?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
wintest: Give the Windows VM a little more time to start back up
[Samba.git] / source3 / winbindd / winbindd_pam.c
blob93034adb84f9ac4e715dca95f2fbf8129fa9c1ad
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon - pam auth funcions
5
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_samr_c.h"
29 #include "rpc_client/cli_pipe.h"
30 #include "rpc_client/cli_samr.h"
31 #include "../librpc/gen_ndr/ndr_netlogon.h"
32 #include "rpc_client/cli_netlogon.h"
33 #include "smb_krb5.h"
34 #include "../lib/crypto/arcfour.h"
35 #include "../libcli/security/security.h"
36 #include "ads.h"
37 #include "../librpc/gen_ndr/krb5pac.h"
38 #include "passdb/machine_sid.h"
39 #include "auth.h"
40 #include "../lib/tsocket/tsocket.h"
41
42 #undef DBGC_CLASS
43 #define DBGC_CLASS DBGC_WINBIND
44
45 #define LOGON_KRB5_FAIL_CLOCK_SKEW 0x02000000
46
47 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
48 struct winbindd_response *resp,
49 struct netr_SamInfo3 *info3)
50 {
51 char *ex;
52 uint32_t i;
53
54 resp->data.auth.info3.logon_time =
55 nt_time_to_unix(info3->base.logon_time);
56 resp->data.auth.info3.logoff_time =
57 nt_time_to_unix(info3->base.logoff_time);
58 resp->data.auth.info3.kickoff_time =
59 nt_time_to_unix(info3->base.kickoff_time);
60 resp->data.auth.info3.pass_last_set_time =
61 nt_time_to_unix(info3->base.last_password_change);
62 resp->data.auth.info3.pass_can_change_time =
63 nt_time_to_unix(info3->base.allow_password_change);
64 resp->data.auth.info3.pass_must_change_time =
65 nt_time_to_unix(info3->base.force_password_change);
66
67 resp->data.auth.info3.logon_count = info3->base.logon_count;
68 resp->data.auth.info3.bad_pw_count = info3->base.bad_password_count;
69
70 resp->data.auth.info3.user_rid = info3->base.rid;
71 resp->data.auth.info3.group_rid = info3->base.primary_gid;
72 sid_to_fstring(resp->data.auth.info3.dom_sid, info3->base.domain_sid);
73
74 resp->data.auth.info3.num_groups = info3->base.groups.count;
75 resp->data.auth.info3.user_flgs = info3->base.user_flags;
76
77 resp->data.auth.info3.acct_flags = info3->base.acct_flags;
78 resp->data.auth.info3.num_other_sids = info3->sidcount;
79
80 fstrcpy(resp->data.auth.info3.user_name,
81 info3->base.account_name.string);
82 fstrcpy(resp->data.auth.info3.full_name,
83 info3->base.full_name.string);
84 fstrcpy(resp->data.auth.info3.logon_script,
85 info3->base.logon_script.string);
86 fstrcpy(resp->data.auth.info3.profile_path,
87 info3->base.profile_path.string);
88 fstrcpy(resp->data.auth.info3.home_dir,
89 info3->base.home_directory.string);
90 fstrcpy(resp->data.auth.info3.dir_drive,
91 info3->base.home_drive.string);
92
93 fstrcpy(resp->data.auth.info3.logon_srv,
94 info3->base.logon_server.string);
95 fstrcpy(resp->data.auth.info3.logon_dom,
96 info3->base.logon_domain.string);
97
98 ex = talloc_strdup(mem_ctx, "");
99 NT_STATUS_HAVE_NO_MEMORY(ex);
100
101 for (i=0; i < info3->base.groups.count; i++) {
102 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
103 info3->base.groups.rids[i].rid,
104 info3->base.groups.rids[i].attributes);
105 NT_STATUS_HAVE_NO_MEMORY(ex);
106 }
107
108 for (i=0; i < info3->sidcount; i++) {
109 char *sid;
110
111 sid = dom_sid_string(mem_ctx, info3->sids[i].sid);
112 NT_STATUS_HAVE_NO_MEMORY(sid);
113
114 ex = talloc_asprintf_append_buffer(ex, "%s:0x%08X\n",
115 sid,
116 info3->sids[i].attributes);
117 NT_STATUS_HAVE_NO_MEMORY(ex);
118
119 talloc_free(sid);
120 }
121
122 resp->extra_data.data = ex;
123 resp->length += talloc_get_size(ex);
124
125 return NT_STATUS_OK;
126 }
127
128 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
129 struct winbindd_response *resp,
130 struct netr_SamInfo3 *info3)
131 {
132 DATA_BLOB blob;
133 enum ndr_err_code ndr_err;
134
135 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
136 (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
137 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
138 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
139 return ndr_map_error2ntstatus(ndr_err);
140 }
141
142 resp->extra_data.data = blob.data;
143 resp->length += blob.length;
144
145 return NT_STATUS_OK;
146 }
147
148 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
149 struct winbindd_response *resp,
150 const struct netr_SamInfo3 *info3,
151 const char *name_domain,
152 const char *name_user)
153 {
154 /* We've been asked to return the unix username, per
155 'winbind use default domain' settings and the like */
156
157 const char *nt_username, *nt_domain;
158
159 nt_domain = talloc_strdup(mem_ctx, info3->base.logon_domain.string);
160 if (!nt_domain) {
161 /* If the server didn't give us one, just use the one
162 * we sent them */
163 nt_domain = name_domain;
164 }
165
166 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
167 if (!nt_username) {
168 /* If the server didn't give us one, just use the one
169 * we sent them */
170 nt_username = name_user;
171 }
172
173 fill_domain_username(resp->data.auth.unix_username,
174 nt_domain, nt_username, true);
175
176 DEBUG(5, ("Setting unix username to [%s]\n",
177 resp->data.auth.unix_username));
178
179 return NT_STATUS_OK;
180 }
181
182 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
183 struct winbindd_response *resp,
184 const struct netr_SamInfo3 *info3,
185 const char *name_domain,
186 const char *name_user)
187 {
188 char *afsname = NULL;
189 char *cell;
190 char *token;
191
192 afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
193 if (afsname == NULL) {
194 return NT_STATUS_NO_MEMORY;
195 }
196
197 afsname = talloc_string_sub(mem_ctx,
198 lp_afs_username_map(),
199 "%D", name_domain);
200 afsname = talloc_string_sub(mem_ctx, afsname,
201 "%u", name_user);
202 afsname = talloc_string_sub(mem_ctx, afsname,
203 "%U", name_user);
204
205 {
206 struct dom_sid user_sid;
207 fstring sidstr;
208
209 sid_compose(&user_sid, info3->base.domain_sid,
210 info3->base.rid);
211 sid_to_fstring(sidstr, &user_sid);
212 afsname = talloc_string_sub(mem_ctx, afsname,
213 "%s", sidstr);
214 }
215
216 if (afsname == NULL) {
217 return NT_STATUS_NO_MEMORY;
218 }
219
220 strlower_m(afsname);
221
222 DEBUG(10, ("Generating token for user %s\n", afsname));
223
224 cell = strchr(afsname, '@');
225
226 if (cell == NULL) {
227 return NT_STATUS_NO_MEMORY;
228 }
229
230 *cell = '\0';
231 cell += 1;
232
233 token = afs_createtoken_str(afsname, cell);
234 if (token == NULL) {
235 return NT_STATUS_OK;
236 }
237 resp->extra_data.data = talloc_strdup(mem_ctx, token);
238 if (resp->extra_data.data == NULL) {
239 return NT_STATUS_NO_MEMORY;
240 }
241 resp->length += strlen((const char *)resp->extra_data.data)+1;
242
243 return NT_STATUS_OK;
244 }
245
246 static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
247 const char *group_sid)
248 /**
249 * Check whether a user belongs to a group or list of groups.
250 *
251 * @param mem_ctx talloc memory context.
252 * @param info3 user information, including group membership info.
253 * @param group_sid One or more groups , separated by commas.
254 *
255 * @return NT_STATUS_OK on success,
256 * NT_STATUS_LOGON_FAILURE if the user does not belong,
257 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
258 */
259 {
260 struct dom_sid *require_membership_of_sid;
261 uint32_t num_require_membership_of_sid;
262 char *req_sid;
263 const char *p;
264 struct dom_sid sid;
265 size_t i;
266 struct security_token *token;
267 TALLOC_CTX *frame = talloc_stackframe();
268 NTSTATUS status;
269
270 /* Parse the 'required group' SID */
271
272 if (!group_sid || !group_sid[0]) {
273 /* NO sid supplied, all users may access */
274 return NT_STATUS_OK;
275 }
276
277 token = talloc_zero(talloc_tos(), struct security_token);
278 if (token == NULL) {
279 DEBUG(0, ("talloc failed\n"));
280 TALLOC_FREE(frame);
281 return NT_STATUS_NO_MEMORY;
282 }
283
284 num_require_membership_of_sid = 0;
285 require_membership_of_sid = NULL;
286
287 p = group_sid;
288
289 while (next_token_talloc(talloc_tos(), &p, &req_sid, ",")) {
290 if (!string_to_sid(&sid, req_sid)) {
291 DEBUG(0, ("check_info3_in_group: could not parse %s "
292 "as a SID!", req_sid));
293 TALLOC_FREE(frame);
294 return NT_STATUS_INVALID_PARAMETER;
295 }
296
297 status = add_sid_to_array(talloc_tos(), &sid,
298 &require_membership_of_sid,
299 &num_require_membership_of_sid);
300 if (!NT_STATUS_IS_OK(status)) {
301 DEBUG(0, ("add_sid_to_array failed\n"));
302 TALLOC_FREE(frame);
303 return status;
304 }
305 }
306
307 status = sid_array_from_info3(talloc_tos(), info3,
308 &token->sids,
309 &token->num_sids,
310 true, false);
311 if (!NT_STATUS_IS_OK(status)) {
312 TALLOC_FREE(frame);
313 return status;
314 }
315
316 if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
317 token))
318 || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
319 token))) {
320 DEBUG(3, ("could not add aliases: %s\n",
321 nt_errstr(status)));
322 TALLOC_FREE(frame);
323 return status;
324 }
325
326 security_token_debug(DBGC_CLASS, 10, token);
327
328 for (i=0; i<num_require_membership_of_sid; i++) {
329 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
330 &require_membership_of_sid[i])));
331 if (nt_token_check_sid(&require_membership_of_sid[i],
332 token)) {
333 DEBUG(10, ("Access ok\n"));
334 TALLOC_FREE(frame);
335 return NT_STATUS_OK;
336 }
337 }
338
339 /* Do not distinguish this error from a wrong username/pw */
340
341 TALLOC_FREE(frame);
342 return NT_STATUS_LOGON_FAILURE;
343 }
344
345 struct winbindd_domain *find_auth_domain(uint8_t flags,
346 const char *domain_name)
347 {
348 struct winbindd_domain *domain;
349
350 if (IS_DC) {
351 domain = find_domain_from_name_noinit(domain_name);
352 if (domain == NULL) {
353 DEBUG(3, ("Authentication for domain [%s] refused "
354 "as it is not a trusted domain\n",
355 domain_name));
356 }
357 return domain;
358 }
359
360 if (strequal(domain_name, get_global_sam_name())) {
361 return find_domain_from_name_noinit(domain_name);
362 }
363
364 /* we can auth against trusted domains */
365 if (flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
366 domain = find_domain_from_name_noinit(domain_name);
367 if (domain == NULL) {
368 DEBUG(3, ("Authentication for domain [%s] skipped "
369 "as it is not a trusted domain\n",
370 domain_name));
371 } else {
372 return domain;
373 }
374 }
375
376 return find_our_domain();
377 }
378
379 static void fill_in_password_policy(struct winbindd_response *r,
380 const struct samr_DomInfo1 *p)
381 {
382 r->data.auth.policy.min_length_password =
383 p->min_password_length;
384 r->data.auth.policy.password_history =
385 p->password_history_length;
386 r->data.auth.policy.password_properties =
387 p->password_properties;
388 r->data.auth.policy.expire =
389 nt_time_to_unix_abs((const NTTIME *)&(p->max_password_age));
390 r->data.auth.policy.min_passwordage =
391 nt_time_to_unix_abs((const NTTIME *)&(p->min_password_age));
392 }
393
394 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
395 struct winbindd_response *response)
396 {
397 TALLOC_CTX *frame = talloc_stackframe();
398 struct winbindd_methods *methods;
399 NTSTATUS status;
400 struct samr_DomInfo1 password_policy;
401
402 if ( !winbindd_can_contact_domain( domain ) ) {
403 DEBUG(5,("fillup_password_policy: No inbound trust to "
404 "contact domain %s\n", domain->name));
405 status = NT_STATUS_NOT_SUPPORTED;
406 goto done;
407 }
408
409 methods = domain->methods;
410
411 status = methods->password_policy(domain, talloc_tos(), &password_policy);
412 if (NT_STATUS_IS_ERR(status)) {
413 goto done;
414 }
415
416 fill_in_password_policy(response, &password_policy);
417
418 done:
419 TALLOC_FREE(frame);
420 return NT_STATUS_OK;
421 }
422
423 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
424 TALLOC_CTX *mem_ctx,
425 uint16 *lockout_threshold)
426 {
427 struct winbindd_methods *methods;
428 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
429 struct samr_DomInfo12 lockout_policy;
430
431 *lockout_threshold = 0;
432
433 methods = domain->methods;
434
435 status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
436 if (NT_STATUS_IS_ERR(status)) {
437 return status;
438 }
439
440 *lockout_threshold = lockout_policy.lockout_threshold;
441
442 return NT_STATUS_OK;
443 }
444
445 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
446 TALLOC_CTX *mem_ctx,
447 uint32 *password_properties)
448 {
449 struct winbindd_methods *methods;
450 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
451 struct samr_DomInfo1 password_policy;
452
453 *password_properties = 0;
454
455 methods = domain->methods;
456
457 status = methods->password_policy(domain, mem_ctx, &password_policy);
458 if (NT_STATUS_IS_ERR(status)) {
459 return status;
460 }
461
462 *password_properties = password_policy.password_properties;
463
464 return NT_STATUS_OK;
465 }
466
467 #ifdef HAVE_KRB5
468
469 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
470 const char *type,
471 uid_t uid,
472 const char **user_ccache_file)
473 {
474 /* accept FILE and WRFILE as krb5_cc_type from the client and then
475 * build the full ccname string based on the user's uid here -
476 * Guenther*/
477
478 const char *gen_cc = NULL;
479
480 if (uid != -1) {
481 if (strequal(type, "FILE")) {
482 gen_cc = talloc_asprintf(
483 mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
484 }
485 if (strequal(type, "WRFILE")) {
486 gen_cc = talloc_asprintf(
487 mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
488 }
489 }
490
491 *user_ccache_file = gen_cc;
492
493 if (gen_cc == NULL) {
494 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
495 }
496 if (gen_cc == NULL) {
497 DEBUG(0,("out of memory\n"));
498 return NULL;
499 }
500
501 DEBUG(10, ("using ccache: %s%s\n", gen_cc,
502 (*user_ccache_file == NULL) ? " (internal)":""));
503
504 return gen_cc;
505 }
506
507 #endif
508
509 uid_t get_uid_from_request(struct winbindd_request *request)
510 {
511 uid_t uid;
512
513 uid = request->data.auth.uid;
514
515 if (uid < 0) {
516 DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
517 return -1;
518 }
519 return uid;
520 }
521
522 /**********************************************************************
523 Authenticate a user with a clear text password using Kerberos and fill up
524 ccache if required
525 **********************************************************************/
526
527 static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
528 struct winbindd_domain *domain,
529 const char *user,
530 const char *pass,
531 const char *krb5_cc_type,
532 uid_t uid,
533 struct netr_SamInfo3 **info3,
534 fstring krb5ccname)
535 {
536 #ifdef HAVE_KRB5
537 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
538 krb5_error_code krb5_ret;
539 const char *cc = NULL;
540 const char *principal_s = NULL;
541 const char *service = NULL;
542 char *realm = NULL;
543 fstring name_domain, name_user;
544 time_t ticket_lifetime = 0;
545 time_t renewal_until = 0;
546 ADS_STRUCT *ads;
547 time_t time_offset = 0;
548 const char *user_ccache_file;
549 struct PAC_LOGON_INFO *logon_info = NULL;
550
551 *info3 = NULL;
552
553 /* 1st step:
554 * prepare a krb5_cc_cache string for the user */
555
556 if (uid == -1) {
557 DEBUG(0,("no valid uid\n"));
558 }
559
560 cc = generate_krb5_ccache(mem_ctx,
561 krb5_cc_type,
562 uid,
563 &user_ccache_file);
564 if (cc == NULL) {
565 return NT_STATUS_NO_MEMORY;
566 }
567
568
569 /* 2nd step:
570 * get kerberos properties */
571
572 if (domain->private_data) {
573 ads = (ADS_STRUCT *)domain->private_data;
574 time_offset = ads->auth.time_offset;
575 }
576
577
578 /* 3rd step:
579 * do kerberos auth and setup ccache as the user */
580
581 parse_domain_user(user, name_domain, name_user);
582
583 realm = domain->alt_name;
584 strupper_m(realm);
585
586 principal_s = talloc_asprintf(mem_ctx, "%s@%s", name_user, realm);
587 if (principal_s == NULL) {
588 return NT_STATUS_NO_MEMORY;
589 }
590
591 service = talloc_asprintf(mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
592 if (service == NULL) {
593 return NT_STATUS_NO_MEMORY;
594 }
595
596 /* if this is a user ccache, we need to act as the user to let the krb5
597 * library handle the chown, etc. */
598
599 /************************ ENTERING NON-ROOT **********************/
600
601 if (user_ccache_file != NULL) {
602 set_effective_uid(uid);
603 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
604 }
605
606 result = kerberos_return_pac(mem_ctx,
607 principal_s,
608 pass,
609 time_offset,
610 &ticket_lifetime,
611 &renewal_until,
612 cc,
613 true,
614 true,
615 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
616 NULL,
617 &logon_info);
618 if (user_ccache_file != NULL) {
619 gain_root_privilege();
620 }
621
622 /************************ RETURNED TO ROOT **********************/
623
624 if (!NT_STATUS_IS_OK(result)) {
625 goto failed;
626 }
627
628 *info3 = &logon_info->info3;
629
630 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
631 principal_s));
632
633 /* if we had a user's ccache then return that string for the pam
634 * environment */
635
636 if (user_ccache_file != NULL) {
637
638 fstrcpy(krb5ccname, user_ccache_file);
639
640 result = add_ccache_to_list(principal_s,
641 cc,
642 service,
643 user,
644 realm,
645 uid,
646 time(NULL),
647 ticket_lifetime,
648 renewal_until,
649 false);
650
651 if (!NT_STATUS_IS_OK(result)) {
652 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
653 nt_errstr(result)));
654 }
655 } else {
656
657 /* need to delete the memory cred cache, it is not used anymore */
658
659 krb5_ret = ads_kdestroy(cc);
660 if (krb5_ret) {
661 DEBUG(3,("winbindd_raw_kerberos_login: "
662 "could not destroy krb5 credential cache: "
663 "%s\n", error_message(krb5_ret)));
664 }
665
666 }
667
668 return NT_STATUS_OK;
669
670 failed:
671
672 /* we could have created a new credential cache with a valid tgt in it
673 * but we werent able to get or verify the service ticket for this
674 * local host and therefor didn't get the PAC, we need to remove that
675 * cache entirely now */
676
677 krb5_ret = ads_kdestroy(cc);
678 if (krb5_ret) {
679 DEBUG(3,("winbindd_raw_kerberos_login: "
680 "could not destroy krb5 credential cache: "
681 "%s\n", error_message(krb5_ret)));
682 }
683
684 if (!NT_STATUS_IS_OK(remove_ccache(user))) {
685 DEBUG(3,("winbindd_raw_kerberos_login: "
686 "could not remove ccache for user %s\n",
687 user));
688 }
689
690 return result;
691 #else
692 return NT_STATUS_NOT_SUPPORTED;
693 #endif /* HAVE_KRB5 */
694 }
695
696 /****************************************************************
697 ****************************************************************/
698
699 bool check_request_flags(uint32_t flags)
700 {
701 uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
702 WBFLAG_PAM_INFO3_TEXT |
703 WBFLAG_PAM_INFO3_NDR;
704
705 if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
706 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
707 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
708 !(flags & flags_edata) ) {
709 return true;
710 }
711
712 DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
713 flags));
714
715 return false;
716 }
717
718 /****************************************************************
719 ****************************************************************/
720
721 static NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
722 struct winbindd_response *resp,
723 uint32_t request_flags,
724 struct netr_SamInfo3 *info3,
725 const char *name_domain,
726 const char *name_user)
727 {
728 NTSTATUS result;
729
730 if (request_flags & WBFLAG_PAM_USER_SESSION_KEY) {
731 memcpy(resp->data.auth.user_session_key,
732 info3->base.key.key,
733 sizeof(resp->data.auth.user_session_key)
734 /* 16 */);
735 }
736
737 if (request_flags & WBFLAG_PAM_LMKEY) {
738 memcpy(resp->data.auth.first_8_lm_hash,
739 info3->base.LMSessKey.key,
740 sizeof(resp->data.auth.first_8_lm_hash)
741 /* 8 */);
742 }
743
744 if (request_flags & WBFLAG_PAM_UNIX_NAME) {
745 result = append_unix_username(mem_ctx, resp,
746 info3, name_domain, name_user);
747 if (!NT_STATUS_IS_OK(result)) {
748 DEBUG(10,("Failed to append Unix Username: %s\n",
749 nt_errstr(result)));
750 return result;
751 }
752 }
753
754 /* currently, anything from here on potentially overwrites extra_data. */
755
756 if (request_flags & WBFLAG_PAM_INFO3_NDR) {
757 result = append_info3_as_ndr(mem_ctx, resp, info3);
758 if (!NT_STATUS_IS_OK(result)) {
759 DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
760 nt_errstr(result)));
761 return result;
762 }
763 }
764
765 if (request_flags & WBFLAG_PAM_INFO3_TEXT) {
766 result = append_info3_as_txt(mem_ctx, resp, info3);
767 if (!NT_STATUS_IS_OK(result)) {
768 DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
769 nt_errstr(result)));
770 return result;
771 }
772 }
773
774 if (request_flags & WBFLAG_PAM_AFS_TOKEN) {
775 result = append_afs_token(mem_ctx, resp,
776 info3, name_domain, name_user);
777 if (!NT_STATUS_IS_OK(result)) {
778 DEBUG(10,("Failed to append AFS token: %s\n",
779 nt_errstr(result)));
780 return result;
781 }
782 }
783
784 return NT_STATUS_OK;
785 }
786
787 static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
788 struct winbindd_cli_state *state,
789 struct netr_SamInfo3 **info3)
790 {
791 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
792 uint16 max_allowed_bad_attempts;
793 fstring name_domain, name_user;
794 struct dom_sid sid;
795 enum lsa_SidType type;
796 uchar new_nt_pass[NT_HASH_LEN];
797 const uint8 *cached_nt_pass;
798 const uint8 *cached_salt;
799 struct netr_SamInfo3 *my_info3;
800 time_t kickoff_time, must_change_time;
801 bool password_good = false;
802 #ifdef HAVE_KRB5
803 struct winbindd_tdc_domain *tdc_domain = NULL;
804 #endif
805
806 *info3 = NULL;
807
808 ZERO_STRUCTP(info3);
809
810 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
811
812 /* Parse domain and username */
813
814 parse_domain_user(state->request->data.auth.user, name_domain, name_user);
815
816
817 if (!lookup_cached_name(name_domain,
818 name_user,
819 &sid,
820 &type)) {
821 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
822 return NT_STATUS_NO_SUCH_USER;
823 }
824
825 if (type != SID_NAME_USER) {
826 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
827 return NT_STATUS_LOGON_FAILURE;
828 }
829
830 result = winbindd_get_creds(domain,
831 state->mem_ctx,
832 &sid,
833 &my_info3,
834 &cached_nt_pass,
835 &cached_salt);
836 if (!NT_STATUS_IS_OK(result)) {
837 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
838 return result;
839 }
840
841 *info3 = my_info3;
842
843 E_md4hash(state->request->data.auth.pass, new_nt_pass);
844
845 dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
846 dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
847 if (cached_salt) {
848 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
849 }
850
851 if (cached_salt) {
852 /* In this case we didn't store the nt_hash itself,
853 but the MD5 combination of salt + nt_hash. */
854 uchar salted_hash[NT_HASH_LEN];
855 E_md5hash(cached_salt, new_nt_pass, salted_hash);
856
857 password_good = (memcmp(cached_nt_pass, salted_hash,
858 NT_HASH_LEN) == 0);
859 } else {
860 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
861 password_good = (memcmp(cached_nt_pass, new_nt_pass,
862 NT_HASH_LEN) == 0);
863 }
864
865 if (password_good) {
866
867 /* User *DOES* know the password, update logon_time and reset
868 * bad_pw_count */
869
870 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
871
872 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
873 return NT_STATUS_ACCOUNT_LOCKED_OUT;
874 }
875
876 if (my_info3->base.acct_flags & ACB_DISABLED) {
877 return NT_STATUS_ACCOUNT_DISABLED;
878 }
879
880 if (my_info3->base.acct_flags & ACB_WSTRUST) {
881 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
882 }
883
884 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
885 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
886 }
887
888 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
889 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
890 }
891
892 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
893 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
894 my_info3->base.acct_flags));
895 return NT_STATUS_LOGON_FAILURE;
896 }
897
898 kickoff_time = nt_time_to_unix(my_info3->base.kickoff_time);
899 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
900 return NT_STATUS_ACCOUNT_EXPIRED;
901 }
902
903 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
904 if (must_change_time != 0 && must_change_time < time(NULL)) {
905 /* we allow grace logons when the password has expired */
906 my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
907 /* return NT_STATUS_PASSWORD_EXPIRED; */
908 goto success;
909 }
910
911 #ifdef HAVE_KRB5
912 if ((state->request->flags & WBFLAG_PAM_KRB5) &&
913 ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
914 ((tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL) ||
915 /* used to cope with the case winbindd starting without network. */
916 !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
917
918 uid_t uid = -1;
919 const char *cc = NULL;
920 char *realm = NULL;
921 const char *principal_s = NULL;
922 const char *service = NULL;
923 const char *user_ccache_file;
924
925 uid = get_uid_from_request(state->request);
926 if (uid == -1) {
927 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
928 return NT_STATUS_INVALID_PARAMETER;
929 }
930
931 cc = generate_krb5_ccache(state->mem_ctx,
932 state->request->data.auth.krb5_cc_type,
933 state->request->data.auth.uid,
934 &user_ccache_file);
935 if (cc == NULL) {
936 return NT_STATUS_NO_MEMORY;
937 }
938
939 realm = domain->alt_name;
940 strupper_m(realm);
941
942 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
943 if (principal_s == NULL) {
944 return NT_STATUS_NO_MEMORY;
945 }
946
947 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
948 if (service == NULL) {
949 return NT_STATUS_NO_MEMORY;
950 }
951
952 if (user_ccache_file != NULL) {
953
954 fstrcpy(state->response->data.auth.krb5ccname,
955 user_ccache_file);
956
957 result = add_ccache_to_list(principal_s,
958 cc,
959 service,
960 state->request->data.auth.user,
961 domain->alt_name,
962 uid,
963 time(NULL),
964 time(NULL) + lp_winbind_cache_time(),
965 time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
966 true);
967
968 if (!NT_STATUS_IS_OK(result)) {
969 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
970 "to add ccache to list: %s\n",
971 nt_errstr(result)));
972 }
973 }
974 }
975 #endif /* HAVE_KRB5 */
976 success:
977 /* FIXME: we possibly should handle logon hours as well (does xp when
978 * offline?) see auth/auth_sam.c:sam_account_ok for details */
979
980 unix_to_nt_time(&my_info3->base.logon_time, time(NULL));
981 my_info3->base.bad_password_count = 0;
982
983 result = winbindd_update_creds_by_info3(domain,
984 state->request->data.auth.user,
985 state->request->data.auth.pass,
986 my_info3);
987 if (!NT_STATUS_IS_OK(result)) {
988 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
989 nt_errstr(result)));
990 return result;
991 }
992
993 return NT_STATUS_OK;
994
995 }
996
997 /* User does *NOT* know the correct password, modify info3 accordingly, but only if online */
998 if (domain->online == false) {
999 goto failed;
1000 }
1001
1002 /* failure of this is not critical */
1003 result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1004 if (!NT_STATUS_IS_OK(result)) {
1005 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1006 "Won't be able to honour account lockout policies\n"));
1007 }
1008
1009 /* increase counter */
1010 my_info3->base.bad_password_count++;
1011
1012 if (max_allowed_bad_attempts == 0) {
1013 goto failed;
1014 }
1015
1016 /* lockout user */
1017 if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1018
1019 uint32 password_properties;
1020
1021 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1022 if (!NT_STATUS_IS_OK(result)) {
1023 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1024 }
1025
1026 if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
1027 (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1028 my_info3->base.acct_flags |= ACB_AUTOLOCK;
1029 }
1030 }
1031
1032 failed:
1033 result = winbindd_update_creds_by_info3(domain,
1034 state->request->data.auth.user,
1035 NULL,
1036 my_info3);
1037
1038 if (!NT_STATUS_IS_OK(result)) {
1039 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1040 nt_errstr(result)));
1041 }
1042
1043 return NT_STATUS_LOGON_FAILURE;
1044 }
1045
1046 static NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1047 struct winbindd_cli_state *state,
1048 struct netr_SamInfo3 **info3)
1049 {
1050 struct winbindd_domain *contact_domain;
1051 fstring name_domain, name_user;
1052 NTSTATUS result;
1053
1054 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1055
1056 /* Parse domain and username */
1057
1058 parse_domain_user(state->request->data.auth.user, name_domain, name_user);
1059
1060 /* what domain should we contact? */
1061
1062 if ( IS_DC ) {
1063 if (!(contact_domain = find_domain_from_name(name_domain))) {
1064 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1065 state->request->data.auth.user, name_domain, name_user, name_domain));
1066 result = NT_STATUS_NO_SUCH_USER;
1067 goto done;
1068 }
1069
1070 } else {
1071 if (is_myname(name_domain)) {
1072 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1073 result = NT_STATUS_NO_SUCH_USER;
1074 goto done;
1075 }
1076
1077 contact_domain = find_domain_from_name(name_domain);
1078 if (contact_domain == NULL) {
1079 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1080 state->request->data.auth.user, name_domain, name_user, name_domain));
1081
1082 result = NT_STATUS_NO_SUCH_USER;
1083 goto done;
1084 }
1085 }
1086
1087 if (contact_domain->initialized &&
1088 contact_domain->active_directory) {
1089 goto try_login;
1090 }
1091
1092 if (!contact_domain->initialized) {
1093 init_dc_connection(contact_domain);
1094 }
1095
1096 if (!contact_domain->active_directory) {
1097 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1098 return NT_STATUS_INVALID_LOGON_TYPE;
1099 }
1100 try_login:
1101 result = winbindd_raw_kerberos_login(
1102 state->mem_ctx, contact_domain,
1103 state->request->data.auth.user,
1104 state->request->data.auth.pass,
1105 state->request->data.auth.krb5_cc_type,
1106 get_uid_from_request(state->request),
1107 info3, state->response->data.auth.krb5ccname);
1108 done:
1109 return result;
1110 }
1111
1112 static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
1113 const char *domain, const char *user,
1114 const DATA_BLOB *challenge,
1115 const DATA_BLOB *lm_resp,
1116 const DATA_BLOB *nt_resp,
1117 struct netr_SamInfo3 **pinfo3)
1118 {
1119 struct auth_usersupplied_info *user_info = NULL;
1120 struct tsocket_address *local;
1121 NTSTATUS status;
1122 int rc;
1123
1124 rc = tsocket_address_inet_from_strings(mem_ctx,
1125 "ip",
1126 "127.0.0.1",
1127 0,
1128 &local);
1129 if (rc < 0) {
1130 return NT_STATUS_NO_MEMORY;
1131 }
1132 status = make_user_info(&user_info, user, user, domain, domain,
1133 lp_netbios_name(), local, lm_resp, nt_resp, NULL, NULL,
1134 NULL, AUTH_PASSWORD_RESPONSE);
1135 if (!NT_STATUS_IS_OK(status)) {
1136 DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
1137 return status;
1138 }
1139
1140 /* We don't want any more mapping of the username */
1141 user_info->mapped_state = True;
1142
1143 status = check_sam_security_info3(challenge, talloc_tos(), user_info,
1144 pinfo3);
1145 free_user_info(&user_info);
1146 DEBUG(10, ("Authenticaticating user %s\\%s returned %s\n", domain,
1147 user, nt_errstr(status)));
1148 return status;
1149 }
1150
1151 static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
1152 TALLOC_CTX *mem_ctx,
1153 uint32_t logon_parameters,
1154 const char *server,
1155 const char *username,
1156 const char *domainname,
1157 const char *workstation,
1158 const uint8_t chal[8],
1159 DATA_BLOB lm_response,
1160 DATA_BLOB nt_response,
1161 struct netr_SamInfo3 **info3)
1162 {
1163 int attempts = 0;
1164 bool retry = false;
1165 NTSTATUS result;
1166
1167 do {
1168 struct rpc_pipe_client *netlogon_pipe;
1169 const struct pipe_auth_data *auth;
1170 uint32_t neg_flags = 0;
1171
1172 ZERO_STRUCTP(info3);
1173 retry = false;
1174
1175 result = cm_connect_netlogon(domain, &netlogon_pipe);
1176
1177 if (!NT_STATUS_IS_OK(result)) {
1178 DEBUG(3,("could not open handle to NETLOGON pipe (error: %s)\n",
1179 nt_errstr(result)));
1180 return result;
1181 }
1182 auth = netlogon_pipe->auth;
1183 if (netlogon_pipe->dc) {
1184 neg_flags = netlogon_pipe->dc->negotiate_flags;
1185 }
1186
1187 /* It is really important to try SamLogonEx here,
1188 * because in a clustered environment, we want to use
1189 * one machine account from multiple physical
1190 * computers.
1191 *
1192 * With a normal SamLogon call, we must keep the
1193 * credentials chain updated and intact between all
1194 * users of the machine account (which would imply
1195 * cross-node communication for every NTLM logon).
1196 *
1197 * (The credentials chain is not per NETLOGON pipe
1198 * connection, but globally on the server/client pair
1199 * by machine name).
1200 *
1201 * When using SamLogonEx, the credentials are not
1202 * supplied, but the session key is implied by the
1203 * wrapping SamLogon context.
1204 *
1205 * -- abartlet 21 April 2008
1206 *
1207 * It's also important to use NetlogonValidationSamInfo4 (6),
1208 * because it relies on the rpc transport encryption
1209 * and avoids using the global netlogon schannel
1210 * session key to en/decrypt secret information
1211 * like the user_session_key for network logons.
1212 *
1213 * [MS-APDS] 3.1.5.2 NTLM Network Logon
1214 * says NETLOGON_NEG_CROSS_FOREST_TRUSTS and
1215 * NETLOGON_NEG_AUTHENTICATED_RPC set together
1216 * are the indication that the server supports
1217 * NetlogonValidationSamInfo4 (6). And it must only
1218 * be used if "SealSecureChannel" is used.
1219 *
1220 * -- metze 4 February 2011
1221 */
1222
1223 if (auth == NULL) {
1224 domain->can_do_validation6 = false;
1225 } else if (auth->auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
1226 domain->can_do_validation6 = false;
1227 } else if (auth->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
1228 domain->can_do_validation6 = false;
1229 } else if (!(neg_flags & NETLOGON_NEG_CROSS_FOREST_TRUSTS)) {
1230 domain->can_do_validation6 = false;
1231 } else if (!(neg_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
1232 domain->can_do_validation6 = false;
1233 }
1234
1235 if (domain->can_do_samlogon_ex) {
1236 result = rpccli_netlogon_sam_network_logon_ex(
1237 netlogon_pipe,
1238 mem_ctx,
1239 logon_parameters,
1240 server, /* server name */
1241 username, /* user name */
1242 domainname, /* target domain */
1243 workstation, /* workstation */
1244 chal,
1245 domain->can_do_validation6 ? 6 : 3,
1246 lm_response,
1247 nt_response,
1248 info3);
1249 } else {
1250 result = rpccli_netlogon_sam_network_logon(
1251 netlogon_pipe,
1252 mem_ctx,
1253 logon_parameters,
1254 server, /* server name */
1255 username, /* user name */
1256 domainname, /* target domain */
1257 workstation, /* workstation */
1258 chal,
1259 domain->can_do_validation6 ? 6 : 3,
1260 lm_response,
1261 nt_response,
1262 info3);
1263 }
1264
1265 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1266
1267 /*
1268 * It's likely that the server also does not support
1269 * validation level 6
1270 */
1271 domain->can_do_validation6 = false;
1272
1273 if (domain->can_do_samlogon_ex) {
1274 DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1275 "retrying with NetSamLogon\n"));
1276 domain->can_do_samlogon_ex = false;
1277 retry = true;
1278 continue;
1279 }
1280
1281
1282 /* Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
1283 * (no Ex). This happens against old Samba
1284 * DCs. Drop the connection.
1285 */
1286 invalidate_cm_connection(&domain->conn);
1287 result = NT_STATUS_LOGON_FAILURE;
1288 break;
1289 }
1290
1291 if (domain->can_do_validation6 &&
1292 (NT_STATUS_EQUAL(result, NT_STATUS_INVALID_INFO_CLASS) ||
1293 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_PARAMETER) ||
1294 NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL))) {
1295 DEBUG(3,("Got a DC that can not do validation level 6, "
1296 "retrying with level 3\n"));
1297 domain->can_do_validation6 = false;
1298 retry = true;
1299 continue;
1300 }
1301
1302 /*
1303 * we increment this after the "feature negotiation"
1304 * for can_do_samlogon_ex and can_do_validation6
1305 */
1306 attempts += 1;
1307
1308 /* We have to try a second time as cm_connect_netlogon
1309 might not yet have noticed that the DC has killed
1310 our connection. */
1311
1312 if (!rpccli_is_connected(netlogon_pipe)) {
1313 retry = true;
1314 continue;
1315 }
1316
1317 /* if we get access denied, a possible cause was that we had
1318 and open connection to the DC, but someone changed our
1319 machine account password out from underneath us using 'net
1320 rpc changetrustpw' */
1321
1322 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1323 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1324 "ACCESS_DENIED. Maybe the trust account "
1325 "password was changed and we didn't know it. "
1326 "Killing connections to domain %s\n",
1327 domainname));
1328 invalidate_cm_connection(&domain->conn);
1329 retry = true;
1330 }
1331
1332 } while ( (attempts < 2) && retry );
1333
1334 return result;
1335 }
1336
1337 static NTSTATUS winbindd_dual_pam_auth_samlogon(TALLOC_CTX *mem_ctx,
1338 struct winbindd_domain *domain,
1339 const char *user,
1340 const char *pass,
1341 uint32_t request_flags,
1342 struct netr_SamInfo3 **info3)
1343 {
1344
1345 uchar chal[8];
1346 DATA_BLOB lm_resp;
1347 DATA_BLOB nt_resp;
1348 unsigned char local_nt_response[24];
1349 fstring name_domain, name_user;
1350 NTSTATUS result;
1351 struct netr_SamInfo3 *my_info3 = NULL;
1352
1353 *info3 = NULL;
1354
1355 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1356
1357 /* Parse domain and username */
1358
1359 parse_domain_user(user, name_domain, name_user);
1360
1361 /* do password magic */
1362
1363 generate_random_buffer(chal, sizeof(chal));
1364
1365 if (lp_client_ntlmv2_auth()) {
1366 DATA_BLOB server_chal;
1367 DATA_BLOB names_blob;
1368 server_chal = data_blob_const(chal, 8);
1369
1370 /* note that the 'workgroup' here is for the local
1371 machine. The 'server name' must match the
1372 'workstation' passed to the actual SamLogon call.
1373 */
1374 names_blob = NTLMv2_generate_names_blob(
1375 mem_ctx, lp_netbios_name(), lp_workgroup());
1376
1377 if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain,
1378 pass,
1379 &server_chal,
1380 &names_blob,
1381 &lm_resp, &nt_resp, NULL, NULL)) {
1382 data_blob_free(&names_blob);
1383 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1384 result = NT_STATUS_NO_MEMORY;
1385 goto done;
1386 }
1387 data_blob_free(&names_blob);
1388 } else {
1389 lm_resp = data_blob_null;
1390 SMBNTencrypt(pass, chal, local_nt_response);
1391
1392 nt_resp = data_blob_talloc(mem_ctx, local_nt_response,
1393 sizeof(local_nt_response));
1394 }
1395
1396 if (strequal(name_domain, get_global_sam_name())) {
1397 DATA_BLOB chal_blob = data_blob_const(chal, sizeof(chal));
1398
1399 result = winbindd_dual_auth_passdb(
1400 mem_ctx, name_domain, name_user,
1401 &chal_blob, &lm_resp, &nt_resp, info3);
1402 goto done;
1403 }
1404
1405 /* check authentication loop */
1406
1407 result = winbind_samlogon_retry_loop(domain,
1408 mem_ctx,
1409 0,
1410 domain->dcname,
1411 name_user,
1412 name_domain,
1413 lp_netbios_name(),
1414 chal,
1415 lm_resp,
1416 nt_resp,
1417 &my_info3);
1418 if (!NT_STATUS_IS_OK(result)) {
1419 goto done;
1420 }
1421
1422 /* handle the case where a NT4 DC does not fill in the acct_flags in
1423 * the samlogon reply info3. When accurate info3 is required by the
1424 * caller, we look up the account flags ourselve - gd */
1425
1426 if ((request_flags & WBFLAG_PAM_INFO3_TEXT) &&
1427 NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
1428
1429 struct rpc_pipe_client *samr_pipe;
1430 struct policy_handle samr_domain_handle, user_pol;
1431 union samr_UserInfo *info = NULL;
1432 NTSTATUS status_tmp, result_tmp;
1433 uint32 acct_flags;
1434 struct dcerpc_binding_handle *b;
1435
1436 status_tmp = cm_connect_sam(domain, mem_ctx,
1437 &samr_pipe, &samr_domain_handle);
1438
1439 if (!NT_STATUS_IS_OK(status_tmp)) {
1440 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1441 nt_errstr(status_tmp)));
1442 goto done;
1443 }
1444
1445 b = samr_pipe->binding_handle;
1446
1447 status_tmp = dcerpc_samr_OpenUser(b, mem_ctx,
1448 &samr_domain_handle,
1449 MAXIMUM_ALLOWED_ACCESS,
1450 my_info3->base.rid,
1451 &user_pol,
1452 &result_tmp);
1453
1454 if (!NT_STATUS_IS_OK(status_tmp)) {
1455 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1456 nt_errstr(status_tmp)));
1457 goto done;
1458 }
1459 if (!NT_STATUS_IS_OK(result_tmp)) {
1460 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1461 nt_errstr(result_tmp)));
1462 goto done;
1463 }
1464
1465 status_tmp = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1466 &user_pol,
1467 16,
1468 &info,
1469 &result_tmp);
1470
1471 if (!NT_STATUS_IS_OK(status_tmp)) {
1472 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1473 nt_errstr(status_tmp)));
1474 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1475 goto done;
1476 }
1477 if (!NT_STATUS_IS_OK(result_tmp)) {
1478 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1479 nt_errstr(result_tmp)));
1480 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1481 goto done;
1482 }
1483
1484 acct_flags = info->info16.acct_flags;
1485
1486 if (acct_flags == 0) {
1487 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1488 goto done;
1489 }
1490
1491 my_info3->base.acct_flags = acct_flags;
1492
1493 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1494
1495 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1496 }
1497
1498 *info3 = my_info3;
1499 done:
1500 return result;
1501 }
1502
1503 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1504 struct winbindd_cli_state *state)
1505 {
1506 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1507 NTSTATUS krb5_result = NT_STATUS_OK;
1508 fstring name_domain, name_user;
1509 char *mapped_user;
1510 fstring domain_user;
1511 struct netr_SamInfo3 *info3 = NULL;
1512 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
1513
1514 /* Ensure null termination */
1515 state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
1516
1517 /* Ensure null termination */
1518 state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
1519
1520 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1521 state->request->data.auth.user));
1522
1523 /* Parse domain and username */
1524
1525 name_map_status = normalize_name_unmap(state->mem_ctx,
1526 state->request->data.auth.user,
1527 &mapped_user);
1528
1529 /* If the name normalization didnt' actually do anything,
1530 just use the original name */
1531
1532 if (!NT_STATUS_IS_OK(name_map_status) &&
1533 !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
1534 {
1535 mapped_user = state->request->data.auth.user;
1536 }
1537
1538 parse_domain_user(mapped_user, name_domain, name_user);
1539
1540 if ( mapped_user != state->request->data.auth.user ) {
1541 fstr_sprintf( domain_user, "%s%c%s", name_domain,
1542 *lp_winbind_separator(),
1543 name_user );
1544 strlcpy( state->request->data.auth.user, domain_user,
1545 sizeof(state->request->data.auth.user));
1546 }
1547
1548 if (!domain->online) {
1549 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1550 if (domain->startup) {
1551 /* Logons are very important to users. If we're offline and
1552 we get a request within the first 30 seconds of startup,
1553 try very hard to find a DC and go online. */
1554
1555 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1556 "request in startup mode.\n", domain->name ));
1557
1558 winbindd_flush_negative_conn_cache(domain);
1559 result = init_dc_connection(domain);
1560 }
1561 }
1562
1563 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1564
1565 /* Check for Kerberos authentication */
1566 if (domain->online && (state->request->flags & WBFLAG_PAM_KRB5)) {
1567
1568 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1569 /* save for later */
1570 krb5_result = result;
1571
1572
1573 if (NT_STATUS_IS_OK(result)) {
1574 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1575 goto process_result;
1576 } else {
1577 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1578 }
1579
1580 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1581 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1582 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1583 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1584 set_domain_offline( domain );
1585 goto cached_logon;
1586 }
1587
1588 /* there are quite some NT_STATUS errors where there is no
1589 * point in retrying with a samlogon, we explictly have to take
1590 * care not to increase the bad logon counter on the DC */
1591
1592 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1593 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1594 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1595 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1596 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1597 NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1598 NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1599 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1600 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1601 NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1602 goto done;
1603 }
1604
1605 if (state->request->flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1606 DEBUG(3,("falling back to samlogon\n"));
1607 goto sam_logon;
1608 } else {
1609 goto cached_logon;
1610 }
1611 }
1612
1613 sam_logon:
1614 /* Check for Samlogon authentication */
1615 if (domain->online) {
1616 result = winbindd_dual_pam_auth_samlogon(
1617 state->mem_ctx, domain,
1618 state->request->data.auth.user,
1619 state->request->data.auth.pass,
1620 state->request->flags,
1621 &info3);
1622
1623 if (NT_STATUS_IS_OK(result)) {
1624 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1625 /* add the Krb5 err if we have one */
1626 if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1627 info3->base.user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1628 }
1629 goto process_result;
1630 }
1631
1632 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1633 nt_errstr(result)));
1634
1635 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1636 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1637 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1638 {
1639 DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1640 set_domain_offline( domain );
1641 goto cached_logon;
1642 }
1643
1644 if (domain->online) {
1645 /* We're still online - fail. */
1646 goto done;
1647 }
1648 }
1649
1650 cached_logon:
1651 /* Check for Cached logons */
1652 if (!domain->online && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN) &&
1653 lp_winbind_offline_logon()) {
1654
1655 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1656
1657 if (NT_STATUS_IS_OK(result)) {
1658 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1659 goto process_result;
1660 } else {
1661 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1662 goto done;
1663 }
1664 }
1665
1666 process_result:
1667
1668 if (NT_STATUS_IS_OK(result)) {
1669
1670 struct dom_sid user_sid;
1671
1672 /* In all codepaths where result == NT_STATUS_OK info3 must have
1673 been initialized. */
1674 if (!info3) {
1675 result = NT_STATUS_INTERNAL_ERROR;
1676 goto done;
1677 }
1678
1679 sid_compose(&user_sid, info3->base.domain_sid,
1680 info3->base.rid);
1681
1682 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
1683 &user_sid);
1684 netsamlogon_cache_store(name_user, info3);
1685
1686 /* save name_to_sid info as early as possible (only if
1687 this is our primary domain so we don't invalidate
1688 the cache entry by storing the seq_num for the wrong
1689 domain). */
1690 if ( domain->primary ) {
1691 cache_name2sid(domain, name_domain, name_user,
1692 SID_NAME_USER, &user_sid);
1693 }
1694
1695 /* Check if the user is in the right group */
1696
1697 result = check_info3_in_group(
1698 info3,
1699 state->request->data.auth.require_membership_of_sid);
1700 if (!NT_STATUS_IS_OK(result)) {
1701 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1702 state->request->data.auth.user,
1703 state->request->data.auth.require_membership_of_sid));
1704 goto done;
1705 }
1706
1707 result = append_auth_data(state->mem_ctx, state->response,
1708 state->request->flags, info3,
1709 name_domain, name_user);
1710 if (!NT_STATUS_IS_OK(result)) {
1711 goto done;
1712 }
1713
1714 if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
1715 && lp_winbind_offline_logon()) {
1716
1717 result = winbindd_store_creds(domain,
1718 state->request->data.auth.user,
1719 state->request->data.auth.pass,
1720 info3);
1721 }
1722
1723 if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
1724 struct winbindd_domain *our_domain = find_our_domain();
1725
1726 /* This is not entirely correct I believe, but it is
1727 consistent. Only apply the password policy settings
1728 too warn users for our own domain. Cannot obtain these
1729 from trusted DCs all the time so don't do it at all.
1730 -- jerry */
1731
1732 result = NT_STATUS_NOT_SUPPORTED;
1733 if (our_domain == domain ) {
1734 result = fillup_password_policy(
1735 our_domain, state->response);
1736 }
1737
1738 if (!NT_STATUS_IS_OK(result)
1739 && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1740 {
1741 DEBUG(10,("Failed to get password policies for domain %s: %s\n",
1742 domain->name, nt_errstr(result)));
1743 goto done;
1744 }
1745 }
1746
1747 result = NT_STATUS_OK;
1748 }
1749
1750 done:
1751 /* give us a more useful (more correct?) error code */
1752 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1753 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1754 result = NT_STATUS_NO_LOGON_SERVERS;
1755 }
1756
1757 set_auth_errors(state->response, result);
1758
1759 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1760 state->request->data.auth.user,
1761 state->response->data.auth.nt_status_string,
1762 state->response->data.auth.pam_error));
1763
1764 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1765 }
1766
1767 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1768 struct winbindd_cli_state *state)
1769 {
1770 NTSTATUS result;
1771 struct netr_SamInfo3 *info3 = NULL;
1772 const char *name_user = NULL;
1773 const char *name_domain = NULL;
1774 const char *workstation;
1775
1776 DATA_BLOB lm_resp, nt_resp;
1777
1778 /* This is child-only, so no check for privileged access is needed
1779 anymore */
1780
1781 /* Ensure null termination */
1782 state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
1783 state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
1784
1785 name_user = state->request->data.auth_crap.user;
1786 name_domain = state->request->data.auth_crap.domain;
1787 workstation = state->request->data.auth_crap.workstation;
1788
1789 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1790 name_domain, name_user));
1791
1792 if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
1793 || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
1794 if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
1795 state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
1796 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1797 state->request->data.auth_crap.lm_resp_len,
1798 state->request->data.auth_crap.nt_resp_len));
1799 result = NT_STATUS_INVALID_PARAMETER;
1800 goto done;
1801 }
1802 }
1803
1804 lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
1805 state->request->data.auth_crap.lm_resp_len);
1806
1807 if (state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) {
1808 nt_resp = data_blob_talloc(state->mem_ctx,
1809 state->request->extra_data.data,
1810 state->request->data.auth_crap.nt_resp_len);
1811 } else {
1812 nt_resp = data_blob_talloc(state->mem_ctx,
1813 state->request->data.auth_crap.nt_resp,
1814 state->request->data.auth_crap.nt_resp_len);
1815 }
1816
1817 if (strequal(name_domain, get_global_sam_name())) {
1818 DATA_BLOB chal_blob = data_blob_const(
1819 state->request->data.auth_crap.chal,
1820 sizeof(state->request->data.auth_crap.chal));
1821
1822 result = winbindd_dual_auth_passdb(
1823 state->mem_ctx, name_domain, name_user,
1824 &chal_blob, &lm_resp, &nt_resp, &info3);
1825 goto process_result;
1826 }
1827
1828 result = winbind_samlogon_retry_loop(domain,
1829 state->mem_ctx,
1830 state->request->data.auth_crap.logon_parameters,
1831 domain->dcname,
1832 name_user,
1833 name_domain,
1834 /* Bug #3248 - found by Stefan Burkei. */
1835 workstation, /* We carefully set this above so use it... */
1836 state->request->data.auth_crap.chal,
1837 lm_resp,
1838 nt_resp,
1839 &info3);
1840 if (!NT_STATUS_IS_OK(result)) {
1841 goto done;
1842 }
1843
1844 process_result:
1845
1846 if (NT_STATUS_IS_OK(result)) {
1847 struct dom_sid user_sid;
1848
1849 sid_compose(&user_sid, info3->base.domain_sid,
1850 info3->base.rid);
1851 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
1852 &user_sid);
1853 netsamlogon_cache_store(name_user, info3);
1854
1855 /* Check if the user is in the right group */
1856
1857 result = check_info3_in_group(
1858 info3,
1859 state->request->data.auth_crap.require_membership_of_sid);
1860 if (!NT_STATUS_IS_OK(result)) {
1861 DEBUG(3, ("User %s is not in the required group (%s), so "
1862 "crap authentication is rejected\n",
1863 state->request->data.auth_crap.user,
1864 state->request->data.auth_crap.require_membership_of_sid));
1865 goto done;
1866 }
1867
1868 result = append_auth_data(state->mem_ctx, state->response,
1869 state->request->flags, info3,
1870 name_domain, name_user);
1871 if (!NT_STATUS_IS_OK(result)) {
1872 goto done;
1873 }
1874 }
1875
1876 done:
1877
1878 /* give us a more useful (more correct?) error code */
1879 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1880 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1881 result = NT_STATUS_NO_LOGON_SERVERS;
1882 }
1883
1884 if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1885 result = nt_status_squash(result);
1886 }
1887
1888 set_auth_errors(state->response, result);
1889
1890 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1891 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1892 name_domain,
1893 name_user,
1894 state->response->data.auth.nt_status_string,
1895 state->response->data.auth.pam_error));
1896
1897 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1898 }
1899
1900 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1901 struct winbindd_cli_state *state)
1902 {
1903 char *oldpass;
1904 char *newpass = NULL;
1905 struct policy_handle dom_pol;
1906 struct rpc_pipe_client *cli = NULL;
1907 bool got_info = false;
1908 struct samr_DomInfo1 *info = NULL;
1909 struct userPwdChangeFailureInformation *reject = NULL;
1910 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1911 fstring domain, user;
1912 struct dcerpc_binding_handle *b = NULL;
1913
1914 ZERO_STRUCT(dom_pol);
1915
1916 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1917 state->request->data.auth.user));
1918
1919 if (!parse_domain_user(state->request->data.chauthtok.user, domain, user)) {
1920 goto done;
1921 }
1922
1923 /* Change password */
1924
1925 oldpass = state->request->data.chauthtok.oldpass;
1926 newpass = state->request->data.chauthtok.newpass;
1927
1928 /* Initialize reject reason */
1929 state->response->data.auth.reject_reason = Undefined;
1930
1931 /* Get sam handle */
1932
1933 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
1934 &dom_pol);
1935 if (!NT_STATUS_IS_OK(result)) {
1936 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
1937 goto done;
1938 }
1939
1940 b = cli->binding_handle;
1941
1942 result = rpccli_samr_chgpasswd_user3(cli, state->mem_ctx,
1943 user,
1944 newpass,
1945 oldpass,
1946 &info,
1947 &reject);
1948
1949 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
1950
1951 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
1952
1953 fill_in_password_policy(state->response, info);
1954
1955 state->response->data.auth.reject_reason =
1956 reject->extendedFailureReason;
1957
1958 got_info = true;
1959 }
1960
1961 /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
1962 * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
1963 * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
1964 * short to comply with the samr_ChangePasswordUser3 idl - gd */
1965
1966 /* only fallback when the chgpasswd_user3 call is not supported */
1967 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
1968 NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) ||
1969 NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL) ||
1970 NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
1971
1972 DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
1973 nt_errstr(result)));
1974
1975 result = rpccli_samr_chgpasswd_user2(cli, state->mem_ctx, user, newpass, oldpass);
1976
1977 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
1978 Map to the same status code as Windows 2003. */
1979
1980 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
1981 result = NT_STATUS_PASSWORD_RESTRICTION;
1982 }
1983 }
1984
1985 done:
1986
1987 if (NT_STATUS_IS_OK(result)
1988 && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
1989 && lp_winbind_offline_logon()) {
1990 result = winbindd_update_creds_by_name(contact_domain, user,
1991 newpass);
1992 /* Again, this happens when we login from gdm or xdm
1993 * and the password expires, *BUT* cached crendentials
1994 * doesn't exist. winbindd_update_creds_by_name()
1995 * returns NT_STATUS_NO_SUCH_USER.
1996 * This is not a failure.
1997 * --- BoYang
1998 * */
1999 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
2000 result = NT_STATUS_OK;
2001 }
2002
2003 if (!NT_STATUS_IS_OK(result)) {
2004 DEBUG(10, ("Failed to store creds: %s\n",
2005 nt_errstr(result)));
2006 goto process_result;
2007 }
2008 }
2009
2010 if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2011
2012 NTSTATUS policy_ret;
2013
2014 policy_ret = fillup_password_policy(
2015 contact_domain, state->response);
2016
2017 /* failure of this is non critical, it will just provide no
2018 * additional information to the client why the change has
2019 * failed - Guenther */
2020
2021 if (!NT_STATUS_IS_OK(policy_ret)) {
2022 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2023 goto process_result;
2024 }
2025 }
2026
2027 process_result:
2028
2029 if (strequal(contact_domain->name, get_global_sam_name())) {
2030 /* FIXME: internal rpc pipe does not cache handles yet */
2031 if (b) {
2032 if (is_valid_policy_hnd(&dom_pol)) {
2033 NTSTATUS _result;
2034 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2035 }
2036 TALLOC_FREE(cli);
2037 }
2038 }
2039
2040 set_auth_errors(state->response, result);
2041
2042 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2043 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2044 domain,
2045 user,
2046 state->response->data.auth.nt_status_string,
2047 state->response->data.auth.pam_error));
2048
2049 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2050 }
2051
2052 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2053 struct winbindd_cli_state *state)
2054 {
2055 NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2056
2057 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2058 state->request->data.logoff.user));
2059
2060 if (!(state->request->flags & WBFLAG_PAM_KRB5)) {
2061 result = NT_STATUS_OK;
2062 goto process_result;
2063 }
2064
2065 if (state->request->data.logoff.krb5ccname[0] == '\0') {
2066 result = NT_STATUS_OK;
2067 goto process_result;
2068 }
2069
2070 #ifdef HAVE_KRB5
2071
2072 if (state->request->data.logoff.uid < 0) {
2073 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2074 goto process_result;
2075 }
2076
2077 /* what we need here is to find the corresponding krb5 ccache name *we*
2078 * created for a given username and destroy it */
2079
2080 if (!ccache_entry_exists(state->request->data.logoff.user)) {
2081 result = NT_STATUS_OK;
2082 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2083 goto process_result;
2084 }
2085
2086 if (!ccache_entry_identical(state->request->data.logoff.user,
2087 state->request->data.logoff.uid,
2088 state->request->data.logoff.krb5ccname)) {
2089 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2090 goto process_result;
2091 }
2092
2093 result = remove_ccache(state->request->data.logoff.user);
2094 if (!NT_STATUS_IS_OK(result)) {
2095 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2096 nt_errstr(result)));
2097 goto process_result;
2098 }
2099
2100 #else
2101 result = NT_STATUS_NOT_SUPPORTED;
2102 #endif
2103
2104 process_result:
2105
2106
2107 set_auth_errors(state->response, result);
2108
2109 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2110 }
2111
2112 /* Change user password with auth crap*/
2113
2114 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2115 {
2116 NTSTATUS result;
2117 DATA_BLOB new_nt_password;
2118 DATA_BLOB old_nt_hash_enc;
2119 DATA_BLOB new_lm_password;
2120 DATA_BLOB old_lm_hash_enc;
2121 fstring domain,user;
2122 struct policy_handle dom_pol;
2123 struct winbindd_domain *contact_domain = domainSt;
2124 struct rpc_pipe_client *cli = NULL;
2125 struct dcerpc_binding_handle *b = NULL;
2126
2127 ZERO_STRUCT(dom_pol);
2128
2129 /* Ensure null termination */
2130 state->request->data.chng_pswd_auth_crap.user[
2131 sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
2132 state->request->data.chng_pswd_auth_crap.domain[
2133 sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
2134 *domain = 0;
2135 *user = 0;
2136
2137 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2138 (unsigned long)state->pid,
2139 state->request->data.chng_pswd_auth_crap.domain,
2140 state->request->data.chng_pswd_auth_crap.user));
2141
2142 if (lp_winbind_offline_logon()) {
2143 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2144 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2145 result = NT_STATUS_ACCESS_DENIED;
2146 goto done;
2147 }
2148
2149 if (*state->request->data.chng_pswd_auth_crap.domain) {
2150 fstrcpy(domain,state->request->data.chng_pswd_auth_crap.domain);
2151 } else {
2152 parse_domain_user(state->request->data.chng_pswd_auth_crap.user,
2153 domain, user);
2154
2155 if(!*domain) {
2156 DEBUG(3,("no domain specified with username (%s) - "
2157 "failing auth\n",
2158 state->request->data.chng_pswd_auth_crap.user));
2159 result = NT_STATUS_NO_SUCH_USER;
2160 goto done;
2161 }
2162 }
2163
2164 if (!*domain && lp_winbind_use_default_domain()) {
2165 fstrcpy(domain,lp_workgroup());
2166 }
2167
2168 if(!*user) {
2169 fstrcpy(user, state->request->data.chng_pswd_auth_crap.user);
2170 }
2171
2172 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2173 (unsigned long)state->pid, domain, user));
2174
2175 /* Change password */
2176 new_nt_password = data_blob_const(
2177 state->request->data.chng_pswd_auth_crap.new_nt_pswd,
2178 state->request->data.chng_pswd_auth_crap.new_nt_pswd_len);
2179
2180 old_nt_hash_enc = data_blob_const(
2181 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
2182 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2183
2184 if(state->request->data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2185 new_lm_password = data_blob_const(
2186 state->request->data.chng_pswd_auth_crap.new_lm_pswd,
2187 state->request->data.chng_pswd_auth_crap.new_lm_pswd_len);
2188
2189 old_lm_hash_enc = data_blob_const(
2190 state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
2191 state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2192 } else {
2193 new_lm_password.length = 0;
2194 old_lm_hash_enc.length = 0;
2195 }
2196
2197 /* Get sam handle */
2198
2199 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2200 if (!NT_STATUS_IS_OK(result)) {
2201 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2202 goto done;
2203 }
2204
2205 b = cli->binding_handle;
2206
2207 result = rpccli_samr_chng_pswd_auth_crap(
2208 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2209 new_lm_password, old_lm_hash_enc);
2210
2211 done:
2212
2213 if (strequal(contact_domain->name, get_global_sam_name())) {
2214 /* FIXME: internal rpc pipe does not cache handles yet */
2215 if (b) {
2216 if (is_valid_policy_hnd(&dom_pol)) {
2217 NTSTATUS _result;
2218 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2219 }
2220 TALLOC_FREE(cli);
2221 }
2222 }
2223
2224 set_auth_errors(state->response, result);
2225
2226 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2227 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2228 domain, user,
2229 state->response->data.auth.nt_status_string,
2230 state->response->data.auth.pam_error));
2231
2232 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2233 }
Samba GIT mirror