?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
VERSION: Raise version number up to 3.0.36.
[Samba.git] / source / nsswitch / winbindd_pam.c
blob708fc62dc476d69662e952bfa0a03f6a3cc992a4
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon - pam auth funcions
5
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program; if not, write to the Free Software
23 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #undef DBGC_CLASS
29 #define DBGC_CLASS DBGC_WINBIND
30
31 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
32 struct winbindd_cli_state *state,
33 NET_USER_INFO_3 *info3)
34 {
35 fstring str_sid;
36
37 state->response.data.auth.info3.logon_time =
38 nt_time_to_unix(info3->logon_time);
39 state->response.data.auth.info3.logoff_time =
40 nt_time_to_unix(info3->logoff_time);
41 state->response.data.auth.info3.kickoff_time =
42 nt_time_to_unix(info3->kickoff_time);
43 state->response.data.auth.info3.pass_last_set_time =
44 nt_time_to_unix(info3->pass_last_set_time);
45 state->response.data.auth.info3.pass_can_change_time =
46 nt_time_to_unix(info3->pass_can_change_time);
47 state->response.data.auth.info3.pass_must_change_time =
48 nt_time_to_unix(info3->pass_must_change_time);
49
50 state->response.data.auth.info3.logon_count = info3->logon_count;
51 state->response.data.auth.info3.bad_pw_count = info3->bad_pw_count;
52
53 state->response.data.auth.info3.user_rid = info3->user_rid;
54 state->response.data.auth.info3.group_rid = info3->group_rid;
55 sid_to_string(str_sid, &(info3->dom_sid.sid));
56 fstrcpy(state->response.data.auth.info3.dom_sid, str_sid);
57
58 state->response.data.auth.info3.num_groups = info3->num_groups;
59 state->response.data.auth.info3.user_flgs = info3->user_flgs;
60
61 state->response.data.auth.info3.acct_flags = info3->acct_flags;
62 state->response.data.auth.info3.num_other_sids = info3->num_other_sids;
63
64 unistr2_to_ascii(state->response.data.auth.info3.user_name,
65 &info3->uni_user_name, -1);
66 unistr2_to_ascii(state->response.data.auth.info3.full_name,
67 &info3->uni_full_name, -1);
68 unistr2_to_ascii(state->response.data.auth.info3.logon_script,
69 &info3->uni_logon_script, -1);
70 unistr2_to_ascii(state->response.data.auth.info3.profile_path,
71 &info3->uni_profile_path, -1);
72 unistr2_to_ascii(state->response.data.auth.info3.home_dir,
73 &info3->uni_home_dir, -1);
74 unistr2_to_ascii(state->response.data.auth.info3.dir_drive,
75 &info3->uni_dir_drive, -1);
76
77 unistr2_to_ascii(state->response.data.auth.info3.logon_srv,
78 &info3->uni_logon_srv, -1);
79 unistr2_to_ascii(state->response.data.auth.info3.logon_dom,
80 &info3->uni_logon_dom, -1);
81
82 return NT_STATUS_OK;
83 }
84
85 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
86 struct winbindd_cli_state *state,
87 NET_USER_INFO_3 *info3)
88 {
89 prs_struct ps;
90 uint32 size;
91 if (!prs_init(&ps, 256 /* Random, non-zero number */, mem_ctx, MARSHALL)) {
92 return NT_STATUS_NO_MEMORY;
93 }
94 if (!net_io_user_info3("", info3, &ps, 1, 3, False)) {
95 prs_mem_free(&ps);
96 return NT_STATUS_UNSUCCESSFUL;
97 }
98
99 size = prs_data_size(&ps);
100 SAFE_FREE(state->response.extra_data.data);
101 state->response.extra_data.data = SMB_MALLOC(size);
102 if (!state->response.extra_data.data) {
103 prs_mem_free(&ps);
104 return NT_STATUS_NO_MEMORY;
105 }
106 memset( state->response.extra_data.data, '\0', size );
107 prs_copy_all_data_out((char *)state->response.extra_data.data, &ps);
108 state->response.length += size;
109 prs_mem_free(&ps);
110 return NT_STATUS_OK;
111 }
112
113 static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
114 NET_USER_INFO_3 *info3,
115 const char *group_sid)
116 /**
117 * Check whether a user belongs to a group or list of groups.
118 *
119 * @param mem_ctx talloc memory context.
120 * @param info3 user information, including group membership info.
121 * @param group_sid One or more groups , separated by commas.
122 *
123 * @return NT_STATUS_OK on success,
124 * NT_STATUS_LOGON_FAILURE if the user does not belong,
125 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
126 */
127 {
128 DOM_SID *require_membership_of_sid;
129 size_t num_require_membership_of_sid;
130 DOM_SID *all_sids;
131 size_t num_all_sids = (2 + info3->num_groups2 + info3->num_other_sids);
132 size_t i, j = 0, k;
133 size_t group_sid_length;
134 const char *search_location;
135 char *single_group_sid;
136 const char *comma;
137
138 /* Parse the 'required group' SID */
139
140 if (!group_sid || !group_sid[0]) {
141 /* NO sid supplied, all users may access */
142 return NT_STATUS_OK;
143 }
144
145 num_require_membership_of_sid = 1;
146 group_sid_length = strlen(group_sid);
147 for (i = 0; i < group_sid_length; i++) {
148 if (',' == group_sid[i]) {
149 num_require_membership_of_sid++;
150 }
151 }
152
153 require_membership_of_sid = TALLOC_ARRAY(mem_ctx, DOM_SID, num_require_membership_of_sid);
154 if (!require_membership_of_sid)
155 return NT_STATUS_NO_MEMORY;
156
157 i = 0;
158 search_location = group_sid;
159
160 if (num_require_membership_of_sid > 1) {
161
162 /* Allocate the maximum possible size */
163 single_group_sid = TALLOC(mem_ctx, group_sid_length);
164 if (!single_group_sid)
165 return NT_STATUS_NO_MEMORY;
166
167 while ( (comma = strstr(search_location, ",")) != NULL ) {
168
169 strncpy(single_group_sid, search_location, comma - search_location);
170 single_group_sid[comma - search_location] = 0;
171
172 if (!string_to_sid(&require_membership_of_sid[i++], single_group_sid)) {
173 DEBUG(0, ("check_info3_in_group: could not parse %s as a SID!",
174 single_group_sid));
175
176 return NT_STATUS_INVALID_PARAMETER;
177 }
178
179 search_location = comma + 1;
180 }
181 }
182
183 if (!string_to_sid(&require_membership_of_sid[i++], search_location)) {
184 DEBUG(0, ("check_info3_in_group: could not parse %s as a SID!",
185 search_location));
186
187 return NT_STATUS_INVALID_PARAMETER;
188 }
189
190 all_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_all_sids);
191 if (!all_sids)
192 return NT_STATUS_NO_MEMORY;
193
194 /* and create (by appending rids) the 'domain' sids */
195
196 sid_copy(&all_sids[0], &(info3->dom_sid.sid));
197
198 if (!sid_append_rid(&all_sids[0], info3->user_rid)) {
199 DEBUG(3,("could not append user's primary RID 0x%x\n",
200 info3->user_rid));
201
202 return NT_STATUS_INVALID_PARAMETER;
203 }
204 j++;
205
206 sid_copy(&all_sids[1], &(info3->dom_sid.sid));
207
208 if (!sid_append_rid(&all_sids[1], info3->group_rid)) {
209 DEBUG(3,("could not append additional group rid 0x%x\n",
210 info3->group_rid));
211
212 return NT_STATUS_INVALID_PARAMETER;
213 }
214 j++;
215
216 for (i = 0; i < info3->num_groups2; i++) {
217
218 sid_copy(&all_sids[j], &(info3->dom_sid.sid));
219
220 if (!sid_append_rid(&all_sids[j], info3->gids[i].g_rid)) {
221 DEBUG(3,("could not append additional group rid 0x%x\n",
222 info3->gids[i].g_rid));
223
224 return NT_STATUS_INVALID_PARAMETER;
225 }
226 j++;
227 }
228
229 /* Copy 'other' sids. We need to do sid filtering here to
230 prevent possible elevation of privileges. See:
231
232 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
233 */
234
235 for (i = 0; i < info3->num_other_sids; i++) {
236 sid_copy(&all_sids[info3->num_groups2 + i + 2],
237 &info3->other_sids[i].sid);
238 j++;
239 }
240
241 for (i = 0; i < j; i++) {
242 fstring sid1, sid2;
243 DEBUG(10, ("User has SID: %s\n",
244 sid_to_string(sid1, &all_sids[i])));
245 for (k = 0; k < num_require_membership_of_sid; k++) {
246 if (sid_equal(&require_membership_of_sid[k], &all_sids[i])) {
247 DEBUG(10, ("SID %s matches %s - user permitted to authenticate!\n",
248 sid_to_string(sid1, &require_membership_of_sid[k]), sid_to_string(sid2, &all_sids[i])));
249 return NT_STATUS_OK;
250 }
251 }
252 }
253
254 /* Do not distinguish this error from a wrong username/pw */
255
256 return NT_STATUS_LOGON_FAILURE;
257 }
258
259 struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
260 const char *domain_name)
261 {
262 struct winbindd_domain *domain;
263
264 if (IS_DC) {
265 domain = find_domain_from_name_noinit(domain_name);
266 if (domain == NULL) {
267 DEBUG(3, ("Authentication for domain [%s] refused"
268 "as it is not a trusted domain\n",
269 domain_name));
270 }
271 return domain;
272 }
273
274 if (is_myname(domain_name)) {
275 DEBUG(3, ("Authentication for domain %s (local domain "
276 "to this server) not supported at this "
277 "stage\n", domain_name));
278 return NULL;
279 }
280
281 /* we can auth against trusted domains */
282 if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
283 domain = find_domain_from_name_noinit(domain_name);
284 if (domain == NULL) {
285 DEBUG(3, ("Authentication for domain [%s] skipped "
286 "as it is not a trusted domain\n",
287 domain_name));
288 } else {
289 return domain;
290 }
291 }
292
293 return find_our_domain();
294 }
295
296 static void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
297 {
298 resp->data.auth.nt_status = NT_STATUS_V(result);
299 fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result));
300
301 /* we might have given a more useful error above */
302 if (*resp->data.auth.error_string == '\0')
303 fstrcpy(resp->data.auth.error_string,
304 get_friendly_nt_error_msg(result));
305 resp->data.auth.pam_error = nt_status_to_pam(result);
306 }
307
308 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
309 struct winbindd_cli_state *state)
310 {
311 struct winbindd_methods *methods;
312 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
313 SAM_UNK_INFO_1 password_policy;
314
315 methods = domain->methods;
316
317 status = methods->password_policy(domain, state->mem_ctx, &password_policy);
318 if (NT_STATUS_IS_ERR(status)) {
319 return status;
320 }
321
322 state->response.data.auth.policy.min_length_password =
323 password_policy.min_length_password;
324 state->response.data.auth.policy.password_history =
325 password_policy.password_history;
326 state->response.data.auth.policy.password_properties =
327 password_policy.password_properties;
328 state->response.data.auth.policy.expire =
329 nt_time_to_unix_abs(&(password_policy.expire));
330 state->response.data.auth.policy.min_passwordage =
331 nt_time_to_unix_abs(&(password_policy.min_passwordage));
332
333 return NT_STATUS_OK;
334 }
335
336 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
337 TALLOC_CTX *mem_ctx,
338 uint16 *max_allowed_bad_attempts)
339 {
340 struct winbindd_methods *methods;
341 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
342 SAM_UNK_INFO_12 lockout_policy;
343
344 *max_allowed_bad_attempts = 0;
345
346 methods = domain->methods;
347
348 status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
349 if (NT_STATUS_IS_ERR(status)) {
350 return status;
351 }
352
353 *max_allowed_bad_attempts = lockout_policy.bad_attempt_lockout;
354
355 return NT_STATUS_OK;
356 }
357
358 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
359 TALLOC_CTX *mem_ctx,
360 uint32 *password_properties)
361 {
362 struct winbindd_methods *methods;
363 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
364 SAM_UNK_INFO_1 password_policy;
365
366 *password_properties = 0;
367
368 methods = domain->methods;
369
370 status = methods->password_policy(domain, mem_ctx, &password_policy);
371 if (NT_STATUS_IS_ERR(status)) {
372 return status;
373 }
374
375 *password_properties = password_policy.password_properties;
376
377 return NT_STATUS_OK;
378 }
379
380 #ifdef HAVE_KRB5
381
382 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
383 const char *type,
384 uid_t uid,
385 BOOL *internal_ccache)
386 {
387 /* accept FILE and WRFILE as krb5_cc_type from the client and then
388 * build the full ccname string based on the user's uid here -
389 * Guenther*/
390
391 const char *gen_cc = NULL;
392
393 *internal_ccache = True;
394
395 if (uid == -1) {
396 goto memory_ccache;
397 }
398
399 if (!type || type[0] == '\0') {
400 goto memory_ccache;
401 }
402
403 if (strequal(type, "FILE")) {
404 gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
405 } else if (strequal(type, "WRFILE")) {
406 gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
407 } else {
408 DEBUG(10,("we don't allow to set a %s type ccache\n", type));
409 goto memory_ccache;
410 }
411
412 *internal_ccache = False;
413 goto done;
414
415 memory_ccache:
416 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
417
418 done:
419 if (gen_cc == NULL) {
420 DEBUG(0,("out of memory\n"));
421 return NULL;
422 }
423
424 DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
425
426 return gen_cc;
427 }
428
429 static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
430 {
431 const char *type = state->request.data.auth.krb5_cc_type;
432
433 state->response.data.auth.krb5ccname[0] = '\0';
434
435 if (type[0] == '\0') {
436 return;
437 }
438
439 if (!strequal(type, "FILE") &&
440 !strequal(type, "WRFILE")) {
441 DEBUG(10,("won't return krbccname for a %s type ccache\n",
442 type));
443 return;
444 }
445
446 fstrcpy(state->response.data.auth.krb5ccname, cc);
447 }
448
449 #endif
450
451 static uid_t get_uid_from_state(struct winbindd_cli_state *state)
452 {
453 uid_t uid = -1;
454
455 uid = state->request.data.auth.uid;
456
457 if (uid < 0) {
458 DEBUG(1,("invalid uid: '%d'\n", uid));
459 return -1;
460 }
461 return uid;
462 }
463
464 /**********************************************************************
465 Authenticate a user with a clear text password using Kerberos and fill up
466 ccache if required
467 **********************************************************************/
468
469 static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
470 struct winbindd_cli_state *state,
471 NET_USER_INFO_3 **info3)
472 {
473 #ifdef HAVE_KRB5
474 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
475 krb5_error_code krb5_ret;
476 DATA_BLOB tkt, session_key_krb5;
477 DATA_BLOB ap_rep, session_key;
478 PAC_DATA *pac_data = NULL;
479 PAC_LOGON_INFO *logon_info = NULL;
480 char *client_princ = NULL;
481 char *client_princ_out = NULL;
482 char *local_service = NULL;
483 const char *cc = NULL;
484 const char *principal_s = NULL;
485 const char *service = NULL;
486 char *realm = NULL;
487 fstring name_domain, name_user;
488 time_t ticket_lifetime = 0;
489 time_t renewal_until = 0;
490 uid_t uid = -1;
491 ADS_STRUCT *ads;
492 time_t time_offset = 0;
493 BOOL internal_ccache = True;
494
495 ZERO_STRUCT(session_key);
496 ZERO_STRUCT(session_key_krb5);
497 ZERO_STRUCT(tkt);
498 ZERO_STRUCT(ap_rep);
499
500 ZERO_STRUCTP(info3);
501
502 *info3 = NULL;
503
504 /* 1st step:
505 * prepare a krb5_cc_cache string for the user */
506
507 uid = get_uid_from_state(state);
508 if (uid == -1) {
509 DEBUG(0,("no valid uid\n"));
510 }
511
512 cc = generate_krb5_ccache(state->mem_ctx,
513 state->request.data.auth.krb5_cc_type,
514 state->request.data.auth.uid,
515 &internal_ccache);
516 if (cc == NULL) {
517 return NT_STATUS_NO_MEMORY;
518 }
519
520
521 /* 2nd step:
522 * get kerberos properties */
523
524 if (domain->private_data) {
525 ads = (ADS_STRUCT *)domain->private_data;
526 time_offset = ads->auth.time_offset;
527 }
528
529
530 /* 3rd step:
531 * do kerberos auth and setup ccache as the user */
532
533 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
534
535 realm = domain->alt_name;
536 strupper_m(realm);
537
538 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
539 if (principal_s == NULL) {
540 return NT_STATUS_NO_MEMORY;
541 }
542
543 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
544 if (service == NULL) {
545 return NT_STATUS_NO_MEMORY;
546 }
547
548 /* if this is a user ccache, we need to act as the user to let the krb5
549 * library handle the chown, etc. */
550
551 /************************ NON-ROOT **********************/
552
553 if (!internal_ccache) {
554
555 set_effective_uid(uid);
556 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
557 }
558
559 krb5_ret = kerberos_kinit_password_ext(principal_s,
560 state->request.data.auth.pass,
561 time_offset,
562 &ticket_lifetime,
563 &renewal_until,
564 cc,
565 True,
566 True,
567 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
568
569 if (krb5_ret) {
570 DEBUG(1,("winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d)\n",
571 principal_s, error_message(krb5_ret), krb5_ret));
572 result = krb5_to_nt_status(krb5_ret);
573 goto failed;
574 }
575
576 /* does http_timestring use heimdals libroken strftime?? - Guenther */
577 DEBUG(10,("got TGT for %s in %s (valid until: %s (%d), renewable till: %s (%d))\n",
578 principal_s, cc,
579 http_timestring(ticket_lifetime), (int)ticket_lifetime,
580 http_timestring(renewal_until), (int)renewal_until));
581
582 /* we cannot continue with krb5 when UF_DONT_REQUIRE_PREAUTH is set,
583 * in that case fallback to NTLM - gd */
584
585 if ((ticket_lifetime == 0) && (renewal_until == 0)) {
586 result = NT_STATUS_INVALID_LOGON_TYPE;
587 goto failed;
588 }
589
590 client_princ = talloc_strdup(state->mem_ctx, global_myname());
591 if (client_princ == NULL) {
592 result = NT_STATUS_NO_MEMORY;
593 goto failed;
594 }
595 strlower_m(client_princ);
596
597 local_service = talloc_asprintf(state->mem_ctx, "%s$@%s", client_princ, lp_realm());
598 if (local_service == NULL) {
599 DEBUG(0,("winbindd_raw_kerberos_login: out of memory\n"));
600 result = NT_STATUS_NO_MEMORY;
601 goto failed;
602 }
603
604 krb5_ret = cli_krb5_get_ticket(local_service,
605 time_offset,
606 &tkt,
607 &session_key_krb5,
608 0,
609 cc,
610 NULL);
611 if (krb5_ret) {
612 DEBUG(1,("winbindd_raw_kerberos_login: failed to get ticket for %s: %s\n",
613 local_service, error_message(krb5_ret)));
614 result = krb5_to_nt_status(krb5_ret);
615 goto failed;
616 }
617
618 if (!internal_ccache) {
619 gain_root_privilege();
620 }
621
622 /************************ NON-ROOT **********************/
623
624 result = ads_verify_ticket(state->mem_ctx,
625 lp_realm(),
626 time_offset,
627 &tkt,
628 &client_princ_out,
629 &pac_data,
630 &ap_rep,
631 &session_key);
632 if (!NT_STATUS_IS_OK(result)) {
633 DEBUG(0,("winbindd_raw_kerberos_login: ads_verify_ticket failed: %s\n",
634 nt_errstr(result)));
635 goto failed;
636 }
637
638 if (!pac_data) {
639 DEBUG(3,("winbindd_raw_kerberos_login: no pac data\n"));
640 result = NT_STATUS_INVALID_PARAMETER;
641 goto failed;
642 }
643
644 logon_info = get_logon_info_from_pac(pac_data);
645 if (logon_info == NULL) {
646 DEBUG(1,("winbindd_raw_kerberos_login: no logon info\n"));
647 result = NT_STATUS_INVALID_PARAMETER;
648 goto failed;
649 }
650
651 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
652 local_service));
653
654
655 /* last step:
656 * put results together */
657
658 *info3 = &logon_info->info3;
659
660 /* if we had a user's ccache then return that string for the pam
661 * environment */
662
663 if (!internal_ccache) {
664
665 setup_return_cc_name(state, cc);
666
667 result = add_ccache_to_list(principal_s,
668 cc,
669 service,
670 state->request.data.auth.user,
671 realm,
672 uid,
673 time(NULL),
674 ticket_lifetime,
675 renewal_until,
676 False);
677
678 if (!NT_STATUS_IS_OK(result)) {
679 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
680 nt_errstr(result)));
681 }
682 } else {
683
684 /* need to delete the memory cred cache, it is not used anymore */
685
686 krb5_ret = ads_kdestroy(cc);
687 if (krb5_ret) {
688 DEBUG(3,("winbindd_raw_kerberos_login: "
689 "could not destroy krb5 credential cache: "
690 "%s\n", error_message(krb5_ret)));
691 }
692
693 }
694
695 result = NT_STATUS_OK;
696
697 goto done;
698
699 failed:
700
701 /* we could have created a new credential cache with a valid tgt in it
702 * but we werent able to get or verify the service ticket for this
703 * local host and therefor didn't get the PAC, we need to remove that
704 * cache entirely now */
705
706 krb5_ret = ads_kdestroy(cc);
707 if (krb5_ret) {
708 DEBUG(3,("winbindd_raw_kerberos_login: "
709 "could not destroy krb5 credential cache: "
710 "%s\n", error_message(krb5_ret)));
711 }
712
713 if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
714 DEBUG(3,("winbindd_raw_kerberos_login: "
715 "could not remove ccache for user %s\n",
716 state->request.data.auth.user));
717 }
718
719 done:
720 data_blob_free(&session_key);
721 data_blob_free(&session_key_krb5);
722 data_blob_free(&ap_rep);
723 data_blob_free(&tkt);
724
725 SAFE_FREE(client_princ_out);
726
727 if (!internal_ccache) {
728 gain_root_privilege();
729 }
730
731 return result;
732 #else
733 return NT_STATUS_NOT_SUPPORTED;
734 #endif /* HAVE_KRB5 */
735 }
736
737 void winbindd_pam_auth(struct winbindd_cli_state *state)
738 {
739 struct winbindd_domain *domain;
740 fstring name_domain, name_user;
741
742 /* Ensure null termination */
743 state->request.data.auth.user
744 [sizeof(state->request.data.auth.user)-1]='\0';
745
746 /* Ensure null termination */
747 state->request.data.auth.pass
748 [sizeof(state->request.data.auth.pass)-1]='\0';
749
750 DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
751 state->request.data.auth.user));
752
753 /* Parse domain and username */
754
755 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
756
757 if (!canonicalize_username(state->request.data.auth.user,
758 name_domain, name_user)) {
759 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
760 DEBUG(5, ("Plain text authentication for %s returned %s "
761 "(PAM: %d)\n",
762 state->request.data.auth.user,
763 state->response.data.auth.nt_status_string,
764 state->response.data.auth.pam_error));
765 request_error(state);
766 return;
767 }
768
769 domain = find_auth_domain(state, name_domain);
770
771 if (domain == NULL) {
772 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
773 DEBUG(5, ("Plain text authentication for %s returned %s "
774 "(PAM: %d)\n",
775 state->request.data.auth.user,
776 state->response.data.auth.nt_status_string,
777 state->response.data.auth.pam_error));
778 request_error(state);
779 return;
780 }
781
782 sendto_domain(state, domain);
783 }
784
785 NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
786 struct winbindd_cli_state *state,
787 NET_USER_INFO_3 **info3)
788 {
789 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
790 uint16 max_allowed_bad_attempts;
791 fstring name_domain, name_user;
792 DOM_SID sid;
793 enum lsa_SidType type;
794 uchar new_nt_pass[NT_HASH_LEN];
795 const uint8 *cached_nt_pass;
796 const uint8 *cached_salt;
797 NET_USER_INFO_3 *my_info3;
798 time_t kickoff_time, must_change_time;
799 BOOL password_good = False;
800
801 *info3 = NULL;
802
803 ZERO_STRUCTP(info3);
804
805 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
806
807 /* Parse domain and username */
808
809 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
810
811
812 if (!lookup_cached_name(state->mem_ctx,
813 name_domain,
814 name_user,
815 &sid,
816 &type)) {
817 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
818 return NT_STATUS_NO_SUCH_USER;
819 }
820
821 if (type != SID_NAME_USER) {
822 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
823 return NT_STATUS_LOGON_FAILURE;
824 }
825
826 result = winbindd_get_creds(domain,
827 state->mem_ctx,
828 &sid,
829 &my_info3,
830 &cached_nt_pass,
831 &cached_salt);
832 if (!NT_STATUS_IS_OK(result)) {
833 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
834 return result;
835 }
836
837 *info3 = my_info3;
838
839 E_md4hash(state->request.data.auth.pass, new_nt_pass);
840
841 #if DEBUG_PASSWORD
842 dump_data(100, (const char *)new_nt_pass, NT_HASH_LEN);
843 dump_data(100, (const char *)cached_nt_pass, NT_HASH_LEN);
844 if (cached_salt) {
845 dump_data(100, (const char *)cached_salt, NT_HASH_LEN);
846 }
847 #endif
848
849 if (cached_salt) {
850 /* In this case we didn't store the nt_hash itself,
851 but the MD5 combination of salt + nt_hash. */
852 uchar salted_hash[NT_HASH_LEN];
853 E_md5hash(cached_salt, new_nt_pass, salted_hash);
854
855 password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
856 True : False;
857 } else {
858 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
859 password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
860 True : False;
861 }
862
863 if (password_good) {
864
865 /* User *DOES* know the password, update logon_time and reset
866 * bad_pw_count */
867
868 my_info3->user_flgs |= LOGON_CACHED_ACCOUNT;
869
870 if (my_info3->acct_flags & ACB_AUTOLOCK) {
871 return NT_STATUS_ACCOUNT_LOCKED_OUT;
872 }
873
874 if (my_info3->acct_flags & ACB_DISABLED) {
875 return NT_STATUS_ACCOUNT_DISABLED;
876 }
877
878 if (my_info3->acct_flags & ACB_WSTRUST) {
879 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
880 }
881
882 if (my_info3->acct_flags & ACB_SVRTRUST) {
883 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
884 }
885
886 if (my_info3->acct_flags & ACB_DOMTRUST) {
887 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
888 }
889
890 if (!(my_info3->acct_flags & ACB_NORMAL)) {
891 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
892 my_info3->acct_flags));
893 return NT_STATUS_LOGON_FAILURE;
894 }
895
896 kickoff_time = nt_time_to_unix(my_info3->kickoff_time);
897 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
898 return NT_STATUS_ACCOUNT_EXPIRED;
899 }
900
901 must_change_time = nt_time_to_unix(my_info3->pass_must_change_time);
902 if (must_change_time != 0 && must_change_time < time(NULL)) {
903 /* we allow grace logons when the password has expired */
904 my_info3->user_flgs |= LOGON_GRACE_LOGON;
905 /* return NT_STATUS_PASSWORD_EXPIRED; */
906 goto success;
907 }
908
909 #ifdef HAVE_KRB5
910 /* FIXME: what else points out that the remote domain is AD ? */
911 if (!strequal(domain->name, domain->alt_name) &&
912 (state->request.flags & WBFLAG_PAM_KRB5)) {
913
914 uid_t uid = -1;
915 const char *cc = NULL;
916 char *realm = NULL;
917 const char *principal_s = NULL;
918 const char *service = NULL;
919 BOOL internal_ccache = False;
920
921 uid = get_uid_from_state(state);
922 if (uid == -1) {
923 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
924 return NT_STATUS_INVALID_PARAMETER;
925 }
926
927 cc = generate_krb5_ccache(state->mem_ctx,
928 state->request.data.auth.krb5_cc_type,
929 state->request.data.auth.uid,
930 &internal_ccache);
931 if (cc == NULL) {
932 return NT_STATUS_NO_MEMORY;
933 }
934
935 realm = domain->alt_name;
936 strupper_m(realm);
937
938 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
939 if (principal_s == NULL) {
940 return NT_STATUS_NO_MEMORY;
941 }
942
943 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
944 if (service == NULL) {
945 return NT_STATUS_NO_MEMORY;
946 }
947
948 if (!internal_ccache) {
949
950 setup_return_cc_name(state, cc);
951
952 result = add_ccache_to_list(principal_s,
953 cc,
954 service,
955 state->request.data.auth.user,
956 domain->alt_name,
957 uid,
958 time(NULL),
959 time(NULL) + lp_winbind_cache_time(),
960 time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
961 True);
962
963 if (!NT_STATUS_IS_OK(result)) {
964 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
965 "to add ccache to list: %s\n",
966 nt_errstr(result)));
967 }
968 }
969 }
970 #endif /* HAVE_KRB5 */
971 success:
972 /* FIXME: we possibly should handle logon hours as well (does xp when
973 * offline?) see auth/auth_sam.c:sam_account_ok for details */
974
975 unix_to_nt_time(&my_info3->logon_time, time(NULL));
976 my_info3->bad_pw_count = 0;
977
978 result = winbindd_update_creds_by_info3(domain,
979 state->mem_ctx,
980 state->request.data.auth.user,
981 state->request.data.auth.pass,
982 my_info3);
983 if (!NT_STATUS_IS_OK(result)) {
984 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
985 nt_errstr(result)));
986 return result;
987 }
988
989 return NT_STATUS_OK;
990
991 }
992
993 /* User does *NOT* know the correct password, modify info3 accordingly */
994
995 /* failure of this is not critical */
996 result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
997 if (!NT_STATUS_IS_OK(result)) {
998 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
999 "Won't be able to honour account lockout policies\n"));
1000 }
1001
1002 /* increase counter */
1003 my_info3->bad_pw_count++;
1004
1005 if (max_allowed_bad_attempts == 0) {
1006 goto failed;
1007 }
1008
1009 /* lockout user */
1010 if (my_info3->bad_pw_count >= max_allowed_bad_attempts) {
1011
1012 uint32 password_properties;
1013
1014 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1015 if (!NT_STATUS_IS_OK(result)) {
1016 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1017 }
1018
1019 if ((my_info3->user_rid != DOMAIN_USER_RID_ADMIN) ||
1020 (password_properties & DOMAIN_LOCKOUT_ADMINS)) {
1021 my_info3->acct_flags |= ACB_AUTOLOCK;
1022 }
1023 }
1024
1025 failed:
1026 result = winbindd_update_creds_by_info3(domain,
1027 state->mem_ctx,
1028 state->request.data.auth.user,
1029 NULL,
1030 my_info3);
1031
1032 if (!NT_STATUS_IS_OK(result)) {
1033 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1034 nt_errstr(result)));
1035 }
1036
1037 return NT_STATUS_LOGON_FAILURE;
1038 }
1039
1040 NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1041 struct winbindd_cli_state *state,
1042 NET_USER_INFO_3 **info3)
1043 {
1044 struct winbindd_domain *contact_domain;
1045 fstring name_domain, name_user;
1046 NTSTATUS result;
1047
1048 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1049
1050 /* Parse domain and username */
1051
1052 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1053
1054 /* what domain should we contact? */
1055
1056 if ( IS_DC ) {
1057 if (!(contact_domain = find_domain_from_name(name_domain))) {
1058 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1059 state->request.data.auth.user, name_domain, name_user, name_domain));
1060 result = NT_STATUS_NO_SUCH_USER;
1061 goto done;
1062 }
1063
1064 } else {
1065 if (is_myname(name_domain)) {
1066 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1067 result = NT_STATUS_NO_SUCH_USER;
1068 goto done;
1069 }
1070
1071 contact_domain = find_domain_from_name(name_domain);
1072 if (contact_domain == NULL) {
1073 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1074 state->request.data.auth.user, name_domain, name_user, name_domain));
1075
1076 contact_domain = find_our_domain();
1077 }
1078 }
1079
1080 if (contact_domain->initialized &&
1081 contact_domain->active_directory) {
1082 goto try_login;
1083 }
1084
1085 if (!contact_domain->initialized) {
1086 init_dc_connection(contact_domain);
1087 }
1088
1089 if (!contact_domain->active_directory) {
1090 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1091 return NT_STATUS_INVALID_LOGON_TYPE;
1092 }
1093 try_login:
1094 result = winbindd_raw_kerberos_login(contact_domain, state, info3);
1095 done:
1096 return result;
1097 }
1098
1099 NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
1100 struct winbindd_cli_state *state,
1101 NET_USER_INFO_3 **info3)
1102 {
1103
1104 struct rpc_pipe_client *netlogon_pipe;
1105 uchar chal[8];
1106 DATA_BLOB lm_resp;
1107 DATA_BLOB nt_resp;
1108 int attempts = 0;
1109 unsigned char local_lm_response[24];
1110 unsigned char local_nt_response[24];
1111 struct winbindd_domain *contact_domain;
1112 fstring name_domain, name_user;
1113 BOOL retry;
1114 NTSTATUS result;
1115 NET_USER_INFO_3 *my_info3;
1116
1117 ZERO_STRUCTP(info3);
1118
1119 *info3 = NULL;
1120
1121 my_info3 = TALLOC_ZERO_P(state->mem_ctx, NET_USER_INFO_3);
1122 if (my_info3 == NULL) {
1123 return NT_STATUS_NO_MEMORY;
1124 }
1125
1126
1127 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1128
1129 /* Parse domain and username */
1130
1131 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1132
1133 /* do password magic */
1134
1135
1136 generate_random_buffer(chal, 8);
1137 if (lp_client_ntlmv2_auth()) {
1138 DATA_BLOB server_chal;
1139 DATA_BLOB names_blob;
1140 DATA_BLOB nt_response;
1141 DATA_BLOB lm_response;
1142 server_chal = data_blob_talloc(state->mem_ctx, chal, 8);
1143
1144 /* note that the 'workgroup' here is a best guess - we don't know
1145 the server's domain at this point. The 'server name' is also
1146 dodgy...
1147 */
1148 names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1149
1150 if (!SMBNTLMv2encrypt(name_user, name_domain,
1151 state->request.data.auth.pass,
1152 &server_chal,
1153 &names_blob,
1154 &lm_response, &nt_response, NULL)) {
1155 data_blob_free(&names_blob);
1156 data_blob_free(&server_chal);
1157 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1158 result = NT_STATUS_NO_MEMORY;
1159 goto done;
1160 }
1161 data_blob_free(&names_blob);
1162 data_blob_free(&server_chal);
1163 lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data,
1164 lm_response.length);
1165 nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data,
1166 nt_response.length);
1167 data_blob_free(&lm_response);
1168 data_blob_free(&nt_response);
1169
1170 } else {
1171 if (lp_client_lanman_auth()
1172 && SMBencrypt(state->request.data.auth.pass,
1173 chal,
1174 local_lm_response)) {
1175 lm_resp = data_blob_talloc(state->mem_ctx,
1176 local_lm_response,
1177 sizeof(local_lm_response));
1178 } else {
1179 lm_resp = data_blob(NULL, 0);
1180 }
1181 SMBNTencrypt(state->request.data.auth.pass,
1182 chal,
1183 local_nt_response);
1184
1185 nt_resp = data_blob_talloc(state->mem_ctx,
1186 local_nt_response,
1187 sizeof(local_nt_response));
1188 }
1189
1190 /* what domain should we contact? */
1191
1192 if ( IS_DC ) {
1193 if (!(contact_domain = find_domain_from_name(name_domain))) {
1194 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1195 state->request.data.auth.user, name_domain, name_user, name_domain));
1196 result = NT_STATUS_NO_SUCH_USER;
1197 goto done;
1198 }
1199
1200 } else {
1201 if (is_myname(name_domain)) {
1202 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1203 result = NT_STATUS_NO_SUCH_USER;
1204 goto done;
1205 }
1206
1207 contact_domain = find_our_domain();
1208 }
1209
1210 /* check authentication loop */
1211
1212 do {
1213
1214 ZERO_STRUCTP(my_info3);
1215 retry = False;
1216
1217 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1218
1219 if (!NT_STATUS_IS_OK(result)) {
1220 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1221 goto done;
1222 }
1223
1224 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1225 state->mem_ctx,
1226 0,
1227 contact_domain->dcname, /* server name */
1228 name_user, /* user name */
1229 name_domain, /* target domain */
1230 global_myname(), /* workstation */
1231 chal,
1232 lm_resp,
1233 nt_resp,
1234 my_info3);
1235 attempts += 1;
1236
1237 /* We have to try a second time as cm_connect_netlogon
1238 might not yet have noticed that the DC has killed
1239 our connection. */
1240
1241 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1242 retry = True;
1243 continue;
1244 }
1245
1246 /* if we get access denied, a possible cause was that we had
1247 and open connection to the DC, but someone changed our
1248 machine account password out from underneath us using 'net
1249 rpc changetrustpw' */
1250
1251 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1252 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1253 "ACCESS_DENIED. Maybe the trust account "
1254 "password was changed and we didn't know it. "
1255 "Killing connections to domain %s\n",
1256 name_domain));
1257 invalidate_cm_connection(&contact_domain->conn);
1258 retry = True;
1259 }
1260
1261 } while ( (attempts < 2) && retry );
1262
1263 /* handle the case where a NT4 DC does not fill in the acct_flags in
1264 * the samlogon reply info3. When accurate info3 is required by the
1265 * caller, we look up the account flags ourselve - gd */
1266
1267 if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
1268 (my_info3->acct_flags == 0) && NT_STATUS_IS_OK(result)) {
1269
1270 struct rpc_pipe_client *samr_pipe;
1271 POLICY_HND samr_domain_handle, user_pol;
1272 SAM_USERINFO_CTR *user_ctr;
1273 NTSTATUS status_tmp;
1274 uint32 acct_flags;
1275
1276 ZERO_STRUCT(user_ctr);
1277
1278 status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
1279 &samr_pipe, &samr_domain_handle);
1280
1281 if (!NT_STATUS_IS_OK(status_tmp)) {
1282 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1283 nt_errstr(status_tmp)));
1284 goto done;
1285 }
1286
1287 status_tmp = rpccli_samr_open_user(samr_pipe, state->mem_ctx,
1288 &samr_domain_handle,
1289 MAXIMUM_ALLOWED_ACCESS,
1290 my_info3->user_rid, &user_pol);
1291
1292 if (!NT_STATUS_IS_OK(status_tmp)) {
1293 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1294 nt_errstr(status_tmp)));
1295 goto done;
1296 }
1297
1298 status_tmp = rpccli_samr_query_userinfo(samr_pipe, state->mem_ctx,
1299 &user_pol, 16, &user_ctr);
1300
1301 if (!NT_STATUS_IS_OK(status_tmp)) {
1302 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1303 nt_errstr(status_tmp)));
1304 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1305 goto done;
1306 }
1307
1308 acct_flags = user_ctr->info.id16->acb_info;
1309
1310 if (acct_flags == 0) {
1311 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1312 goto done;
1313 }
1314
1315 my_info3->acct_flags = acct_flags;
1316
1317 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1318
1319 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1320 }
1321
1322 *info3 = my_info3;
1323 done:
1324 return result;
1325 }
1326
1327 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1328 struct winbindd_cli_state *state)
1329 {
1330 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1331 fstring name_domain, name_user;
1332 NET_USER_INFO_3 *info3 = NULL;
1333
1334 /* Ensure null termination */
1335 state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
1336
1337 /* Ensure null termination */
1338 state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
1339
1340 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1341 state->request.data.auth.user));
1342
1343 /* Parse domain and username */
1344
1345 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1346
1347 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1348
1349 if (domain->online == False) {
1350 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1351 if (domain->startup) {
1352 /* Logons are very important to users. If we're offline and
1353 we get a request within the first 30 seconds of startup,
1354 try very hard to find a DC and go online. */
1355
1356 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1357 "request in startup mode.\n", domain->name ));
1358
1359 winbindd_flush_negative_conn_cache(domain);
1360 result = init_dc_connection(domain);
1361 }
1362 }
1363
1364 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1365
1366 /* Check for Kerberos authentication */
1367 if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
1368
1369 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1370
1371 if (NT_STATUS_IS_OK(result)) {
1372 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1373 goto process_result;
1374 } else {
1375 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1376 }
1377
1378 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1379 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1380 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1381 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1382 /* Use set_domain_offline() instead of
1383 * just set status offline, otherwise,
1384 * domain will never goes online again
1385 * --- BoYang */
1386 set_domain_offline(domain);
1387 }
1388
1389 /* there are quite some NT_STATUS errors where there is no
1390 * point in retrying with a samlogon, we explictly have to take
1391 * care not to increase the bad logon counter on the DC */
1392
1393 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1394 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1395 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1396 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1397 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1398 NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1399 NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1400 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1401 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1402 NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1403 goto process_result;
1404 }
1405
1406 if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1407 DEBUG(3,("falling back to samlogon\n"));
1408 goto sam_logon;
1409 } else {
1410 goto cached_logon;
1411 }
1412 }
1413
1414 sam_logon:
1415 /* Check for Samlogon authentication */
1416 if (domain->online) {
1417 result = winbindd_dual_pam_auth_samlogon(domain, state, &info3);
1418
1419 if (NT_STATUS_IS_OK(result)) {
1420 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1421 goto process_result;
1422 } else {
1423 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n", nt_errstr(result)));
1424 if (domain->online) {
1425 /* We're still online - fail. */
1426 goto done;
1427 }
1428 /* Else drop through and see if we can check offline.... */
1429 }
1430 }
1431
1432 cached_logon:
1433 /* Check for Cached logons */
1434 if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
1435 lp_winbind_offline_logon()) {
1436
1437 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1438
1439 if (NT_STATUS_IS_OK(result)) {
1440 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1441 goto process_result;
1442 } else {
1443 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1444 goto done;
1445 }
1446 }
1447
1448 process_result:
1449
1450 if (NT_STATUS_IS_OK(result)) {
1451
1452 DOM_SID user_sid;
1453
1454 /* In all codepaths where result == NT_STATUS_OK info3 must have
1455 been initialized. */
1456 if (!info3) {
1457 result = NT_STATUS_INTERNAL_ERROR;
1458 goto done;
1459 }
1460
1461 netsamlogon_cache_store(name_user, info3);
1462 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1463
1464 /* save name_to_sid info as early as possible */
1465 sid_compose(&user_sid, &info3->dom_sid.sid, info3->user_rid);
1466 cache_name2sid(domain, name_domain, name_user, SID_NAME_USER, &user_sid);
1467
1468 /* Check if the user is in the right group */
1469
1470 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1471 state->request.data.auth.require_membership_of_sid))) {
1472 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1473 state->request.data.auth.user,
1474 state->request.data.auth.require_membership_of_sid));
1475 goto done;
1476 }
1477
1478 if (state->request.flags & WBFLAG_PAM_INFO3_NDR) {
1479 result = append_info3_as_ndr(state->mem_ctx, state, info3);
1480 if (!NT_STATUS_IS_OK(result)) {
1481 DEBUG(10,("Failed to append INFO3 (NDR): %s\n", nt_errstr(result)));
1482 goto done;
1483 }
1484 }
1485
1486 if (state->request.flags & WBFLAG_PAM_INFO3_TEXT) {
1487 result = append_info3_as_txt(state->mem_ctx, state, info3);
1488 if (!NT_STATUS_IS_OK(result)) {
1489 DEBUG(10,("Failed to append INFO3 (TXT): %s\n", nt_errstr(result)));
1490 goto done;
1491 }
1492
1493 }
1494
1495 if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
1496
1497 /* Store in-memory creds for single-signon using ntlm_auth. */
1498 result = winbindd_add_memory_creds(state->request.data.auth.user,
1499 get_uid_from_state(state),
1500 state->request.data.auth.pass);
1501
1502 if (!NT_STATUS_IS_OK(result)) {
1503 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
1504 goto done;
1505 }
1506
1507 if (lp_winbind_offline_logon()) {
1508 result = winbindd_store_creds(domain,
1509 state->mem_ctx,
1510 state->request.data.auth.user,
1511 state->request.data.auth.pass,
1512 info3, NULL);
1513 if (!NT_STATUS_IS_OK(result)) {
1514
1515 /* Release refcount. */
1516 winbindd_delete_memory_creds(state->request.data.auth.user);
1517
1518 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
1519 goto done;
1520 }
1521 }
1522 }
1523
1524 if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
1525 result = fillup_password_policy(domain, state);
1526
1527 if (!NT_STATUS_IS_OK(result)) {
1528 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
1529 goto done;
1530 }
1531 }
1532
1533 if (state->request.flags & WBFLAG_PAM_UNIX_NAME) {
1534 /* We've been asked to return the unix username, per
1535 'winbind use default domain' settings and the like */
1536
1537 fstring username_out;
1538 const char *nt_username, *nt_domain;
1539
1540 if (!(nt_username = unistr2_tdup(state->mem_ctx, &info3->uni_user_name))) {
1541 /* If the server didn't give us one, just use the one we sent them */
1542 nt_username = name_user;
1543 }
1544
1545 if (!(nt_domain = unistr2_tdup(state->mem_ctx, &info3->uni_logon_dom))) {
1546 /* If the server didn't give us one, just use the one we sent them */
1547 nt_domain = name_domain;
1548 }
1549
1550 fill_domain_username(username_out, nt_domain, nt_username, True);
1551
1552 DEBUG(5, ("Setting unix username to [%s]\n", username_out));
1553
1554 SAFE_FREE(state->response.extra_data.data);
1555 state->response.extra_data.data = SMB_STRDUP(username_out);
1556 if (!state->response.extra_data.data) {
1557 result = NT_STATUS_NO_MEMORY;
1558 goto done;
1559 }
1560 state->response.length +=
1561 strlen((const char *)state->response.extra_data.data)+1;
1562 }
1563 }
1564
1565
1566 done:
1567 /* give us a more useful (more correct?) error code */
1568 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1569 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1570 result = NT_STATUS_NO_LOGON_SERVERS;
1571 }
1572
1573 state->response.data.auth.nt_status = NT_STATUS_V(result);
1574 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1575
1576 /* we might have given a more useful error above */
1577 if (!*state->response.data.auth.error_string)
1578 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1579 state->response.data.auth.pam_error = nt_status_to_pam(result);
1580
1581 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1582 state->request.data.auth.user,
1583 state->response.data.auth.nt_status_string,
1584 state->response.data.auth.pam_error));
1585
1586 if ( NT_STATUS_IS_OK(result) && info3 &&
1587 (state->request.flags & WBFLAG_PAM_AFS_TOKEN) ) {
1588
1589 char *afsname = talloc_strdup(state->mem_ctx,
1590 lp_afs_username_map());
1591 char *cell;
1592
1593 if (afsname == NULL) {
1594 goto no_token;
1595 }
1596
1597 afsname = talloc_string_sub(state->mem_ctx,
1598 lp_afs_username_map(),
1599 "%D", name_domain);
1600 afsname = talloc_string_sub(state->mem_ctx, afsname,
1601 "%u", name_user);
1602 afsname = talloc_string_sub(state->mem_ctx, afsname,
1603 "%U", name_user);
1604
1605 {
1606 DOM_SID user_sid;
1607 fstring sidstr;
1608
1609 sid_copy(&user_sid, &info3->dom_sid.sid);
1610 sid_append_rid(&user_sid, info3->user_rid);
1611 sid_to_string(sidstr, &user_sid);
1612 afsname = talloc_string_sub(state->mem_ctx, afsname,
1613 "%s", sidstr);
1614 }
1615
1616 if (afsname == NULL) {
1617 goto no_token;
1618 }
1619
1620 strlower_m(afsname);
1621
1622 DEBUG(10, ("Generating token for user %s\n", afsname));
1623
1624 cell = strchr(afsname, '@');
1625
1626 if (cell == NULL) {
1627 goto no_token;
1628 }
1629
1630 *cell = '\0';
1631 cell += 1;
1632
1633 /* Append an AFS token string */
1634 SAFE_FREE(state->response.extra_data.data);
1635 state->response.extra_data.data =
1636 afs_createtoken_str(afsname, cell);
1637
1638 if (state->response.extra_data.data != NULL) {
1639 state->response.length +=
1640 strlen((const char *)state->response.extra_data.data)+1;
1641 }
1642
1643 no_token:
1644 TALLOC_FREE(afsname);
1645 }
1646
1647 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1648 }
1649
1650
1651 /**********************************************************************
1652 Challenge Response Authentication Protocol
1653 **********************************************************************/
1654
1655 void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
1656 {
1657 struct winbindd_domain *domain = NULL;
1658 const char *domain_name = NULL;
1659 NTSTATUS result;
1660
1661 if (!state->privileged) {
1662 char *error_string = NULL;
1663 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1664 "denied. !\n"));
1665 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1666 "on %s are set correctly.\n",
1667 get_winbind_priv_pipe_dir()));
1668 /* send a better message than ACCESS_DENIED */
1669 error_string = talloc_asprintf(state->mem_ctx,
1670 "winbind client not authorized "
1671 "to use winbindd_pam_auth_crap."
1672 " Ensure permissions on %s "
1673 "are set correctly.",
1674 get_winbind_priv_pipe_dir());
1675 fstrcpy(state->response.data.auth.error_string, error_string);
1676 result = NT_STATUS_ACCESS_DENIED;
1677 goto done;
1678 }
1679
1680 /* Ensure null termination */
1681 state->request.data.auth_crap.user
1682 [sizeof(state->request.data.auth_crap.user)-1]=0;
1683 state->request.data.auth_crap.domain
1684 [sizeof(state->request.data.auth_crap.domain)-1]=0;
1685
1686 DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1687 (unsigned long)state->pid,
1688 state->request.data.auth_crap.domain,
1689 state->request.data.auth_crap.user));
1690
1691 if (*state->request.data.auth_crap.domain != '\0') {
1692 domain_name = state->request.data.auth_crap.domain;
1693 } else if (lp_winbind_use_default_domain()) {
1694 domain_name = lp_workgroup();
1695 }
1696
1697 if (domain_name != NULL)
1698 domain = find_auth_domain(state, domain_name);
1699
1700 if (domain != NULL) {
1701 sendto_domain(state, domain);
1702 return;
1703 }
1704
1705 result = NT_STATUS_NO_SUCH_USER;
1706
1707 done:
1708 set_auth_errors(&state->response, result);
1709 DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1710 state->request.data.auth_crap.domain,
1711 state->request.data.auth_crap.user,
1712 state->response.data.auth.nt_status_string,
1713 state->response.data.auth.pam_error));
1714 request_error(state);
1715 return;
1716 }
1717
1718
1719 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1720 struct winbindd_cli_state *state)
1721 {
1722 NTSTATUS result;
1723 NET_USER_INFO_3 info3;
1724 struct rpc_pipe_client *netlogon_pipe;
1725 const char *name_user = NULL;
1726 const char *name_domain = NULL;
1727 const char *workstation;
1728 struct winbindd_domain *contact_domain;
1729 int attempts = 0;
1730 BOOL retry;
1731
1732 DATA_BLOB lm_resp, nt_resp;
1733
1734 /* This is child-only, so no check for privileged access is needed
1735 anymore */
1736
1737 /* Ensure null termination */
1738 state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
1739 state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
1740
1741 name_user = state->request.data.auth_crap.user;
1742
1743 if (*state->request.data.auth_crap.domain) {
1744 name_domain = state->request.data.auth_crap.domain;
1745 } else if (lp_winbind_use_default_domain()) {
1746 name_domain = lp_workgroup();
1747 } else {
1748 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1749 name_user));
1750 result = NT_STATUS_NO_SUCH_USER;
1751 goto done;
1752 }
1753
1754 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1755 name_domain, name_user));
1756
1757 if (*state->request.data.auth_crap.workstation) {
1758 workstation = state->request.data.auth_crap.workstation;
1759 } else {
1760 workstation = global_myname();
1761 }
1762
1763 if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
1764 || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
1765 if (!state->request.flags & WBFLAG_BIG_NTLMV2_BLOB ||
1766 state->request.extra_len != state->request.data.auth_crap.nt_resp_len) {
1767 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1768 state->request.data.auth_crap.lm_resp_len,
1769 state->request.data.auth_crap.nt_resp_len));
1770 result = NT_STATUS_INVALID_PARAMETER;
1771 goto done;
1772 }
1773 }
1774
1775 lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
1776 state->request.data.auth_crap.lm_resp_len);
1777 if (state->request.flags & WBFLAG_BIG_NTLMV2_BLOB) {
1778 nt_resp = data_blob_talloc(state->mem_ctx,
1779 state->request.extra_data.data,
1780 state->request.data.auth_crap.nt_resp_len);
1781 } else {
1782 nt_resp = data_blob_talloc(state->mem_ctx,
1783 state->request.data.auth_crap.nt_resp,
1784 state->request.data.auth_crap.nt_resp_len);
1785 }
1786
1787 /* what domain should we contact? */
1788
1789 if ( IS_DC ) {
1790 if (!(contact_domain = find_domain_from_name(name_domain))) {
1791 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1792 state->request.data.auth_crap.user, name_domain, name_user, name_domain));
1793 result = NT_STATUS_NO_SUCH_USER;
1794 goto done;
1795 }
1796 } else {
1797 if (is_myname(name_domain)) {
1798 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1799 result = NT_STATUS_NO_SUCH_USER;
1800 goto done;
1801 }
1802 contact_domain = find_our_domain();
1803 }
1804
1805 do {
1806 ZERO_STRUCT(info3);
1807 retry = False;
1808
1809 netlogon_pipe = NULL;
1810 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1811
1812 if (!NT_STATUS_IS_OK(result)) {
1813 DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1814 nt_errstr(result)));
1815 goto done;
1816 }
1817
1818 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1819 state->mem_ctx,
1820 state->request.data.auth_crap.logon_parameters,
1821 contact_domain->dcname,
1822 name_user,
1823 name_domain,
1824 /* Bug #3248 - found by Stefan Burkei. */
1825 workstation, /* We carefully set this above so use it... */
1826 state->request.data.auth_crap.chal,
1827 lm_resp,
1828 nt_resp,
1829 &info3);
1830
1831 attempts += 1;
1832
1833 /* We have to try a second time as cm_connect_netlogon
1834 might not yet have noticed that the DC has killed
1835 our connection. */
1836
1837 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1838 retry = True;
1839 continue;
1840 }
1841
1842 /* if we get access denied, a possible cause was that we had and open
1843 connection to the DC, but someone changed our machine account password
1844 out from underneath us using 'net rpc changetrustpw' */
1845
1846 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1847 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1848 "ACCESS_DENIED. Maybe the trust account "
1849 "password was changed and we didn't know it. "
1850 "Killing connections to domain %s\n",
1851 name_domain));
1852 invalidate_cm_connection(&contact_domain->conn);
1853 retry = True;
1854 }
1855
1856 } while ( (attempts < 2) && retry );
1857
1858 if (NT_STATUS_IS_OK(result)) {
1859
1860 netsamlogon_cache_store(name_user, &info3);
1861 wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3);
1862
1863 /* Check if the user is in the right group */
1864
1865 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3,
1866 state->request.data.auth_crap.require_membership_of_sid))) {
1867 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1868 state->request.data.auth_crap.user,
1869 state->request.data.auth_crap.require_membership_of_sid));
1870 goto done;
1871 }
1872
1873 if (state->request.flags & WBFLAG_PAM_INFO3_NDR) {
1874 result = append_info3_as_ndr(state->mem_ctx, state, &info3);
1875 } else if (state->request.flags & WBFLAG_PAM_UNIX_NAME) {
1876 /* ntlm_auth should return the unix username, per
1877 'winbind use default domain' settings and the like */
1878
1879 fstring username_out;
1880 const char *nt_username, *nt_domain;
1881 if (!(nt_username = unistr2_tdup(state->mem_ctx, &(info3.uni_user_name)))) {
1882 /* If the server didn't give us one, just use the one we sent them */
1883 nt_username = name_user;
1884 }
1885
1886 if (!(nt_domain = unistr2_tdup(state->mem_ctx, &(info3.uni_logon_dom)))) {
1887 /* If the server didn't give us one, just use the one we sent them */
1888 nt_domain = name_domain;
1889 }
1890
1891 fill_domain_username(username_out, nt_domain, nt_username, True);
1892
1893 DEBUG(5, ("Setting unix username to [%s]\n", username_out));
1894
1895 SAFE_FREE(state->response.extra_data.data);
1896 state->response.extra_data.data = SMB_STRDUP(username_out);
1897 if (!state->response.extra_data.data) {
1898 result = NT_STATUS_NO_MEMORY;
1899 goto done;
1900 }
1901 state->response.length +=
1902 strlen((const char *)state->response.extra_data.data)+1;
1903 }
1904
1905 if (state->request.flags & WBFLAG_PAM_USER_SESSION_KEY) {
1906 memcpy(state->response.data.auth.user_session_key, info3.user_sess_key,
1907 sizeof(state->response.data.auth.user_session_key) /* 16 */);
1908 }
1909 if (state->request.flags & WBFLAG_PAM_LMKEY) {
1910 memcpy(state->response.data.auth.first_8_lm_hash, info3.lm_sess_key,
1911 sizeof(state->response.data.auth.first_8_lm_hash) /* 8 */);
1912 }
1913 }
1914
1915 done:
1916
1917 /* give us a more useful (more correct?) error code */
1918 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1919 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1920 result = NT_STATUS_NO_LOGON_SERVERS;
1921 }
1922
1923 if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1924 result = nt_status_squash(result);
1925 }
1926
1927 state->response.data.auth.nt_status = NT_STATUS_V(result);
1928 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1929
1930 /* we might have given a more useful error above */
1931 if (!*state->response.data.auth.error_string) {
1932 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1933 }
1934 state->response.data.auth.pam_error = nt_status_to_pam(result);
1935
1936 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1937 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1938 name_domain,
1939 name_user,
1940 state->response.data.auth.nt_status_string,
1941 state->response.data.auth.pam_error));
1942
1943 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1944 }
1945
1946 /* Change a user password */
1947
1948 void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
1949 {
1950 fstring domain, user;
1951 struct winbindd_domain *contact_domain;
1952
1953 DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
1954 state->request.data.chauthtok.user));
1955
1956 /* Setup crap */
1957
1958 if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
1959 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1960 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
1961 "(PAM: %d)\n",
1962 state->request.data.auth.user,
1963 state->response.data.auth.nt_status_string,
1964 state->response.data.auth.pam_error));
1965 request_error(state);
1966 return;
1967 }
1968
1969 contact_domain = find_domain_from_name(domain);
1970 if (!contact_domain) {
1971 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1972 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
1973 state->request.data.chauthtok.user, domain, user, domain));
1974 request_error(state);
1975 return;
1976 }
1977
1978 sendto_domain(state, contact_domain);
1979 }
1980
1981 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1982 struct winbindd_cli_state *state)
1983 {
1984 char *oldpass;
1985 char *newpass = NULL;
1986 POLICY_HND dom_pol;
1987 struct rpc_pipe_client *cli;
1988 BOOL got_info = False;
1989 SAM_UNK_INFO_1 info;
1990 SAMR_CHANGE_REJECT reject;
1991 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1992 fstring domain, user;
1993
1994 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1995 state->request.data.auth.user));
1996
1997 if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
1998 goto done;
1999 }
2000
2001 /* Change password */
2002
2003 oldpass = state->request.data.chauthtok.oldpass;
2004 newpass = state->request.data.chauthtok.newpass;
2005
2006 /* Initialize reject reason */
2007 state->response.data.auth.reject_reason = Undefined;
2008
2009 /* Get sam handle */
2010
2011 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
2012 &dom_pol);
2013 if (!NT_STATUS_IS_OK(result)) {
2014 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2015 goto done;
2016 }
2017
2018 result = rpccli_samr_chgpasswd3(cli, state->mem_ctx, user, newpass, oldpass, &info, &reject);
2019
2020 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2021
2022 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2023 state->response.data.auth.policy.min_length_password =
2024 info.min_length_password;
2025 state->response.data.auth.policy.password_history =
2026 info.password_history;
2027 state->response.data.auth.policy.password_properties =
2028 info.password_properties;
2029 state->response.data.auth.policy.expire =
2030 nt_time_to_unix_abs(&info.expire);
2031 state->response.data.auth.policy.min_passwordage =
2032 nt_time_to_unix_abs(&info.min_passwordage);
2033
2034 state->response.data.auth.reject_reason =
2035 reject.reject_reason;
2036
2037 got_info = True;
2038 }
2039
2040 /* only fallback when the chgpasswd3 call is not supported */
2041 if ((NT_STATUS_EQUAL(result, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR))) ||
2042 (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) ||
2043 (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED))) {
2044
2045 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
2046 nt_errstr(result)));
2047
2048 result = rpccli_samr_chgpasswd_user(cli, state->mem_ctx, user, newpass, oldpass);
2049
2050 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2051 Map to the same status code as Windows 2003. */
2052
2053 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2054 result = NT_STATUS_PASSWORD_RESTRICTION;
2055 }
2056 }
2057
2058 done:
2059
2060 if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
2061
2062 /* Update the single sign-on memory creds. */
2063 result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
2064 newpass);
2065
2066 /* When we login from gdm or xdm and password expires,
2067 * we change the password, but there are no memory crendentials.
2068 * So, winbindd_replace_memory_creds() returns
2069 * NT_STATUS_OBJECT_NAME_NOT_FOUND. This is not a failure.
2070 * --- BoYang
2071 * */
2072 if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
2073 result = NT_STATUS_OK;
2074 }
2075
2076 if (!NT_STATUS_IS_OK(result)) {
2077 DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
2078 goto process_result;
2079 }
2080
2081 if (lp_winbind_offline_logon()) {
2082 result = winbindd_update_creds_by_name(contact_domain,
2083 state->mem_ctx, user,
2084 newpass);
2085 /* Again, this happens when we login from gdm or xdm
2086 * and the password expires, *BUT* cached crendentials
2087 * don't exist. winbindd_update_creds_by_name()
2088 * returns NT_STATUS_NO_SUCH_USER.
2089 * This is not a failure.
2090 * --- BoYang
2091 * */
2092 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
2093 result = NT_STATUS_OK;
2094 }
2095 if (!NT_STATUS_IS_OK(result)) {
2096 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
2097 goto process_result;
2098 }
2099 }
2100 }
2101
2102 if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2103
2104 NTSTATUS policy_ret;
2105
2106 policy_ret = fillup_password_policy(contact_domain, state);
2107
2108 /* failure of this is non critical, it will just provide no
2109 * additional information to the client why the change has
2110 * failed - Guenther */
2111
2112 if (!NT_STATUS_IS_OK(policy_ret)) {
2113 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2114 goto process_result;
2115 }
2116 }
2117
2118 process_result:
2119
2120 state->response.data.auth.nt_status = NT_STATUS_V(result);
2121 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2122 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2123 state->response.data.auth.pam_error = nt_status_to_pam(result);
2124
2125 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2126 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2127 domain,
2128 user,
2129 state->response.data.auth.nt_status_string,
2130 state->response.data.auth.pam_error));
2131
2132 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2133 }
2134
2135 void winbindd_pam_logoff(struct winbindd_cli_state *state)
2136 {
2137 struct winbindd_domain *domain;
2138 fstring name_domain, user;
2139 uid_t caller_uid = (uid_t)-1;
2140 uid_t request_uid = state->request.data.logoff.uid;
2141
2142 DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
2143 state->request.data.logoff.user));
2144
2145 /* Ensure null termination */
2146 state->request.data.logoff.user
2147 [sizeof(state->request.data.logoff.user)-1]='\0';
2148
2149 state->request.data.logoff.krb5ccname
2150 [sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
2151
2152 if (request_uid == (gid_t)-1) {
2153 goto failed;
2154 }
2155
2156 if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
2157 goto failed;
2158 }
2159
2160 if ((domain = find_auth_domain(state, name_domain)) == NULL) {
2161 goto failed;
2162 }
2163
2164 if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
2165 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2166 strerror(errno)));
2167 goto failed;
2168 }
2169
2170 switch (caller_uid) {
2171 case -1:
2172 goto failed;
2173 case 0:
2174 /* root must be able to logoff any user - gd */
2175 state->request.data.logoff.uid = request_uid;
2176 break;
2177 default:
2178 if (caller_uid != request_uid) {
2179 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2180 goto failed;
2181 }
2182 state->request.data.logoff.uid = caller_uid;
2183 break;
2184 }
2185
2186 sendto_domain(state, domain);
2187 return;
2188
2189 failed:
2190 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2191 DEBUG(5, ("Pam Logoff for %s returned %s "
2192 "(PAM: %d)\n",
2193 state->request.data.logoff.user,
2194 state->response.data.auth.nt_status_string,
2195 state->response.data.auth.pam_error));
2196 request_error(state);
2197 return;
2198 }
2199
2200 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2201 struct winbindd_cli_state *state)
2202 {
2203 NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2204
2205 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2206 state->request.data.logoff.user));
2207
2208 if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
2209 result = NT_STATUS_OK;
2210 goto process_result;
2211 }
2212
2213 if (state->request.data.logoff.krb5ccname[0] == '\0') {
2214 result = NT_STATUS_OK;
2215 goto process_result;
2216 }
2217
2218 #ifdef HAVE_KRB5
2219
2220 if (state->request.data.logoff.uid < 0) {
2221 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2222 goto process_result;
2223 }
2224
2225 /* what we need here is to find the corresponding krb5 ccache name *we*
2226 * created for a given username and destroy it */
2227
2228 if (!ccache_entry_exists(state->request.data.logoff.user)) {
2229 result = NT_STATUS_OK;
2230 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2231 goto process_result;
2232 }
2233
2234 if (!ccache_entry_identical(state->request.data.logoff.user,
2235 state->request.data.logoff.uid,
2236 state->request.data.logoff.krb5ccname)) {
2237 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2238 goto process_result;
2239 }
2240
2241 result = remove_ccache(state->request.data.logoff.user);
2242 if (!NT_STATUS_IS_OK(result)) {
2243 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2244 nt_errstr(result)));
2245 goto process_result;
2246 }
2247
2248 #else
2249 result = NT_STATUS_NOT_SUPPORTED;
2250 #endif
2251
2252 process_result:
2253
2254 winbindd_delete_memory_creds(state->request.data.logoff.user);
2255
2256 state->response.data.auth.nt_status = NT_STATUS_V(result);
2257 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2258 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2259 state->response.data.auth.pam_error = nt_status_to_pam(result);
2260
2261 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2262 }
2263
2264 /* Change user password with auth crap*/
2265
2266 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
2267 {
2268 struct winbindd_domain *domain = NULL;
2269 const char *domain_name = NULL;
2270
2271 /* Ensure null termination */
2272 state->request.data.chng_pswd_auth_crap.user[
2273 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2274 state->request.data.chng_pswd_auth_crap.domain[
2275 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2276
2277 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2278 (unsigned long)state->pid,
2279 state->request.data.chng_pswd_auth_crap.domain,
2280 state->request.data.chng_pswd_auth_crap.user));
2281
2282 if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
2283 domain_name = state->request.data.chng_pswd_auth_crap.domain;
2284 } else if (lp_winbind_use_default_domain()) {
2285 domain_name = lp_workgroup();
2286 }
2287
2288 if (domain_name != NULL)
2289 domain = find_domain_from_name(domain_name);
2290
2291 if (domain != NULL) {
2292 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2293 "%s\n", (unsigned long)state->pid,domain->name));
2294 sendto_domain(state, domain);
2295 return;
2296 }
2297
2298 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2299 DEBUG(5, ("CRAP change password for %s\\%s returned %s (PAM: %d)\n",
2300 state->request.data.chng_pswd_auth_crap.domain,
2301 state->request.data.chng_pswd_auth_crap.user,
2302 state->response.data.auth.nt_status_string,
2303 state->response.data.auth.pam_error));
2304 request_error(state);
2305 return;
2306 }
2307
2308 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2309 {
2310 NTSTATUS result;
2311 DATA_BLOB new_nt_password;
2312 DATA_BLOB old_nt_hash_enc;
2313 DATA_BLOB new_lm_password;
2314 DATA_BLOB old_lm_hash_enc;
2315 fstring domain,user;
2316 POLICY_HND dom_pol;
2317 struct winbindd_domain *contact_domain = domainSt;
2318 struct rpc_pipe_client *cli;
2319
2320 /* Ensure null termination */
2321 state->request.data.chng_pswd_auth_crap.user[
2322 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2323 state->request.data.chng_pswd_auth_crap.domain[
2324 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2325 *domain = 0;
2326 *user = 0;
2327
2328 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2329 (unsigned long)state->pid,
2330 state->request.data.chng_pswd_auth_crap.domain,
2331 state->request.data.chng_pswd_auth_crap.user));
2332
2333 if (lp_winbind_offline_logon()) {
2334 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2335 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2336 result = NT_STATUS_ACCESS_DENIED;
2337 goto done;
2338 }
2339
2340 if (*state->request.data.chng_pswd_auth_crap.domain) {
2341 fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
2342 } else {
2343 parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
2344 domain, user);
2345
2346 if(!*domain) {
2347 DEBUG(3,("no domain specified with username (%s) - "
2348 "failing auth\n",
2349 state->request.data.chng_pswd_auth_crap.user));
2350 result = NT_STATUS_NO_SUCH_USER;
2351 goto done;
2352 }
2353 }
2354
2355 if (!*domain && lp_winbind_use_default_domain()) {
2356 fstrcpy(domain,(char *)lp_workgroup());
2357 }
2358
2359 if(!*user) {
2360 fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
2361 }
2362
2363 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2364 (unsigned long)state->pid, domain, user));
2365
2366 /* Change password */
2367 new_nt_password = data_blob_talloc(
2368 state->mem_ctx,
2369 state->request.data.chng_pswd_auth_crap.new_nt_pswd,
2370 state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
2371
2372 old_nt_hash_enc = data_blob_talloc(
2373 state->mem_ctx,
2374 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
2375 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2376
2377 if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2378 new_lm_password = data_blob_talloc(
2379 state->mem_ctx,
2380 state->request.data.chng_pswd_auth_crap.new_lm_pswd,
2381 state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
2382
2383 old_lm_hash_enc = data_blob_talloc(
2384 state->mem_ctx,
2385 state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
2386 state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2387 } else {
2388 new_lm_password.length = 0;
2389 old_lm_hash_enc.length = 0;
2390 }
2391
2392 /* Get sam handle */
2393
2394 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2395 if (!NT_STATUS_IS_OK(result)) {
2396 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2397 goto done;
2398 }
2399
2400 result = rpccli_samr_chng_pswd_auth_crap(
2401 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2402 new_lm_password, old_lm_hash_enc);
2403
2404 done:
2405 state->response.data.auth.nt_status = NT_STATUS_V(result);
2406 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2407 fstrcpy(state->response.data.auth.error_string,
2408 get_friendly_nt_error_msg(result));
2409 state->response.data.auth.pam_error = nt_status_to_pam(result);
2410
2411 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2412 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2413 domain, user,
2414 state->response.data.auth.nt_status_string,
2415 state->response.data.auth.pam_error));
2416
2417 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2418 }
Samba GIT mirror