2 Unix SMB/CIFS implementation.
4 Winbind daemon - pam auth funcions
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program; if not, write to the Free Software
23 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 static NTSTATUS
append_info3_as_txt(TALLOC_CTX
*mem_ctx
,
32 struct winbindd_cli_state
*state
,
33 NET_USER_INFO_3
*info3
)
37 state
->response
.data
.auth
.info3
.logon_time
=
38 nt_time_to_unix(info3
->logon_time
);
39 state
->response
.data
.auth
.info3
.logoff_time
=
40 nt_time_to_unix(info3
->logoff_time
);
41 state
->response
.data
.auth
.info3
.kickoff_time
=
42 nt_time_to_unix(info3
->kickoff_time
);
43 state
->response
.data
.auth
.info3
.pass_last_set_time
=
44 nt_time_to_unix(info3
->pass_last_set_time
);
45 state
->response
.data
.auth
.info3
.pass_can_change_time
=
46 nt_time_to_unix(info3
->pass_can_change_time
);
47 state
->response
.data
.auth
.info3
.pass_must_change_time
=
48 nt_time_to_unix(info3
->pass_must_change_time
);
50 state
->response
.data
.auth
.info3
.logon_count
= info3
->logon_count
;
51 state
->response
.data
.auth
.info3
.bad_pw_count
= info3
->bad_pw_count
;
53 state
->response
.data
.auth
.info3
.user_rid
= info3
->user_rid
;
54 state
->response
.data
.auth
.info3
.group_rid
= info3
->group_rid
;
55 sid_to_string(str_sid
, &(info3
->dom_sid
.sid
));
56 fstrcpy(state
->response
.data
.auth
.info3
.dom_sid
, str_sid
);
58 state
->response
.data
.auth
.info3
.num_groups
= info3
->num_groups
;
59 state
->response
.data
.auth
.info3
.user_flgs
= info3
->user_flgs
;
61 state
->response
.data
.auth
.info3
.acct_flags
= info3
->acct_flags
;
62 state
->response
.data
.auth
.info3
.num_other_sids
= info3
->num_other_sids
;
64 unistr2_to_ascii(state
->response
.data
.auth
.info3
.user_name
,
65 &info3
->uni_user_name
, -1);
66 unistr2_to_ascii(state
->response
.data
.auth
.info3
.full_name
,
67 &info3
->uni_full_name
, -1);
68 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_script
,
69 &info3
->uni_logon_script
, -1);
70 unistr2_to_ascii(state
->response
.data
.auth
.info3
.profile_path
,
71 &info3
->uni_profile_path
, -1);
72 unistr2_to_ascii(state
->response
.data
.auth
.info3
.home_dir
,
73 &info3
->uni_home_dir
, -1);
74 unistr2_to_ascii(state
->response
.data
.auth
.info3
.dir_drive
,
75 &info3
->uni_dir_drive
, -1);
77 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_srv
,
78 &info3
->uni_logon_srv
, -1);
79 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_dom
,
80 &info3
->uni_logon_dom
, -1);
85 static NTSTATUS
append_info3_as_ndr(TALLOC_CTX
*mem_ctx
,
86 struct winbindd_cli_state
*state
,
87 NET_USER_INFO_3
*info3
)
91 if (!prs_init(&ps
, 256 /* Random, non-zero number */, mem_ctx
, MARSHALL
)) {
92 return NT_STATUS_NO_MEMORY
;
94 if (!net_io_user_info3("", info3
, &ps
, 1, 3, False
)) {
96 return NT_STATUS_UNSUCCESSFUL
;
99 size
= prs_data_size(&ps
);
100 SAFE_FREE(state
->response
.extra_data
.data
);
101 state
->response
.extra_data
.data
= SMB_MALLOC(size
);
102 if (!state
->response
.extra_data
.data
) {
104 return NT_STATUS_NO_MEMORY
;
106 memset( state
->response
.extra_data
.data
, '\0', size
);
107 prs_copy_all_data_out((char *)state
->response
.extra_data
.data
, &ps
);
108 state
->response
.length
+= size
;
113 static NTSTATUS
check_info3_in_group(TALLOC_CTX
*mem_ctx
,
114 NET_USER_INFO_3
*info3
,
115 const char *group_sid
)
117 * Check whether a user belongs to a group or list of groups.
119 * @param mem_ctx talloc memory context.
120 * @param info3 user information, including group membership info.
121 * @param group_sid One or more groups , separated by commas.
123 * @return NT_STATUS_OK on success,
124 * NT_STATUS_LOGON_FAILURE if the user does not belong,
125 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
128 DOM_SID
*require_membership_of_sid
;
129 size_t num_require_membership_of_sid
;
131 size_t num_all_sids
= (2 + info3
->num_groups2
+ info3
->num_other_sids
);
133 size_t group_sid_length
;
134 const char *search_location
;
135 char *single_group_sid
;
138 /* Parse the 'required group' SID */
140 if (!group_sid
|| !group_sid
[0]) {
141 /* NO sid supplied, all users may access */
145 num_require_membership_of_sid
= 1;
146 group_sid_length
= strlen(group_sid
);
147 for (i
= 0; i
< group_sid_length
; i
++) {
148 if (',' == group_sid
[i
]) {
149 num_require_membership_of_sid
++;
153 require_membership_of_sid
= TALLOC_ARRAY(mem_ctx
, DOM_SID
, num_require_membership_of_sid
);
154 if (!require_membership_of_sid
)
155 return NT_STATUS_NO_MEMORY
;
158 search_location
= group_sid
;
160 if (num_require_membership_of_sid
> 1) {
162 /* Allocate the maximum possible size */
163 single_group_sid
= TALLOC(mem_ctx
, group_sid_length
);
164 if (!single_group_sid
)
165 return NT_STATUS_NO_MEMORY
;
167 while ( (comma
= strstr(search_location
, ",")) != NULL
) {
169 strncpy(single_group_sid
, search_location
, comma
- search_location
);
170 single_group_sid
[comma
- search_location
] = 0;
172 if (!string_to_sid(&require_membership_of_sid
[i
++], single_group_sid
)) {
173 DEBUG(0, ("check_info3_in_group: could not parse %s as a SID!",
176 return NT_STATUS_INVALID_PARAMETER
;
179 search_location
= comma
+ 1;
183 if (!string_to_sid(&require_membership_of_sid
[i
++], search_location
)) {
184 DEBUG(0, ("check_info3_in_group: could not parse %s as a SID!",
187 return NT_STATUS_INVALID_PARAMETER
;
190 all_sids
= TALLOC_ARRAY(mem_ctx
, DOM_SID
, num_all_sids
);
192 return NT_STATUS_NO_MEMORY
;
194 /* and create (by appending rids) the 'domain' sids */
196 sid_copy(&all_sids
[0], &(info3
->dom_sid
.sid
));
198 if (!sid_append_rid(&all_sids
[0], info3
->user_rid
)) {
199 DEBUG(3,("could not append user's primary RID 0x%x\n",
202 return NT_STATUS_INVALID_PARAMETER
;
206 sid_copy(&all_sids
[1], &(info3
->dom_sid
.sid
));
208 if (!sid_append_rid(&all_sids
[1], info3
->group_rid
)) {
209 DEBUG(3,("could not append additional group rid 0x%x\n",
212 return NT_STATUS_INVALID_PARAMETER
;
216 for (i
= 0; i
< info3
->num_groups2
; i
++) {
218 sid_copy(&all_sids
[j
], &(info3
->dom_sid
.sid
));
220 if (!sid_append_rid(&all_sids
[j
], info3
->gids
[i
].g_rid
)) {
221 DEBUG(3,("could not append additional group rid 0x%x\n",
222 info3
->gids
[i
].g_rid
));
224 return NT_STATUS_INVALID_PARAMETER
;
229 /* Copy 'other' sids. We need to do sid filtering here to
230 prevent possible elevation of privileges. See:
232 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
235 for (i
= 0; i
< info3
->num_other_sids
; i
++) {
236 sid_copy(&all_sids
[info3
->num_groups2
+ i
+ 2],
237 &info3
->other_sids
[i
].sid
);
241 for (i
= 0; i
< j
; i
++) {
243 DEBUG(10, ("User has SID: %s\n",
244 sid_to_string(sid1
, &all_sids
[i
])));
245 for (k
= 0; k
< num_require_membership_of_sid
; k
++) {
246 if (sid_equal(&require_membership_of_sid
[k
], &all_sids
[i
])) {
247 DEBUG(10, ("SID %s matches %s - user permitted to authenticate!\n",
248 sid_to_string(sid1
, &require_membership_of_sid
[k
]), sid_to_string(sid2
, &all_sids
[i
])));
254 /* Do not distinguish this error from a wrong username/pw */
256 return NT_STATUS_LOGON_FAILURE
;
259 struct winbindd_domain
*find_auth_domain(struct winbindd_cli_state
*state
,
260 const char *domain_name
)
262 struct winbindd_domain
*domain
;
265 domain
= find_domain_from_name_noinit(domain_name
);
266 if (domain
== NULL
) {
267 DEBUG(3, ("Authentication for domain [%s] refused"
268 "as it is not a trusted domain\n",
274 if (is_myname(domain_name
)) {
275 DEBUG(3, ("Authentication for domain %s (local domain "
276 "to this server) not supported at this "
277 "stage\n", domain_name
));
281 /* we can auth against trusted domains */
282 if (state
->request
.flags
& WBFLAG_PAM_CONTACT_TRUSTDOM
) {
283 domain
= find_domain_from_name_noinit(domain_name
);
284 if (domain
== NULL
) {
285 DEBUG(3, ("Authentication for domain [%s] skipped "
286 "as it is not a trusted domain\n",
293 return find_our_domain();
296 static void set_auth_errors(struct winbindd_response
*resp
, NTSTATUS result
)
298 resp
->data
.auth
.nt_status
= NT_STATUS_V(result
);
299 fstrcpy(resp
->data
.auth
.nt_status_string
, nt_errstr(result
));
301 /* we might have given a more useful error above */
302 if (*resp
->data
.auth
.error_string
== '\0')
303 fstrcpy(resp
->data
.auth
.error_string
,
304 get_friendly_nt_error_msg(result
));
305 resp
->data
.auth
.pam_error
= nt_status_to_pam(result
);
308 static NTSTATUS
fillup_password_policy(struct winbindd_domain
*domain
,
309 struct winbindd_cli_state
*state
)
311 struct winbindd_methods
*methods
;
312 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
313 SAM_UNK_INFO_1 password_policy
;
315 methods
= domain
->methods
;
317 status
= methods
->password_policy(domain
, state
->mem_ctx
, &password_policy
);
318 if (NT_STATUS_IS_ERR(status
)) {
322 state
->response
.data
.auth
.policy
.min_length_password
=
323 password_policy
.min_length_password
;
324 state
->response
.data
.auth
.policy
.password_history
=
325 password_policy
.password_history
;
326 state
->response
.data
.auth
.policy
.password_properties
=
327 password_policy
.password_properties
;
328 state
->response
.data
.auth
.policy
.expire
=
329 nt_time_to_unix_abs(&(password_policy
.expire
));
330 state
->response
.data
.auth
.policy
.min_passwordage
=
331 nt_time_to_unix_abs(&(password_policy
.min_passwordage
));
336 static NTSTATUS
get_max_bad_attempts_from_lockout_policy(struct winbindd_domain
*domain
,
338 uint16
*max_allowed_bad_attempts
)
340 struct winbindd_methods
*methods
;
341 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
342 SAM_UNK_INFO_12 lockout_policy
;
344 *max_allowed_bad_attempts
= 0;
346 methods
= domain
->methods
;
348 status
= methods
->lockout_policy(domain
, mem_ctx
, &lockout_policy
);
349 if (NT_STATUS_IS_ERR(status
)) {
353 *max_allowed_bad_attempts
= lockout_policy
.bad_attempt_lockout
;
358 static NTSTATUS
get_pwd_properties(struct winbindd_domain
*domain
,
360 uint32
*password_properties
)
362 struct winbindd_methods
*methods
;
363 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
364 SAM_UNK_INFO_1 password_policy
;
366 *password_properties
= 0;
368 methods
= domain
->methods
;
370 status
= methods
->password_policy(domain
, mem_ctx
, &password_policy
);
371 if (NT_STATUS_IS_ERR(status
)) {
375 *password_properties
= password_policy
.password_properties
;
382 static const char *generate_krb5_ccache(TALLOC_CTX
*mem_ctx
,
385 BOOL
*internal_ccache
)
387 /* accept FILE and WRFILE as krb5_cc_type from the client and then
388 * build the full ccname string based on the user's uid here -
391 const char *gen_cc
= NULL
;
393 *internal_ccache
= True
;
399 if (!type
|| type
[0] == '\0') {
403 if (strequal(type
, "FILE")) {
404 gen_cc
= talloc_asprintf(mem_ctx
, "FILE:/tmp/krb5cc_%d", uid
);
405 } else if (strequal(type
, "WRFILE")) {
406 gen_cc
= talloc_asprintf(mem_ctx
, "WRFILE:/tmp/krb5cc_%d", uid
);
408 DEBUG(10,("we don't allow to set a %s type ccache\n", type
));
412 *internal_ccache
= False
;
416 gen_cc
= talloc_strdup(mem_ctx
, "MEMORY:winbindd_pam_ccache");
419 if (gen_cc
== NULL
) {
420 DEBUG(0,("out of memory\n"));
424 DEBUG(10,("using ccache: %s %s\n", gen_cc
, *internal_ccache
? "(internal)":""));
429 static void setup_return_cc_name(struct winbindd_cli_state
*state
, const char *cc
)
431 const char *type
= state
->request
.data
.auth
.krb5_cc_type
;
433 state
->response
.data
.auth
.krb5ccname
[0] = '\0';
435 if (type
[0] == '\0') {
439 if (!strequal(type
, "FILE") &&
440 !strequal(type
, "WRFILE")) {
441 DEBUG(10,("won't return krbccname for a %s type ccache\n",
446 fstrcpy(state
->response
.data
.auth
.krb5ccname
, cc
);
451 static uid_t
get_uid_from_state(struct winbindd_cli_state
*state
)
455 uid
= state
->request
.data
.auth
.uid
;
458 DEBUG(1,("invalid uid: '%d'\n", uid
));
464 /**********************************************************************
465 Authenticate a user with a clear text password using Kerberos and fill up
467 **********************************************************************/
469 static NTSTATUS
winbindd_raw_kerberos_login(struct winbindd_domain
*domain
,
470 struct winbindd_cli_state
*state
,
471 NET_USER_INFO_3
**info3
)
474 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
475 krb5_error_code krb5_ret
;
476 DATA_BLOB tkt
, session_key_krb5
;
477 DATA_BLOB ap_rep
, session_key
;
478 PAC_DATA
*pac_data
= NULL
;
479 PAC_LOGON_INFO
*logon_info
= NULL
;
480 char *client_princ
= NULL
;
481 char *client_princ_out
= NULL
;
482 char *local_service
= NULL
;
483 const char *cc
= NULL
;
484 const char *principal_s
= NULL
;
485 const char *service
= NULL
;
487 fstring name_domain
, name_user
;
488 time_t ticket_lifetime
= 0;
489 time_t renewal_until
= 0;
492 time_t time_offset
= 0;
493 BOOL internal_ccache
= True
;
495 ZERO_STRUCT(session_key
);
496 ZERO_STRUCT(session_key_krb5
);
505 * prepare a krb5_cc_cache string for the user */
507 uid
= get_uid_from_state(state
);
509 DEBUG(0,("no valid uid\n"));
512 cc
= generate_krb5_ccache(state
->mem_ctx
,
513 state
->request
.data
.auth
.krb5_cc_type
,
514 state
->request
.data
.auth
.uid
,
517 return NT_STATUS_NO_MEMORY
;
522 * get kerberos properties */
524 if (domain
->private_data
) {
525 ads
= (ADS_STRUCT
*)domain
->private_data
;
526 time_offset
= ads
->auth
.time_offset
;
531 * do kerberos auth and setup ccache as the user */
533 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
535 realm
= domain
->alt_name
;
538 principal_s
= talloc_asprintf(state
->mem_ctx
, "%s@%s", name_user
, realm
);
539 if (principal_s
== NULL
) {
540 return NT_STATUS_NO_MEMORY
;
543 service
= talloc_asprintf(state
->mem_ctx
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
);
544 if (service
== NULL
) {
545 return NT_STATUS_NO_MEMORY
;
548 /* if this is a user ccache, we need to act as the user to let the krb5
549 * library handle the chown, etc. */
551 /************************ NON-ROOT **********************/
553 if (!internal_ccache
) {
555 set_effective_uid(uid
);
556 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid
));
559 krb5_ret
= kerberos_kinit_password_ext(principal_s
,
560 state
->request
.data
.auth
.pass
,
567 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
);
570 DEBUG(1,("winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d)\n",
571 principal_s
, error_message(krb5_ret
), krb5_ret
));
572 result
= krb5_to_nt_status(krb5_ret
);
576 /* does http_timestring use heimdals libroken strftime?? - Guenther */
577 DEBUG(10,("got TGT for %s in %s (valid until: %s (%d), renewable till: %s (%d))\n",
579 http_timestring(ticket_lifetime
), (int)ticket_lifetime
,
580 http_timestring(renewal_until
), (int)renewal_until
));
582 /* we cannot continue with krb5 when UF_DONT_REQUIRE_PREAUTH is set,
583 * in that case fallback to NTLM - gd */
585 if ((ticket_lifetime
== 0) && (renewal_until
== 0)) {
586 result
= NT_STATUS_INVALID_LOGON_TYPE
;
590 client_princ
= talloc_strdup(state
->mem_ctx
, global_myname());
591 if (client_princ
== NULL
) {
592 result
= NT_STATUS_NO_MEMORY
;
595 strlower_m(client_princ
);
597 local_service
= talloc_asprintf(state
->mem_ctx
, "%s$@%s", client_princ
, lp_realm());
598 if (local_service
== NULL
) {
599 DEBUG(0,("winbindd_raw_kerberos_login: out of memory\n"));
600 result
= NT_STATUS_NO_MEMORY
;
604 krb5_ret
= cli_krb5_get_ticket(local_service
,
612 DEBUG(1,("winbindd_raw_kerberos_login: failed to get ticket for %s: %s\n",
613 local_service
, error_message(krb5_ret
)));
614 result
= krb5_to_nt_status(krb5_ret
);
618 if (!internal_ccache
) {
619 gain_root_privilege();
622 /************************ NON-ROOT **********************/
624 result
= ads_verify_ticket(state
->mem_ctx
,
632 if (!NT_STATUS_IS_OK(result
)) {
633 DEBUG(0,("winbindd_raw_kerberos_login: ads_verify_ticket failed: %s\n",
639 DEBUG(3,("winbindd_raw_kerberos_login: no pac data\n"));
640 result
= NT_STATUS_INVALID_PARAMETER
;
644 logon_info
= get_logon_info_from_pac(pac_data
);
645 if (logon_info
== NULL
) {
646 DEBUG(1,("winbindd_raw_kerberos_login: no logon info\n"));
647 result
= NT_STATUS_INVALID_PARAMETER
;
651 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
656 * put results together */
658 *info3
= &logon_info
->info3
;
660 /* if we had a user's ccache then return that string for the pam
663 if (!internal_ccache
) {
665 setup_return_cc_name(state
, cc
);
667 result
= add_ccache_to_list(principal_s
,
670 state
->request
.data
.auth
.user
,
678 if (!NT_STATUS_IS_OK(result
)) {
679 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
684 /* need to delete the memory cred cache, it is not used anymore */
686 krb5_ret
= ads_kdestroy(cc
);
688 DEBUG(3,("winbindd_raw_kerberos_login: "
689 "could not destroy krb5 credential cache: "
690 "%s\n", error_message(krb5_ret
)));
695 result
= NT_STATUS_OK
;
701 /* we could have created a new credential cache with a valid tgt in it
702 * but we werent able to get or verify the service ticket for this
703 * local host and therefor didn't get the PAC, we need to remove that
704 * cache entirely now */
706 krb5_ret
= ads_kdestroy(cc
);
708 DEBUG(3,("winbindd_raw_kerberos_login: "
709 "could not destroy krb5 credential cache: "
710 "%s\n", error_message(krb5_ret
)));
713 if (!NT_STATUS_IS_OK(remove_ccache(state
->request
.data
.auth
.user
))) {
714 DEBUG(3,("winbindd_raw_kerberos_login: "
715 "could not remove ccache for user %s\n",
716 state
->request
.data
.auth
.user
));
720 data_blob_free(&session_key
);
721 data_blob_free(&session_key_krb5
);
722 data_blob_free(&ap_rep
);
723 data_blob_free(&tkt
);
725 SAFE_FREE(client_princ_out
);
727 if (!internal_ccache
) {
728 gain_root_privilege();
733 return NT_STATUS_NOT_SUPPORTED
;
734 #endif /* HAVE_KRB5 */
737 void winbindd_pam_auth(struct winbindd_cli_state
*state
)
739 struct winbindd_domain
*domain
;
740 fstring name_domain
, name_user
;
742 /* Ensure null termination */
743 state
->request
.data
.auth
.user
744 [sizeof(state
->request
.data
.auth
.user
)-1]='\0';
746 /* Ensure null termination */
747 state
->request
.data
.auth
.pass
748 [sizeof(state
->request
.data
.auth
.pass
)-1]='\0';
750 DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state
->pid
,
751 state
->request
.data
.auth
.user
));
753 /* Parse domain and username */
755 ws_name_return( state
->request
.data
.auth
.user
, WB_REPLACE_CHAR
);
757 if (!canonicalize_username(state
->request
.data
.auth
.user
,
758 name_domain
, name_user
)) {
759 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
760 DEBUG(5, ("Plain text authentication for %s returned %s "
762 state
->request
.data
.auth
.user
,
763 state
->response
.data
.auth
.nt_status_string
,
764 state
->response
.data
.auth
.pam_error
));
765 request_error(state
);
769 domain
= find_auth_domain(state
, name_domain
);
771 if (domain
== NULL
) {
772 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
773 DEBUG(5, ("Plain text authentication for %s returned %s "
775 state
->request
.data
.auth
.user
,
776 state
->response
.data
.auth
.nt_status_string
,
777 state
->response
.data
.auth
.pam_error
));
778 request_error(state
);
782 sendto_domain(state
, domain
);
785 NTSTATUS
winbindd_dual_pam_auth_cached(struct winbindd_domain
*domain
,
786 struct winbindd_cli_state
*state
,
787 NET_USER_INFO_3
**info3
)
789 NTSTATUS result
= NT_STATUS_LOGON_FAILURE
;
790 uint16 max_allowed_bad_attempts
;
791 fstring name_domain
, name_user
;
793 enum lsa_SidType type
;
794 uchar new_nt_pass
[NT_HASH_LEN
];
795 const uint8
*cached_nt_pass
;
796 const uint8
*cached_salt
;
797 NET_USER_INFO_3
*my_info3
;
798 time_t kickoff_time
, must_change_time
;
799 BOOL password_good
= False
;
805 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
807 /* Parse domain and username */
809 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
812 if (!lookup_cached_name(state
->mem_ctx
,
817 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
818 return NT_STATUS_NO_SUCH_USER
;
821 if (type
!= SID_NAME_USER
) {
822 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type
)));
823 return NT_STATUS_LOGON_FAILURE
;
826 result
= winbindd_get_creds(domain
,
832 if (!NT_STATUS_IS_OK(result
)) {
833 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result
)));
839 E_md4hash(state
->request
.data
.auth
.pass
, new_nt_pass
);
842 dump_data(100, (const char *)new_nt_pass
, NT_HASH_LEN
);
843 dump_data(100, (const char *)cached_nt_pass
, NT_HASH_LEN
);
845 dump_data(100, (const char *)cached_salt
, NT_HASH_LEN
);
850 /* In this case we didn't store the nt_hash itself,
851 but the MD5 combination of salt + nt_hash. */
852 uchar salted_hash
[NT_HASH_LEN
];
853 E_md5hash(cached_salt
, new_nt_pass
, salted_hash
);
855 password_good
= (memcmp(cached_nt_pass
, salted_hash
, NT_HASH_LEN
) == 0) ?
858 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
859 password_good
= (memcmp(cached_nt_pass
, new_nt_pass
, NT_HASH_LEN
) == 0) ?
865 /* User *DOES* know the password, update logon_time and reset
868 my_info3
->user_flgs
|= LOGON_CACHED_ACCOUNT
;
870 if (my_info3
->acct_flags
& ACB_AUTOLOCK
) {
871 return NT_STATUS_ACCOUNT_LOCKED_OUT
;
874 if (my_info3
->acct_flags
& ACB_DISABLED
) {
875 return NT_STATUS_ACCOUNT_DISABLED
;
878 if (my_info3
->acct_flags
& ACB_WSTRUST
) {
879 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
;
882 if (my_info3
->acct_flags
& ACB_SVRTRUST
) {
883 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT
;
886 if (my_info3
->acct_flags
& ACB_DOMTRUST
) {
887 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
;
890 if (!(my_info3
->acct_flags
& ACB_NORMAL
)) {
891 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
892 my_info3
->acct_flags
));
893 return NT_STATUS_LOGON_FAILURE
;
896 kickoff_time
= nt_time_to_unix(my_info3
->kickoff_time
);
897 if (kickoff_time
!= 0 && time(NULL
) > kickoff_time
) {
898 return NT_STATUS_ACCOUNT_EXPIRED
;
901 must_change_time
= nt_time_to_unix(my_info3
->pass_must_change_time
);
902 if (must_change_time
!= 0 && must_change_time
< time(NULL
)) {
903 /* we allow grace logons when the password has expired */
904 my_info3
->user_flgs
|= LOGON_GRACE_LOGON
;
905 /* return NT_STATUS_PASSWORD_EXPIRED; */
910 /* FIXME: what else points out that the remote domain is AD ? */
911 if (!strequal(domain
->name
, domain
->alt_name
) &&
912 (state
->request
.flags
& WBFLAG_PAM_KRB5
)) {
915 const char *cc
= NULL
;
917 const char *principal_s
= NULL
;
918 const char *service
= NULL
;
919 BOOL internal_ccache
= False
;
921 uid
= get_uid_from_state(state
);
923 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
924 return NT_STATUS_INVALID_PARAMETER
;
927 cc
= generate_krb5_ccache(state
->mem_ctx
,
928 state
->request
.data
.auth
.krb5_cc_type
,
929 state
->request
.data
.auth
.uid
,
932 return NT_STATUS_NO_MEMORY
;
935 realm
= domain
->alt_name
;
938 principal_s
= talloc_asprintf(state
->mem_ctx
, "%s@%s", name_user
, realm
);
939 if (principal_s
== NULL
) {
940 return NT_STATUS_NO_MEMORY
;
943 service
= talloc_asprintf(state
->mem_ctx
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
);
944 if (service
== NULL
) {
945 return NT_STATUS_NO_MEMORY
;
948 if (!internal_ccache
) {
950 setup_return_cc_name(state
, cc
);
952 result
= add_ccache_to_list(principal_s
,
955 state
->request
.data
.auth
.user
,
959 time(NULL
) + lp_winbind_cache_time(),
960 time(NULL
) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
963 if (!NT_STATUS_IS_OK(result
)) {
964 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
965 "to add ccache to list: %s\n",
970 #endif /* HAVE_KRB5 */
972 /* FIXME: we possibly should handle logon hours as well (does xp when
973 * offline?) see auth/auth_sam.c:sam_account_ok for details */
975 unix_to_nt_time(&my_info3
->logon_time
, time(NULL
));
976 my_info3
->bad_pw_count
= 0;
978 result
= winbindd_update_creds_by_info3(domain
,
980 state
->request
.data
.auth
.user
,
981 state
->request
.data
.auth
.pass
,
983 if (!NT_STATUS_IS_OK(result
)) {
984 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
993 /* User does *NOT* know the correct password, modify info3 accordingly */
995 /* failure of this is not critical */
996 result
= get_max_bad_attempts_from_lockout_policy(domain
, state
->mem_ctx
, &max_allowed_bad_attempts
);
997 if (!NT_STATUS_IS_OK(result
)) {
998 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
999 "Won't be able to honour account lockout policies\n"));
1002 /* increase counter */
1003 my_info3
->bad_pw_count
++;
1005 if (max_allowed_bad_attempts
== 0) {
1010 if (my_info3
->bad_pw_count
>= max_allowed_bad_attempts
) {
1012 uint32 password_properties
;
1014 result
= get_pwd_properties(domain
, state
->mem_ctx
, &password_properties
);
1015 if (!NT_STATUS_IS_OK(result
)) {
1016 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1019 if ((my_info3
->user_rid
!= DOMAIN_USER_RID_ADMIN
) ||
1020 (password_properties
& DOMAIN_LOCKOUT_ADMINS
)) {
1021 my_info3
->acct_flags
|= ACB_AUTOLOCK
;
1026 result
= winbindd_update_creds_by_info3(domain
,
1028 state
->request
.data
.auth
.user
,
1032 if (!NT_STATUS_IS_OK(result
)) {
1033 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1034 nt_errstr(result
)));
1037 return NT_STATUS_LOGON_FAILURE
;
1040 NTSTATUS
winbindd_dual_pam_auth_kerberos(struct winbindd_domain
*domain
,
1041 struct winbindd_cli_state
*state
,
1042 NET_USER_INFO_3
**info3
)
1044 struct winbindd_domain
*contact_domain
;
1045 fstring name_domain
, name_user
;
1048 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1050 /* Parse domain and username */
1052 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1054 /* what domain should we contact? */
1057 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1058 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1059 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1060 result
= NT_STATUS_NO_SUCH_USER
;
1065 if (is_myname(name_domain
)) {
1066 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1067 result
= NT_STATUS_NO_SUCH_USER
;
1071 contact_domain
= find_domain_from_name(name_domain
);
1072 if (contact_domain
== NULL
) {
1073 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1074 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1076 contact_domain
= find_our_domain();
1080 if (contact_domain
->initialized
&&
1081 contact_domain
->active_directory
) {
1085 if (!contact_domain
->initialized
) {
1086 init_dc_connection(contact_domain
);
1089 if (!contact_domain
->active_directory
) {
1090 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1091 return NT_STATUS_INVALID_LOGON_TYPE
;
1094 result
= winbindd_raw_kerberos_login(contact_domain
, state
, info3
);
1099 NTSTATUS
winbindd_dual_pam_auth_samlogon(struct winbindd_domain
*domain
,
1100 struct winbindd_cli_state
*state
,
1101 NET_USER_INFO_3
**info3
)
1104 struct rpc_pipe_client
*netlogon_pipe
;
1109 unsigned char local_lm_response
[24];
1110 unsigned char local_nt_response
[24];
1111 struct winbindd_domain
*contact_domain
;
1112 fstring name_domain
, name_user
;
1115 NET_USER_INFO_3
*my_info3
;
1117 ZERO_STRUCTP(info3
);
1121 my_info3
= TALLOC_ZERO_P(state
->mem_ctx
, NET_USER_INFO_3
);
1122 if (my_info3
== NULL
) {
1123 return NT_STATUS_NO_MEMORY
;
1127 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1129 /* Parse domain and username */
1131 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1133 /* do password magic */
1136 generate_random_buffer(chal
, 8);
1137 if (lp_client_ntlmv2_auth()) {
1138 DATA_BLOB server_chal
;
1139 DATA_BLOB names_blob
;
1140 DATA_BLOB nt_response
;
1141 DATA_BLOB lm_response
;
1142 server_chal
= data_blob_talloc(state
->mem_ctx
, chal
, 8);
1144 /* note that the 'workgroup' here is a best guess - we don't know
1145 the server's domain at this point. The 'server name' is also
1148 names_blob
= NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1150 if (!SMBNTLMv2encrypt(name_user
, name_domain
,
1151 state
->request
.data
.auth
.pass
,
1154 &lm_response
, &nt_response
, NULL
)) {
1155 data_blob_free(&names_blob
);
1156 data_blob_free(&server_chal
);
1157 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1158 result
= NT_STATUS_NO_MEMORY
;
1161 data_blob_free(&names_blob
);
1162 data_blob_free(&server_chal
);
1163 lm_resp
= data_blob_talloc(state
->mem_ctx
, lm_response
.data
,
1164 lm_response
.length
);
1165 nt_resp
= data_blob_talloc(state
->mem_ctx
, nt_response
.data
,
1166 nt_response
.length
);
1167 data_blob_free(&lm_response
);
1168 data_blob_free(&nt_response
);
1171 if (lp_client_lanman_auth()
1172 && SMBencrypt(state
->request
.data
.auth
.pass
,
1174 local_lm_response
)) {
1175 lm_resp
= data_blob_talloc(state
->mem_ctx
,
1177 sizeof(local_lm_response
));
1179 lm_resp
= data_blob(NULL
, 0);
1181 SMBNTencrypt(state
->request
.data
.auth
.pass
,
1185 nt_resp
= data_blob_talloc(state
->mem_ctx
,
1187 sizeof(local_nt_response
));
1190 /* what domain should we contact? */
1193 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1194 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1195 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1196 result
= NT_STATUS_NO_SUCH_USER
;
1201 if (is_myname(name_domain
)) {
1202 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1203 result
= NT_STATUS_NO_SUCH_USER
;
1207 contact_domain
= find_our_domain();
1210 /* check authentication loop */
1214 ZERO_STRUCTP(my_info3
);
1217 result
= cm_connect_netlogon(contact_domain
, &netlogon_pipe
);
1219 if (!NT_STATUS_IS_OK(result
)) {
1220 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1224 result
= rpccli_netlogon_sam_network_logon(netlogon_pipe
,
1227 contact_domain
->dcname
, /* server name */
1228 name_user
, /* user name */
1229 name_domain
, /* target domain */
1230 global_myname(), /* workstation */
1237 /* We have to try a second time as cm_connect_netlogon
1238 might not yet have noticed that the DC has killed
1241 if (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)) {
1246 /* if we get access denied, a possible cause was that we had
1247 and open connection to the DC, but someone changed our
1248 machine account password out from underneath us using 'net
1249 rpc changetrustpw' */
1251 if ( NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1252 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1253 "ACCESS_DENIED. Maybe the trust account "
1254 "password was changed and we didn't know it. "
1255 "Killing connections to domain %s\n",
1257 invalidate_cm_connection(&contact_domain
->conn
);
1261 } while ( (attempts
< 2) && retry
);
1263 /* handle the case where a NT4 DC does not fill in the acct_flags in
1264 * the samlogon reply info3. When accurate info3 is required by the
1265 * caller, we look up the account flags ourselve - gd */
1267 if ((state
->request
.flags
& WBFLAG_PAM_INFO3_TEXT
) &&
1268 (my_info3
->acct_flags
== 0) && NT_STATUS_IS_OK(result
)) {
1270 struct rpc_pipe_client
*samr_pipe
;
1271 POLICY_HND samr_domain_handle
, user_pol
;
1272 SAM_USERINFO_CTR
*user_ctr
;
1273 NTSTATUS status_tmp
;
1276 ZERO_STRUCT(user_ctr
);
1278 status_tmp
= cm_connect_sam(contact_domain
, state
->mem_ctx
,
1279 &samr_pipe
, &samr_domain_handle
);
1281 if (!NT_STATUS_IS_OK(status_tmp
)) {
1282 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1283 nt_errstr(status_tmp
)));
1287 status_tmp
= rpccli_samr_open_user(samr_pipe
, state
->mem_ctx
,
1288 &samr_domain_handle
,
1289 MAXIMUM_ALLOWED_ACCESS
,
1290 my_info3
->user_rid
, &user_pol
);
1292 if (!NT_STATUS_IS_OK(status_tmp
)) {
1293 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1294 nt_errstr(status_tmp
)));
1298 status_tmp
= rpccli_samr_query_userinfo(samr_pipe
, state
->mem_ctx
,
1299 &user_pol
, 16, &user_ctr
);
1301 if (!NT_STATUS_IS_OK(status_tmp
)) {
1302 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1303 nt_errstr(status_tmp
)));
1304 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1308 acct_flags
= user_ctr
->info
.id16
->acb_info
;
1310 if (acct_flags
== 0) {
1311 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1315 my_info3
->acct_flags
= acct_flags
;
1317 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags
));
1319 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1327 enum winbindd_result
winbindd_dual_pam_auth(struct winbindd_domain
*domain
,
1328 struct winbindd_cli_state
*state
)
1330 NTSTATUS result
= NT_STATUS_LOGON_FAILURE
;
1331 fstring name_domain
, name_user
;
1332 NET_USER_INFO_3
*info3
= NULL
;
1334 /* Ensure null termination */
1335 state
->request
.data
.auth
.user
[sizeof(state
->request
.data
.auth
.user
)-1]='\0';
1337 /* Ensure null termination */
1338 state
->request
.data
.auth
.pass
[sizeof(state
->request
.data
.auth
.pass
)-1]='\0';
1340 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state
->pid
,
1341 state
->request
.data
.auth
.user
));
1343 /* Parse domain and username */
1345 ws_name_return( state
->request
.data
.auth
.user
, WB_REPLACE_CHAR
);
1347 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1349 if (domain
->online
== False
) {
1350 result
= NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1351 if (domain
->startup
) {
1352 /* Logons are very important to users. If we're offline and
1353 we get a request within the first 30 seconds of startup,
1354 try very hard to find a DC and go online. */
1356 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1357 "request in startup mode.\n", domain
->name
));
1359 winbindd_flush_negative_conn_cache(domain
);
1360 result
= init_dc_connection(domain
);
1364 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain
->name
, domain
->online
? "online":"offline"));
1366 /* Check for Kerberos authentication */
1367 if (domain
->online
&& (state
->request
.flags
& WBFLAG_PAM_KRB5
)) {
1369 result
= winbindd_dual_pam_auth_kerberos(domain
, state
, &info3
);
1371 if (NT_STATUS_IS_OK(result
)) {
1372 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1373 goto process_result
;
1375 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result
)));
1378 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_LOGON_SERVERS
) ||
1379 NT_STATUS_EQUAL(result
, NT_STATUS_IO_TIMEOUT
) ||
1380 NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
1381 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1382 domain
->online
= False
;
1385 /* there are quite some NT_STATUS errors where there is no
1386 * point in retrying with a samlogon, we explictly have to take
1387 * care not to increase the bad logon counter on the DC */
1389 if (NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_DISABLED
) ||
1390 NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_EXPIRED
) ||
1391 NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_LOCKED_OUT
) ||
1392 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_LOGON_HOURS
) ||
1393 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_WORKSTATION
) ||
1394 NT_STATUS_EQUAL(result
, NT_STATUS_LOGON_FAILURE
) ||
1395 NT_STATUS_EQUAL(result
, NT_STATUS_NO_SUCH_USER
) ||
1396 NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_EXPIRED
) ||
1397 NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_MUST_CHANGE
) ||
1398 NT_STATUS_EQUAL(result
, NT_STATUS_WRONG_PASSWORD
)) {
1399 goto process_result
;
1402 if (state
->request
.flags
& WBFLAG_PAM_FALLBACK_AFTER_KRB5
) {
1403 DEBUG(3,("falling back to samlogon\n"));
1411 /* Check for Samlogon authentication */
1412 if (domain
->online
) {
1413 result
= winbindd_dual_pam_auth_samlogon(domain
, state
, &info3
);
1415 if (NT_STATUS_IS_OK(result
)) {
1416 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1417 goto process_result
;
1419 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n", nt_errstr(result
)));
1420 if (domain
->online
) {
1421 /* We're still online - fail. */
1424 /* Else drop through and see if we can check offline.... */
1429 /* Check for Cached logons */
1430 if (!domain
->online
&& (state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
) &&
1431 lp_winbind_offline_logon()) {
1433 result
= winbindd_dual_pam_auth_cached(domain
, state
, &info3
);
1435 if (NT_STATUS_IS_OK(result
)) {
1436 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1437 goto process_result
;
1439 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result
)));
1446 if (NT_STATUS_IS_OK(result
)) {
1450 /* In all codepaths where result == NT_STATUS_OK info3 must have
1451 been initialized. */
1453 result
= NT_STATUS_INTERNAL_ERROR
;
1457 netsamlogon_cache_store(name_user
, info3
);
1458 wcache_invalidate_samlogon(find_domain_from_name(name_domain
), info3
);
1460 /* save name_to_sid info as early as possible */
1461 sid_compose(&user_sid
, &info3
->dom_sid
.sid
, info3
->user_rid
);
1462 cache_name2sid(domain
, name_domain
, name_user
, SID_NAME_USER
, &user_sid
);
1464 /* Check if the user is in the right group */
1466 if (!NT_STATUS_IS_OK(result
= check_info3_in_group(state
->mem_ctx
, info3
,
1467 state
->request
.data
.auth
.require_membership_of_sid
))) {
1468 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1469 state
->request
.data
.auth
.user
,
1470 state
->request
.data
.auth
.require_membership_of_sid
));
1474 if (state
->request
.flags
& WBFLAG_PAM_INFO3_NDR
) {
1475 result
= append_info3_as_ndr(state
->mem_ctx
, state
, info3
);
1476 if (!NT_STATUS_IS_OK(result
)) {
1477 DEBUG(10,("Failed to append INFO3 (NDR): %s\n", nt_errstr(result
)));
1482 if (state
->request
.flags
& WBFLAG_PAM_INFO3_TEXT
) {
1483 result
= append_info3_as_txt(state
->mem_ctx
, state
, info3
);
1484 if (!NT_STATUS_IS_OK(result
)) {
1485 DEBUG(10,("Failed to append INFO3 (TXT): %s\n", nt_errstr(result
)));
1491 if ((state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
)) {
1493 /* Store in-memory creds for single-signon using ntlm_auth. */
1494 result
= winbindd_add_memory_creds(state
->request
.data
.auth
.user
,
1495 get_uid_from_state(state
),
1496 state
->request
.data
.auth
.pass
);
1498 if (!NT_STATUS_IS_OK(result
)) {
1499 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result
)));
1503 if (lp_winbind_offline_logon()) {
1504 result
= winbindd_store_creds(domain
,
1506 state
->request
.data
.auth
.user
,
1507 state
->request
.data
.auth
.pass
,
1509 if (!NT_STATUS_IS_OK(result
)) {
1511 /* Release refcount. */
1512 winbindd_delete_memory_creds(state
->request
.data
.auth
.user
);
1514 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result
)));
1520 result
= fillup_password_policy(domain
, state
);
1522 if (!NT_STATUS_IS_OK(result
)) {
1523 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result
)));
1527 if (state
->request
.flags
& WBFLAG_PAM_UNIX_NAME
) {
1528 /* We've been asked to return the unix username, per
1529 'winbind use default domain' settings and the like */
1531 fstring username_out
;
1532 const char *nt_username
, *nt_domain
;
1534 if (!(nt_username
= unistr2_tdup(state
->mem_ctx
, &info3
->uni_user_name
))) {
1535 /* If the server didn't give us one, just use the one we sent them */
1536 nt_username
= name_user
;
1539 if (!(nt_domain
= unistr2_tdup(state
->mem_ctx
, &info3
->uni_logon_dom
))) {
1540 /* If the server didn't give us one, just use the one we sent them */
1541 nt_domain
= name_domain
;
1544 fill_domain_username(username_out
, nt_domain
, nt_username
, True
);
1546 DEBUG(5, ("Setting unix username to [%s]\n", username_out
));
1548 SAFE_FREE(state
->response
.extra_data
.data
);
1549 state
->response
.extra_data
.data
= SMB_STRDUP(username_out
);
1550 if (!state
->response
.extra_data
.data
) {
1551 result
= NT_STATUS_NO_MEMORY
;
1554 state
->response
.length
+=
1555 strlen((const char *)state
->response
.extra_data
.data
)+1;
1561 /* give us a more useful (more correct?) error code */
1562 if ((NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) ||
1563 (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)))) {
1564 result
= NT_STATUS_NO_LOGON_SERVERS
;
1567 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
1568 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
1570 /* we might have given a more useful error above */
1571 if (!*state
->response
.data
.auth
.error_string
)
1572 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
1573 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
1575 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1576 state
->request
.data
.auth
.user
,
1577 state
->response
.data
.auth
.nt_status_string
,
1578 state
->response
.data
.auth
.pam_error
));
1580 if ( NT_STATUS_IS_OK(result
) && info3
&&
1581 (state
->request
.flags
& WBFLAG_PAM_AFS_TOKEN
) ) {
1583 char *afsname
= talloc_strdup(state
->mem_ctx
,
1584 lp_afs_username_map());
1587 if (afsname
== NULL
) {
1591 afsname
= talloc_string_sub(state
->mem_ctx
,
1592 lp_afs_username_map(),
1594 afsname
= talloc_string_sub(state
->mem_ctx
, afsname
,
1596 afsname
= talloc_string_sub(state
->mem_ctx
, afsname
,
1603 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
1604 sid_append_rid(&user_sid
, info3
->user_rid
);
1605 sid_to_string(sidstr
, &user_sid
);
1606 afsname
= talloc_string_sub(state
->mem_ctx
, afsname
,
1610 if (afsname
== NULL
) {
1614 strlower_m(afsname
);
1616 DEBUG(10, ("Generating token for user %s\n", afsname
));
1618 cell
= strchr(afsname
, '@');
1627 /* Append an AFS token string */
1628 SAFE_FREE(state
->response
.extra_data
.data
);
1629 state
->response
.extra_data
.data
=
1630 afs_createtoken_str(afsname
, cell
);
1632 if (state
->response
.extra_data
.data
!= NULL
) {
1633 state
->response
.length
+=
1634 strlen((const char *)state
->response
.extra_data
.data
)+1;
1638 TALLOC_FREE(afsname
);
1641 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
1645 /**********************************************************************
1646 Challenge Response Authentication Protocol
1647 **********************************************************************/
1649 void winbindd_pam_auth_crap(struct winbindd_cli_state
*state
)
1651 struct winbindd_domain
*domain
= NULL
;
1652 const char *domain_name
= NULL
;
1655 if (!state
->privileged
) {
1656 char *error_string
= NULL
;
1657 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1659 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1660 "on %s are set correctly.\n",
1661 get_winbind_priv_pipe_dir()));
1662 /* send a better message than ACCESS_DENIED */
1663 error_string
= talloc_asprintf(state
->mem_ctx
,
1664 "winbind client not authorized "
1665 "to use winbindd_pam_auth_crap."
1666 " Ensure permissions on %s "
1667 "are set correctly.",
1668 get_winbind_priv_pipe_dir());
1669 fstrcpy(state
->response
.data
.auth
.error_string
, error_string
);
1670 result
= NT_STATUS_ACCESS_DENIED
;
1674 /* Ensure null termination */
1675 state
->request
.data
.auth_crap
.user
1676 [sizeof(state
->request
.data
.auth_crap
.user
)-1]=0;
1677 state
->request
.data
.auth_crap
.domain
1678 [sizeof(state
->request
.data
.auth_crap
.domain
)-1]=0;
1680 DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1681 (unsigned long)state
->pid
,
1682 state
->request
.data
.auth_crap
.domain
,
1683 state
->request
.data
.auth_crap
.user
));
1685 if (*state
->request
.data
.auth_crap
.domain
!= '\0') {
1686 domain_name
= state
->request
.data
.auth_crap
.domain
;
1687 } else if (lp_winbind_use_default_domain()) {
1688 domain_name
= lp_workgroup();
1691 if (domain_name
!= NULL
)
1692 domain
= find_auth_domain(state
, domain_name
);
1694 if (domain
!= NULL
) {
1695 sendto_domain(state
, domain
);
1699 result
= NT_STATUS_NO_SUCH_USER
;
1702 set_auth_errors(&state
->response
, result
);
1703 DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1704 state
->request
.data
.auth_crap
.domain
,
1705 state
->request
.data
.auth_crap
.user
,
1706 state
->response
.data
.auth
.nt_status_string
,
1707 state
->response
.data
.auth
.pam_error
));
1708 request_error(state
);
1713 enum winbindd_result
winbindd_dual_pam_auth_crap(struct winbindd_domain
*domain
,
1714 struct winbindd_cli_state
*state
)
1717 NET_USER_INFO_3 info3
;
1718 struct rpc_pipe_client
*netlogon_pipe
;
1719 const char *name_user
= NULL
;
1720 const char *name_domain
= NULL
;
1721 const char *workstation
;
1722 struct winbindd_domain
*contact_domain
;
1726 DATA_BLOB lm_resp
, nt_resp
;
1728 /* This is child-only, so no check for privileged access is needed
1731 /* Ensure null termination */
1732 state
->request
.data
.auth_crap
.user
[sizeof(state
->request
.data
.auth_crap
.user
)-1]=0;
1733 state
->request
.data
.auth_crap
.domain
[sizeof(state
->request
.data
.auth_crap
.domain
)-1]=0;
1735 name_user
= state
->request
.data
.auth_crap
.user
;
1737 if (*state
->request
.data
.auth_crap
.domain
) {
1738 name_domain
= state
->request
.data
.auth_crap
.domain
;
1739 } else if (lp_winbind_use_default_domain()) {
1740 name_domain
= lp_workgroup();
1742 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1744 result
= NT_STATUS_NO_SUCH_USER
;
1748 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state
->pid
,
1749 name_domain
, name_user
));
1751 if (*state
->request
.data
.auth_crap
.workstation
) {
1752 workstation
= state
->request
.data
.auth_crap
.workstation
;
1754 workstation
= global_myname();
1757 if (state
->request
.data
.auth_crap
.lm_resp_len
> sizeof(state
->request
.data
.auth_crap
.lm_resp
)
1758 || state
->request
.data
.auth_crap
.nt_resp_len
> sizeof(state
->request
.data
.auth_crap
.nt_resp
)) {
1759 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1760 state
->request
.data
.auth_crap
.lm_resp_len
,
1761 state
->request
.data
.auth_crap
.nt_resp_len
));
1762 result
= NT_STATUS_INVALID_PARAMETER
;
1766 lm_resp
= data_blob_talloc(state
->mem_ctx
, state
->request
.data
.auth_crap
.lm_resp
,
1767 state
->request
.data
.auth_crap
.lm_resp_len
);
1768 nt_resp
= data_blob_talloc(state
->mem_ctx
, state
->request
.data
.auth_crap
.nt_resp
,
1769 state
->request
.data
.auth_crap
.nt_resp_len
);
1771 /* what domain should we contact? */
1774 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1775 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1776 state
->request
.data
.auth_crap
.user
, name_domain
, name_user
, name_domain
));
1777 result
= NT_STATUS_NO_SUCH_USER
;
1781 if (is_myname(name_domain
)) {
1782 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1783 result
= NT_STATUS_NO_SUCH_USER
;
1786 contact_domain
= find_our_domain();
1793 netlogon_pipe
= NULL
;
1794 result
= cm_connect_netlogon(contact_domain
, &netlogon_pipe
);
1796 if (!NT_STATUS_IS_OK(result
)) {
1797 DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1798 nt_errstr(result
)));
1802 result
= rpccli_netlogon_sam_network_logon(netlogon_pipe
,
1804 state
->request
.data
.auth_crap
.logon_parameters
,
1805 contact_domain
->dcname
,
1808 /* Bug #3248 - found by Stefan Burkei. */
1809 workstation
, /* We carefully set this above so use it... */
1810 state
->request
.data
.auth_crap
.chal
,
1817 /* We have to try a second time as cm_connect_netlogon
1818 might not yet have noticed that the DC has killed
1821 if (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)) {
1826 /* if we get access denied, a possible cause was that we had and open
1827 connection to the DC, but someone changed our machine account password
1828 out from underneath us using 'net rpc changetrustpw' */
1830 if ( NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1831 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1832 "ACCESS_DENIED. Maybe the trust account "
1833 "password was changed and we didn't know it. "
1834 "Killing connections to domain %s\n",
1836 invalidate_cm_connection(&contact_domain
->conn
);
1840 } while ( (attempts
< 2) && retry
);
1842 if (NT_STATUS_IS_OK(result
)) {
1844 netsamlogon_cache_store(name_user
, &info3
);
1845 wcache_invalidate_samlogon(find_domain_from_name(name_domain
), &info3
);
1847 /* Check if the user is in the right group */
1849 if (!NT_STATUS_IS_OK(result
= check_info3_in_group(state
->mem_ctx
, &info3
,
1850 state
->request
.data
.auth_crap
.require_membership_of_sid
))) {
1851 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1852 state
->request
.data
.auth_crap
.user
,
1853 state
->request
.data
.auth_crap
.require_membership_of_sid
));
1857 if (state
->request
.flags
& WBFLAG_PAM_INFO3_NDR
) {
1858 result
= append_info3_as_ndr(state
->mem_ctx
, state
, &info3
);
1859 } else if (state
->request
.flags
& WBFLAG_PAM_UNIX_NAME
) {
1860 /* ntlm_auth should return the unix username, per
1861 'winbind use default domain' settings and the like */
1863 fstring username_out
;
1864 const char *nt_username
, *nt_domain
;
1865 if (!(nt_username
= unistr2_tdup(state
->mem_ctx
, &(info3
.uni_user_name
)))) {
1866 /* If the server didn't give us one, just use the one we sent them */
1867 nt_username
= name_user
;
1870 if (!(nt_domain
= unistr2_tdup(state
->mem_ctx
, &(info3
.uni_logon_dom
)))) {
1871 /* If the server didn't give us one, just use the one we sent them */
1872 nt_domain
= name_domain
;
1875 fill_domain_username(username_out
, nt_domain
, nt_username
, True
);
1877 DEBUG(5, ("Setting unix username to [%s]\n", username_out
));
1879 SAFE_FREE(state
->response
.extra_data
.data
);
1880 state
->response
.extra_data
.data
= SMB_STRDUP(username_out
);
1881 if (!state
->response
.extra_data
.data
) {
1882 result
= NT_STATUS_NO_MEMORY
;
1885 state
->response
.length
+=
1886 strlen((const char *)state
->response
.extra_data
.data
)+1;
1889 if (state
->request
.flags
& WBFLAG_PAM_USER_SESSION_KEY
) {
1890 memcpy(state
->response
.data
.auth
.user_session_key
, info3
.user_sess_key
,
1891 sizeof(state
->response
.data
.auth
.user_session_key
) /* 16 */);
1893 if (state
->request
.flags
& WBFLAG_PAM_LMKEY
) {
1894 memcpy(state
->response
.data
.auth
.first_8_lm_hash
, info3
.lm_sess_key
,
1895 sizeof(state
->response
.data
.auth
.first_8_lm_hash
) /* 8 */);
1901 /* give us a more useful (more correct?) error code */
1902 if ((NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) ||
1903 (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)))) {
1904 result
= NT_STATUS_NO_LOGON_SERVERS
;
1907 if (state
->request
.flags
& WBFLAG_PAM_NT_STATUS_SQUASH
) {
1908 result
= nt_status_squash(result
);
1911 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
1912 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
1914 /* we might have given a more useful error above */
1915 if (!*state
->response
.data
.auth
.error_string
) {
1916 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
1918 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
1920 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
1921 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1924 state
->response
.data
.auth
.nt_status_string
,
1925 state
->response
.data
.auth
.pam_error
));
1927 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
1930 /* Change a user password */
1932 void winbindd_pam_chauthtok(struct winbindd_cli_state
*state
)
1934 fstring domain
, user
;
1935 struct winbindd_domain
*contact_domain
;
1937 DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state
->pid
,
1938 state
->request
.data
.chauthtok
.user
));
1942 if (!canonicalize_username(state
->request
.data
.chauthtok
.user
, domain
, user
)) {
1943 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
1944 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
1946 state
->request
.data
.auth
.user
,
1947 state
->response
.data
.auth
.nt_status_string
,
1948 state
->response
.data
.auth
.pam_error
));
1949 request_error(state
);
1953 contact_domain
= find_domain_from_name(domain
);
1954 if (!contact_domain
) {
1955 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
1956 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
1957 state
->request
.data
.chauthtok
.user
, domain
, user
, domain
));
1958 request_error(state
);
1962 sendto_domain(state
, contact_domain
);
1965 enum winbindd_result
winbindd_dual_pam_chauthtok(struct winbindd_domain
*contact_domain
,
1966 struct winbindd_cli_state
*state
)
1969 char *newpass
= NULL
;
1971 struct rpc_pipe_client
*cli
;
1972 BOOL got_info
= False
;
1973 SAM_UNK_INFO_1 info
;
1974 SAMR_CHANGE_REJECT reject
;
1975 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1976 fstring domain
, user
;
1978 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state
->pid
,
1979 state
->request
.data
.auth
.user
));
1981 if (!parse_domain_user(state
->request
.data
.chauthtok
.user
, domain
, user
)) {
1985 /* Change password */
1987 oldpass
= state
->request
.data
.chauthtok
.oldpass
;
1988 newpass
= state
->request
.data
.chauthtok
.newpass
;
1990 /* Initialize reject reason */
1991 state
->response
.data
.auth
.reject_reason
= Undefined
;
1993 /* Get sam handle */
1995 result
= cm_connect_sam(contact_domain
, state
->mem_ctx
, &cli
,
1997 if (!NT_STATUS_IS_OK(result
)) {
1998 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain
));
2002 result
= rpccli_samr_chgpasswd3(cli
, state
->mem_ctx
, user
, newpass
, oldpass
, &info
, &reject
);
2004 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2006 if (NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_RESTRICTION
) ) {
2007 state
->response
.data
.auth
.policy
.min_length_password
=
2008 info
.min_length_password
;
2009 state
->response
.data
.auth
.policy
.password_history
=
2010 info
.password_history
;
2011 state
->response
.data
.auth
.policy
.password_properties
=
2012 info
.password_properties
;
2013 state
->response
.data
.auth
.policy
.expire
=
2014 nt_time_to_unix_abs(&info
.expire
);
2015 state
->response
.data
.auth
.policy
.min_passwordage
=
2016 nt_time_to_unix_abs(&info
.min_passwordage
);
2018 state
->response
.data
.auth
.reject_reason
=
2019 reject
.reject_reason
;
2024 /* only fallback when the chgpasswd3 call is not supported */
2025 if ((NT_STATUS_EQUAL(result
, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR
))) ||
2026 (NT_STATUS_EQUAL(result
, NT_STATUS_NOT_SUPPORTED
)) ||
2027 (NT_STATUS_EQUAL(result
, NT_STATUS_NOT_IMPLEMENTED
))) {
2029 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
2030 nt_errstr(result
)));
2032 result
= rpccli_samr_chgpasswd_user(cli
, state
->mem_ctx
, user
, newpass
, oldpass
);
2034 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2035 Map to the same status code as Windows 2003. */
2037 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION
, result
) ) {
2038 result
= NT_STATUS_PASSWORD_RESTRICTION
;
2044 if (NT_STATUS_IS_OK(result
) && (state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
)) {
2046 /* Update the single sign-on memory creds. */
2047 result
= winbindd_replace_memory_creds(state
->request
.data
.chauthtok
.user
,
2050 if (!NT_STATUS_IS_OK(result
)) {
2051 DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result
)));
2052 goto process_result
;
2055 if (lp_winbind_offline_logon()) {
2056 result
= winbindd_update_creds_by_name(contact_domain
,
2057 state
->mem_ctx
, user
,
2059 if (!NT_STATUS_IS_OK(result
)) {
2060 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result
)));
2061 goto process_result
;
2066 if (!NT_STATUS_IS_OK(result
) && !got_info
&& contact_domain
) {
2068 NTSTATUS policy_ret
;
2070 policy_ret
= fillup_password_policy(contact_domain
, state
);
2072 /* failure of this is non critical, it will just provide no
2073 * additional information to the client why the change has
2074 * failed - Guenther */
2076 if (!NT_STATUS_IS_OK(policy_ret
)) {
2077 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret
)));
2078 goto process_result
;
2084 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2085 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2086 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
2087 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2089 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
2090 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2093 state
->response
.data
.auth
.nt_status_string
,
2094 state
->response
.data
.auth
.pam_error
));
2096 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2099 void winbindd_pam_logoff(struct winbindd_cli_state
*state
)
2101 struct winbindd_domain
*domain
;
2102 fstring name_domain
, user
;
2103 uid_t caller_uid
= (uid_t
)-1;
2104 uid_t request_uid
= state
->request
.data
.logoff
.uid
;
2106 DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state
->pid
,
2107 state
->request
.data
.logoff
.user
));
2109 /* Ensure null termination */
2110 state
->request
.data
.logoff
.user
2111 [sizeof(state
->request
.data
.logoff
.user
)-1]='\0';
2113 state
->request
.data
.logoff
.krb5ccname
2114 [sizeof(state
->request
.data
.logoff
.krb5ccname
)-1]='\0';
2116 if (request_uid
== (gid_t
)-1) {
2120 if (!canonicalize_username(state
->request
.data
.logoff
.user
, name_domain
, user
)) {
2124 if ((domain
= find_auth_domain(state
, name_domain
)) == NULL
) {
2128 if ((sys_getpeereid(state
->sock
, &caller_uid
)) != 0) {
2129 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2134 switch (caller_uid
) {
2138 /* root must be able to logoff any user - gd */
2139 state
->request
.data
.logoff
.uid
= request_uid
;
2142 if (caller_uid
!= request_uid
) {
2143 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2146 state
->request
.data
.logoff
.uid
= caller_uid
;
2150 sendto_domain(state
, domain
);
2154 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
2155 DEBUG(5, ("Pam Logoff for %s returned %s "
2157 state
->request
.data
.logoff
.user
,
2158 state
->response
.data
.auth
.nt_status_string
,
2159 state
->response
.data
.auth
.pam_error
));
2160 request_error(state
);
2164 enum winbindd_result
winbindd_dual_pam_logoff(struct winbindd_domain
*domain
,
2165 struct winbindd_cli_state
*state
)
2167 NTSTATUS result
= NT_STATUS_NOT_SUPPORTED
;
2169 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state
->pid
,
2170 state
->request
.data
.logoff
.user
));
2172 if (!(state
->request
.flags
& WBFLAG_PAM_KRB5
)) {
2173 result
= NT_STATUS_OK
;
2174 goto process_result
;
2177 if (state
->request
.data
.logoff
.krb5ccname
[0] == '\0') {
2178 result
= NT_STATUS_OK
;
2179 goto process_result
;
2184 if (state
->request
.data
.logoff
.uid
< 0) {
2185 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2186 goto process_result
;
2189 /* what we need here is to find the corresponding krb5 ccache name *we*
2190 * created for a given username and destroy it */
2192 if (!ccache_entry_exists(state
->request
.data
.logoff
.user
)) {
2193 result
= NT_STATUS_OK
;
2194 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2195 goto process_result
;
2198 if (!ccache_entry_identical(state
->request
.data
.logoff
.user
,
2199 state
->request
.data
.logoff
.uid
,
2200 state
->request
.data
.logoff
.krb5ccname
)) {
2201 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2202 goto process_result
;
2205 result
= remove_ccache(state
->request
.data
.logoff
.user
);
2206 if (!NT_STATUS_IS_OK(result
)) {
2207 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2208 nt_errstr(result
)));
2209 goto process_result
;
2213 result
= NT_STATUS_NOT_SUPPORTED
;
2218 winbindd_delete_memory_creds(state
->request
.data
.logoff
.user
);
2220 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2221 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2222 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
2223 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2225 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2228 /* Change user password with auth crap*/
2230 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state
*state
)
2232 struct winbindd_domain
*domain
= NULL
;
2233 const char *domain_name
= NULL
;
2235 /* Ensure null termination */
2236 state
->request
.data
.chng_pswd_auth_crap
.user
[
2237 sizeof(state
->request
.data
.chng_pswd_auth_crap
.user
)-1]=0;
2238 state
->request
.data
.chng_pswd_auth_crap
.domain
[
2239 sizeof(state
->request
.data
.chng_pswd_auth_crap
.domain
)-1]=0;
2241 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2242 (unsigned long)state
->pid
,
2243 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2244 state
->request
.data
.chng_pswd_auth_crap
.user
));
2246 if (*state
->request
.data
.chng_pswd_auth_crap
.domain
!= '\0') {
2247 domain_name
= state
->request
.data
.chng_pswd_auth_crap
.domain
;
2248 } else if (lp_winbind_use_default_domain()) {
2249 domain_name
= lp_workgroup();
2252 if (domain_name
!= NULL
)
2253 domain
= find_domain_from_name(domain_name
);
2255 if (domain
!= NULL
) {
2256 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2257 "%s\n", (unsigned long)state
->pid
,domain
->name
));
2258 sendto_domain(state
, domain
);
2262 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
2263 DEBUG(5, ("CRAP change password for %s\\%s returned %s (PAM: %d)\n",
2264 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2265 state
->request
.data
.chng_pswd_auth_crap
.user
,
2266 state
->response
.data
.auth
.nt_status_string
,
2267 state
->response
.data
.auth
.pam_error
));
2268 request_error(state
);
2272 enum winbindd_result
winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain
*domainSt
, struct winbindd_cli_state
*state
)
2275 DATA_BLOB new_nt_password
;
2276 DATA_BLOB old_nt_hash_enc
;
2277 DATA_BLOB new_lm_password
;
2278 DATA_BLOB old_lm_hash_enc
;
2279 fstring domain
,user
;
2281 struct winbindd_domain
*contact_domain
= domainSt
;
2282 struct rpc_pipe_client
*cli
;
2284 /* Ensure null termination */
2285 state
->request
.data
.chng_pswd_auth_crap
.user
[
2286 sizeof(state
->request
.data
.chng_pswd_auth_crap
.user
)-1]=0;
2287 state
->request
.data
.chng_pswd_auth_crap
.domain
[
2288 sizeof(state
->request
.data
.chng_pswd_auth_crap
.domain
)-1]=0;
2292 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2293 (unsigned long)state
->pid
,
2294 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2295 state
->request
.data
.chng_pswd_auth_crap
.user
));
2297 if (lp_winbind_offline_logon()) {
2298 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2299 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2300 result
= NT_STATUS_ACCESS_DENIED
;
2304 if (*state
->request
.data
.chng_pswd_auth_crap
.domain
) {
2305 fstrcpy(domain
,state
->request
.data
.chng_pswd_auth_crap
.domain
);
2307 parse_domain_user(state
->request
.data
.chng_pswd_auth_crap
.user
,
2311 DEBUG(3,("no domain specified with username (%s) - "
2313 state
->request
.data
.chng_pswd_auth_crap
.user
));
2314 result
= NT_STATUS_NO_SUCH_USER
;
2319 if (!*domain
&& lp_winbind_use_default_domain()) {
2320 fstrcpy(domain
,(char *)lp_workgroup());
2324 fstrcpy(user
, state
->request
.data
.chng_pswd_auth_crap
.user
);
2327 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2328 (unsigned long)state
->pid
, domain
, user
));
2330 /* Change password */
2331 new_nt_password
= data_blob_talloc(
2333 state
->request
.data
.chng_pswd_auth_crap
.new_nt_pswd
,
2334 state
->request
.data
.chng_pswd_auth_crap
.new_nt_pswd_len
);
2336 old_nt_hash_enc
= data_blob_talloc(
2338 state
->request
.data
.chng_pswd_auth_crap
.old_nt_hash_enc
,
2339 state
->request
.data
.chng_pswd_auth_crap
.old_nt_hash_enc_len
);
2341 if(state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd_len
> 0) {
2342 new_lm_password
= data_blob_talloc(
2344 state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd
,
2345 state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd_len
);
2347 old_lm_hash_enc
= data_blob_talloc(
2349 state
->request
.data
.chng_pswd_auth_crap
.old_lm_hash_enc
,
2350 state
->request
.data
.chng_pswd_auth_crap
.old_lm_hash_enc_len
);
2352 new_lm_password
.length
= 0;
2353 old_lm_hash_enc
.length
= 0;
2356 /* Get sam handle */
2358 result
= cm_connect_sam(contact_domain
, state
->mem_ctx
, &cli
, &dom_pol
);
2359 if (!NT_STATUS_IS_OK(result
)) {
2360 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain
));
2364 result
= rpccli_samr_chng_pswd_auth_crap(
2365 cli
, state
->mem_ctx
, user
, new_nt_password
, old_nt_hash_enc
,
2366 new_lm_password
, old_lm_hash_enc
);
2369 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2370 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2371 fstrcpy(state
->response
.data
.auth
.error_string
,
2372 get_friendly_nt_error_msg(result
));
2373 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2375 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
2376 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2378 state
->response
.data
.auth
.nt_status_string
,
2379 state
->response
.data
.auth
.pam_error
));
2381 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;