2 Unix SMB/CIFS implementation.
4 PAC Glue between Samba and the KDC
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
7 Copyright (C) Simo Sorce <idra@samba.org> 2010
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "kdc/kdc-glue.h"
26 #include "kdc/pac-glue.h"
28 /* Given the right private pointer from hdb_samba4, get a PAC from the attached ldb messages */
29 static krb5_error_code
samba_wdc_get_pac(void *priv
, krb5_context context
,
30 struct hdb_entry_ex
*client
,
37 struct samba_kdc_entry
*skdc_entry
=
38 talloc_get_type_abort(client
->ctx
,
39 struct samba_kdc_entry
);
41 mem_ctx
= talloc_named(client
->ctx
, 0, "samba_get_pac context");
46 nt_status
= samba_kdc_get_pac_blob(mem_ctx
, skdc_entry
, &pac_blob
);
47 if (!NT_STATUS_IS_OK(nt_status
)) {
52 ret
= samba_make_krb5_pac(context
, pac_blob
, NULL
, pac
);
58 /* Resign (and reform, including possibly new groups) a PAC */
60 static krb5_error_code
samba_wdc_reget_pac(void *priv
, krb5_context context
,
61 const krb5_principal client_principal
,
62 const krb5_principal delegated_proxy_principal
,
63 struct hdb_entry_ex
*client
,
64 struct hdb_entry_ex
*server
,
65 struct hdb_entry_ex
*krbtgt
,
68 struct samba_kdc_entry
*p
=
69 talloc_get_type_abort(server
->ctx
,
70 struct samba_kdc_entry
);
71 struct samba_kdc_entry
*krbtgt_skdc_entry
=
72 talloc_get_type_abort(krbtgt
->ctx
,
73 struct samba_kdc_entry
);
74 TALLOC_CTX
*mem_ctx
= talloc_named(p
, 0, "samba_kdc_reget_pac context");
76 DATA_BLOB
*deleg_blob
= NULL
;
79 struct PAC_SIGNATURE_DATA
*pac_srv_sig
;
80 struct PAC_SIGNATURE_DATA
*pac_kdc_sig
;
81 bool is_in_db
, is_untrusted
;
87 /* The user account may be set not to want the PAC */
88 if (!samba_princ_needs_pac(p
)) {
93 /* If the krbtgt was generated by an RODC, and we are not that
94 * RODC, then we need to regenerate the PAC - we can't trust
96 ret
= samba_krbtgt_is_in_db(krbtgt_skdc_entry
, &is_in_db
, &is_untrusted
);
103 struct samba_kdc_entry
*client_skdc_entry
= NULL
;
105 if (client
== NULL
) {
106 return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN
;
109 client_skdc_entry
= talloc_get_type_abort(client
->ctx
,
110 struct samba_kdc_entry
);
112 nt_status
= samba_kdc_get_pac_blob(mem_ctx
, client_skdc_entry
, &pac_blob
);
113 if (!NT_STATUS_IS_OK(nt_status
)) {
114 talloc_free(mem_ctx
);
118 pac_blob
= talloc_zero(mem_ctx
, DATA_BLOB
);
120 talloc_free(mem_ctx
);
124 pac_srv_sig
= talloc_zero(mem_ctx
, struct PAC_SIGNATURE_DATA
);
126 talloc_free(mem_ctx
);
130 pac_kdc_sig
= talloc_zero(mem_ctx
, struct PAC_SIGNATURE_DATA
);
132 talloc_free(mem_ctx
);
136 nt_status
= samba_kdc_update_pac_blob(mem_ctx
, context
,
138 pac_srv_sig
, pac_kdc_sig
);
139 if (!NT_STATUS_IS_OK(nt_status
)) {
140 DEBUG(0, ("Building PAC failed: %s\n",
141 nt_errstr(nt_status
)));
142 talloc_free(mem_ctx
);
147 /* Now check the KDC signature, fetching the correct key based on the enc type */
148 ret
= kdc_check_pac(context
, pac_srv_sig
->signature
, pac_kdc_sig
, krbtgt
);
150 DEBUG(1, ("PAC KDC signature failed to verify\n"));
151 talloc_free(mem_ctx
);
157 if (delegated_proxy_principal
) {
158 deleg_blob
= talloc_zero(mem_ctx
, DATA_BLOB
);
160 talloc_free(mem_ctx
);
164 nt_status
= samba_kdc_update_delegation_info_blob(mem_ctx
,
166 server
->entry
.principal
,
167 delegated_proxy_principal
,
169 if (!NT_STATUS_IS_OK(nt_status
)) {
170 DEBUG(0, ("Building PAC failed: %s\n",
171 nt_errstr(nt_status
)));
172 talloc_free(mem_ctx
);
177 /* We now completely regenerate this pac */
178 krb5_pac_free(context
, *pac
);
180 ret
= samba_make_krb5_pac(context
, pac_blob
, deleg_blob
, pac
);
182 talloc_free(mem_ctx
);
186 static char *get_netbios_name(TALLOC_CTX
*mem_ctx
, HostAddresses
*addrs
)
188 char *nb_name
= NULL
;
192 for (i
= 0; addrs
&& i
< addrs
->len
; i
++) {
193 if (addrs
->val
[i
].addr_type
!= KRB5_ADDRESS_NETBIOS
) {
196 len
= MIN(addrs
->val
[i
].address
.length
, 15);
197 nb_name
= talloc_strndup(mem_ctx
,
198 addrs
->val
[i
].address
.data
, len
);
204 if ((nb_name
== NULL
) || (nb_name
[0] == '\0')) {
208 /* Strip space padding */
209 for (len
= strlen(nb_name
) - 1;
210 (len
> 0) && (nb_name
[len
] == ' ');
218 static krb5_data
fill_krb5_data(void *data
, size_t length
)
223 kdata
.length
= length
;
228 static krb5_error_code
samba_wdc_check_client_access(void *priv
,
229 krb5_context context
,
230 krb5_kdc_configuration
*config
,
231 hdb_entry_ex
*client_ex
, const char *client_name
,
232 hdb_entry_ex
*server_ex
, const char *server_name
,
236 struct samba_kdc_entry
*kdc_entry
;
237 bool password_change
;
241 kdc_entry
= talloc_get_type(client_ex
->ctx
, struct samba_kdc_entry
);
242 password_change
= (server_ex
&& server_ex
->entry
.flags
.change_pw
);
243 workstation
= get_netbios_name((TALLOC_CTX
*)client_ex
->ctx
,
244 req
->req_body
.addresses
);
246 nt_status
= samba_kdc_check_client_access(kdc_entry
,
251 if (!NT_STATUS_IS_OK(nt_status
)) {
252 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_MEMORY
)) {
259 samba_kdc_build_edata_reply(nt_status
, &data
);
260 *e_data
= fill_krb5_data(data
.data
, data
.length
);
263 return samba_kdc_map_policy_err(nt_status
);
266 /* Now do the standard Heimdal check */
267 return kdc_check_flags(context
, config
,
268 client_ex
, client_name
,
269 server_ex
, server_name
,
270 req
->msg_type
== krb_as_req
);
273 static krb5_error_code
samba_wdc_plugin_init(krb5_context context
, void **ptr
)
279 static void samba_wdc_plugin_fini(void *ptr
)
284 struct krb5plugin_windc_ftable windc_plugin_table
= {
285 .minor_version
= KRB5_WINDC_PLUGIN_MINOR
,
286 .init
= samba_wdc_plugin_init
,
287 .fini
= samba_wdc_plugin_fini
,
288 .pac_generate
= samba_wdc_get_pac
,
289 .pac_verify
= samba_wdc_reget_pac
,
290 .client_access
= samba_wdc_check_client_access
,