2 Unix SMB/CIFS implementation.
6 Copyright (C) Gerald (Jerry) Carter 2007
8 This library is free software; you can redistribute it and/or
9 modify it under the terms of the GNU Lesser General Public
10 License as published by the Free Software Foundation; either
11 version 3 of the License, or (at your option) any later version.
13 This library is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Library General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 /* Define error types */
31 * @brief Status codes returned from wbc functions
35 WBC_ERR_SUCCESS
= 0, /**< Successful completion **/
36 WBC_ERR_NOT_IMPLEMENTED
,/**< Function not implemented **/
37 WBC_ERR_UNKNOWN_FAILURE
,/**< General failure **/
38 WBC_ERR_NO_MEMORY
, /**< Memory allocation error **/
39 WBC_ERR_INVALID_SID
, /**< Invalid SID format **/
40 WBC_ERR_INVALID_PARAM
, /**< An Invalid parameter was supplied **/
41 WBC_ERR_WINBIND_NOT_AVAILABLE
, /**< Winbind daemon is not available **/
42 WBC_ERR_DOMAIN_NOT_FOUND
, /**< Domain is not trusted or cannot be found **/
43 WBC_ERR_INVALID_RESPONSE
, /**< Winbind returned an invalid response **/
44 WBC_ERR_NSS_ERROR
, /**< NSS_STATUS error **/
45 WBC_ERR_AUTH_ERROR
, /**< Authentication failed **/
46 WBC_ERR_UNKNOWN_USER
, /**< User account cannot be found */
47 WBC_ERR_UNKNOWN_GROUP
, /**< Group account cannot be found */
48 WBC_ERR_PWD_CHANGE_FAILED
/**< Password Change has failed */
51 typedef enum _wbcErrType wbcErr
;
53 #define WBC_ERROR_IS_OK(x) ((x) == WBC_ERR_SUCCESS)
55 const char *wbcErrorString(wbcErr error
);
58 * @brief Some useful details about the wbclient library
60 * 0.1: Initial version
61 * 0.2: Added wbcRemoveUidMapping()
62 * Added wbcRemoveGidMapping()
64 #define WBCLIENT_MAJOR_VERSION 0
65 #define WBCLIENT_MINOR_VERSION 2
66 #define WBCLIENT_VENDOR_VERSION "Samba libwbclient"
67 struct wbcLibraryDetails
{
68 uint16_t major_version
;
69 uint16_t minor_version
;
70 const char *vendor_version
;
74 * @brief Some useful details about the running winbindd
77 struct wbcInterfaceDetails
{
78 uint32_t interface_version
;
79 const char *winbind_version
;
80 char winbind_separator
;
81 const char *netbios_name
;
82 const char *netbios_domain
;
83 const char *dns_domain
;
87 * Data types used by the Winbind Client API
90 #ifndef WBC_MAXSUBAUTHS
91 #define WBC_MAXSUBAUTHS 15 /* max sub authorities in a SID */
95 * @brief Windows Security Identifier
103 uint32_t sub_auths
[WBC_MAXSUBAUTHS
];
107 * @brief Security Identifier type
111 WBC_SID_NAME_USE_NONE
=0,
113 WBC_SID_NAME_DOM_GRP
=2,
114 WBC_SID_NAME_DOMAIN
=3,
115 WBC_SID_NAME_ALIAS
=4,
116 WBC_SID_NAME_WKN_GRP
=5,
117 WBC_SID_NAME_DELETED
=6,
118 WBC_SID_NAME_INVALID
=7,
119 WBC_SID_NAME_UNKNOWN
=8,
120 WBC_SID_NAME_COMPUTER
=9
124 * @brief Security Identifier with attributes
127 struct wbcSidWithAttr
{
128 struct wbcDomainSid sid
;
132 /* wbcSidWithAttr->attributes */
134 #define WBC_SID_ATTR_GROUP_MANDATORY 0x00000001
135 #define WBC_SID_ATTR_GROUP_ENABLED_BY_DEFAULT 0x00000002
136 #define WBC_SID_ATTR_GROUP_ENABLED 0x00000004
137 #define WBC_SID_ATTR_GROUP_OWNER 0x00000008
138 #define WBC_SID_ATTR_GROUP_USEFOR_DENY_ONLY 0x00000010
139 #define WBC_SID_ATTR_GROUP_RESOURCE 0x20000000
140 #define WBC_SID_ATTR_GROUP_LOGON_ID 0xC0000000
143 * @brief Windows GUID
150 uint16_t time_hi_and_version
;
151 uint8_t clock_seq
[2];
156 * @brief Domain Information
159 struct wbcDomainInfo
{
162 struct wbcDomainSid sid
;
163 uint32_t domain_flags
;
164 uint32_t trust_flags
;
168 /* wbcDomainInfo->domain_flags */
170 #define WBC_DOMINFO_DOMAIN_UNKNOWN 0x00000000
171 #define WBC_DOMINFO_DOMAIN_NATIVE 0x00000001
172 #define WBC_DOMINFO_DOMAIN_AD 0x00000002
173 #define WBC_DOMINFO_DOMAIN_PRIMARY 0x00000004
174 #define WBC_DOMINFO_DOMAIN_OFFLINE 0x00000008
176 /* wbcDomainInfo->trust_flags */
178 #define WBC_DOMINFO_TRUST_TRANSITIVE 0x00000001
179 #define WBC_DOMINFO_TRUST_INCOMING 0x00000002
180 #define WBC_DOMINFO_TRUST_OUTGOING 0x00000004
182 /* wbcDomainInfo->trust_type */
184 #define WBC_DOMINFO_TRUSTTYPE_NONE 0x00000000
185 #define WBC_DOMINFO_TRUSTTYPE_FOREST 0x00000001
186 #define WBC_DOMINFO_TRUSTTYPE_IN_FOREST 0x00000002
187 #define WBC_DOMINFO_TRUSTTYPE_EXTERNAL 0x00000003
191 * @brief Auth User Parameters
194 struct wbcAuthUserParams
{
195 const char *account_name
;
196 const char *domain_name
;
197 const char *workstation_name
;
201 uint32_t parameter_control
;
203 enum wbcAuthUserLevel
{
204 WBC_AUTH_USER_LEVEL_PLAIN
= 1,
205 WBC_AUTH_USER_LEVEL_HASH
= 2,
206 WBC_AUTH_USER_LEVEL_RESPONSE
= 3
209 const char *plaintext
;
215 uint8_t challenge
[8];
225 * @brief Generic Blob
237 struct wbcNamedBlob
{
244 * @brief Logon User Parameters
247 struct wbcLogonUserParams
{
248 const char *username
;
249 const char *password
;
251 struct wbcNamedBlob
*blobs
;
255 * @brief ChangePassword Parameters
258 struct wbcChangePasswordParams
{
259 const char *account_name
;
260 const char *domain_name
;
264 enum wbcChangePasswordLevel
{
265 WBC_CHANGE_PASSWORD_LEVEL_PLAIN
= 1,
266 WBC_CHANGE_PASSWORD_LEVEL_RESPONSE
= 2
270 const char *plaintext
;
272 uint32_t old_nt_hash_enc_length
;
273 uint8_t *old_nt_hash_enc_data
;
274 uint32_t old_lm_hash_enc_length
;
275 uint8_t *old_lm_hash_enc_data
;
279 const char *plaintext
;
289 /* wbcAuthUserParams->parameter_control */
291 #define WBC_MSV1_0_CLEARTEXT_PASSWORD_ALLOWED 0x00000002
292 #define WBC_MSV1_0_UPDATE_LOGON_STATISTICS 0x00000004
293 #define WBC_MSV1_0_RETURN_USER_PARAMETERS 0x00000008
294 #define WBC_MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT 0x00000020
295 #define WBC_MSV1_0_RETURN_PROFILE_PATH 0x00000200
296 #define WBC_MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT 0x00000800
298 /* wbcAuthUserParams->flags */
300 #define WBC_AUTH_PARAM_FLAGS_INTERACTIVE_LOGON 0x00000001
303 * @brief Auth User Information
305 * Some of the strings are maybe NULL
308 struct wbcAuthUserInfo
{
312 char *user_principal
;
315 char *dns_domain_name
;
318 uint8_t user_session_key
[16];
319 uint8_t lm_session_key
[8];
321 uint16_t logon_count
;
322 uint16_t bad_password_count
;
325 uint64_t logoff_time
;
326 uint64_t kickoff_time
;
327 uint64_t pass_last_set_time
;
328 uint64_t pass_can_change_time
;
329 uint64_t pass_must_change_time
;
334 char *home_directory
;
338 * the 1st one is the account sid
339 * the 2nd one is the primary_group sid
340 * followed by the rest of the groups
343 struct wbcSidWithAttr
*sids
;
347 * @brief Logon User Information
349 * Some of the strings are maybe NULL
352 struct wbcLogonUserInfo
{
353 struct wbcAuthUserInfo
*info
;
355 struct wbcNamedBlob
*blobs
;
358 /* wbcAuthUserInfo->user_flags */
360 #define WBC_AUTH_USER_INFO_GUEST 0x00000001
361 #define WBC_AUTH_USER_INFO_NOENCRYPTION 0x00000002
362 #define WBC_AUTH_USER_INFO_CACHED_ACCOUNT 0x00000004
363 #define WBC_AUTH_USER_INFO_USED_LM_PASSWORD 0x00000008
364 #define WBC_AUTH_USER_INFO_EXTRA_SIDS 0x00000020
365 #define WBC_AUTH_USER_INFO_SUBAUTH_SESSION_KEY 0x00000040
366 #define WBC_AUTH_USER_INFO_SERVER_TRUST_ACCOUNT 0x00000080
367 #define WBC_AUTH_USER_INFO_NTLMV2_ENABLED 0x00000100
368 #define WBC_AUTH_USER_INFO_RESOURCE_GROUPS 0x00000200
369 #define WBC_AUTH_USER_INFO_PROFILE_PATH_RETURNED 0x00000400
370 #define WBC_AUTH_USER_INFO_GRACE_LOGON 0x01000000
372 /* wbcAuthUserInfo->acct_flags */
374 #define WBC_ACB_DISABLED 0x00000001 /* 1 User account disabled */
375 #define WBC_ACB_HOMDIRREQ 0x00000002 /* 1 Home directory required */
376 #define WBC_ACB_PWNOTREQ 0x00000004 /* 1 User password not required */
377 #define WBC_ACB_TEMPDUP 0x00000008 /* 1 Temporary duplicate account */
378 #define WBC_ACB_NORMAL 0x00000010 /* 1 Normal user account */
379 #define WBC_ACB_MNS 0x00000020 /* 1 MNS logon user account */
380 #define WBC_ACB_DOMTRUST 0x00000040 /* 1 Interdomain trust account */
381 #define WBC_ACB_WSTRUST 0x00000080 /* 1 Workstation trust account */
382 #define WBC_ACB_SVRTRUST 0x00000100 /* 1 Server trust account */
383 #define WBC_ACB_PWNOEXP 0x00000200 /* 1 User password does not expire */
384 #define WBC_ACB_AUTOLOCK 0x00000400 /* 1 Account auto locked */
385 #define WBC_ACB_ENC_TXT_PWD_ALLOWED 0x00000800 /* 1 Encryped text password is allowed */
386 #define WBC_ACB_SMARTCARD_REQUIRED 0x00001000 /* 1 Smart Card required */
387 #define WBC_ACB_TRUSTED_FOR_DELEGATION 0x00002000 /* 1 Trusted for Delegation */
388 #define WBC_ACB_NOT_DELEGATED 0x00004000 /* 1 Not delegated */
389 #define WBC_ACB_USE_DES_KEY_ONLY 0x00008000 /* 1 Use DES key only */
390 #define WBC_ACB_DONT_REQUIRE_PREAUTH 0x00010000 /* 1 Preauth not required */
391 #define WBC_ACB_PW_EXPIRED 0x00020000 /* 1 Password Expired */
392 #define WBC_ACB_NO_AUTH_DATA_REQD 0x00080000 /* 1 = No authorization data required */
394 struct wbcAuthErrorInfo
{
398 char *display_string
;
402 * @brief User Password Policy Information
405 /* wbcUserPasswordPolicyInfo->password_properties */
407 #define WBC_DOMAIN_PASSWORD_COMPLEX 0x00000001
408 #define WBC_DOMAIN_PASSWORD_NO_ANON_CHANGE 0x00000002
409 #define WBC_DOMAIN_PASSWORD_NO_CLEAR_CHANGE 0x00000004
410 #define WBC_DOMAIN_PASSWORD_LOCKOUT_ADMINS 0x00000008
411 #define WBC_DOMAIN_PASSWORD_STORE_CLEARTEXT 0x00000010
412 #define WBC_DOMAIN_REFUSE_PASSWORD_CHANGE 0x00000020
414 struct wbcUserPasswordPolicyInfo
{
415 uint32_t min_length_password
;
416 uint32_t password_history
;
417 uint32_t password_properties
;
419 uint64_t min_passwordage
;
423 * @brief Change Password Reject Reason
426 enum wbcPasswordChangeRejectReason
{
427 WBC_PWD_CHANGE_REJECT_OTHER
=0,
428 WBC_PWD_CHANGE_REJECT_TOO_SHORT
=1,
429 WBC_PWD_CHANGE_REJECT_IN_HISTORY
=2,
430 WBC_PWD_CHANGE_REJECT_COMPLEXITY
=5
434 * @brief Logoff User Parameters
437 struct wbcLogoffUserParams
{
438 const char *username
;
440 struct wbcNamedBlob
*blobs
;
444 * DomainControllerInfo struct
446 struct wbcDomainControllerInfo
{
451 * DomainControllerInfoEx struct
453 struct wbcDomainControllerInfoEx
{
455 const char *dc_address
;
456 uint16_t dc_address_type
;
457 struct wbcGuid
*domain_guid
;
458 const char *domain_name
;
459 const char *forest_name
;
461 const char *dc_site_name
;
462 const char *client_site_name
;
469 void wbcFreeMemory(void*);
473 * Utility functions for dealing with SIDs
476 wbcErr
wbcSidToString(const struct wbcDomainSid
*sid
,
479 wbcErr
wbcStringToSid(const char *sid_string
,
480 struct wbcDomainSid
*sid
);
483 * Utility functions for dealing with GUIDs
486 wbcErr
wbcGuidToString(const struct wbcGuid
*guid
,
489 wbcErr
wbcStringToGuid(const char *guid_string
,
490 struct wbcGuid
*guid
);
492 wbcErr
wbcPing(void);
494 wbcErr
wbcLibraryDetails(struct wbcLibraryDetails
**details
);
496 wbcErr
wbcInterfaceDetails(struct wbcInterfaceDetails
**details
);
499 * Name/SID conversion
502 wbcErr
wbcLookupName(const char *dom_name
,
504 struct wbcDomainSid
*sid
,
505 enum wbcSidType
*name_type
);
507 wbcErr
wbcLookupSid(const struct wbcDomainSid
*sid
,
510 enum wbcSidType
*name_type
);
512 wbcErr
wbcLookupRids(struct wbcDomainSid
*dom_sid
,
515 const char **domain_name
,
517 enum wbcSidType
**types
);
519 wbcErr
wbcLookupUserSids(const struct wbcDomainSid
*user_sid
,
520 bool domain_groups_only
,
522 struct wbcDomainSid
**sids
);
524 wbcErr
wbcListUsers(const char *domain_name
,
526 const char ***users
);
528 wbcErr
wbcListGroups(const char *domain_name
,
529 uint32_t *num_groups
,
530 const char ***groups
);
532 wbcErr
wbcGetDisplayName(const struct wbcDomainSid
*sid
,
535 enum wbcSidType
*pname_type
);
538 * SID/uid/gid Mappings
541 wbcErr
wbcSidToUid(const struct wbcDomainSid
*sid
,
544 wbcErr
wbcUidToSid(uid_t uid
,
545 struct wbcDomainSid
*sid
);
547 wbcErr
wbcSidToGid(const struct wbcDomainSid
*sid
,
550 wbcErr
wbcGidToSid(gid_t gid
,
551 struct wbcDomainSid
*sid
);
553 wbcErr
wbcAllocateUid(uid_t
*puid
);
555 wbcErr
wbcAllocateGid(gid_t
*pgid
);
557 wbcErr
wbcSetUidMapping(uid_t uid
, const struct wbcDomainSid
*sid
);
559 wbcErr
wbcSetGidMapping(gid_t gid
, const struct wbcDomainSid
*sid
);
561 wbcErr
wbcRemoveUidMapping(uid_t uid
, const struct wbcDomainSid
*sid
);
563 wbcErr
wbcRemoveGidMapping(gid_t gid
, const struct wbcDomainSid
*sid
);
565 wbcErr
wbcSetUidHwm(uid_t uid_hwm
);
567 wbcErr
wbcSetGidHwm(gid_t gid_hwm
);
570 * NSS Lookup User/Group details
573 wbcErr
wbcGetpwnam(const char *name
, struct passwd
**pwd
);
575 wbcErr
wbcGetpwuid(uid_t uid
, struct passwd
**pwd
);
577 wbcErr
wbcGetgrnam(const char *name
, struct group
**grp
);
579 wbcErr
wbcGetgrgid(gid_t gid
, struct group
**grp
);
581 wbcErr
wbcSetpwent(void);
583 wbcErr
wbcEndpwent(void);
585 wbcErr
wbcGetpwent(struct passwd
**pwd
);
587 wbcErr
wbcSetgrent(void);
589 wbcErr
wbcEndgrent(void);
591 wbcErr
wbcGetgrent(struct group
**grp
);
593 wbcErr
wbcGetGroups(const char *account
,
594 uint32_t *num_groups
,
599 * Lookup Domain information
602 wbcErr
wbcDomainInfo(const char *domain
,
603 struct wbcDomainInfo
**info
);
605 wbcErr
wbcListTrusts(struct wbcDomainInfo
**domains
,
606 size_t *num_domains
);
608 /* Flags for wbcLookupDomainController */
610 #define WBC_LOOKUP_DC_FORCE_REDISCOVERY 0x00000001
611 #define WBC_LOOKUP_DC_DS_REQUIRED 0x00000010
612 #define WBC_LOOKUP_DC_DS_PREFERRED 0x00000020
613 #define WBC_LOOKUP_DC_GC_SERVER_REQUIRED 0x00000040
614 #define WBC_LOOKUP_DC_PDC_REQUIRED 0x00000080
615 #define WBC_LOOKUP_DC_BACKGROUND_ONLY 0x00000100
616 #define WBC_LOOKUP_DC_IP_REQUIRED 0x00000200
617 #define WBC_LOOKUP_DC_KDC_REQUIRED 0x00000400
618 #define WBC_LOOKUP_DC_TIMESERV_REQUIRED 0x00000800
619 #define WBC_LOOKUP_DC_WRITABLE_REQUIRED 0x00001000
620 #define WBC_LOOKUP_DC_GOOD_TIMESERV_PREFERRED 0x00002000
621 #define WBC_LOOKUP_DC_AVOID_SELF 0x00004000
622 #define WBC_LOOKUP_DC_ONLY_LDAP_NEEDED 0x00008000
623 #define WBC_LOOKUP_DC_IS_FLAT_NAME 0x00010000
624 #define WBC_LOOKUP_DC_IS_DNS_NAME 0x00020000
625 #define WBC_LOOKUP_DC_TRY_NEXTCLOSEST_SITE 0x00040000
626 #define WBC_LOOKUP_DC_DS_6_REQUIRED 0x00080000
627 #define WBC_LOOKUP_DC_RETURN_DNS_NAME 0x40000000
628 #define WBC_LOOKUP_DC_RETURN_FLAT_NAME 0x80000000
630 wbcErr
wbcLookupDomainController(const char *domain
,
632 struct wbcDomainControllerInfo
**dc_info
);
634 wbcErr
wbcLookupDomainControllerEx(const char *domain
,
635 struct wbcGuid
*guid
,
638 struct wbcDomainControllerInfoEx
**dc_info
);
641 * Athenticate functions
644 wbcErr
wbcAuthenticateUser(const char *username
,
645 const char *password
);
647 wbcErr
wbcAuthenticateUserEx(const struct wbcAuthUserParams
*params
,
648 struct wbcAuthUserInfo
**info
,
649 struct wbcAuthErrorInfo
**error
);
651 wbcErr
wbcLogonUser(const struct wbcLogonUserParams
*params
,
652 struct wbcLogonUserInfo
**info
,
653 struct wbcAuthErrorInfo
**error
,
654 struct wbcUserPasswordPolicyInfo
**policy
);
656 wbcErr
wbcLogoffUser(const char *username
,
658 const char *ccfilename
);
660 wbcErr
wbcLogoffUserEx(const struct wbcLogoffUserParams
*params
,
661 struct wbcAuthErrorInfo
**error
);
663 wbcErr
wbcChangeUserPassword(const char *username
,
664 const char *old_password
,
665 const char *new_password
);
667 wbcErr
wbcChangeUserPasswordEx(const struct wbcChangePasswordParams
*params
,
668 struct wbcAuthErrorInfo
**error
,
669 enum wbcPasswordChangeRejectReason
*reject_reason
,
670 struct wbcUserPasswordPolicyInfo
**policy
);
675 wbcErr
wbcResolveWinsByName(const char *name
, char **ip
);
676 wbcErr
wbcResolveWinsByIP(const char *ip
, char **name
);
679 * Trusted domain functions
681 wbcErr
wbcCheckTrustCredentials(const char *domain
,
682 struct wbcAuthErrorInfo
**error
);
686 wbcErr
wbcAddNamedBlob(size_t *num_blobs
,
687 struct wbcNamedBlob
**blobs
,
693 #endif /* _WBCLIENT_H */