?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:kdc: pass down SAMBA_KDC_FLAG_PROTOCOL_TRANSITION to samba_kdc_update_pac()
[Samba.git] / source4 / kdc / mit_samba.c
blobd9271b8ffef92d49836d4ae97d6e7078b50e596a
1 /*
2 MIT-Samba4 library
3
4 Copyright (c) 2010, Simo Sorce <idra@samba.org>
5 Copyright (c) 2014-2015 Guenther Deschner <gd@samba.org>
6 Copyright (c) 2014-2016 Andreas Schneider <asn@samba.org>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #define TEVENT_DEPRECATED 1
23
24 #include "includes.h"
25 #include "param/param.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "system/kerberos.h"
28 #include <com_err.h>
29 #include <kdb.h>
30 #include <kadm5/kadm_err.h>
31 #include "kdc/sdb.h"
32 #include "kdc/sdb_kdb.h"
33 #include "auth/kerberos/kerberos.h"
34 #include "auth/kerberos/pac_utils.h"
35 #include "kdc/samba_kdc.h"
36 #include "kdc/pac-glue.h"
37 #include "kdc/db-glue.h"
38 #include "auth/auth.h"
39 #include "kdc/kpasswd_glue.h"
40 #include "auth/auth_sam.h"
41
42 #include "mit_samba.h"
43
44 #undef DBGC_CLASS
45 #define DBGC_CLASS DBGC_KERBEROS
46
47 void mit_samba_context_free(struct mit_samba_context *ctx)
48 {
49 /* free heimdal's krb5_context */
50 if (ctx->context) {
51 krb5_free_context(ctx->context);
52 }
53
54 /* then free everything else */
55 talloc_free(ctx);
56 }
57
58 /*
59 * Implemant a callback to log to the MIT KDC log facility
60 *
61 * http://web.mit.edu/kerberos/krb5-devel/doc/plugindev/general.html#logging-from-kdc-and-kadmind-plugin-modules
62 */
63 static void mit_samba_debug(void *private_ptr, int msg_level, const char *msg)
64 {
65 int is_error = errno;
66
67 if (msg_level > 0) {
68 is_error = 0;
69 }
70
71 com_err("", is_error, "%s", msg);
72 }
73
74 int mit_samba_context_init(struct mit_samba_context **_ctx)
75 {
76 NTSTATUS status;
77 struct mit_samba_context *ctx;
78 const char *s4_conf_file;
79 int ret;
80 struct samba_kdc_base_context base_ctx;
81
82 ctx = talloc_zero(NULL, struct mit_samba_context);
83 if (!ctx) {
84 ret = ENOMEM;
85 goto done;
86 }
87
88 base_ctx.ev_ctx = tevent_context_init(ctx);
89 if (!base_ctx.ev_ctx) {
90 ret = ENOMEM;
91 goto done;
92 }
93 tevent_loop_allow_nesting(base_ctx.ev_ctx);
94 base_ctx.lp_ctx = loadparm_init_global(false);
95 if (!base_ctx.lp_ctx) {
96 ret = ENOMEM;
97 goto done;
98 }
99
100 debug_set_callback(NULL, mit_samba_debug);
101
102 /* init s4 configuration */
103 s4_conf_file = lpcfg_configfile(base_ctx.lp_ctx);
104 if (s4_conf_file != NULL) {
105 char *p = talloc_strdup(ctx, s4_conf_file);
106 if (p == NULL) {
107 ret = ENOMEM;
108 goto done;
109 }
110 lpcfg_load(base_ctx.lp_ctx, p);
111 TALLOC_FREE(p);
112 } else {
113 lpcfg_load_default(base_ctx.lp_ctx);
114 }
115
116 status = samba_kdc_setup_db_ctx(ctx, &base_ctx, &ctx->db_ctx);
117 if (!NT_STATUS_IS_OK(status)) {
118 ret = EINVAL;
119 goto done;
120 }
121
122 /* init heimdal's krb_context and log facilities */
123 ret = smb_krb5_init_context_basic(ctx,
124 ctx->db_ctx->lp_ctx,
125 &ctx->context);
126 if (ret) {
127 goto done;
128 }
129
130 ret = 0;
131
132 done:
133 if (ret) {
134 mit_samba_context_free(ctx);
135 } else {
136 *_ctx = ctx;
137 }
138 return ret;
139 }
140
141 static krb5_error_code ks_is_tgs_principal(struct mit_samba_context *ctx,
142 krb5_const_principal principal)
143 {
144 char *p;
145 int eq = -1;
146
147 p = smb_krb5_principal_get_comp_string(ctx, ctx->context, principal, 0);
148
149 eq = krb5_princ_size(ctx->context, principal) == 2 &&
150 (strcmp(p, KRB5_TGS_NAME) == 0);
151
152 talloc_free(p);
153
154 return eq;
155 }
156
157 int mit_samba_generate_salt(krb5_data *salt)
158 {
159 if (salt == NULL) {
160 return EINVAL;
161 }
162
163 salt->length = 16;
164 salt->data = malloc(salt->length);
165 if (salt->data == NULL) {
166 return ENOMEM;
167 }
168
169 generate_random_buffer((uint8_t *)salt->data, salt->length);
170
171 return 0;
172 }
173
174 int mit_samba_generate_random_password(krb5_data *pwd)
175 {
176 TALLOC_CTX *tmp_ctx;
177 char *password;
178
179 if (pwd == NULL) {
180 return EINVAL;
181 }
182 pwd->length = 24;
183
184 tmp_ctx = talloc_named(NULL,
185 0,
186 "mit_samba_create_principal_password context");
187 if (tmp_ctx == NULL) {
188 return ENOMEM;
189 }
190
191 password = generate_random_password(tmp_ctx, pwd->length, pwd->length);
192 if (password == NULL) {
193 talloc_free(tmp_ctx);
194 return ENOMEM;
195 }
196
197 pwd->data = strdup(password);
198 talloc_free(tmp_ctx);
199 if (pwd->data == NULL) {
200 return ENOMEM;
201 }
202
203 return 0;
204 }
205
206 int mit_samba_get_principal(struct mit_samba_context *ctx,
207 krb5_const_principal principal,
208 unsigned int kflags,
209 krb5_db_entry **_kentry)
210 {
211 struct sdb_entry sentry = {};
212 krb5_db_entry *kentry;
213 int ret;
214 uint32_t sflags = 0;
215 krb5_principal referral_principal = NULL;
216
217 kentry = calloc(1, sizeof(krb5_db_entry));
218 if (kentry == NULL) {
219 return ENOMEM;
220 }
221
222 #if KRB5_KDB_API_VERSION >= 10
223 /*
224 * The MIT KDC code that wants the canonical name in all lookups, and
225 * takes care to canonicalize only when appropriate.
226 */
227 sflags |= SDB_F_FORCE_CANON;
228 #endif
229
230 #if KRB5_KDB_DAL_MAJOR_VERSION >= 9
231 if (kflags & KRB5_KDB_FLAG_REFERRAL_OK) {
232 sflags |= SDB_F_CANON;
233 }
234
235 if (kflags & KRB5_KDB_FLAG_CLIENT) {
236 sflags |= SDB_F_GET_CLIENT;
237
238 if (!(kflags & KRB5_KDB_FLAG_REFERRAL_OK)) {
239 sflags |= SDB_F_FOR_AS_REQ;
240 }
241 } else {
242 int equal = smb_krb5_principal_is_tgs(ctx->context, principal);
243 if (equal == -1) {
244 return ENOMEM;
245 }
246
247 if (equal) {
248 sflags |= SDB_F_GET_KRBTGT;
249 } else {
250 sflags |= SDB_F_GET_SERVER;
251
252 if (!(kflags & KRB5_KDB_FLAG_REFERRAL_OK)) {
253 sflags |= SDB_F_FOR_TGS_REQ;
254 }
255 }
256 }
257 #else /* KRB5_KDB_DAL_MAJOR_VERSION < 9 */
258 if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
259 sflags |= SDB_F_CANON;
260 }
261 if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |
262 KRB5_KDB_FLAG_INCLUDE_PAC)) {
263 /*
264 * KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is equal to
265 * SDB_F_FOR_AS_REQ
266 *
267 * We use ANY to also allow AS_REQ for service principal names
268 * This is supported by Windows.
269 */
270 sflags |= SDB_F_GET_ANY|SDB_F_FOR_AS_REQ;
271 } else {
272 int equal = smb_krb5_principal_is_tgs(ctx->context, principal);
273 if (equal == -1) {
274 return ENOMEM;
275 }
276
277 if (equal) {
278 sflags |= SDB_F_GET_KRBTGT;
279 } else {
280 sflags |= SDB_F_GET_SERVER|SDB_F_FOR_TGS_REQ;
281 }
282 }
283 #endif /* KRB5_KDB_DAL_MAJOR_VERSION */
284
285 /* always set this or the created_by data will not be populated by samba's
286 * backend and we will fail to parse the entry later */
287 sflags |= SDB_F_ADMIN_DATA;
288
289
290 fetch_referral_principal:
291 ret = samba_kdc_fetch(ctx->context, ctx->db_ctx,
292 principal, sflags, 0, &sentry);
293 switch (ret) {
294 case 0:
295 break;
296 case SDB_ERR_NOENTRY:
297 ret = KRB5_KDB_NOENTRY;
298 goto done;
299 case SDB_ERR_WRONG_REALM: {
300 char *dest_realm = NULL;
301 const char *our_realm = lpcfg_realm(ctx->db_ctx->lp_ctx);
302
303 if (sflags & SDB_F_FOR_AS_REQ) {
304 /*
305 * If this is a request for a TGT, we are done. The KDC
306 * will return the correct error to the client.
307 */
308 ret = 0;
309 break;
310 }
311
312 if (referral_principal != NULL) {
313 sdb_entry_free(&sentry);
314 ret = KRB5_KDB_NOENTRY;
315 goto done;
316 }
317
318 /*
319 * We get a TGS request
320 *
321 * cifs/dc7.SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA.EXAMPLE.COM
322 *
323 * to our DC for the realm
324 *
325 * ADDOM.SAMBA.EXAMPLE.COM
326 *
327 * We look up if we have and entry in the database and get an
328 * entry with the pricipal:
329 *
330 * cifs/dc7.SAMBA2008R2.EXAMPLE.COM@SAMBA2008R2.EXAMPLE.COM
331 *
332 * and the error: SDB_ERR_WRONG_REALM.
333 *
334 * In the case of a TGS-REQ we need to return a referral ticket
335 * fo the next trust hop to the client. This ticket will have
336 * the following principal:
337 *
338 * krbtgt/SAMBA2008R2.EXAMPLE.COM@ADDOM.SAMBA.EXAMPLE.COM
339 *
340 * We just redo the lookup in the database with the referral
341 * principal and return success.
342 */
343 dest_realm = smb_krb5_principal_get_realm(
344 ctx, ctx->context, sentry.principal);
345 sdb_entry_free(&sentry);
346 if (dest_realm == NULL) {
347 ret = KRB5_KDB_NOENTRY;
348 goto done;
349 }
350
351 ret = smb_krb5_make_principal(ctx->context,
352 &referral_principal,
353 our_realm,
354 KRB5_TGS_NAME,
355 dest_realm,
356 NULL);
357 TALLOC_FREE(dest_realm);
358 if (ret != 0) {
359 goto done;
360 }
361
362 principal = referral_principal;
363 goto fetch_referral_principal;
364 }
365 case SDB_ERR_NOT_FOUND_HERE:
366 /* FIXME: RODC support */
367 default:
368 goto done;
369 }
370
371 ret = sdb_entry_to_krb5_db_entry(ctx->context, &sentry, kentry);
372
373 sdb_entry_free(&sentry);
374
375 done:
376 krb5_free_principal(ctx->context, referral_principal);
377 referral_principal = NULL;
378
379 if (ret) {
380 free(kentry);
381 } else {
382 *_kentry = kentry;
383 }
384 return ret;
385 }
386
387 int mit_samba_get_firstkey(struct mit_samba_context *ctx,
388 krb5_db_entry **_kentry)
389 {
390 struct sdb_entry sentry = {};
391 krb5_db_entry *kentry;
392 int ret;
393
394 kentry = malloc(sizeof(krb5_db_entry));
395 if (kentry == NULL) {
396 return ENOMEM;
397 }
398
399 ret = samba_kdc_firstkey(ctx->context, ctx->db_ctx, &sentry);
400 switch (ret) {
401 case 0:
402 break;
403 case SDB_ERR_NOENTRY:
404 free(kentry);
405 return KRB5_KDB_NOENTRY;
406 case SDB_ERR_NOT_FOUND_HERE:
407 /* FIXME: RODC support */
408 default:
409 free(kentry);
410 return ret;
411 }
412
413 ret = sdb_entry_to_krb5_db_entry(ctx->context, &sentry, kentry);
414
415 sdb_entry_free(&sentry);
416
417 if (ret) {
418 free(kentry);
419 } else {
420 *_kentry = kentry;
421 }
422 return ret;
423 }
424
425 int mit_samba_get_nextkey(struct mit_samba_context *ctx,
426 krb5_db_entry **_kentry)
427 {
428 struct sdb_entry sentry = {};
429 krb5_db_entry *kentry;
430 int ret;
431
432 kentry = malloc(sizeof(krb5_db_entry));
433 if (kentry == NULL) {
434 return ENOMEM;
435 }
436
437 ret = samba_kdc_nextkey(ctx->context, ctx->db_ctx, &sentry);
438 switch (ret) {
439 case 0:
440 break;
441 case SDB_ERR_NOENTRY:
442 free(kentry);
443 return KRB5_KDB_NOENTRY;
444 case SDB_ERR_NOT_FOUND_HERE:
445 /* FIXME: RODC support */
446 default:
447 free(kentry);
448 return ret;
449 }
450
451 ret = sdb_entry_to_krb5_db_entry(ctx->context, &sentry, kentry);
452
453 sdb_entry_free(&sentry);
454
455 if (ret) {
456 free(kentry);
457 } else {
458 *_kentry = kentry;
459 }
460 return ret;
461 }
462
463 int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
464 krb5_context context,
465 uint32_t flags,
466 krb5_db_entry *client,
467 krb5_db_entry *server,
468 krb5_keyblock *replaced_reply_key,
469 krb5_pac *pac)
470 {
471 TALLOC_CTX *tmp_ctx;
472 DATA_BLOB *logon_info_blob = NULL;
473 DATA_BLOB *upn_dns_info_blob = NULL;
474 DATA_BLOB *cred_ndr = NULL;
475 DATA_BLOB **cred_ndr_ptr = NULL;
476 DATA_BLOB cred_blob = data_blob_null;
477 DATA_BLOB *pcred_blob = NULL;
478 DATA_BLOB *pac_attrs_blob = NULL;
479 DATA_BLOB *requester_sid_blob = NULL;
480 NTSTATUS nt_status;
481 krb5_error_code code;
482 struct samba_kdc_entry *skdc_entry;
483 bool is_krbtgt;
484
485 skdc_entry = talloc_get_type_abort(client->e_data,
486 struct samba_kdc_entry);
487
488 tmp_ctx = talloc_named(smb_ctx,
489 0,
490 "mit_samba_get_pac_data_blobs context");
491 if (tmp_ctx == NULL) {
492 return ENOMEM;
493 }
494
495 /* Check if we have a PREAUTH key */
496 if (replaced_reply_key != NULL) {
497 cred_ndr_ptr = &cred_ndr;
498 }
499
500 is_krbtgt = ks_is_tgs_principal(smb_ctx, server->princ);
501
502 nt_status = samba_kdc_get_pac_blobs(tmp_ctx,
503 skdc_entry,
504 &logon_info_blob,
505 cred_ndr_ptr,
506 &upn_dns_info_blob,
507 is_krbtgt ? &pac_attrs_blob : NULL,
508 PAC_ATTRIBUTE_FLAG_PAC_WAS_GIVEN_IMPLICITLY,
509 is_krbtgt ? &requester_sid_blob : NULL);
510 if (!NT_STATUS_IS_OK(nt_status)) {
511 talloc_free(tmp_ctx);
512 if (NT_STATUS_EQUAL(nt_status,
513 NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
514 return ENOENT;
515 }
516 return EINVAL;
517 }
518
519 if (replaced_reply_key != NULL && cred_ndr != NULL) {
520 code = samba_kdc_encrypt_pac_credentials(context,
521 replaced_reply_key,
522 cred_ndr,
523 tmp_ctx,
524 &cred_blob);
525 if (code != 0) {
526 talloc_free(tmp_ctx);
527 return code;
528 }
529 pcred_blob = &cred_blob;
530 }
531
532 code = samba_make_krb5_pac(context,
533 logon_info_blob,
534 pcred_blob,
535 upn_dns_info_blob,
536 pac_attrs_blob,
537 requester_sid_blob,
538 NULL,
539 *pac);
540
541 talloc_free(tmp_ctx);
542 return code;
543 }
544
545 #if KRB5_KDB_DAL_MAJOR_VERSION < 9
546 krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,
547 krb5_context context,
548 int kdc_flags,
549 krb5_const_principal client_principal,
550 krb5_db_entry *client,
551 krb5_db_entry *server,
552 krb5_db_entry *krbtgt,
553 krb5_keyblock *krbtgt_keyblock,
554 krb5_pac *pac)
555 {
556 TALLOC_CTX *tmp_ctx;
557 krb5_error_code code;
558 struct samba_kdc_entry *client_skdc_entry = NULL;
559 struct samba_kdc_entry *krbtgt_skdc_entry = NULL;
560 struct samba_kdc_entry *server_skdc_entry = NULL;
561 krb5_principal delegated_proxy_principal = NULL;
562 krb5_pac new_pac = NULL;
563 bool is_in_db = false;
564 bool is_untrusted = false;
565 uint32_t flags = SAMBA_KDC_FLAG_SKIP_PAC_BUFFER;
566
567 /* Create a memory context early so code can use talloc_stackframe() */
568 tmp_ctx = talloc_named(ctx, 0, "mit_samba_reget_pac context");
569 if (tmp_ctx == NULL) {
570 return ENOMEM;
571 }
572
573 if (client != NULL) {
574 client_skdc_entry =
575 talloc_get_type_abort(client->e_data,
576 struct samba_kdc_entry);
577 }
578
579 if (server == NULL) {
580 code = EINVAL;
581 goto done;
582 }
583
584 server_skdc_entry =
585 talloc_get_type_abort(server->e_data,
586 struct samba_kdc_entry);
587
588 if (krbtgt == NULL) {
589 code = EINVAL;
590 goto done;
591 }
592 krbtgt_skdc_entry =
593 talloc_get_type_abort(krbtgt->e_data,
594 struct samba_kdc_entry);
595
596 code = samba_krbtgt_is_in_db(krbtgt_skdc_entry,
597 &is_in_db,
598 &is_untrusted);
599 if (code != 0) {
600 goto done;
601 }
602
603 if (is_untrusted) {
604 flags |= SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED;
605 }
606
607 if (is_in_db) {
608 flags |= SAMBA_KDC_FLAG_KRBTGT_IN_DB;
609
610 }
611
612 if (kdc_flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {
613 flags |= SAMBA_KDC_FLAG_PROTOCOL_TRANSITION;
614 }
615
616 if (kdc_flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
617 flags |= SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION;
618 delegated_proxy_principal = discard_const(client_principal);
619 }
620
621 /* Build an updated PAC */
622 code = krb5_pac_init(context, &new_pac);
623 if (code != 0) {
624 goto done;
625 }
626
627 code = samba_kdc_update_pac(tmp_ctx,
628 context,
629 krbtgt_skdc_entry->kdc_db_ctx->samdb,
630 flags,
631 client_skdc_entry,
632 server->princ,
633 server_skdc_entry,
634 krbtgt_skdc_entry,
635 delegated_proxy_principal,
636 *pac,
637 new_pac);
638 if (code != 0) {
639 krb5_pac_free(context, new_pac);
640 if (code == ENODATA) {
641 krb5_pac_free(context, *pac);
642 *pac = NULL;
643 code = 0;
644 }
645 goto done;
646 }
647
648 /* We now replace the pac */
649 krb5_pac_free(context, *pac);
650 *pac = new_pac;
651
652 done:
653 talloc_free(tmp_ctx);
654 return code;
655 }
656 #else
657 krb5_error_code mit_samba_update_pac(struct mit_samba_context *ctx,
658 krb5_context context,
659 int kdc_flags,
660 krb5_db_entry *client,
661 krb5_db_entry *server,
662 krb5_db_entry *krbtgt,
663 krb5_pac old_pac,
664 krb5_pac new_pac)
665 {
666 TALLOC_CTX *tmp_ctx = NULL;
667 krb5_error_code code;
668 struct samba_kdc_entry *client_skdc_entry = NULL;
669 struct samba_kdc_entry *server_skdc_entry = NULL;
670 struct samba_kdc_entry *krbtgt_skdc_entry = NULL;
671 bool is_in_db = false;
672 bool is_untrusted = false;
673 uint32_t flags = SAMBA_KDC_FLAG_SKIP_PAC_BUFFER;
674
675 /* Create a memory context early so code can use talloc_stackframe() */
676 tmp_ctx = talloc_named(ctx, 0, "mit_samba_update_pac context");
677 if (tmp_ctx == NULL) {
678 return ENOMEM;
679 }
680
681 if (client != NULL) {
682 client_skdc_entry =
683 talloc_get_type_abort(client->e_data,
684 struct samba_kdc_entry);
685 }
686
687 if (krbtgt == NULL) {
688 code = EINVAL;
689 goto done;
690 }
691 krbtgt_skdc_entry =
692 talloc_get_type_abort(krbtgt->e_data,
693 struct samba_kdc_entry);
694
695 server_skdc_entry =
696 talloc_get_type_abort(server->e_data,
697 struct samba_kdc_entry);
698
699 /*
700 * If the krbtgt was generated by an RODC, and we are not that
701 * RODC, then we need to regenerate the PAC - we can't trust
702 * it, and confirm that the RODC was permitted to print this ticket
703 *
704 * Because of the samba_kdc_validate_pac_blob() step we can be
705 * sure that the record in 'client' or 'server' matches the SID in the
706 * original PAC.
707 */
708 code = samba_krbtgt_is_in_db(krbtgt_skdc_entry,
709 &is_in_db,
710 &is_untrusted);
711 if (code != 0) {
712 goto done;
713 }
714
715 if (is_untrusted) {
716 flags |= SAMBA_KDC_FLAG_KRBTGT_IS_UNTRUSTED;
717 }
718
719 if (is_in_db) {
720 flags |= SAMBA_KDC_FLAG_KRBTGT_IN_DB;
721
722 }
723
724 if (kdc_flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {
725 flags |= SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION;
726 }
727
728 code = samba_kdc_update_pac(tmp_ctx,
729 context,
730 krbtgt_skdc_entry->kdc_db_ctx->samdb,
731 flags,
732 client_skdc_entry,
733 server->princ,
734 server_skdc_entry,
735 krbtgt_skdc_entry,
736 NULL,
737 old_pac,
738 new_pac);
739 if (code != 0) {
740 if (code == ENODATA) {
741 /*
742 * We can't tell the KDC to not issue a PAC. It will
743 * just return the newly allocated empty PAC.
744 */
745 code = 0;
746 }
747 }
748
749 done:
750 talloc_free(tmp_ctx);
751 return code;
752 }
753 #endif
754
755 /* provide header, function is exported but there are no public headers */
756
757 krb5_error_code encode_krb5_padata_sequence(krb5_pa_data *const *rep, krb5_data **code);
758
759 /* this function allocates 'data' using malloc.
760 * The caller is responsible for freeing it */
761 static void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
762 {
763 krb5_error_code ret = 0;
764 krb5_pa_data pa, *ppa[2];
765 krb5_data *d = NULL;
766
767 if (!e_data)
768 return;
769
770 e_data->data = NULL;
771 e_data->length = 0;
772
773 pa.magic = KV5M_PA_DATA;
774 pa.pa_type = KRB5_PADATA_PW_SALT;
775 pa.length = 12;
776 pa.contents = malloc(pa.length);
777 if (!pa.contents) {
778 return;
779 }
780
781 SIVAL(pa.contents, 0, NT_STATUS_V(nt_status));
782 SIVAL(pa.contents, 4, 0);
783 SIVAL(pa.contents, 8, 1);
784
785 ppa[0] = &pa;
786 ppa[1] = NULL;
787
788 ret = encode_krb5_padata_sequence(ppa, &d);
789 free(pa.contents);
790 if (ret) {
791 return;
792 }
793
794 e_data->data = (uint8_t *)d->data;
795 e_data->length = d->length;
796
797 /* free d, not d->data - gd */
798 free(d);
799
800 return;
801 }
802
803 int mit_samba_check_client_access(struct mit_samba_context *ctx,
804 krb5_db_entry *client,
805 const char *client_name,
806 krb5_db_entry *server,
807 const char *server_name,
808 const char *netbios_name,
809 bool password_change,
810 DATA_BLOB *e_data)
811 {
812 struct samba_kdc_entry *skdc_entry;
813 NTSTATUS nt_status;
814
815 skdc_entry = talloc_get_type(client->e_data, struct samba_kdc_entry);
816
817 nt_status = samba_kdc_check_client_access(skdc_entry,
818 client_name,
819 netbios_name,
820 password_change);
821
822 if (!NT_STATUS_IS_OK(nt_status)) {
823 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
824 return ENOMEM;
825 }
826
827 samba_kdc_build_edata_reply(nt_status, e_data);
828
829 return samba_kdc_map_policy_err(nt_status);
830 }
831
832 return 0;
833 }
834
835 int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
836 const krb5_db_entry *server,
837 krb5_const_principal target_principal)
838 {
839 #if KRB5_KDB_DAL_MAJOR_VERSION < 9
840 return KRB5KDC_ERR_BADOPTION;
841 #else
842 struct samba_kdc_entry *server_skdc_entry =
843 talloc_get_type_abort(server->e_data, struct samba_kdc_entry);
844 krb5_error_code code;
845
846 code = samba_kdc_check_s4u2proxy(ctx->context,
847 ctx->db_ctx,
848 server_skdc_entry,
849 target_principal);
850
851 return code;
852 #endif
853 }
854
855 krb5_error_code mit_samba_check_allowed_to_delegate_from(
856 struct mit_samba_context *ctx,
857 krb5_const_principal client_principal,
858 krb5_const_principal server_principal,
859 krb5_pac header_pac,
860 const krb5_db_entry *proxy)
861 {
862 #if KRB5_KDB_DAL_MAJOR_VERSION < 8
863 return KRB5KDC_ERR_POLICY;
864 #else
865 struct samba_kdc_entry *proxy_skdc_entry =
866 talloc_get_type_abort(proxy->e_data, struct samba_kdc_entry);
867 krb5_error_code code;
868
869 code = samba_kdc_check_s4u2proxy_rbcd(ctx->context,
870 ctx->db_ctx,
871 client_principal,
872 server_principal,
873 header_pac,
874 proxy_skdc_entry);
875
876 return code;
877 #endif
878 }
879
880 static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
881 NTSTATUS result,
882 enum samPwdChangeReason reject_reason,
883 struct samr_DomInfo1 *dominfo)
884 {
885 krb5_error_code code = KADM5_PASS_Q_GENERIC;
886
887 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
888 code = KADM5_BAD_PRINCIPAL;
889 krb5_set_error_message(context,
890 code,
891 "No such user when changing password");
892 }
893 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
894 code = KADM5_PASS_Q_GENERIC;
895 krb5_set_error_message(context,
896 code,
897 "Not permitted to change password");
898 }
899 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) &&
900 dominfo != NULL) {
901 switch (reject_reason) {
902 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT:
903 code = KADM5_PASS_Q_TOOSHORT;
904 krb5_set_error_message(context,
905 code,
906 "Password too short, password "
907 "must be at least %d characters "
908 "long.",
909 dominfo->min_password_length);
910 break;
911 case SAM_PWD_CHANGE_NOT_COMPLEX:
912 code = KADM5_PASS_Q_DICT;
913 krb5_set_error_message(context,
914 code,
915 "Password does not meet "
916 "complexity requirements");
917 break;
918 case SAM_PWD_CHANGE_PWD_IN_HISTORY:
919 code = KADM5_PASS_TOOSOON;
920 krb5_set_error_message(context,
921 code,
922 "Password is already in password "
923 "history. New password must not "
924 "match any of your %d previous "
925 "passwords.",
926 dominfo->password_history_length);
927 break;
928 default:
929 code = KADM5_PASS_Q_GENERIC;
930 krb5_set_error_message(context,
931 code,
932 "Password change rejected, "
933 "password changes may not be "
934 "permitted on this account, or "
935 "the minimum password age may "
936 "not have elapsed.");
937 break;
938 }
939 }
940
941 return code;
942 }
943
944 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
945 char *pwd,
946 krb5_db_entry *db_entry)
947 {
948 NTSTATUS status;
949 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
950 TALLOC_CTX *tmp_ctx;
951 DATA_BLOB password;
952 enum samPwdChangeReason reject_reason;
953 struct samr_DomInfo1 *dominfo;
954 const char *error_string = NULL;
955 struct auth_user_info_dc *user_info_dc;
956 struct samba_kdc_entry *p =
957 talloc_get_type_abort(db_entry->e_data, struct samba_kdc_entry);
958 krb5_error_code code = 0;
959
960 #ifdef DEBUG_PASSWORD
961 DEBUG(1,("mit_samba_kpasswd_change_password called with: %s\n", pwd));
962 #endif
963
964 tmp_ctx = talloc_named(ctx, 0, "mit_samba_kpasswd_change_password");
965 if (tmp_ctx == NULL) {
966 return ENOMEM;
967 }
968
969 status = samba_kdc_get_user_info_from_db(p,
970 p->msg,
971 &user_info_dc);
972 if (!NT_STATUS_IS_OK(status)) {
973 DEBUG(1,("samba_kdc_get_user_info_from_db failed: %s\n",
974 nt_errstr(status)));
975 talloc_free(tmp_ctx);
976 return EINVAL;
977 }
978
979 status = auth_generate_session_info(tmp_ctx,
980 ctx->db_ctx->lp_ctx,
981 ctx->db_ctx->samdb,
982 user_info_dc,
983 0, /* session_info_flags */
984 &ctx->session_info);
985
986 if (!NT_STATUS_IS_OK(status)) {
987 DEBUG(1,("auth_generate_session_info failed: %s\n",
988 nt_errstr(status)));
989 talloc_free(tmp_ctx);
990 return EINVAL;
991 }
992
993 /* password is expected as UTF16 */
994
995 if (!convert_string_talloc(tmp_ctx, CH_UTF8, CH_UTF16,
996 pwd, strlen(pwd),
997 &password.data, &password.length)) {
998 DEBUG(1,("convert_string_talloc failed\n"));
999 talloc_free(tmp_ctx);
1000 return EINVAL;
1001 }
1002
1003 status = samdb_kpasswd_change_password(tmp_ctx,
1004 ctx->db_ctx->lp_ctx,
1005 ctx->db_ctx->ev_ctx,
1006 ctx->session_info,
1007 &password,
1008 &reject_reason,
1009 &dominfo,
1010 &error_string,
1011 &result);
1012 if (!NT_STATUS_IS_OK(status)) {
1013 DEBUG(1,("samdb_kpasswd_change_password failed: %s\n",
1014 nt_errstr(status)));
1015 code = KADM5_PASS_Q_GENERIC;
1016 krb5_set_error_message(ctx->context, code, "%s", error_string);
1017 goto out;
1018 }
1019
1020 if (!NT_STATUS_IS_OK(result)) {
1021 code = mit_samba_change_pwd_error(ctx->context,
1022 result,
1023 reject_reason,
1024 dominfo);
1025 }
1026
1027 out:
1028 talloc_free(tmp_ctx);
1029
1030 return code;
1031 }
1032
1033 void mit_samba_zero_bad_password_count(krb5_db_entry *db_entry)
1034 {
1035 struct netr_SendToSamBase *send_to_sam = NULL;
1036 struct samba_kdc_entry *p =
1037 talloc_get_type_abort(db_entry->e_data, struct samba_kdc_entry);
1038 struct ldb_dn *domain_dn;
1039
1040 domain_dn = ldb_get_default_basedn(p->kdc_db_ctx->samdb);
1041
1042 authsam_logon_success_accounting(p->kdc_db_ctx->samdb,
1043 p->msg,
1044 domain_dn,
1045 true,
1046 &send_to_sam);
1047 /* TODO: RODC support */
1048 }
1049
1050
1051 void mit_samba_update_bad_password_count(krb5_db_entry *db_entry)
1052 {
1053 struct samba_kdc_entry *p =
1054 talloc_get_type_abort(db_entry->e_data, struct samba_kdc_entry);
1055
1056 authsam_update_bad_pwd_count(p->kdc_db_ctx->samdb,
1057 p->msg,
1058 ldb_get_default_basedn(p->kdc_db_ctx->samdb));
1059 }
1060
1061 bool mit_samba_princ_needs_pac(krb5_db_entry *db_entry)
1062 {
1063 struct samba_kdc_entry *skdc_entry =
1064 talloc_get_type_abort(db_entry->e_data, struct samba_kdc_entry);
1065
1066 return samba_princ_needs_pac(skdc_entry);
1067 }
Samba GIT mirror