-23 04:09:18 +01:00
winbindd_lookupname.c
winbind: Use dom_sid_str_buf
2018-12-20 23:40:24 +01:00
winbindd_lookuprids.c
s3: safe_string: do not include string_wrappers.h
2020-08-28 00:56:34 +00:00
winbindd_lookupsid.c
s3: safe_string: do not include string_wrappers.h
2020-08-28 00:56:34 +00:00
winbindd_lookupsids.c
CVE-2020-14323 winbind: Fix invalid lookupsids DoS
2020-10-29 10:25:37 +00:00
winbindd_misc.c
CVE-2020-25717: Add FreeIPA domain controller role
2021-11-09 19:45:33 +00:00
winbindd_msrpc.c
winbindd: remove obsolete sequence_number from struct winbindd_methods
2021-04-29 15:49:16 +00:00
winbindd_ndr.c
s3:winbind: Remove no longer used domain's private_data pointer
2022-04-15 14:45:44 +00:00
winbindd_pam_auth_crap.c
CVE-2020-25717: s3:winbindd: make sure we default to r->out.authoritative = true
2021-11-09 19:45:32 +00:00
winbindd_pam_auth.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
winbindd_pam_chauthtok.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
winbindd_pam_chng_pswd_auth_crap.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
winbindd_pam_logoff.c
lib: give global_contexts.c its own header file
2021-01-08 20:31:33 +00:00
winbindd_pam.c
s3:winbind: Create service principal inside add_ccache_to_list()
2022-07-18 08:47:13 +00:00
winbindd_ping_dc.c
winbindd: Fix winbindd_ping_dc_recv
2018-06-16 01:06:36 +02:00
winbindd_proto.h
s3:winbind: Create service principal inside add_ccache_to_list()
2022-07-18 08:47:13 +00:00
winbindd_reconnect_ads.c
winbindd: remove obsolete sequence_number from struct winbindd_methods
2021-04-29 15:49:16 +00:00
winbindd_reconnect.c
winbindd: remove obsolete sequence_number from struct winbindd_methods
2021-04-29 15:49:16 +00:00
winbindd_rpc.c
s3:winbindd: Remove unused rpc_sequence_number()
2021-04-29 15:01:29 +00:00
winbindd_rpc.h
s3:winbindd: Remove unused rpc_sequence_number()
2021-04-29 15:01:29 +00:00
winbindd_samr.c
s3:winbind: Simplify open_cached_internal_pipe_conn()
2022-04-15 13:46:10 +00:00
winbindd_setgrent.c
winbind: call lp_winbind_enum_{users,groups}() already in set{pw,gr}ent()
2018-02-23 04:09:18 +01:00
winbindd_setpwent.c
winbind: call lp_winbind_enum_{users,groups}() already in set{pw,gr}ent()
2018-02-23 04:09:18 +01:00
winbindd_show_sequence.c
…
winbindd_sids_to_xids.c
winbind: Simplify winbindd_sids_to_xids_recv()
2021-10-08 19:28:32 +00:00
winbindd_util.c
winbindd: Replace asprintf() with talloc_asprintf()
2022-01-18 20:22:38 +00:00
winbindd_wins_byip.c
s3: libsmb: Convert node_status_query() and associated functions and callers to expect a size_t * return.
2020-09-15 10:09:36 +00:00
winbindd_wins_byname.c
s3: libsmb: Convert the WINS and broadcast name functions to return size_t * num addresses.
2020-09-15 10:09:36 +00:00
winbindd_xids_to_sids.c
winbind: Enhance xids2sids debugging
2019-02-08 08:51:19 +01:00
winbindd.c
s3:rpc_server: Activate samba-dcerpcd
2021-12-10 14:02:30 +00:00
winbindd.h
s3:winbind: Remove no longer used domain's private_data pointer
2022-04-15 14:45:44 +00:00
wscript_build
s3:rpc_server: Activate samba-dcerpcd
2021-12-10 14:02:30 +00:00