2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "auth/auth.h"
27 #include "libcli/security/security.h"
28 #include "libcli/auth/libcli_auth.h"
29 #include "dsdb/samdb/samdb.h"
30 #include "auth/credentials/credentials.h"
32 /* this default function can be used by mostly all backends
33 * which don't want to set a challenge
35 NTSTATUS
auth_get_challenge_not_implemented(struct auth_method_context
*ctx
, TALLOC_CTX
*mem_ctx
, DATA_BLOB
*challenge
)
37 /* we don't want to set a challenge */
38 return NT_STATUS_NOT_IMPLEMENTED
;
41 /****************************************************************************
42 Create an auth_usersupplied_data structure after appropriate mapping.
43 ****************************************************************************/
45 NTSTATUS
map_user_info(TALLOC_CTX
*mem_ctx
,
46 const struct auth_usersupplied_info
*user_info
,
47 struct auth_usersupplied_info
**user_info_mapped
)
52 DEBUG(5,("map_user_info: Mapping user [%s]\\[%s] from workstation [%s]\n",
53 user_info
->client
.domain_name
, user_info
->client
.account_name
, user_info
->workstation_name
));
55 account_name
= talloc_strdup(mem_ctx
, user_info
->client
.account_name
);
57 return NT_STATUS_NO_MEMORY
;
60 /* don't allow "" as a domain, fixes a Win9X bug
61 where it doens't supply a domain for logon script
62 'net use' commands. */
64 /* Split user@realm names into user and realm components. This is TODO to fix with proper userprincipalname support */
65 if (user_info
->client
.domain_name
&& *user_info
->client
.domain_name
) {
66 domain
= user_info
->client
.domain_name
;
67 } else if (strchr_m(user_info
->client
.account_name
, '@')) {
68 d
= strchr_m(account_name
, '@');
70 return NT_STATUS_INTERNAL_ERROR
;
76 domain
= lp_workgroup();
79 *user_info_mapped
= talloc(mem_ctx
, struct auth_usersupplied_info
);
80 if (!*user_info_mapped
) {
81 return NT_STATUS_NO_MEMORY
;
83 talloc_reference(*user_info_mapped
, user_info
);
84 **user_info_mapped
= *user_info
;
85 (*user_info_mapped
)->mapped_state
= True
;
86 (*user_info_mapped
)->mapped
.domain_name
= talloc_strdup(*user_info_mapped
, domain
);
87 (*user_info_mapped
)->mapped
.account_name
= talloc_strdup(*user_info_mapped
, account_name
);
88 talloc_free(account_name
);
89 if (!(*user_info_mapped
)->mapped
.domain_name
90 || !(*user_info_mapped
)->mapped
.account_name
) {
91 return NT_STATUS_NO_MEMORY
;
97 /****************************************************************************
98 Create an auth_usersupplied_data structure after appropriate mapping.
99 ****************************************************************************/
101 NTSTATUS
encrypt_user_info(TALLOC_CTX
*mem_ctx
, struct auth_context
*auth_context
,
102 enum auth_password_state to_state
,
103 const struct auth_usersupplied_info
*user_info_in
,
104 const struct auth_usersupplied_info
**user_info_encrypted
)
107 struct auth_usersupplied_info
*user_info_temp
;
109 case AUTH_PASSWORD_RESPONSE
:
110 switch (user_info_in
->password_state
) {
111 case AUTH_PASSWORD_PLAIN
:
113 const struct auth_usersupplied_info
*user_info_temp2
;
114 nt_status
= encrypt_user_info(mem_ctx
, auth_context
,
116 user_info_in
, &user_info_temp2
);
117 if (!NT_STATUS_IS_OK(nt_status
)) {
120 user_info_in
= user_info_temp2
;
123 case AUTH_PASSWORD_HASH
:
125 const uint8_t *challenge
;
126 DATA_BLOB chall_blob
;
127 user_info_temp
= talloc(mem_ctx
, struct auth_usersupplied_info
);
128 if (!user_info_temp
) {
129 return NT_STATUS_NO_MEMORY
;
131 talloc_reference(user_info_temp
, user_info_in
);
132 *user_info_temp
= *user_info_in
;
133 user_info_temp
->mapped_state
= to_state
;
135 nt_status
= auth_get_challenge(auth_context
, &challenge
);
136 if (!NT_STATUS_IS_OK(nt_status
)) {
140 chall_blob
= data_blob_talloc(mem_ctx
, challenge
, 8);
141 if (lp_client_ntlmv2_auth()) {
142 DATA_BLOB names_blob
= NTLMv2_generate_names_blob(mem_ctx
, lp_netbios_name(), lp_workgroup());
143 DATA_BLOB lmv2_response
, ntlmv2_response
, lmv2_session_key
, ntlmv2_session_key
;
145 if (!SMBNTLMv2encrypt_hash(user_info_temp
,
146 user_info_in
->client
.account_name
,
147 user_info_in
->client
.domain_name
,
148 user_info_in
->password
.hash
.nt
->hash
, &chall_blob
,
150 &lmv2_response
, &ntlmv2_response
,
151 &lmv2_session_key
, &ntlmv2_session_key
)) {
152 data_blob_free(&names_blob
);
153 return NT_STATUS_NO_MEMORY
;
155 data_blob_free(&names_blob
);
156 user_info_temp
->password
.response
.lanman
= lmv2_response
;
157 user_info_temp
->password
.response
.nt
= ntlmv2_response
;
159 data_blob_free(&lmv2_session_key
);
160 data_blob_free(&ntlmv2_session_key
);
162 DATA_BLOB blob
= data_blob_talloc(mem_ctx
, NULL
, 24);
163 SMBOWFencrypt(user_info_in
->password
.hash
.nt
->hash
, challenge
, blob
.data
);
165 user_info_temp
->password
.response
.nt
= blob
;
166 if (lp_client_lanman_auth() && user_info_in
->password
.hash
.lanman
) {
167 DATA_BLOB lm_blob
= data_blob_talloc(mem_ctx
, NULL
, 24);
168 SMBOWFencrypt(user_info_in
->password
.hash
.lanman
->hash
, challenge
, blob
.data
);
169 user_info_temp
->password
.response
.lanman
= lm_blob
;
171 /* if not sending the LM password, send the NT password twice */
172 user_info_temp
->password
.response
.lanman
= user_info_temp
->password
.response
.nt
;
176 user_info_in
= user_info_temp
;
179 case AUTH_PASSWORD_RESPONSE
:
180 *user_info_encrypted
= user_info_in
;
183 case AUTH_PASSWORD_HASH
:
185 switch (user_info_in
->password_state
) {
186 case AUTH_PASSWORD_PLAIN
:
188 struct samr_Password lanman
;
189 struct samr_Password nt
;
191 user_info_temp
= talloc(mem_ctx
, struct auth_usersupplied_info
);
192 if (!user_info_temp
) {
193 return NT_STATUS_NO_MEMORY
;
195 talloc_reference(user_info_temp
, user_info_in
);
196 *user_info_temp
= *user_info_in
;
197 user_info_temp
->mapped_state
= to_state
;
199 if (E_deshash(user_info_in
->password
.plaintext
, lanman
.hash
)) {
200 user_info_temp
->password
.hash
.lanman
= talloc(user_info_temp
,
201 struct samr_Password
);
202 *user_info_temp
->password
.hash
.lanman
= lanman
;
204 user_info_temp
->password
.hash
.lanman
= NULL
;
207 E_md4hash(user_info_in
->password
.plaintext
, nt
.hash
);
208 user_info_temp
->password
.hash
.nt
= talloc(user_info_temp
,
209 struct samr_Password
);
210 *user_info_temp
->password
.hash
.nt
= nt
;
212 user_info_in
= user_info_temp
;
215 case AUTH_PASSWORD_HASH
:
216 *user_info_encrypted
= user_info_in
;
219 return NT_STATUS_INVALID_PARAMETER
;
225 return NT_STATUS_INVALID_PARAMETER
;
231 /***************************************************************************
232 Make a server_info struct from the info3 returned by a domain logon
233 ***************************************************************************/
234 NTSTATUS
make_server_info_netlogon_validation(TALLOC_CTX
*mem_ctx
,
235 const char *account_name
,
236 uint16_t validation_level
,
237 union netr_Validation
*validation
,
238 struct auth_serversupplied_info
**_server_info
)
240 struct auth_serversupplied_info
*server_info
;
241 struct netr_SamBaseInfo
*base
= NULL
;
244 switch (validation_level
) {
246 if (!validation
|| !validation
->sam2
) {
247 return NT_STATUS_INVALID_PARAMETER
;
249 base
= &validation
->sam2
->base
;
252 if (!validation
|| !validation
->sam3
) {
253 return NT_STATUS_INVALID_PARAMETER
;
255 base
= &validation
->sam3
->base
;
258 if (!validation
|| !validation
->sam6
) {
259 return NT_STATUS_INVALID_PARAMETER
;
261 base
= &validation
->sam6
->base
;
264 return NT_STATUS_INVALID_LEVEL
;
267 server_info
= talloc(mem_ctx
, struct auth_serversupplied_info
);
268 NT_STATUS_HAVE_NO_MEMORY(server_info
);
271 Here is where we should check the list of
272 trusted domains, and verify that the SID
275 server_info
->account_sid
= dom_sid_add_rid(server_info
, base
->domain_sid
, base
->rid
);
276 NT_STATUS_HAVE_NO_MEMORY(server_info
->account_sid
);
279 server_info
->primary_group_sid
= dom_sid_add_rid(server_info
, base
->domain_sid
, base
->primary_gid
);
280 NT_STATUS_HAVE_NO_MEMORY(server_info
->primary_group_sid
);
282 server_info
->n_domain_groups
= base
->groups
.count
;
283 if (base
->groups
.count
) {
284 server_info
->domain_groups
= talloc_array(server_info
, struct dom_sid
*, base
->groups
.count
);
285 NT_STATUS_HAVE_NO_MEMORY(server_info
->domain_groups
);
287 server_info
->domain_groups
= NULL
;
290 for (i
= 0; i
< base
->groups
.count
; i
++) {
291 server_info
->domain_groups
[i
] = dom_sid_add_rid(server_info
, base
->domain_sid
, base
->groups
.rids
[i
].rid
);
292 NT_STATUS_HAVE_NO_MEMORY(server_info
->domain_groups
[i
]);
295 /* Copy 'other' sids. We need to do sid filtering here to
296 prevent possible elevation of privileges. See:
298 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
301 if (validation_level
== 3) {
302 struct dom_sid
**dgrps
= server_info
->domain_groups
;
303 size_t sidcount
= server_info
->n_domain_groups
+ validation
->sam3
->sidcount
;
304 size_t n_dgrps
= server_info
->n_domain_groups
;
306 if (validation
->sam3
->sidcount
> 0) {
307 dgrps
= talloc_realloc(server_info
, dgrps
, struct dom_sid
*, sidcount
);
308 NT_STATUS_HAVE_NO_MEMORY(dgrps
);
310 for (i
= 0; i
< validation
->sam3
->sidcount
; i
++) {
311 dgrps
[n_dgrps
+ i
] = talloc_reference(dgrps
, validation
->sam3
->sids
[i
].sid
);
315 server_info
->n_domain_groups
= sidcount
;
316 server_info
->domain_groups
= dgrps
;
318 /* Where are the 'global' sids?... */
321 if (base
->account_name
.string
) {
322 server_info
->account_name
= talloc_reference(server_info
, base
->account_name
.string
);
324 server_info
->account_name
= talloc_strdup(server_info
, account_name
);
325 NT_STATUS_HAVE_NO_MEMORY(server_info
->account_name
);
328 server_info
->domain_name
= talloc_reference(server_info
, base
->domain
.string
);
329 server_info
->full_name
= talloc_reference(server_info
, base
->full_name
.string
);
330 server_info
->logon_script
= talloc_reference(server_info
, base
->logon_script
.string
);
331 server_info
->profile_path
= talloc_reference(server_info
, base
->profile_path
.string
);
332 server_info
->home_directory
= talloc_reference(server_info
, base
->home_directory
.string
);
333 server_info
->home_drive
= talloc_reference(server_info
, base
->home_drive
.string
);
334 server_info
->logon_server
= talloc_reference(server_info
, base
->logon_server
.string
);
335 server_info
->last_logon
= base
->last_logon
;
336 server_info
->last_logoff
= base
->last_logoff
;
337 server_info
->acct_expiry
= base
->acct_expiry
;
338 server_info
->last_password_change
= base
->last_password_change
;
339 server_info
->allow_password_change
= base
->allow_password_change
;
340 server_info
->force_password_change
= base
->force_password_change
;
341 server_info
->logon_count
= base
->logon_count
;
342 server_info
->bad_password_count
= base
->bad_password_count
;
343 server_info
->acct_flags
= base
->acct_flags
;
345 server_info
->authenticated
= True
;
347 /* ensure we are never given NULL session keys */
349 if (all_zero(base
->key
.key
, sizeof(base
->key
.key
))) {
350 server_info
->user_session_key
= data_blob(NULL
, 0);
352 server_info
->user_session_key
= data_blob_talloc(server_info
, base
->key
.key
, sizeof(base
->key
.key
));
353 NT_STATUS_HAVE_NO_MEMORY(server_info
->user_session_key
.data
);
356 if (all_zero(base
->LMSessKey
.key
, sizeof(base
->LMSessKey
.key
))) {
357 server_info
->lm_session_key
= data_blob(NULL
, 0);
359 server_info
->lm_session_key
= data_blob_talloc(server_info
, base
->LMSessKey
.key
, sizeof(base
->LMSessKey
.key
));
360 NT_STATUS_HAVE_NO_MEMORY(server_info
->lm_session_key
.data
);
363 *_server_info
= server_info
;
368 NTSTATUS
auth_anonymous_server_info(TALLOC_CTX
*mem_ctx
, struct auth_serversupplied_info
**_server_info
)
370 struct auth_serversupplied_info
*server_info
;
371 server_info
= talloc(mem_ctx
, struct auth_serversupplied_info
);
372 NT_STATUS_HAVE_NO_MEMORY(server_info
);
374 server_info
->account_sid
= dom_sid_parse_talloc(server_info
, SID_NT_ANONYMOUS
);
375 NT_STATUS_HAVE_NO_MEMORY(server_info
->account_sid
);
377 /* is this correct? */
378 server_info
->primary_group_sid
= dom_sid_parse_talloc(server_info
, SID_BUILTIN_GUESTS
);
379 NT_STATUS_HAVE_NO_MEMORY(server_info
->primary_group_sid
);
381 server_info
->n_domain_groups
= 0;
382 server_info
->domain_groups
= NULL
;
384 /* annoying, but the Anonymous really does have a session key,
385 and it is all zeros! */
386 server_info
->user_session_key
= data_blob_talloc(server_info
, NULL
, 16);
387 NT_STATUS_HAVE_NO_MEMORY(server_info
->user_session_key
.data
);
389 server_info
->lm_session_key
= data_blob_talloc(server_info
, NULL
, 16);
390 NT_STATUS_HAVE_NO_MEMORY(server_info
->lm_session_key
.data
);
392 data_blob_clear(&server_info
->user_session_key
);
393 data_blob_clear(&server_info
->lm_session_key
);
395 server_info
->account_name
= talloc_strdup(server_info
, "ANONYMOUS LOGON");
396 NT_STATUS_HAVE_NO_MEMORY(server_info
->account_name
);
398 server_info
->domain_name
= talloc_strdup(server_info
, "NT AUTHORITY");
399 NT_STATUS_HAVE_NO_MEMORY(server_info
->domain_name
);
401 server_info
->full_name
= talloc_strdup(server_info
, "Anonymous Logon");
402 NT_STATUS_HAVE_NO_MEMORY(server_info
->full_name
);
404 server_info
->logon_script
= talloc_strdup(server_info
, "");
405 NT_STATUS_HAVE_NO_MEMORY(server_info
->logon_script
);
407 server_info
->profile_path
= talloc_strdup(server_info
, "");
408 NT_STATUS_HAVE_NO_MEMORY(server_info
->profile_path
);
410 server_info
->home_directory
= talloc_strdup(server_info
, "");
411 NT_STATUS_HAVE_NO_MEMORY(server_info
->home_directory
);
413 server_info
->home_drive
= talloc_strdup(server_info
, "");
414 NT_STATUS_HAVE_NO_MEMORY(server_info
->home_drive
);
416 server_info
->logon_server
= talloc_strdup(server_info
, lp_netbios_name());
417 NT_STATUS_HAVE_NO_MEMORY(server_info
->logon_server
);
419 server_info
->last_logon
= 0;
420 server_info
->last_logoff
= 0;
421 server_info
->acct_expiry
= 0;
422 server_info
->last_password_change
= 0;
423 server_info
->allow_password_change
= 0;
424 server_info
->force_password_change
= 0;
426 server_info
->logon_count
= 0;
427 server_info
->bad_password_count
= 0;
429 server_info
->acct_flags
= ACB_NORMAL
;
431 server_info
->authenticated
= False
;
433 *_server_info
= server_info
;
438 NTSTATUS
auth_system_server_info(TALLOC_CTX
*mem_ctx
, struct auth_serversupplied_info
**_server_info
)
440 struct auth_serversupplied_info
*server_info
;
441 server_info
= talloc(mem_ctx
, struct auth_serversupplied_info
);
442 NT_STATUS_HAVE_NO_MEMORY(server_info
);
444 server_info
->account_sid
= dom_sid_parse_talloc(server_info
, SID_NT_SYSTEM
);
445 NT_STATUS_HAVE_NO_MEMORY(server_info
->account_sid
);
447 /* is this correct? */
448 server_info
->primary_group_sid
= dom_sid_parse_talloc(server_info
, SID_BUILTIN_ADMINISTRATORS
);
449 NT_STATUS_HAVE_NO_MEMORY(server_info
->primary_group_sid
);
451 server_info
->n_domain_groups
= 0;
452 server_info
->domain_groups
= NULL
;
454 /* annoying, but the Anonymous really does have a session key,
455 and it is all zeros! */
456 server_info
->user_session_key
= data_blob_talloc(server_info
, NULL
, 16);
457 NT_STATUS_HAVE_NO_MEMORY(server_info
->user_session_key
.data
);
459 server_info
->lm_session_key
= data_blob_talloc(server_info
, NULL
, 16);
460 NT_STATUS_HAVE_NO_MEMORY(server_info
->lm_session_key
.data
);
462 data_blob_clear(&server_info
->user_session_key
);
463 data_blob_clear(&server_info
->lm_session_key
);
465 server_info
->account_name
= talloc_strdup(server_info
, "SYSTEM");
466 NT_STATUS_HAVE_NO_MEMORY(server_info
->account_name
);
468 server_info
->domain_name
= talloc_strdup(server_info
, "NT AUTHORITY");
469 NT_STATUS_HAVE_NO_MEMORY(server_info
->domain_name
);
471 server_info
->full_name
= talloc_strdup(server_info
, "System");
472 NT_STATUS_HAVE_NO_MEMORY(server_info
->full_name
);
474 server_info
->logon_script
= talloc_strdup(server_info
, "");
475 NT_STATUS_HAVE_NO_MEMORY(server_info
->logon_script
);
477 server_info
->profile_path
= talloc_strdup(server_info
, "");
478 NT_STATUS_HAVE_NO_MEMORY(server_info
->profile_path
);
480 server_info
->home_directory
= talloc_strdup(server_info
, "");
481 NT_STATUS_HAVE_NO_MEMORY(server_info
->home_directory
);
483 server_info
->home_drive
= talloc_strdup(server_info
, "");
484 NT_STATUS_HAVE_NO_MEMORY(server_info
->home_drive
);
486 server_info
->logon_server
= talloc_strdup(server_info
, lp_netbios_name());
487 NT_STATUS_HAVE_NO_MEMORY(server_info
->logon_server
);
489 server_info
->last_logon
= 0;
490 server_info
->last_logoff
= 0;
491 server_info
->acct_expiry
= 0;
492 server_info
->last_password_change
= 0;
493 server_info
->allow_password_change
= 0;
494 server_info
->force_password_change
= 0;
496 server_info
->logon_count
= 0;
497 server_info
->bad_password_count
= 0;
499 server_info
->acct_flags
= ACB_NORMAL
;
501 server_info
->authenticated
= True
;
503 *_server_info
= server_info
;
508 NTSTATUS
auth_generate_session_info(TALLOC_CTX
*mem_ctx
,
509 struct auth_serversupplied_info
*server_info
,
510 struct auth_session_info
**_session_info
)
512 struct auth_session_info
*session_info
;
515 session_info
= talloc(mem_ctx
, struct auth_session_info
);
516 NT_STATUS_HAVE_NO_MEMORY(session_info
);
518 session_info
->server_info
= talloc_reference(session_info
, server_info
);
520 /* unless set otherwise, the session key is the user session
521 * key from the auth subsystem */
522 session_info
->session_key
= server_info
->user_session_key
;
524 nt_status
= security_token_create(session_info
,
525 server_info
->account_sid
,
526 server_info
->primary_group_sid
,
527 server_info
->n_domain_groups
,
528 server_info
->domain_groups
,
529 server_info
->authenticated
,
530 &session_info
->security_token
);
531 NT_STATUS_NOT_OK_RETURN(nt_status
);
533 session_info
->credentials
= NULL
;
535 *_session_info
= session_info
;
539 NTSTATUS
auth_anonymous_session_info(TALLOC_CTX
*parent_ctx
,
540 struct auth_session_info
**_session_info
)
543 struct auth_serversupplied_info
*server_info
= NULL
;
544 struct auth_session_info
*session_info
= NULL
;
545 TALLOC_CTX
*mem_ctx
= talloc_new(parent_ctx
);
547 nt_status
= auth_anonymous_server_info(mem_ctx
,
549 if (!NT_STATUS_IS_OK(nt_status
)) {
550 talloc_free(mem_ctx
);
554 /* references the server_info into the session_info */
555 nt_status
= auth_generate_session_info(parent_ctx
, server_info
, &session_info
);
556 talloc_free(mem_ctx
);
558 NT_STATUS_NOT_OK_RETURN(nt_status
);
560 session_info
->credentials
= cli_credentials_init(session_info
);
561 if (!session_info
->credentials
) {
562 return NT_STATUS_NO_MEMORY
;
565 cli_credentials_set_conf(session_info
->credentials
);
566 cli_credentials_set_anonymous(session_info
->credentials
);
568 *_session_info
= session_info
;
573 struct auth_session_info
*anonymous_session(TALLOC_CTX
*mem_ctx
)
576 struct auth_session_info
*session_info
= NULL
;
577 nt_status
= auth_anonymous_session_info(mem_ctx
, &session_info
);
578 if (!NT_STATUS_IS_OK(nt_status
)) {
584 NTSTATUS
auth_system_session_info(TALLOC_CTX
*parent_ctx
,
585 struct auth_session_info
**_session_info
)
588 struct auth_serversupplied_info
*server_info
= NULL
;
589 struct auth_session_info
*session_info
= NULL
;
590 TALLOC_CTX
*mem_ctx
= talloc_new(parent_ctx
);
592 nt_status
= auth_system_server_info(mem_ctx
,
594 if (!NT_STATUS_IS_OK(nt_status
)) {
595 talloc_free(mem_ctx
);
599 /* references the server_info into the session_info */
600 nt_status
= auth_generate_session_info(parent_ctx
, server_info
, &session_info
);
601 talloc_free(mem_ctx
);
603 NT_STATUS_NOT_OK_RETURN(nt_status
);
605 session_info
->credentials
= cli_credentials_init(session_info
);
606 if (!session_info
->credentials
) {
607 return NT_STATUS_NO_MEMORY
;
610 cli_credentials_set_conf(session_info
->credentials
);
612 if (lp_parm_bool(-1,"system","anonymous", False
)) {
613 cli_credentials_set_anonymous(session_info
->credentials
);
615 cli_credentials_set_machine_account_pending(session_info
->credentials
);
617 *_session_info
= session_info
;
622 _PUBLIC_
struct auth_session_info
*system_session(TALLOC_CTX
*mem_ctx
)
625 struct auth_session_info
*session_info
= NULL
;
626 nt_status
= auth_system_session_info(mem_ctx
, &session_info
);
627 if (!NT_STATUS_IS_OK(nt_status
)) {
633 /****************************************************************************
634 prints a struct auth_session_info security token to debug output.
635 ****************************************************************************/
636 void auth_session_info_debug(int dbg_lev
,
637 const struct auth_session_info
*session_info
)
640 DEBUG(dbg_lev
, ("Session Info: (NULL)\n"));
644 security_token_debug(dbg_lev
, session_info
->security_token
);
648 * Squash an NT_STATUS in line with security requirements.
649 * In an attempt to avoid giving the whole game away when users
650 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
651 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
652 * (session setups in particular).
654 * @param nt_status NTSTATUS input for squashing.
655 * @return the 'squashed' nt_status
657 NTSTATUS
auth_nt_status_squash(NTSTATUS nt_status
)
659 if NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
) {
660 /* Match WinXP and don't give the game away */
661 return NT_STATUS_LOGON_FAILURE
;
662 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_WRONG_PASSWORD
) {
663 /* Match WinXP and don't give the game away */
664 return NT_STATUS_LOGON_FAILURE
;