?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[GLUE] Rsync SAMBA_3_0 SVN r25598 in order to create the v3-0-test branch.
[Samba.git] / source / nsswitch / winbindd_pam.c
blob589f4839e0bfb9c8c58af53d6050c71fe1313f4e
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon - pam auth funcions
5
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program; if not, write to the Free Software
23 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #undef DBGC_CLASS
29 #define DBGC_CLASS DBGC_WINBIND
30
31 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
32 struct winbindd_cli_state *state,
33 NET_USER_INFO_3 *info3)
34 {
35 fstring str_sid;
36
37 state->response.data.auth.info3.logon_time =
38 nt_time_to_unix(info3->logon_time);
39 state->response.data.auth.info3.logoff_time =
40 nt_time_to_unix(info3->logoff_time);
41 state->response.data.auth.info3.kickoff_time =
42 nt_time_to_unix(info3->kickoff_time);
43 state->response.data.auth.info3.pass_last_set_time =
44 nt_time_to_unix(info3->pass_last_set_time);
45 state->response.data.auth.info3.pass_can_change_time =
46 nt_time_to_unix(info3->pass_can_change_time);
47 state->response.data.auth.info3.pass_must_change_time =
48 nt_time_to_unix(info3->pass_must_change_time);
49
50 state->response.data.auth.info3.logon_count = info3->logon_count;
51 state->response.data.auth.info3.bad_pw_count = info3->bad_pw_count;
52
53 state->response.data.auth.info3.user_rid = info3->user_rid;
54 state->response.data.auth.info3.group_rid = info3->group_rid;
55 sid_to_string(str_sid, &(info3->dom_sid.sid));
56 fstrcpy(state->response.data.auth.info3.dom_sid, str_sid);
57
58 state->response.data.auth.info3.num_groups = info3->num_groups;
59 state->response.data.auth.info3.user_flgs = info3->user_flgs;
60
61 state->response.data.auth.info3.acct_flags = info3->acct_flags;
62 state->response.data.auth.info3.num_other_sids = info3->num_other_sids;
63
64 unistr2_to_ascii(state->response.data.auth.info3.user_name,
65 &info3->uni_user_name, -1);
66 unistr2_to_ascii(state->response.data.auth.info3.full_name,
67 &info3->uni_full_name, -1);
68 unistr2_to_ascii(state->response.data.auth.info3.logon_script,
69 &info3->uni_logon_script, -1);
70 unistr2_to_ascii(state->response.data.auth.info3.profile_path,
71 &info3->uni_profile_path, -1);
72 unistr2_to_ascii(state->response.data.auth.info3.home_dir,
73 &info3->uni_home_dir, -1);
74 unistr2_to_ascii(state->response.data.auth.info3.dir_drive,
75 &info3->uni_dir_drive, -1);
76
77 unistr2_to_ascii(state->response.data.auth.info3.logon_srv,
78 &info3->uni_logon_srv, -1);
79 unistr2_to_ascii(state->response.data.auth.info3.logon_dom,
80 &info3->uni_logon_dom, -1);
81
82 return NT_STATUS_OK;
83 }
84
85 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
86 struct winbindd_cli_state *state,
87 NET_USER_INFO_3 *info3)
88 {
89 prs_struct ps;
90 uint32 size;
91 if (!prs_init(&ps, 256 /* Random, non-zero number */, mem_ctx, MARSHALL)) {
92 return NT_STATUS_NO_MEMORY;
93 }
94 if (!net_io_user_info3("", info3, &ps, 1, 3, False)) {
95 prs_mem_free(&ps);
96 return NT_STATUS_UNSUCCESSFUL;
97 }
98
99 size = prs_data_size(&ps);
100 SAFE_FREE(state->response.extra_data.data);
101 state->response.extra_data.data = SMB_MALLOC(size);
102 if (!state->response.extra_data.data) {
103 prs_mem_free(&ps);
104 return NT_STATUS_NO_MEMORY;
105 }
106 memset( state->response.extra_data.data, '\0', size );
107 prs_copy_all_data_out((char *)state->response.extra_data.data, &ps);
108 state->response.length += size;
109 prs_mem_free(&ps);
110 return NT_STATUS_OK;
111 }
112
113 static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
114 NET_USER_INFO_3 *info3,
115 const char *group_sid)
116 /**
117 * Check whether a user belongs to a group or list of groups.
118 *
119 * @param mem_ctx talloc memory context.
120 * @param info3 user information, including group membership info.
121 * @param group_sid One or more groups , separated by commas.
122 *
123 * @return NT_STATUS_OK on success,
124 * NT_STATUS_LOGON_FAILURE if the user does not belong,
125 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
126 */
127 {
128 DOM_SID *require_membership_of_sid;
129 size_t num_require_membership_of_sid;
130 DOM_SID *all_sids;
131 size_t num_all_sids = (2 + info3->num_groups2 + info3->num_other_sids);
132 size_t i, j = 0, k;
133 size_t group_sid_length;
134 const char *search_location;
135 char *single_group_sid;
136 const char *comma;
137
138 /* Parse the 'required group' SID */
139
140 if (!group_sid || !group_sid[0]) {
141 /* NO sid supplied, all users may access */
142 return NT_STATUS_OK;
143 }
144
145 num_require_membership_of_sid = 1;
146 group_sid_length = strlen(group_sid);
147 for (i = 0; i < group_sid_length; i++) {
148 if (',' == group_sid[i]) {
149 num_require_membership_of_sid++;
150 }
151 }
152
153 require_membership_of_sid = TALLOC_ARRAY(mem_ctx, DOM_SID, num_require_membership_of_sid);
154 if (!require_membership_of_sid)
155 return NT_STATUS_NO_MEMORY;
156
157 i = 0;
158 search_location = group_sid;
159
160 if (num_require_membership_of_sid > 1) {
161
162 /* Allocate the maximum possible size */
163 single_group_sid = TALLOC(mem_ctx, group_sid_length);
164 if (!single_group_sid)
165 return NT_STATUS_NO_MEMORY;
166
167 while ( (comma = strstr(search_location, ",")) != NULL ) {
168
169 strncpy(single_group_sid, search_location, comma - search_location);
170 single_group_sid[comma - search_location] = 0;
171
172 if (!string_to_sid(&require_membership_of_sid[i++], single_group_sid)) {
173 DEBUG(0, ("check_info3_in_group: could not parse %s as a SID!",
174 single_group_sid));
175
176 return NT_STATUS_INVALID_PARAMETER;
177 }
178
179 search_location = comma + 1;
180 }
181 }
182
183 if (!string_to_sid(&require_membership_of_sid[i++], search_location)) {
184 DEBUG(0, ("check_info3_in_group: could not parse %s as a SID!",
185 search_location));
186
187 return NT_STATUS_INVALID_PARAMETER;
188 }
189
190 all_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_all_sids);
191 if (!all_sids)
192 return NT_STATUS_NO_MEMORY;
193
194 /* and create (by appending rids) the 'domain' sids */
195
196 sid_copy(&all_sids[0], &(info3->dom_sid.sid));
197
198 if (!sid_append_rid(&all_sids[0], info3->user_rid)) {
199 DEBUG(3,("could not append user's primary RID 0x%x\n",
200 info3->user_rid));
201
202 return NT_STATUS_INVALID_PARAMETER;
203 }
204 j++;
205
206 sid_copy(&all_sids[1], &(info3->dom_sid.sid));
207
208 if (!sid_append_rid(&all_sids[1], info3->group_rid)) {
209 DEBUG(3,("could not append additional group rid 0x%x\n",
210 info3->group_rid));
211
212 return NT_STATUS_INVALID_PARAMETER;
213 }
214 j++;
215
216 for (i = 0; i < info3->num_groups2; i++) {
217
218 sid_copy(&all_sids[j], &(info3->dom_sid.sid));
219
220 if (!sid_append_rid(&all_sids[j], info3->gids[i].g_rid)) {
221 DEBUG(3,("could not append additional group rid 0x%x\n",
222 info3->gids[i].g_rid));
223
224 return NT_STATUS_INVALID_PARAMETER;
225 }
226 j++;
227 }
228
229 /* Copy 'other' sids. We need to do sid filtering here to
230 prevent possible elevation of privileges. See:
231
232 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
233 */
234
235 for (i = 0; i < info3->num_other_sids; i++) {
236 sid_copy(&all_sids[info3->num_groups2 + i + 2],
237 &info3->other_sids[i].sid);
238 j++;
239 }
240
241 for (i = 0; i < j; i++) {
242 fstring sid1, sid2;
243 DEBUG(10, ("User has SID: %s\n",
244 sid_to_string(sid1, &all_sids[i])));
245 for (k = 0; k < num_require_membership_of_sid; k++) {
246 if (sid_equal(&require_membership_of_sid[k], &all_sids[i])) {
247 DEBUG(10, ("SID %s matches %s - user permitted to authenticate!\n",
248 sid_to_string(sid1, &require_membership_of_sid[k]), sid_to_string(sid2, &all_sids[i])));
249 return NT_STATUS_OK;
250 }
251 }
252 }
253
254 /* Do not distinguish this error from a wrong username/pw */
255
256 return NT_STATUS_LOGON_FAILURE;
257 }
258
259 struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
260 const char *domain_name)
261 {
262 struct winbindd_domain *domain;
263
264 if (IS_DC) {
265 domain = find_domain_from_name_noinit(domain_name);
266 if (domain == NULL) {
267 DEBUG(3, ("Authentication for domain [%s] refused"
268 "as it is not a trusted domain\n",
269 domain_name));
270 }
271 return domain;
272 }
273
274 if (is_myname(domain_name)) {
275 DEBUG(3, ("Authentication for domain %s (local domain "
276 "to this server) not supported at this "
277 "stage\n", domain_name));
278 return NULL;
279 }
280
281 /* we can auth against trusted domains */
282 if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
283 domain = find_domain_from_name_noinit(domain_name);
284 if (domain == NULL) {
285 DEBUG(3, ("Authentication for domain [%s] skipped "
286 "as it is not a trusted domain\n",
287 domain_name));
288 } else {
289 return domain;
290 }
291 }
292
293 return find_our_domain();
294 }
295
296 static void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
297 {
298 resp->data.auth.nt_status = NT_STATUS_V(result);
299 fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result));
300
301 /* we might have given a more useful error above */
302 if (*resp->data.auth.error_string == '\0')
303 fstrcpy(resp->data.auth.error_string,
304 get_friendly_nt_error_msg(result));
305 resp->data.auth.pam_error = nt_status_to_pam(result);
306 }
307
308 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
309 struct winbindd_cli_state *state)
310 {
311 struct winbindd_methods *methods;
312 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
313 SAM_UNK_INFO_1 password_policy;
314
315 methods = domain->methods;
316
317 status = methods->password_policy(domain, state->mem_ctx, &password_policy);
318 if (NT_STATUS_IS_ERR(status)) {
319 return status;
320 }
321
322 state->response.data.auth.policy.min_length_password =
323 password_policy.min_length_password;
324 state->response.data.auth.policy.password_history =
325 password_policy.password_history;
326 state->response.data.auth.policy.password_properties =
327 password_policy.password_properties;
328 state->response.data.auth.policy.expire =
329 nt_time_to_unix_abs(&(password_policy.expire));
330 state->response.data.auth.policy.min_passwordage =
331 nt_time_to_unix_abs(&(password_policy.min_passwordage));
332
333 return NT_STATUS_OK;
334 }
335
336 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
337 TALLOC_CTX *mem_ctx,
338 uint16 *max_allowed_bad_attempts)
339 {
340 struct winbindd_methods *methods;
341 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
342 SAM_UNK_INFO_12 lockout_policy;
343
344 *max_allowed_bad_attempts = 0;
345
346 methods = domain->methods;
347
348 status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
349 if (NT_STATUS_IS_ERR(status)) {
350 return status;
351 }
352
353 *max_allowed_bad_attempts = lockout_policy.bad_attempt_lockout;
354
355 return NT_STATUS_OK;
356 }
357
358 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
359 TALLOC_CTX *mem_ctx,
360 uint32 *password_properties)
361 {
362 struct winbindd_methods *methods;
363 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
364 SAM_UNK_INFO_1 password_policy;
365
366 *password_properties = 0;
367
368 methods = domain->methods;
369
370 status = methods->password_policy(domain, mem_ctx, &password_policy);
371 if (NT_STATUS_IS_ERR(status)) {
372 return status;
373 }
374
375 *password_properties = password_policy.password_properties;
376
377 return NT_STATUS_OK;
378 }
379
380 #ifdef HAVE_KRB5
381
382 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
383 const char *type,
384 uid_t uid,
385 BOOL *internal_ccache)
386 {
387 /* accept FILE and WRFILE as krb5_cc_type from the client and then
388 * build the full ccname string based on the user's uid here -
389 * Guenther*/
390
391 const char *gen_cc = NULL;
392
393 *internal_ccache = True;
394
395 if (uid == -1) {
396 goto memory_ccache;
397 }
398
399 if (!type || type[0] == '\0') {
400 goto memory_ccache;
401 }
402
403 if (strequal(type, "FILE")) {
404 gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
405 } else if (strequal(type, "WRFILE")) {
406 gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
407 } else {
408 DEBUG(10,("we don't allow to set a %s type ccache\n", type));
409 goto memory_ccache;
410 }
411
412 *internal_ccache = False;
413 goto done;
414
415 memory_ccache:
416 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
417
418 done:
419 if (gen_cc == NULL) {
420 DEBUG(0,("out of memory\n"));
421 return NULL;
422 }
423
424 DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
425
426 return gen_cc;
427 }
428
429 static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
430 {
431 const char *type = state->request.data.auth.krb5_cc_type;
432
433 state->response.data.auth.krb5ccname[0] = '\0';
434
435 if (type[0] == '\0') {
436 return;
437 }
438
439 if (!strequal(type, "FILE") &&
440 !strequal(type, "WRFILE")) {
441 DEBUG(10,("won't return krbccname for a %s type ccache\n",
442 type));
443 return;
444 }
445
446 fstrcpy(state->response.data.auth.krb5ccname, cc);
447 }
448
449 #endif
450
451 static uid_t get_uid_from_state(struct winbindd_cli_state *state)
452 {
453 uid_t uid = -1;
454
455 uid = state->request.data.auth.uid;
456
457 if (uid < 0) {
458 DEBUG(1,("invalid uid: '%d'\n", uid));
459 return -1;
460 }
461 return uid;
462 }
463
464 /**********************************************************************
465 Authenticate a user with a clear text password using Kerberos and fill up
466 ccache if required
467 **********************************************************************/
468
469 static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
470 struct winbindd_cli_state *state,
471 NET_USER_INFO_3 **info3)
472 {
473 #ifdef HAVE_KRB5
474 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
475 krb5_error_code krb5_ret;
476 DATA_BLOB tkt, session_key_krb5;
477 DATA_BLOB ap_rep, session_key;
478 PAC_DATA *pac_data = NULL;
479 PAC_LOGON_INFO *logon_info = NULL;
480 char *client_princ = NULL;
481 char *client_princ_out = NULL;
482 char *local_service = NULL;
483 const char *cc = NULL;
484 const char *principal_s = NULL;
485 const char *service = NULL;
486 char *realm = NULL;
487 fstring name_domain, name_user;
488 time_t ticket_lifetime = 0;
489 time_t renewal_until = 0;
490 uid_t uid = -1;
491 ADS_STRUCT *ads;
492 time_t time_offset = 0;
493 BOOL internal_ccache = True;
494
495 ZERO_STRUCT(session_key);
496 ZERO_STRUCT(session_key_krb5);
497 ZERO_STRUCT(tkt);
498 ZERO_STRUCT(ap_rep);
499
500 ZERO_STRUCTP(info3);
501
502 *info3 = NULL;
503
504 /* 1st step:
505 * prepare a krb5_cc_cache string for the user */
506
507 uid = get_uid_from_state(state);
508 if (uid == -1) {
509 DEBUG(0,("no valid uid\n"));
510 }
511
512 cc = generate_krb5_ccache(state->mem_ctx,
513 state->request.data.auth.krb5_cc_type,
514 state->request.data.auth.uid,
515 &internal_ccache);
516 if (cc == NULL) {
517 return NT_STATUS_NO_MEMORY;
518 }
519
520
521 /* 2nd step:
522 * get kerberos properties */
523
524 if (domain->private_data) {
525 ads = (ADS_STRUCT *)domain->private_data;
526 time_offset = ads->auth.time_offset;
527 }
528
529
530 /* 3rd step:
531 * do kerberos auth and setup ccache as the user */
532
533 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
534
535 realm = domain->alt_name;
536 strupper_m(realm);
537
538 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
539 if (principal_s == NULL) {
540 return NT_STATUS_NO_MEMORY;
541 }
542
543 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
544 if (service == NULL) {
545 return NT_STATUS_NO_MEMORY;
546 }
547
548 /* if this is a user ccache, we need to act as the user to let the krb5
549 * library handle the chown, etc. */
550
551 /************************ NON-ROOT **********************/
552
553 if (!internal_ccache) {
554
555 set_effective_uid(uid);
556 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
557 }
558
559 krb5_ret = kerberos_kinit_password_ext(principal_s,
560 state->request.data.auth.pass,
561 time_offset,
562 &ticket_lifetime,
563 &renewal_until,
564 cc,
565 True,
566 True,
567 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
568
569 if (krb5_ret) {
570 DEBUG(1,("winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d)\n",
571 principal_s, error_message(krb5_ret), krb5_ret));
572 result = krb5_to_nt_status(krb5_ret);
573 goto failed;
574 }
575
576 /* does http_timestring use heimdals libroken strftime?? - Guenther */
577 DEBUG(10,("got TGT for %s in %s (valid until: %s (%d), renewable till: %s (%d))\n",
578 principal_s, cc,
579 http_timestring(ticket_lifetime), (int)ticket_lifetime,
580 http_timestring(renewal_until), (int)renewal_until));
581
582 /* we cannot continue with krb5 when UF_DONT_REQUIRE_PREAUTH is set,
583 * in that case fallback to NTLM - gd */
584
585 if ((ticket_lifetime == 0) && (renewal_until == 0)) {
586 result = NT_STATUS_INVALID_LOGON_TYPE;
587 goto failed;
588 }
589
590 client_princ = talloc_strdup(state->mem_ctx, global_myname());
591 if (client_princ == NULL) {
592 result = NT_STATUS_NO_MEMORY;
593 goto failed;
594 }
595 strlower_m(client_princ);
596
597 local_service = talloc_asprintf(state->mem_ctx, "%s$@%s", client_princ, lp_realm());
598 if (local_service == NULL) {
599 DEBUG(0,("winbindd_raw_kerberos_login: out of memory\n"));
600 result = NT_STATUS_NO_MEMORY;
601 goto failed;
602 }
603
604 krb5_ret = cli_krb5_get_ticket(local_service,
605 time_offset,
606 &tkt,
607 &session_key_krb5,
608 0,
609 cc,
610 NULL);
611 if (krb5_ret) {
612 DEBUG(1,("winbindd_raw_kerberos_login: failed to get ticket for %s: %s\n",
613 local_service, error_message(krb5_ret)));
614 result = krb5_to_nt_status(krb5_ret);
615 goto failed;
616 }
617
618 if (!internal_ccache) {
619 gain_root_privilege();
620 }
621
622 /************************ NON-ROOT **********************/
623
624 result = ads_verify_ticket(state->mem_ctx,
625 lp_realm(),
626 time_offset,
627 &tkt,
628 &client_princ_out,
629 &pac_data,
630 &ap_rep,
631 &session_key);
632 if (!NT_STATUS_IS_OK(result)) {
633 DEBUG(0,("winbindd_raw_kerberos_login: ads_verify_ticket failed: %s\n",
634 nt_errstr(result)));
635 goto failed;
636 }
637
638 if (!pac_data) {
639 DEBUG(3,("winbindd_raw_kerberos_login: no pac data\n"));
640 result = NT_STATUS_INVALID_PARAMETER;
641 goto failed;
642 }
643
644 logon_info = get_logon_info_from_pac(pac_data);
645 if (logon_info == NULL) {
646 DEBUG(1,("winbindd_raw_kerberos_login: no logon info\n"));
647 result = NT_STATUS_INVALID_PARAMETER;
648 goto failed;
649 }
650
651 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
652 local_service));
653
654
655 /* last step:
656 * put results together */
657
658 *info3 = &logon_info->info3;
659
660 /* if we had a user's ccache then return that string for the pam
661 * environment */
662
663 if (!internal_ccache) {
664
665 setup_return_cc_name(state, cc);
666
667 result = add_ccache_to_list(principal_s,
668 cc,
669 service,
670 state->request.data.auth.user,
671 realm,
672 uid,
673 time(NULL),
674 ticket_lifetime,
675 renewal_until,
676 False);
677
678 if (!NT_STATUS_IS_OK(result)) {
679 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
680 nt_errstr(result)));
681 }
682 } else {
683
684 /* need to delete the memory cred cache, it is not used anymore */
685
686 krb5_ret = ads_kdestroy(cc);
687 if (krb5_ret) {
688 DEBUG(3,("winbindd_raw_kerberos_login: "
689 "could not destroy krb5 credential cache: "
690 "%s\n", error_message(krb5_ret)));
691 }
692
693 }
694
695 result = NT_STATUS_OK;
696
697 goto done;
698
699 failed:
700
701 /* we could have created a new credential cache with a valid tgt in it
702 * but we werent able to get or verify the service ticket for this
703 * local host and therefor didn't get the PAC, we need to remove that
704 * cache entirely now */
705
706 krb5_ret = ads_kdestroy(cc);
707 if (krb5_ret) {
708 DEBUG(3,("winbindd_raw_kerberos_login: "
709 "could not destroy krb5 credential cache: "
710 "%s\n", error_message(krb5_ret)));
711 }
712
713 if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
714 DEBUG(3,("winbindd_raw_kerberos_login: "
715 "could not remove ccache for user %s\n",
716 state->request.data.auth.user));
717 }
718
719 done:
720 data_blob_free(&session_key);
721 data_blob_free(&session_key_krb5);
722 data_blob_free(&ap_rep);
723 data_blob_free(&tkt);
724
725 SAFE_FREE(client_princ_out);
726
727 if (!internal_ccache) {
728 gain_root_privilege();
729 }
730
731 return result;
732 #else
733 return NT_STATUS_NOT_SUPPORTED;
734 #endif /* HAVE_KRB5 */
735 }
736
737 void winbindd_pam_auth(struct winbindd_cli_state *state)
738 {
739 struct winbindd_domain *domain;
740 fstring name_domain, name_user;
741
742 /* Ensure null termination */
743 state->request.data.auth.user
744 [sizeof(state->request.data.auth.user)-1]='\0';
745
746 /* Ensure null termination */
747 state->request.data.auth.pass
748 [sizeof(state->request.data.auth.pass)-1]='\0';
749
750 DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
751 state->request.data.auth.user));
752
753 /* Parse domain and username */
754
755 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
756
757 if (!canonicalize_username(state->request.data.auth.user,
758 name_domain, name_user)) {
759 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
760 DEBUG(5, ("Plain text authentication for %s returned %s "
761 "(PAM: %d)\n",
762 state->request.data.auth.user,
763 state->response.data.auth.nt_status_string,
764 state->response.data.auth.pam_error));
765 request_error(state);
766 return;
767 }
768
769 domain = find_auth_domain(state, name_domain);
770
771 if (domain == NULL) {
772 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
773 DEBUG(5, ("Plain text authentication for %s returned %s "
774 "(PAM: %d)\n",
775 state->request.data.auth.user,
776 state->response.data.auth.nt_status_string,
777 state->response.data.auth.pam_error));
778 request_error(state);
779 return;
780 }
781
782 sendto_domain(state, domain);
783 }
784
785 NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
786 struct winbindd_cli_state *state,
787 NET_USER_INFO_3 **info3)
788 {
789 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
790 uint16 max_allowed_bad_attempts;
791 fstring name_domain, name_user;
792 DOM_SID sid;
793 enum lsa_SidType type;
794 uchar new_nt_pass[NT_HASH_LEN];
795 const uint8 *cached_nt_pass;
796 const uint8 *cached_salt;
797 NET_USER_INFO_3 *my_info3;
798 time_t kickoff_time, must_change_time;
799 BOOL password_good = False;
800
801 *info3 = NULL;
802
803 ZERO_STRUCTP(info3);
804
805 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
806
807 /* Parse domain and username */
808
809 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
810
811
812 if (!lookup_cached_name(state->mem_ctx,
813 name_domain,
814 name_user,
815 &sid,
816 &type)) {
817 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
818 return NT_STATUS_NO_SUCH_USER;
819 }
820
821 if (type != SID_NAME_USER) {
822 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
823 return NT_STATUS_LOGON_FAILURE;
824 }
825
826 result = winbindd_get_creds(domain,
827 state->mem_ctx,
828 &sid,
829 &my_info3,
830 &cached_nt_pass,
831 &cached_salt);
832 if (!NT_STATUS_IS_OK(result)) {
833 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
834 return result;
835 }
836
837 *info3 = my_info3;
838
839 E_md4hash(state->request.data.auth.pass, new_nt_pass);
840
841 #if DEBUG_PASSWORD
842 dump_data(100, (const char *)new_nt_pass, NT_HASH_LEN);
843 dump_data(100, (const char *)cached_nt_pass, NT_HASH_LEN);
844 if (cached_salt) {
845 dump_data(100, (const char *)cached_salt, NT_HASH_LEN);
846 }
847 #endif
848
849 if (cached_salt) {
850 /* In this case we didn't store the nt_hash itself,
851 but the MD5 combination of salt + nt_hash. */
852 uchar salted_hash[NT_HASH_LEN];
853 E_md5hash(cached_salt, new_nt_pass, salted_hash);
854
855 password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
856 True : False;
857 } else {
858 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
859 password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
860 True : False;
861 }
862
863 if (password_good) {
864
865 /* User *DOES* know the password, update logon_time and reset
866 * bad_pw_count */
867
868 my_info3->user_flgs |= LOGON_CACHED_ACCOUNT;
869
870 if (my_info3->acct_flags & ACB_AUTOLOCK) {
871 return NT_STATUS_ACCOUNT_LOCKED_OUT;
872 }
873
874 if (my_info3->acct_flags & ACB_DISABLED) {
875 return NT_STATUS_ACCOUNT_DISABLED;
876 }
877
878 if (my_info3->acct_flags & ACB_WSTRUST) {
879 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
880 }
881
882 if (my_info3->acct_flags & ACB_SVRTRUST) {
883 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
884 }
885
886 if (my_info3->acct_flags & ACB_DOMTRUST) {
887 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
888 }
889
890 if (!(my_info3->acct_flags & ACB_NORMAL)) {
891 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
892 my_info3->acct_flags));
893 return NT_STATUS_LOGON_FAILURE;
894 }
895
896 kickoff_time = nt_time_to_unix(my_info3->kickoff_time);
897 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
898 return NT_STATUS_ACCOUNT_EXPIRED;
899 }
900
901 must_change_time = nt_time_to_unix(my_info3->pass_must_change_time);
902 if (must_change_time != 0 && must_change_time < time(NULL)) {
903 /* we allow grace logons when the password has expired */
904 my_info3->user_flgs |= LOGON_GRACE_LOGON;
905 /* return NT_STATUS_PASSWORD_EXPIRED; */
906 goto success;
907 }
908
909 #ifdef HAVE_KRB5
910 /* FIXME: what else points out that the remote domain is AD ? */
911 if (!strequal(domain->name, domain->alt_name) &&
912 (state->request.flags & WBFLAG_PAM_KRB5)) {
913
914 uid_t uid = -1;
915 const char *cc = NULL;
916 char *realm = NULL;
917 const char *principal_s = NULL;
918 const char *service = NULL;
919 BOOL internal_ccache = False;
920
921 uid = get_uid_from_state(state);
922 if (uid == -1) {
923 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
924 return NT_STATUS_INVALID_PARAMETER;
925 }
926
927 cc = generate_krb5_ccache(state->mem_ctx,
928 state->request.data.auth.krb5_cc_type,
929 state->request.data.auth.uid,
930 &internal_ccache);
931 if (cc == NULL) {
932 return NT_STATUS_NO_MEMORY;
933 }
934
935 realm = domain->alt_name;
936 strupper_m(realm);
937
938 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
939 if (principal_s == NULL) {
940 return NT_STATUS_NO_MEMORY;
941 }
942
943 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
944 if (service == NULL) {
945 return NT_STATUS_NO_MEMORY;
946 }
947
948 if (!internal_ccache) {
949
950 setup_return_cc_name(state, cc);
951
952 result = add_ccache_to_list(principal_s,
953 cc,
954 service,
955 state->request.data.auth.user,
956 domain->alt_name,
957 uid,
958 time(NULL),
959 time(NULL) + lp_winbind_cache_time(),
960 time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
961 True);
962
963 if (!NT_STATUS_IS_OK(result)) {
964 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
965 "to add ccache to list: %s\n",
966 nt_errstr(result)));
967 }
968 }
969 }
970 #endif /* HAVE_KRB5 */
971 success:
972 /* FIXME: we possibly should handle logon hours as well (does xp when
973 * offline?) see auth/auth_sam.c:sam_account_ok for details */
974
975 unix_to_nt_time(&my_info3->logon_time, time(NULL));
976 my_info3->bad_pw_count = 0;
977
978 result = winbindd_update_creds_by_info3(domain,
979 state->mem_ctx,
980 state->request.data.auth.user,
981 state->request.data.auth.pass,
982 my_info3);
983 if (!NT_STATUS_IS_OK(result)) {
984 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
985 nt_errstr(result)));
986 return result;
987 }
988
989 return NT_STATUS_OK;
990
991 }
992
993 /* User does *NOT* know the correct password, modify info3 accordingly */
994
995 /* failure of this is not critical */
996 result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
997 if (!NT_STATUS_IS_OK(result)) {
998 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
999 "Won't be able to honour account lockout policies\n"));
1000 }
1001
1002 /* increase counter */
1003 my_info3->bad_pw_count++;
1004
1005 if (max_allowed_bad_attempts == 0) {
1006 goto failed;
1007 }
1008
1009 /* lockout user */
1010 if (my_info3->bad_pw_count >= max_allowed_bad_attempts) {
1011
1012 uint32 password_properties;
1013
1014 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1015 if (!NT_STATUS_IS_OK(result)) {
1016 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1017 }
1018
1019 if ((my_info3->user_rid != DOMAIN_USER_RID_ADMIN) ||
1020 (password_properties & DOMAIN_LOCKOUT_ADMINS)) {
1021 my_info3->acct_flags |= ACB_AUTOLOCK;
1022 }
1023 }
1024
1025 failed:
1026 result = winbindd_update_creds_by_info3(domain,
1027 state->mem_ctx,
1028 state->request.data.auth.user,
1029 NULL,
1030 my_info3);
1031
1032 if (!NT_STATUS_IS_OK(result)) {
1033 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1034 nt_errstr(result)));
1035 }
1036
1037 return NT_STATUS_LOGON_FAILURE;
1038 }
1039
1040 NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1041 struct winbindd_cli_state *state,
1042 NET_USER_INFO_3 **info3)
1043 {
1044 struct winbindd_domain *contact_domain;
1045 fstring name_domain, name_user;
1046 NTSTATUS result;
1047
1048 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1049
1050 /* Parse domain and username */
1051
1052 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1053
1054 /* what domain should we contact? */
1055
1056 if ( IS_DC ) {
1057 if (!(contact_domain = find_domain_from_name(name_domain))) {
1058 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1059 state->request.data.auth.user, name_domain, name_user, name_domain));
1060 result = NT_STATUS_NO_SUCH_USER;
1061 goto done;
1062 }
1063
1064 } else {
1065 if (is_myname(name_domain)) {
1066 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1067 result = NT_STATUS_NO_SUCH_USER;
1068 goto done;
1069 }
1070
1071 contact_domain = find_domain_from_name(name_domain);
1072 if (contact_domain == NULL) {
1073 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1074 state->request.data.auth.user, name_domain, name_user, name_domain));
1075
1076 contact_domain = find_our_domain();
1077 }
1078 }
1079
1080 if (contact_domain->initialized &&
1081 contact_domain->active_directory) {
1082 goto try_login;
1083 }
1084
1085 if (!contact_domain->initialized) {
1086 init_dc_connection(contact_domain);
1087 }
1088
1089 if (!contact_domain->active_directory) {
1090 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1091 return NT_STATUS_INVALID_LOGON_TYPE;
1092 }
1093 try_login:
1094 result = winbindd_raw_kerberos_login(contact_domain, state, info3);
1095 done:
1096 return result;
1097 }
1098
1099 NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
1100 struct winbindd_cli_state *state,
1101 NET_USER_INFO_3 **info3)
1102 {
1103
1104 struct rpc_pipe_client *netlogon_pipe;
1105 uchar chal[8];
1106 DATA_BLOB lm_resp;
1107 DATA_BLOB nt_resp;
1108 int attempts = 0;
1109 unsigned char local_lm_response[24];
1110 unsigned char local_nt_response[24];
1111 struct winbindd_domain *contact_domain;
1112 fstring name_domain, name_user;
1113 BOOL retry;
1114 NTSTATUS result;
1115 NET_USER_INFO_3 *my_info3;
1116
1117 ZERO_STRUCTP(info3);
1118
1119 *info3 = NULL;
1120
1121 my_info3 = TALLOC_ZERO_P(state->mem_ctx, NET_USER_INFO_3);
1122 if (my_info3 == NULL) {
1123 return NT_STATUS_NO_MEMORY;
1124 }
1125
1126
1127 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1128
1129 /* Parse domain and username */
1130
1131 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1132
1133 /* do password magic */
1134
1135
1136 generate_random_buffer(chal, 8);
1137 if (lp_client_ntlmv2_auth()) {
1138 DATA_BLOB server_chal;
1139 DATA_BLOB names_blob;
1140 DATA_BLOB nt_response;
1141 DATA_BLOB lm_response;
1142 server_chal = data_blob_talloc(state->mem_ctx, chal, 8);
1143
1144 /* note that the 'workgroup' here is a best guess - we don't know
1145 the server's domain at this point. The 'server name' is also
1146 dodgy...
1147 */
1148 names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1149
1150 if (!SMBNTLMv2encrypt(name_user, name_domain,
1151 state->request.data.auth.pass,
1152 &server_chal,
1153 &names_blob,
1154 &lm_response, &nt_response, NULL)) {
1155 data_blob_free(&names_blob);
1156 data_blob_free(&server_chal);
1157 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1158 result = NT_STATUS_NO_MEMORY;
1159 goto done;
1160 }
1161 data_blob_free(&names_blob);
1162 data_blob_free(&server_chal);
1163 lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data,
1164 lm_response.length);
1165 nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data,
1166 nt_response.length);
1167 data_blob_free(&lm_response);
1168 data_blob_free(&nt_response);
1169
1170 } else {
1171 if (lp_client_lanman_auth()
1172 && SMBencrypt(state->request.data.auth.pass,
1173 chal,
1174 local_lm_response)) {
1175 lm_resp = data_blob_talloc(state->mem_ctx,
1176 local_lm_response,
1177 sizeof(local_lm_response));
1178 } else {
1179 lm_resp = data_blob(NULL, 0);
1180 }
1181 SMBNTencrypt(state->request.data.auth.pass,
1182 chal,
1183 local_nt_response);
1184
1185 nt_resp = data_blob_talloc(state->mem_ctx,
1186 local_nt_response,
1187 sizeof(local_nt_response));
1188 }
1189
1190 /* what domain should we contact? */
1191
1192 if ( IS_DC ) {
1193 if (!(contact_domain = find_domain_from_name(name_domain))) {
1194 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1195 state->request.data.auth.user, name_domain, name_user, name_domain));
1196 result = NT_STATUS_NO_SUCH_USER;
1197 goto done;
1198 }
1199
1200 } else {
1201 if (is_myname(name_domain)) {
1202 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1203 result = NT_STATUS_NO_SUCH_USER;
1204 goto done;
1205 }
1206
1207 contact_domain = find_our_domain();
1208 }
1209
1210 /* check authentication loop */
1211
1212 do {
1213
1214 ZERO_STRUCTP(my_info3);
1215 retry = False;
1216
1217 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1218
1219 if (!NT_STATUS_IS_OK(result)) {
1220 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1221 goto done;
1222 }
1223
1224 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1225 state->mem_ctx,
1226 0,
1227 contact_domain->dcname, /* server name */
1228 name_user, /* user name */
1229 name_domain, /* target domain */
1230 global_myname(), /* workstation */
1231 chal,
1232 lm_resp,
1233 nt_resp,
1234 my_info3);
1235 attempts += 1;
1236
1237 /* We have to try a second time as cm_connect_netlogon
1238 might not yet have noticed that the DC has killed
1239 our connection. */
1240
1241 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1242 retry = True;
1243 continue;
1244 }
1245
1246 /* if we get access denied, a possible cause was that we had
1247 and open connection to the DC, but someone changed our
1248 machine account password out from underneath us using 'net
1249 rpc changetrustpw' */
1250
1251 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1252 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1253 "ACCESS_DENIED. Maybe the trust account "
1254 "password was changed and we didn't know it. "
1255 "Killing connections to domain %s\n",
1256 name_domain));
1257 invalidate_cm_connection(&contact_domain->conn);
1258 retry = True;
1259 }
1260
1261 } while ( (attempts < 2) && retry );
1262
1263 /* handle the case where a NT4 DC does not fill in the acct_flags in
1264 * the samlogon reply info3. When accurate info3 is required by the
1265 * caller, we look up the account flags ourselve - gd */
1266
1267 if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
1268 (my_info3->acct_flags == 0) && NT_STATUS_IS_OK(result)) {
1269
1270 struct rpc_pipe_client *samr_pipe;
1271 POLICY_HND samr_domain_handle, user_pol;
1272 SAM_USERINFO_CTR *user_ctr;
1273 NTSTATUS status_tmp;
1274 uint32 acct_flags;
1275
1276 ZERO_STRUCT(user_ctr);
1277
1278 status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
1279 &samr_pipe, &samr_domain_handle);
1280
1281 if (!NT_STATUS_IS_OK(status_tmp)) {
1282 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1283 nt_errstr(status_tmp)));
1284 goto done;
1285 }
1286
1287 status_tmp = rpccli_samr_open_user(samr_pipe, state->mem_ctx,
1288 &samr_domain_handle,
1289 MAXIMUM_ALLOWED_ACCESS,
1290 my_info3->user_rid, &user_pol);
1291
1292 if (!NT_STATUS_IS_OK(status_tmp)) {
1293 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1294 nt_errstr(status_tmp)));
1295 goto done;
1296 }
1297
1298 status_tmp = rpccli_samr_query_userinfo(samr_pipe, state->mem_ctx,
1299 &user_pol, 16, &user_ctr);
1300
1301 if (!NT_STATUS_IS_OK(status_tmp)) {
1302 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1303 nt_errstr(status_tmp)));
1304 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1305 goto done;
1306 }
1307
1308 acct_flags = user_ctr->info.id16->acb_info;
1309
1310 if (acct_flags == 0) {
1311 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1312 goto done;
1313 }
1314
1315 my_info3->acct_flags = acct_flags;
1316
1317 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1318
1319 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1320 }
1321
1322 *info3 = my_info3;
1323 done:
1324 return result;
1325 }
1326
1327 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1328 struct winbindd_cli_state *state)
1329 {
1330 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1331 fstring name_domain, name_user;
1332 NET_USER_INFO_3 *info3 = NULL;
1333
1334 /* Ensure null termination */
1335 state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
1336
1337 /* Ensure null termination */
1338 state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
1339
1340 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1341 state->request.data.auth.user));
1342
1343 /* Parse domain and username */
1344
1345 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1346
1347 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1348
1349 if (domain->online == False) {
1350 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1351 if (domain->startup) {
1352 /* Logons are very important to users. If we're offline and
1353 we get a request within the first 30 seconds of startup,
1354 try very hard to find a DC and go online. */
1355
1356 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1357 "request in startup mode.\n", domain->name ));
1358
1359 winbindd_flush_negative_conn_cache(domain);
1360 result = init_dc_connection(domain);
1361 }
1362 }
1363
1364 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1365
1366 /* Check for Kerberos authentication */
1367 if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
1368
1369 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1370
1371 if (NT_STATUS_IS_OK(result)) {
1372 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1373 goto process_result;
1374 } else {
1375 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1376 }
1377
1378 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1379 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1380 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1381 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1382 domain->online = False;
1383 }
1384
1385 /* there are quite some NT_STATUS errors where there is no
1386 * point in retrying with a samlogon, we explictly have to take
1387 * care not to increase the bad logon counter on the DC */
1388
1389 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1390 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1391 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1392 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1393 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1394 NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1395 NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1396 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1397 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1398 NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1399 goto process_result;
1400 }
1401
1402 if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1403 DEBUG(3,("falling back to samlogon\n"));
1404 goto sam_logon;
1405 } else {
1406 goto cached_logon;
1407 }
1408 }
1409
1410 sam_logon:
1411 /* Check for Samlogon authentication */
1412 if (domain->online) {
1413 result = winbindd_dual_pam_auth_samlogon(domain, state, &info3);
1414
1415 if (NT_STATUS_IS_OK(result)) {
1416 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1417 goto process_result;
1418 } else {
1419 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n", nt_errstr(result)));
1420 if (domain->online) {
1421 /* We're still online - fail. */
1422 goto done;
1423 }
1424 /* Else drop through and see if we can check offline.... */
1425 }
1426 }
1427
1428 cached_logon:
1429 /* Check for Cached logons */
1430 if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
1431 lp_winbind_offline_logon()) {
1432
1433 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1434
1435 if (NT_STATUS_IS_OK(result)) {
1436 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1437 goto process_result;
1438 } else {
1439 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1440 goto done;
1441 }
1442 }
1443
1444 process_result:
1445
1446 if (NT_STATUS_IS_OK(result)) {
1447
1448 DOM_SID user_sid;
1449
1450 /* In all codepaths where result == NT_STATUS_OK info3 must have
1451 been initialized. */
1452 if (!info3) {
1453 result = NT_STATUS_INTERNAL_ERROR;
1454 goto done;
1455 }
1456
1457 netsamlogon_cache_store(name_user, info3);
1458 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1459
1460 /* save name_to_sid info as early as possible */
1461 sid_compose(&user_sid, &info3->dom_sid.sid, info3->user_rid);
1462 cache_name2sid(domain, name_domain, name_user, SID_NAME_USER, &user_sid);
1463
1464 /* Check if the user is in the right group */
1465
1466 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1467 state->request.data.auth.require_membership_of_sid))) {
1468 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1469 state->request.data.auth.user,
1470 state->request.data.auth.require_membership_of_sid));
1471 goto done;
1472 }
1473
1474 if (state->request.flags & WBFLAG_PAM_INFO3_NDR) {
1475 result = append_info3_as_ndr(state->mem_ctx, state, info3);
1476 if (!NT_STATUS_IS_OK(result)) {
1477 DEBUG(10,("Failed to append INFO3 (NDR): %s\n", nt_errstr(result)));
1478 goto done;
1479 }
1480 }
1481
1482 if (state->request.flags & WBFLAG_PAM_INFO3_TEXT) {
1483 result = append_info3_as_txt(state->mem_ctx, state, info3);
1484 if (!NT_STATUS_IS_OK(result)) {
1485 DEBUG(10,("Failed to append INFO3 (TXT): %s\n", nt_errstr(result)));
1486 goto done;
1487 }
1488
1489 }
1490
1491 if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
1492
1493 /* Store in-memory creds for single-signon using ntlm_auth. */
1494 result = winbindd_add_memory_creds(state->request.data.auth.user,
1495 get_uid_from_state(state),
1496 state->request.data.auth.pass);
1497
1498 if (!NT_STATUS_IS_OK(result)) {
1499 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
1500 goto done;
1501 }
1502
1503 if (lp_winbind_offline_logon()) {
1504 result = winbindd_store_creds(domain,
1505 state->mem_ctx,
1506 state->request.data.auth.user,
1507 state->request.data.auth.pass,
1508 info3, NULL);
1509 if (!NT_STATUS_IS_OK(result)) {
1510
1511 /* Release refcount. */
1512 winbindd_delete_memory_creds(state->request.data.auth.user);
1513
1514 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
1515 goto done;
1516 }
1517 }
1518 }
1519
1520 result = fillup_password_policy(domain, state);
1521
1522 if (!NT_STATUS_IS_OK(result)) {
1523 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
1524 goto done;
1525 }
1526
1527 if (state->request.flags & WBFLAG_PAM_UNIX_NAME) {
1528 /* We've been asked to return the unix username, per
1529 'winbind use default domain' settings and the like */
1530
1531 fstring username_out;
1532 const char *nt_username, *nt_domain;
1533
1534 if (!(nt_username = unistr2_tdup(state->mem_ctx, &info3->uni_user_name))) {
1535 /* If the server didn't give us one, just use the one we sent them */
1536 nt_username = name_user;
1537 }
1538
1539 if (!(nt_domain = unistr2_tdup(state->mem_ctx, &info3->uni_logon_dom))) {
1540 /* If the server didn't give us one, just use the one we sent them */
1541 nt_domain = name_domain;
1542 }
1543
1544 fill_domain_username(username_out, nt_domain, nt_username, True);
1545
1546 DEBUG(5, ("Setting unix username to [%s]\n", username_out));
1547
1548 SAFE_FREE(state->response.extra_data.data);
1549 state->response.extra_data.data = SMB_STRDUP(username_out);
1550 if (!state->response.extra_data.data) {
1551 result = NT_STATUS_NO_MEMORY;
1552 goto done;
1553 }
1554 state->response.length +=
1555 strlen((const char *)state->response.extra_data.data)+1;
1556 }
1557 }
1558
1559
1560 done:
1561 /* give us a more useful (more correct?) error code */
1562 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1563 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1564 result = NT_STATUS_NO_LOGON_SERVERS;
1565 }
1566
1567 state->response.data.auth.nt_status = NT_STATUS_V(result);
1568 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1569
1570 /* we might have given a more useful error above */
1571 if (!*state->response.data.auth.error_string)
1572 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1573 state->response.data.auth.pam_error = nt_status_to_pam(result);
1574
1575 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1576 state->request.data.auth.user,
1577 state->response.data.auth.nt_status_string,
1578 state->response.data.auth.pam_error));
1579
1580 if ( NT_STATUS_IS_OK(result) && info3 &&
1581 (state->request.flags & WBFLAG_PAM_AFS_TOKEN) ) {
1582
1583 char *afsname = talloc_strdup(state->mem_ctx,
1584 lp_afs_username_map());
1585 char *cell;
1586
1587 if (afsname == NULL) {
1588 goto no_token;
1589 }
1590
1591 afsname = talloc_string_sub(state->mem_ctx,
1592 lp_afs_username_map(),
1593 "%D", name_domain);
1594 afsname = talloc_string_sub(state->mem_ctx, afsname,
1595 "%u", name_user);
1596 afsname = talloc_string_sub(state->mem_ctx, afsname,
1597 "%U", name_user);
1598
1599 {
1600 DOM_SID user_sid;
1601 fstring sidstr;
1602
1603 sid_copy(&user_sid, &info3->dom_sid.sid);
1604 sid_append_rid(&user_sid, info3->user_rid);
1605 sid_to_string(sidstr, &user_sid);
1606 afsname = talloc_string_sub(state->mem_ctx, afsname,
1607 "%s", sidstr);
1608 }
1609
1610 if (afsname == NULL) {
1611 goto no_token;
1612 }
1613
1614 strlower_m(afsname);
1615
1616 DEBUG(10, ("Generating token for user %s\n", afsname));
1617
1618 cell = strchr(afsname, '@');
1619
1620 if (cell == NULL) {
1621 goto no_token;
1622 }
1623
1624 *cell = '\0';
1625 cell += 1;
1626
1627 /* Append an AFS token string */
1628 SAFE_FREE(state->response.extra_data.data);
1629 state->response.extra_data.data =
1630 afs_createtoken_str(afsname, cell);
1631
1632 if (state->response.extra_data.data != NULL) {
1633 state->response.length +=
1634 strlen((const char *)state->response.extra_data.data)+1;
1635 }
1636
1637 no_token:
1638 TALLOC_FREE(afsname);
1639 }
1640
1641 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1642 }
1643
1644
1645 /**********************************************************************
1646 Challenge Response Authentication Protocol
1647 **********************************************************************/
1648
1649 void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
1650 {
1651 struct winbindd_domain *domain = NULL;
1652 const char *domain_name = NULL;
1653 NTSTATUS result;
1654
1655 if (!state->privileged) {
1656 char *error_string = NULL;
1657 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1658 "denied. !\n"));
1659 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1660 "on %s are set correctly.\n",
1661 get_winbind_priv_pipe_dir()));
1662 /* send a better message than ACCESS_DENIED */
1663 error_string = talloc_asprintf(state->mem_ctx,
1664 "winbind client not authorized "
1665 "to use winbindd_pam_auth_crap."
1666 " Ensure permissions on %s "
1667 "are set correctly.",
1668 get_winbind_priv_pipe_dir());
1669 fstrcpy(state->response.data.auth.error_string, error_string);
1670 result = NT_STATUS_ACCESS_DENIED;
1671 goto done;
1672 }
1673
1674 /* Ensure null termination */
1675 state->request.data.auth_crap.user
1676 [sizeof(state->request.data.auth_crap.user)-1]=0;
1677 state->request.data.auth_crap.domain
1678 [sizeof(state->request.data.auth_crap.domain)-1]=0;
1679
1680 DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1681 (unsigned long)state->pid,
1682 state->request.data.auth_crap.domain,
1683 state->request.data.auth_crap.user));
1684
1685 if (*state->request.data.auth_crap.domain != '\0') {
1686 domain_name = state->request.data.auth_crap.domain;
1687 } else if (lp_winbind_use_default_domain()) {
1688 domain_name = lp_workgroup();
1689 }
1690
1691 if (domain_name != NULL)
1692 domain = find_auth_domain(state, domain_name);
1693
1694 if (domain != NULL) {
1695 sendto_domain(state, domain);
1696 return;
1697 }
1698
1699 result = NT_STATUS_NO_SUCH_USER;
1700
1701 done:
1702 set_auth_errors(&state->response, result);
1703 DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1704 state->request.data.auth_crap.domain,
1705 state->request.data.auth_crap.user,
1706 state->response.data.auth.nt_status_string,
1707 state->response.data.auth.pam_error));
1708 request_error(state);
1709 return;
1710 }
1711
1712
1713 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1714 struct winbindd_cli_state *state)
1715 {
1716 NTSTATUS result;
1717 NET_USER_INFO_3 info3;
1718 struct rpc_pipe_client *netlogon_pipe;
1719 const char *name_user = NULL;
1720 const char *name_domain = NULL;
1721 const char *workstation;
1722 struct winbindd_domain *contact_domain;
1723 int attempts = 0;
1724 BOOL retry;
1725
1726 DATA_BLOB lm_resp, nt_resp;
1727
1728 /* This is child-only, so no check for privileged access is needed
1729 anymore */
1730
1731 /* Ensure null termination */
1732 state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
1733 state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
1734
1735 name_user = state->request.data.auth_crap.user;
1736
1737 if (*state->request.data.auth_crap.domain) {
1738 name_domain = state->request.data.auth_crap.domain;
1739 } else if (lp_winbind_use_default_domain()) {
1740 name_domain = lp_workgroup();
1741 } else {
1742 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1743 name_user));
1744 result = NT_STATUS_NO_SUCH_USER;
1745 goto done;
1746 }
1747
1748 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1749 name_domain, name_user));
1750
1751 if (*state->request.data.auth_crap.workstation) {
1752 workstation = state->request.data.auth_crap.workstation;
1753 } else {
1754 workstation = global_myname();
1755 }
1756
1757 if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
1758 || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
1759 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1760 state->request.data.auth_crap.lm_resp_len,
1761 state->request.data.auth_crap.nt_resp_len));
1762 result = NT_STATUS_INVALID_PARAMETER;
1763 goto done;
1764 }
1765
1766 lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
1767 state->request.data.auth_crap.lm_resp_len);
1768 nt_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.nt_resp,
1769 state->request.data.auth_crap.nt_resp_len);
1770
1771 /* what domain should we contact? */
1772
1773 if ( IS_DC ) {
1774 if (!(contact_domain = find_domain_from_name(name_domain))) {
1775 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1776 state->request.data.auth_crap.user, name_domain, name_user, name_domain));
1777 result = NT_STATUS_NO_SUCH_USER;
1778 goto done;
1779 }
1780 } else {
1781 if (is_myname(name_domain)) {
1782 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1783 result = NT_STATUS_NO_SUCH_USER;
1784 goto done;
1785 }
1786 contact_domain = find_our_domain();
1787 }
1788
1789 do {
1790 ZERO_STRUCT(info3);
1791 retry = False;
1792
1793 netlogon_pipe = NULL;
1794 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1795
1796 if (!NT_STATUS_IS_OK(result)) {
1797 DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1798 nt_errstr(result)));
1799 goto done;
1800 }
1801
1802 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1803 state->mem_ctx,
1804 state->request.data.auth_crap.logon_parameters,
1805 contact_domain->dcname,
1806 name_user,
1807 name_domain,
1808 /* Bug #3248 - found by Stefan Burkei. */
1809 workstation, /* We carefully set this above so use it... */
1810 state->request.data.auth_crap.chal,
1811 lm_resp,
1812 nt_resp,
1813 &info3);
1814
1815 attempts += 1;
1816
1817 /* We have to try a second time as cm_connect_netlogon
1818 might not yet have noticed that the DC has killed
1819 our connection. */
1820
1821 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1822 retry = True;
1823 continue;
1824 }
1825
1826 /* if we get access denied, a possible cause was that we had and open
1827 connection to the DC, but someone changed our machine account password
1828 out from underneath us using 'net rpc changetrustpw' */
1829
1830 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1831 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1832 "ACCESS_DENIED. Maybe the trust account "
1833 "password was changed and we didn't know it. "
1834 "Killing connections to domain %s\n",
1835 name_domain));
1836 invalidate_cm_connection(&contact_domain->conn);
1837 retry = True;
1838 }
1839
1840 } while ( (attempts < 2) && retry );
1841
1842 if (NT_STATUS_IS_OK(result)) {
1843
1844 netsamlogon_cache_store(name_user, &info3);
1845 wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3);
1846
1847 /* Check if the user is in the right group */
1848
1849 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3,
1850 state->request.data.auth_crap.require_membership_of_sid))) {
1851 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1852 state->request.data.auth_crap.user,
1853 state->request.data.auth_crap.require_membership_of_sid));
1854 goto done;
1855 }
1856
1857 if (state->request.flags & WBFLAG_PAM_INFO3_NDR) {
1858 result = append_info3_as_ndr(state->mem_ctx, state, &info3);
1859 } else if (state->request.flags & WBFLAG_PAM_UNIX_NAME) {
1860 /* ntlm_auth should return the unix username, per
1861 'winbind use default domain' settings and the like */
1862
1863 fstring username_out;
1864 const char *nt_username, *nt_domain;
1865 if (!(nt_username = unistr2_tdup(state->mem_ctx, &(info3.uni_user_name)))) {
1866 /* If the server didn't give us one, just use the one we sent them */
1867 nt_username = name_user;
1868 }
1869
1870 if (!(nt_domain = unistr2_tdup(state->mem_ctx, &(info3.uni_logon_dom)))) {
1871 /* If the server didn't give us one, just use the one we sent them */
1872 nt_domain = name_domain;
1873 }
1874
1875 fill_domain_username(username_out, nt_domain, nt_username, True);
1876
1877 DEBUG(5, ("Setting unix username to [%s]\n", username_out));
1878
1879 SAFE_FREE(state->response.extra_data.data);
1880 state->response.extra_data.data = SMB_STRDUP(username_out);
1881 if (!state->response.extra_data.data) {
1882 result = NT_STATUS_NO_MEMORY;
1883 goto done;
1884 }
1885 state->response.length +=
1886 strlen((const char *)state->response.extra_data.data)+1;
1887 }
1888
1889 if (state->request.flags & WBFLAG_PAM_USER_SESSION_KEY) {
1890 memcpy(state->response.data.auth.user_session_key, info3.user_sess_key,
1891 sizeof(state->response.data.auth.user_session_key) /* 16 */);
1892 }
1893 if (state->request.flags & WBFLAG_PAM_LMKEY) {
1894 memcpy(state->response.data.auth.first_8_lm_hash, info3.lm_sess_key,
1895 sizeof(state->response.data.auth.first_8_lm_hash) /* 8 */);
1896 }
1897 }
1898
1899 done:
1900
1901 /* give us a more useful (more correct?) error code */
1902 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1903 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1904 result = NT_STATUS_NO_LOGON_SERVERS;
1905 }
1906
1907 if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1908 result = nt_status_squash(result);
1909 }
1910
1911 state->response.data.auth.nt_status = NT_STATUS_V(result);
1912 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1913
1914 /* we might have given a more useful error above */
1915 if (!*state->response.data.auth.error_string) {
1916 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1917 }
1918 state->response.data.auth.pam_error = nt_status_to_pam(result);
1919
1920 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1921 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1922 name_domain,
1923 name_user,
1924 state->response.data.auth.nt_status_string,
1925 state->response.data.auth.pam_error));
1926
1927 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1928 }
1929
1930 /* Change a user password */
1931
1932 void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
1933 {
1934 fstring domain, user;
1935 struct winbindd_domain *contact_domain;
1936
1937 DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
1938 state->request.data.chauthtok.user));
1939
1940 /* Setup crap */
1941
1942 if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
1943 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1944 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
1945 "(PAM: %d)\n",
1946 state->request.data.auth.user,
1947 state->response.data.auth.nt_status_string,
1948 state->response.data.auth.pam_error));
1949 request_error(state);
1950 return;
1951 }
1952
1953 contact_domain = find_domain_from_name(domain);
1954 if (!contact_domain) {
1955 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1956 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
1957 state->request.data.chauthtok.user, domain, user, domain));
1958 request_error(state);
1959 return;
1960 }
1961
1962 sendto_domain(state, contact_domain);
1963 }
1964
1965 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1966 struct winbindd_cli_state *state)
1967 {
1968 char *oldpass;
1969 char *newpass = NULL;
1970 POLICY_HND dom_pol;
1971 struct rpc_pipe_client *cli;
1972 BOOL got_info = False;
1973 SAM_UNK_INFO_1 info;
1974 SAMR_CHANGE_REJECT reject;
1975 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1976 fstring domain, user;
1977
1978 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1979 state->request.data.auth.user));
1980
1981 if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
1982 goto done;
1983 }
1984
1985 /* Change password */
1986
1987 oldpass = state->request.data.chauthtok.oldpass;
1988 newpass = state->request.data.chauthtok.newpass;
1989
1990 /* Initialize reject reason */
1991 state->response.data.auth.reject_reason = Undefined;
1992
1993 /* Get sam handle */
1994
1995 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
1996 &dom_pol);
1997 if (!NT_STATUS_IS_OK(result)) {
1998 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
1999 goto done;
2000 }
2001
2002 result = rpccli_samr_chgpasswd3(cli, state->mem_ctx, user, newpass, oldpass, &info, &reject);
2003
2004 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2005
2006 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2007 state->response.data.auth.policy.min_length_password =
2008 info.min_length_password;
2009 state->response.data.auth.policy.password_history =
2010 info.password_history;
2011 state->response.data.auth.policy.password_properties =
2012 info.password_properties;
2013 state->response.data.auth.policy.expire =
2014 nt_time_to_unix_abs(&info.expire);
2015 state->response.data.auth.policy.min_passwordage =
2016 nt_time_to_unix_abs(&info.min_passwordage);
2017
2018 state->response.data.auth.reject_reason =
2019 reject.reject_reason;
2020
2021 got_info = True;
2022 }
2023
2024 /* only fallback when the chgpasswd3 call is not supported */
2025 if ((NT_STATUS_EQUAL(result, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR))) ||
2026 (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) ||
2027 (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED))) {
2028
2029 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
2030 nt_errstr(result)));
2031
2032 result = rpccli_samr_chgpasswd_user(cli, state->mem_ctx, user, newpass, oldpass);
2033
2034 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2035 Map to the same status code as Windows 2003. */
2036
2037 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2038 result = NT_STATUS_PASSWORD_RESTRICTION;
2039 }
2040 }
2041
2042 done:
2043
2044 if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
2045
2046 /* Update the single sign-on memory creds. */
2047 result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
2048 newpass);
2049
2050 if (!NT_STATUS_IS_OK(result)) {
2051 DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
2052 goto process_result;
2053 }
2054
2055 if (lp_winbind_offline_logon()) {
2056 result = winbindd_update_creds_by_name(contact_domain,
2057 state->mem_ctx, user,
2058 newpass);
2059 if (!NT_STATUS_IS_OK(result)) {
2060 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
2061 goto process_result;
2062 }
2063 }
2064 }
2065
2066 if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2067
2068 NTSTATUS policy_ret;
2069
2070 policy_ret = fillup_password_policy(contact_domain, state);
2071
2072 /* failure of this is non critical, it will just provide no
2073 * additional information to the client why the change has
2074 * failed - Guenther */
2075
2076 if (!NT_STATUS_IS_OK(policy_ret)) {
2077 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2078 goto process_result;
2079 }
2080 }
2081
2082 process_result:
2083
2084 state->response.data.auth.nt_status = NT_STATUS_V(result);
2085 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2086 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2087 state->response.data.auth.pam_error = nt_status_to_pam(result);
2088
2089 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2090 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2091 domain,
2092 user,
2093 state->response.data.auth.nt_status_string,
2094 state->response.data.auth.pam_error));
2095
2096 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2097 }
2098
2099 void winbindd_pam_logoff(struct winbindd_cli_state *state)
2100 {
2101 struct winbindd_domain *domain;
2102 fstring name_domain, user;
2103 uid_t caller_uid = (uid_t)-1;
2104 uid_t request_uid = state->request.data.logoff.uid;
2105
2106 DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
2107 state->request.data.logoff.user));
2108
2109 /* Ensure null termination */
2110 state->request.data.logoff.user
2111 [sizeof(state->request.data.logoff.user)-1]='\0';
2112
2113 state->request.data.logoff.krb5ccname
2114 [sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
2115
2116 if (request_uid == (gid_t)-1) {
2117 goto failed;
2118 }
2119
2120 if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
2121 goto failed;
2122 }
2123
2124 if ((domain = find_auth_domain(state, name_domain)) == NULL) {
2125 goto failed;
2126 }
2127
2128 if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
2129 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2130 strerror(errno)));
2131 goto failed;
2132 }
2133
2134 switch (caller_uid) {
2135 case -1:
2136 goto failed;
2137 case 0:
2138 /* root must be able to logoff any user - gd */
2139 state->request.data.logoff.uid = request_uid;
2140 break;
2141 default:
2142 if (caller_uid != request_uid) {
2143 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2144 goto failed;
2145 }
2146 state->request.data.logoff.uid = caller_uid;
2147 break;
2148 }
2149
2150 sendto_domain(state, domain);
2151 return;
2152
2153 failed:
2154 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2155 DEBUG(5, ("Pam Logoff for %s returned %s "
2156 "(PAM: %d)\n",
2157 state->request.data.logoff.user,
2158 state->response.data.auth.nt_status_string,
2159 state->response.data.auth.pam_error));
2160 request_error(state);
2161 return;
2162 }
2163
2164 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2165 struct winbindd_cli_state *state)
2166 {
2167 NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2168
2169 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2170 state->request.data.logoff.user));
2171
2172 if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
2173 result = NT_STATUS_OK;
2174 goto process_result;
2175 }
2176
2177 if (state->request.data.logoff.krb5ccname[0] == '\0') {
2178 result = NT_STATUS_OK;
2179 goto process_result;
2180 }
2181
2182 #ifdef HAVE_KRB5
2183
2184 if (state->request.data.logoff.uid < 0) {
2185 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2186 goto process_result;
2187 }
2188
2189 /* what we need here is to find the corresponding krb5 ccache name *we*
2190 * created for a given username and destroy it */
2191
2192 if (!ccache_entry_exists(state->request.data.logoff.user)) {
2193 result = NT_STATUS_OK;
2194 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2195 goto process_result;
2196 }
2197
2198 if (!ccache_entry_identical(state->request.data.logoff.user,
2199 state->request.data.logoff.uid,
2200 state->request.data.logoff.krb5ccname)) {
2201 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2202 goto process_result;
2203 }
2204
2205 result = remove_ccache(state->request.data.logoff.user);
2206 if (!NT_STATUS_IS_OK(result)) {
2207 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2208 nt_errstr(result)));
2209 goto process_result;
2210 }
2211
2212 #else
2213 result = NT_STATUS_NOT_SUPPORTED;
2214 #endif
2215
2216 process_result:
2217
2218 winbindd_delete_memory_creds(state->request.data.logoff.user);
2219
2220 state->response.data.auth.nt_status = NT_STATUS_V(result);
2221 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2222 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2223 state->response.data.auth.pam_error = nt_status_to_pam(result);
2224
2225 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2226 }
2227
2228 /* Change user password with auth crap*/
2229
2230 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
2231 {
2232 struct winbindd_domain *domain = NULL;
2233 const char *domain_name = NULL;
2234
2235 /* Ensure null termination */
2236 state->request.data.chng_pswd_auth_crap.user[
2237 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2238 state->request.data.chng_pswd_auth_crap.domain[
2239 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2240
2241 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2242 (unsigned long)state->pid,
2243 state->request.data.chng_pswd_auth_crap.domain,
2244 state->request.data.chng_pswd_auth_crap.user));
2245
2246 if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
2247 domain_name = state->request.data.chng_pswd_auth_crap.domain;
2248 } else if (lp_winbind_use_default_domain()) {
2249 domain_name = lp_workgroup();
2250 }
2251
2252 if (domain_name != NULL)
2253 domain = find_domain_from_name(domain_name);
2254
2255 if (domain != NULL) {
2256 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2257 "%s\n", (unsigned long)state->pid,domain->name));
2258 sendto_domain(state, domain);
2259 return;
2260 }
2261
2262 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2263 DEBUG(5, ("CRAP change password for %s\\%s returned %s (PAM: %d)\n",
2264 state->request.data.chng_pswd_auth_crap.domain,
2265 state->request.data.chng_pswd_auth_crap.user,
2266 state->response.data.auth.nt_status_string,
2267 state->response.data.auth.pam_error));
2268 request_error(state);
2269 return;
2270 }
2271
2272 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2273 {
2274 NTSTATUS result;
2275 DATA_BLOB new_nt_password;
2276 DATA_BLOB old_nt_hash_enc;
2277 DATA_BLOB new_lm_password;
2278 DATA_BLOB old_lm_hash_enc;
2279 fstring domain,user;
2280 POLICY_HND dom_pol;
2281 struct winbindd_domain *contact_domain = domainSt;
2282 struct rpc_pipe_client *cli;
2283
2284 /* Ensure null termination */
2285 state->request.data.chng_pswd_auth_crap.user[
2286 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2287 state->request.data.chng_pswd_auth_crap.domain[
2288 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2289 *domain = 0;
2290 *user = 0;
2291
2292 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2293 (unsigned long)state->pid,
2294 state->request.data.chng_pswd_auth_crap.domain,
2295 state->request.data.chng_pswd_auth_crap.user));
2296
2297 if (lp_winbind_offline_logon()) {
2298 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2299 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2300 result = NT_STATUS_ACCESS_DENIED;
2301 goto done;
2302 }
2303
2304 if (*state->request.data.chng_pswd_auth_crap.domain) {
2305 fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
2306 } else {
2307 parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
2308 domain, user);
2309
2310 if(!*domain) {
2311 DEBUG(3,("no domain specified with username (%s) - "
2312 "failing auth\n",
2313 state->request.data.chng_pswd_auth_crap.user));
2314 result = NT_STATUS_NO_SUCH_USER;
2315 goto done;
2316 }
2317 }
2318
2319 if (!*domain && lp_winbind_use_default_domain()) {
2320 fstrcpy(domain,(char *)lp_workgroup());
2321 }
2322
2323 if(!*user) {
2324 fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
2325 }
2326
2327 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2328 (unsigned long)state->pid, domain, user));
2329
2330 /* Change password */
2331 new_nt_password = data_blob_talloc(
2332 state->mem_ctx,
2333 state->request.data.chng_pswd_auth_crap.new_nt_pswd,
2334 state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
2335
2336 old_nt_hash_enc = data_blob_talloc(
2337 state->mem_ctx,
2338 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
2339 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2340
2341 if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2342 new_lm_password = data_blob_talloc(
2343 state->mem_ctx,
2344 state->request.data.chng_pswd_auth_crap.new_lm_pswd,
2345 state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
2346
2347 old_lm_hash_enc = data_blob_talloc(
2348 state->mem_ctx,
2349 state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
2350 state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2351 } else {
2352 new_lm_password.length = 0;
2353 old_lm_hash_enc.length = 0;
2354 }
2355
2356 /* Get sam handle */
2357
2358 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2359 if (!NT_STATUS_IS_OK(result)) {
2360 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2361 goto done;
2362 }
2363
2364 result = rpccli_samr_chng_pswd_auth_crap(
2365 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2366 new_lm_password, old_lm_hash_enc);
2367
2368 done:
2369 state->response.data.auth.nt_status = NT_STATUS_V(result);
2370 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2371 fstrcpy(state->response.data.auth.error_string,
2372 get_friendly_nt_error_msg(result));
2373 state->response.data.auth.pam_error = nt_status_to_pam(result);
2374
2375 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2376 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2377 domain, user,
2378 state->response.data.auth.nt_status_string,
2379 state->response.data.auth.pam_error));
2380
2381 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2382 }
Samba GIT mirror