s3:secrets: rework des_salt_key() to take the realm as argument
[Samba.git] / auth / common_auth.h
blob507971794f3b3068f7fdf562ca67e46ed2150ae6
1 /*
2 Unix SMB/CIFS implementation.
3 Standardised Authentication types
4 Copyright (C) Andrew Bartlett 2001-2010
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #ifndef AUTH_COMMON_AUTH_H
21 #define AUTH_COMMON_AUTH_H
23 #include "librpc/gen_ndr/auth.h"
25 #define USER_INFO_CASE_INSENSITIVE_USERNAME 0x01 /* username may be in any case */
26 #define USER_INFO_CASE_INSENSITIVE_PASSWORD 0x02 /* password may be in any case */
27 #define USER_INFO_DONT_CHECK_UNIX_ACCOUNT 0x04 /* don't check unix account status */
28 #define USER_INFO_INTERACTIVE_LOGON 0x08 /* Interactive logon */
29 /*unused #define USER_INFO_LOCAL_SAM_ONLY 0x10 Only authenticate against the local SAM, do not map missing passwords to NO_SUCH_USER */
30 #define USER_INFO_INFO3_AND_NO_AUTHZ 0x20 /* Only fill in server_info->info3 and do not do any authorization steps */
32 enum auth_password_state {
33 AUTH_PASSWORD_PLAIN = 1,
34 AUTH_PASSWORD_HASH = 2,
35 AUTH_PASSWORD_RESPONSE = 3
38 #define AUTH_SESSION_INFO_DEFAULT_GROUPS 0x01 /* Add the user to the default world and network groups */
39 #define AUTH_SESSION_INFO_AUTHENTICATED 0x02 /* Add the user to the 'authenticated users' group */
40 #define AUTH_SESSION_INFO_SIMPLE_PRIVILEGES 0x04 /* Use a trivial map between users and privilages, rather than a DB */
41 #define AUTH_SESSION_INFO_UNIX_TOKEN 0x08 /* The returned token must have the unix_token and unix_info elements provided */
42 #define AUTH_SESSION_INFO_NTLM 0x10 /* The returned token must have authenticated-with-NTLM flag set */
44 struct auth_usersupplied_info
46 const char *workstation_name;
47 const struct tsocket_address *remote_host;
48 const struct tsocket_address *local_host;
50 uint32_t logon_parameters;
52 bool mapped_state;
53 bool was_mapped;
54 /* the values the client gives us */
55 struct {
56 const char *account_name;
57 const char *domain_name;
58 } client, mapped;
60 enum auth_password_state password_state;
62 struct {
63 struct {
64 DATA_BLOB lanman;
65 DATA_BLOB nt;
66 } response;
67 struct {
68 struct samr_Password *lanman;
69 struct samr_Password *nt;
70 } hash;
72 char *plaintext;
73 } password;
74 uint32_t flags;
76 struct {
77 uint32_t negotiate_flags;
78 enum netr_SchannelType secure_channel_type;
79 const char *computer_name; /* [charset(UTF8)] */
80 const char *account_name; /* [charset(UTF8)] */
81 struct dom_sid *sid; /* [unique] */
82 } netlogon_trust_account;
84 const char *service_description;
85 const char *auth_description;
88 * for logging only, normally worked out from the password but
89 * for krb5 logging only (krb5 normally doesn't use this) we
90 * record the enc type here
92 const char *password_type;
95 struct auth_method_context;
96 struct tevent_context;
97 struct imessaging_context;
98 struct loadparm_context;
99 struct ldb_context;
100 struct smb_krb5_context;
102 struct auth4_context {
103 struct {
104 /* Who set this up in the first place? */
105 const char *set_by;
107 DATA_BLOB data;
108 } challenge;
110 /* methods, in the order they should be called */
111 struct auth_method_context *methods;
113 /* the event context to use for calls that can block */
114 struct tevent_context *event_ctx;
116 /* the messaging context which can be used by backends */
117 struct imessaging_context *msg_ctx;
119 /* loadparm context */
120 struct loadparm_context *lp_ctx;
122 /* SAM database for this local machine - to fill in local groups, or to authenticate local NTLM users */
123 struct ldb_context *sam_ctx;
125 /* Private data for the callbacks on this auth context */
126 void *private_data;
128 NTSTATUS (*check_ntlm_password)(struct auth4_context *auth_ctx,
129 TALLOC_CTX *mem_ctx,
130 const struct auth_usersupplied_info *user_info,
131 uint8_t *pauthoritative,
132 void **server_returned_info,
133 DATA_BLOB *nt_session_key, DATA_BLOB *lm_session_key);
135 NTSTATUS (*get_ntlm_challenge)(struct auth4_context *auth_ctx, uint8_t chal[8]);
137 NTSTATUS (*set_ntlm_challenge)(struct auth4_context *auth_ctx, const uint8_t chal[8], const char *set_by);
139 NTSTATUS (*generate_session_info)(struct auth4_context *auth_context,
140 TALLOC_CTX *mem_ctx,
141 void *server_returned_info,
142 const char *original_user_name,
143 uint32_t session_info_flags,
144 struct auth_session_info **session_info);
146 NTSTATUS (*generate_session_info_pac)(struct auth4_context *auth_ctx,
147 TALLOC_CTX *mem_ctx,
148 struct smb_krb5_context *smb_krb5_context,
149 DATA_BLOB *pac_blob,
150 const char *principal_name,
151 const struct tsocket_address *remote_address,
152 uint32_t session_info_flags,
153 struct auth_session_info **session_info);
156 #define AUTHZ_TRANSPORT_PROTECTION_NONE "NONE"
157 #define AUTHZ_TRANSPORT_PROTECTION_SMB "SMB"
158 #define AUTHZ_TRANSPORT_PROTECTION_TLS "TLS"
159 #define AUTHZ_TRANSPORT_PROTECTION_SEAL "SEAL"
160 #define AUTHZ_TRANSPORT_PROTECTION_SIGN "SIGN"
163 * Log details of an authentication attempt.
164 * Successful and unsuccessful attempts are logged.
166 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
167 * authentication events over the message bus.
169 void log_authentication_event(struct imessaging_context *msg_ctx,
170 struct loadparm_context *lp_ctx,
171 const struct auth_usersupplied_info *ui,
172 NTSTATUS status,
173 const char *account_name,
174 const char *domain_name,
175 const char *unix_username,
176 struct dom_sid *sid);
179 * Log details of a successful authorization to a service.
181 * Only successful authorizations are logged. For clarity:
182 * - NTLM bad passwords will be recorded by log_authentication_event
183 * - Kerberos decrypt failures need to be logged in gensec_gssapi et al
185 * The service may later refuse authorization due to an ACL.
188 * NOTE: msg_ctx and lp_ctx is optional, but when supplied allows streaming the
189 * authorization events over the message bus.
191 void log_successful_authz_event(struct imessaging_context *msg_ctx,
192 struct loadparm_context *lp_ctx,
193 const struct tsocket_address *remote,
194 const struct tsocket_address *local,
195 const char *service_description,
196 const char *auth_type,
197 const char *transport_protection,
198 struct auth_session_info *session_info);
199 #endif