2 Unix SMB/CIFS implementation.
4 Winbind daemon - krb5 credential cache functions
5 and in-memory cache functions.
7 Copyright (C) Guenther Deschner 2005-2006
8 Copyright (C) Jeremy Allison 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
28 #include "libads/kerberos_proto.h"
29 #include "lib/global_contexts.h"
32 #define DBGC_CLASS DBGC_WINBIND
34 /* uncomment this to do fast debugging on the krb5 ticket renewal event */
35 #ifdef DEBUG_KRB5_TKT_RENEWAL
36 #undef DEBUG_KRB5_TKT_RENEWAL
39 #define MAX_CCACHES 100
41 static struct WINBINDD_CCACHE_ENTRY
*ccache_list
;
42 static void krb5_ticket_gain_handler(struct tevent_context
*,
43 struct tevent_timer
*,
46 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY
*,
49 /* The Krb5 ticket refresh handler should be scheduled
50 at one-half of the period from now till the tkt
53 static time_t krb5_event_refresh_time(time_t end_time
)
55 time_t rest
= end_time
- time(NULL
);
56 return end_time
- rest
/2;
59 /****************************************************************
60 Find an entry by name.
61 ****************************************************************/
63 static struct WINBINDD_CCACHE_ENTRY
*get_ccache_by_username(const char *username
)
65 struct WINBINDD_CCACHE_ENTRY
*entry
;
67 for (entry
= ccache_list
; entry
; entry
= entry
->next
) {
68 if (strequal(entry
->username
, username
)) {
75 /****************************************************************
77 ****************************************************************/
79 static int ccache_entry_count(void)
81 struct WINBINDD_CCACHE_ENTRY
*entry
;
84 for (entry
= ccache_list
; entry
; entry
= entry
->next
) {
90 void ccache_remove_all_after_fork(void)
92 struct WINBINDD_CCACHE_ENTRY
*cur
, *next
;
94 for (cur
= ccache_list
; cur
; cur
= next
) {
96 DLIST_REMOVE(ccache_list
, cur
);
97 TALLOC_FREE(cur
->event
);
104 /****************************************************************
105 Do the work of refreshing the ticket.
106 ****************************************************************/
108 static void krb5_ticket_refresh_handler(struct tevent_context
*event_ctx
,
109 struct tevent_timer
*te
,
113 struct WINBINDD_CCACHE_ENTRY
*entry
=
114 talloc_get_type_abort(private_data
, struct WINBINDD_CCACHE_ENTRY
);
118 time_t expire_time
= 0;
119 struct WINBINDD_MEMORY_CREDS
*cred_ptr
= entry
->cred_ptr
;
122 DBG_DEBUG("event called for: %s, %s\n",
123 entry
->ccname
, entry
->username
);
125 TALLOC_FREE(entry
->event
);
129 /* Kinit again if we have the user password and we can't renew the old
132 * This happens when machine are put to sleep for a very long time. */
134 if (entry
->renew_until
< time(NULL
)) {
136 if (cred_ptr
&& cred_ptr
->pass
) {
138 set_effective_uid(entry
->uid
);
140 ret
= kerberos_kinit_password_ext(entry
->principal_name
,
142 0, /* hm, can we do time correction here ? */
143 &entry
->refresh_time
,
146 False
, /* no PAC required anymore */
148 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
153 gain_root_privilege();
156 DEBUG(3,("krb5_ticket_refresh_handler: "
157 "could not re-kinit: %s\n",
158 error_message(ret
)));
159 /* destroy the ticket because we cannot rekinit
160 * it, ignore error here */
161 ads_kdestroy(entry
->ccname
);
163 /* Don't break the ticket refresh chain: retry
164 * refreshing ticket sometime later when KDC is
165 * unreachable -- BoYang. More error code handling
169 if ((ret
== KRB5_KDC_UNREACH
)
170 || (ret
== KRB5_REALM_CANT_RESOLVE
)) {
171 #if defined(DEBUG_KRB5_TKT_RENEWAL)
172 new_start
= time(NULL
) + 30;
174 new_start
= time(NULL
) +
175 MAX(30, lp_winbind_cache_time());
177 add_krb5_ticket_gain_handler_event(entry
,
178 timeval_set(new_start
, 0));
181 TALLOC_FREE(entry
->event
);
185 DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
186 "for: %s in ccache: %s\n",
187 entry
->principal_name
, entry
->ccname
));
189 #if defined(DEBUG_KRB5_TKT_RENEWAL)
190 new_start
= time(NULL
) + 30;
192 /* The tkt should be refreshed at one-half the period
193 from now to the expiration time */
194 expire_time
= entry
->refresh_time
;
195 new_start
= krb5_event_refresh_time(entry
->refresh_time
);
200 * No cached credentials
201 * destroy ticket and refresh chain
203 ads_kdestroy(entry
->ccname
);
204 TALLOC_FREE(entry
->event
);
209 set_effective_uid(entry
->uid
);
211 ret
= smb_krb5_renew_ticket(entry
->ccname
,
212 entry
->canon_principal
,
215 #if defined(DEBUG_KRB5_TKT_RENEWAL)
216 new_start
= time(NULL
) + 30;
218 expire_time
= new_start
;
219 new_start
= krb5_event_refresh_time(new_start
);
222 gain_root_privilege();
225 DEBUG(3,("krb5_ticket_refresh_handler: "
226 "could not renew tickets: %s\n",
227 error_message(ret
)));
228 /* maybe we are beyond the renewing window */
230 /* evil rises here, we refresh ticket failed,
231 * but the ticket might be expired. Therefore,
232 * When we refresh ticket failed, destory the
235 ads_kdestroy(entry
->ccname
);
237 /* avoid breaking the renewal chain: retry in
238 * lp_winbind_cache_time() seconds when the KDC was not
239 * available right now.
240 * the return code can be KRB5_REALM_CANT_RESOLVE.
241 * More error code handling here? */
243 if ((ret
== KRB5_KDC_UNREACH
)
244 || (ret
== KRB5_REALM_CANT_RESOLVE
)) {
245 #if defined(DEBUG_KRB5_TKT_RENEWAL)
246 new_start
= time(NULL
) + 30;
248 new_start
= time(NULL
) +
249 MAX(30, lp_winbind_cache_time());
251 /* ticket is destroyed here, we have to regain it
252 * if it is possible */
253 add_krb5_ticket_gain_handler_event(entry
,
254 timeval_set(new_start
, 0));
258 /* This is evil, if the ticket was already expired.
259 * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
260 * But there is still a chance that we can rekinit it.
262 * This happens when user login in online mode, and then network
263 * down or something cause winbind goes offline for a very long time,
264 * and then goes online again. ticket expired, renew failed.
265 * This happens when machine are put to sleep for a long time,
266 * but shorter than entry->renew_util.
268 * Looks like the KDC is reachable, we want to rekinit as soon as
269 * possible instead of waiting some time later. */
270 if ((ret
== KRB5KRB_AP_ERR_TKT_EXPIRED
)
271 || (ret
== KRB5_FCC_NOFILE
)) goto rekinit
;
277 /* in cases that ticket will be unrenewable soon, we don't try to renew ticket
278 * but try to regain ticket if it is possible */
279 if (entry
->renew_until
&& expire_time
280 && (entry
->renew_until
<= expire_time
)) {
281 /* try to regain ticket 10 seconds before expiration */
283 add_krb5_ticket_gain_handler_event(entry
,
284 timeval_set(expire_time
, 0));
288 if (entry
->refresh_time
== 0) {
289 entry
->refresh_time
= new_start
;
291 entry
->event
= tevent_add_timer(global_event_context(), entry
,
292 timeval_set(new_start
, 0),
293 krb5_ticket_refresh_handler
,
299 /****************************************************************
300 Do the work of regaining a ticket when coming from offline auth.
301 ****************************************************************/
303 static void krb5_ticket_gain_handler(struct tevent_context
*event_ctx
,
304 struct tevent_timer
*te
,
308 struct WINBINDD_CCACHE_ENTRY
*entry
=
309 talloc_get_type_abort(private_data
, struct WINBINDD_CCACHE_ENTRY
);
313 struct WINBINDD_MEMORY_CREDS
*cred_ptr
= entry
->cred_ptr
;
314 struct winbindd_domain
*domain
= NULL
;
317 DBG_DEBUG("event called for: %s, %s\n",
318 entry
->ccname
, entry
->username
);
320 TALLOC_FREE(entry
->event
);
324 if (!cred_ptr
|| !cred_ptr
->pass
) {
325 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
329 if ((domain
= find_domain_from_name(entry
->realm
)) == NULL
) {
330 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
334 if (!domain
->online
) {
338 set_effective_uid(entry
->uid
);
340 ret
= kerberos_kinit_password_ext(entry
->principal_name
,
342 0, /* hm, can we do time correction here ? */
343 &entry
->refresh_time
,
346 False
, /* no PAC required anymore */
348 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
353 gain_root_privilege();
356 DEBUG(3,("krb5_ticket_gain_handler: "
357 "could not kinit: %s\n",
358 error_message(ret
)));
359 /* evil. If we cannot do it, destroy any the __maybe__
360 * __existing__ ticket */
361 ads_kdestroy(entry
->ccname
);
365 DEBUG(10,("krb5_ticket_gain_handler: "
366 "successful kinit for: %s in ccache: %s\n",
367 entry
->principal_name
, entry
->ccname
));
373 #if defined(DEBUG_KRB5_TKT_RENEWAL)
374 t
= timeval_set(time(NULL
) + 30, 0);
376 t
= timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
379 add_krb5_ticket_gain_handler_event(entry
, t
);
384 #if defined(DEBUG_KRB5_TKT_RENEWAL)
385 t
= timeval_set(time(NULL
) + 30, 0);
387 t
= timeval_set(krb5_event_refresh_time(entry
->refresh_time
), 0);
390 if (entry
->refresh_time
== 0) {
391 entry
->refresh_time
= t
.tv_sec
;
393 entry
->event
= tevent_add_timer(global_event_context(),
396 krb5_ticket_refresh_handler
,
403 /**************************************************************
404 The gain initial ticket case is recognised as entry->refresh_time
406 **************************************************************/
408 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY
*entry
,
411 entry
->refresh_time
= 0;
412 entry
->event
= tevent_add_timer(global_event_context(),
415 krb5_ticket_gain_handler
,
419 void ccache_regain_all_now(void)
421 struct WINBINDD_CCACHE_ENTRY
*cur
;
422 struct timeval t
= timeval_current();
424 for (cur
= ccache_list
; cur
; cur
= cur
->next
) {
425 struct tevent_timer
*new_event
;
428 * if refresh_time is 0, we know that the
429 * the event has the krb5_ticket_gain_handler
431 if (cur
->refresh_time
== 0) {
432 new_event
= tevent_add_timer(global_event_context(),
435 krb5_ticket_gain_handler
,
438 new_event
= tevent_add_timer(global_event_context(),
441 krb5_ticket_refresh_handler
,
449 TALLOC_FREE(cur
->event
);
450 cur
->event
= new_event
;
456 /****************************************************************
457 Check if an ccache entry exists.
458 ****************************************************************/
460 bool ccache_entry_exists(const char *username
)
462 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
463 return (entry
!= NULL
);
466 /****************************************************************
467 Ensure we're changing the correct entry.
468 ****************************************************************/
470 bool ccache_entry_identical(const char *username
,
474 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
480 if (entry
->uid
!= uid
) {
481 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
482 (unsigned int)entry
->uid
, (unsigned int)uid
));
485 if (!strcsequal(entry
->ccname
, ccname
)) {
486 DEBUG(0,("cache_entry_identical: "
487 "ccnames differ: (cache) %s != (client) %s\n",
488 entry
->ccname
, ccname
));
494 NTSTATUS
add_ccache_to_list(const char *princ_name
,
496 const char *username
,
503 bool postponed_request
,
504 const char *canon_principal
,
505 const char *canon_realm
)
507 struct WINBINDD_CCACHE_ENTRY
*entry
= NULL
;
511 if ((username
== NULL
&& princ_name
== NULL
) ||
512 ccname
== NULL
|| uid
== (uid_t
)-1) {
513 return NT_STATUS_INVALID_PARAMETER
;
516 if (ccache_entry_count() + 1 > MAX_CCACHES
) {
517 DEBUG(10,("add_ccache_to_list: "
518 "max number of ccaches reached\n"));
519 return NT_STATUS_NO_MORE_ENTRIES
;
522 /* Reference count old entries */
523 entry
= get_ccache_by_username(username
);
525 /* Check cached entries are identical. */
526 if (!ccache_entry_identical(username
, uid
, ccname
)) {
527 return NT_STATUS_INVALID_PARAMETER
;
530 DEBUG(10,("add_ccache_to_list: "
531 "ref count on entry %s is now %d\n",
532 username
, entry
->ref_count
));
533 /* FIXME: in this case we still might want to have a krb5 cred
534 * event handler created - gd
535 * Add ticket refresh handler here */
537 if (!lp_winbind_refresh_tickets() || renew_until
<= 0) {
542 if (postponed_request
) {
543 t
= timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
544 add_krb5_ticket_gain_handler_event(entry
, t
);
546 /* Renew at 1/2 the ticket expiration time */
547 #if defined(DEBUG_KRB5_TKT_RENEWAL)
548 t
= timeval_set(time(NULL
)+30, 0);
550 t
= timeval_set(krb5_event_refresh_time(ticket_end
),
553 if (!entry
->refresh_time
) {
554 entry
->refresh_time
= t
.tv_sec
;
556 entry
->event
= tevent_add_timer(global_event_context(),
559 krb5_ticket_refresh_handler
,
564 ntret
= remove_ccache(username
);
565 if (!NT_STATUS_IS_OK(ntret
)) {
566 DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
567 "ccache %s for user %s\n", entry
->ccname
,
569 DEBUG(0, ("add_ccache_to_list: error is %s\n",
573 return NT_STATUS_NO_MEMORY
;
576 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
581 * If we're set up to renew our krb5 tickets, we must
582 * cache the credentials in memory for the ticket
583 * renew function (or increase the reference count
584 * if we're logging in more than once). Fix inspired
585 * by patch from Ian Gordon <ian.gordon@strath.ac.uk>
589 ntret
= winbindd_add_memory_creds(username
, uid
, pass
);
590 DEBUG(10, ("winbindd_add_memory_creds returned: %s\n",
596 entry
= talloc(NULL
, struct WINBINDD_CCACHE_ENTRY
);
598 return NT_STATUS_NO_MEMORY
;
604 entry
->username
= talloc_strdup(entry
, username
);
605 if (!entry
->username
) {
610 entry
->principal_name
= talloc_strdup(entry
, princ_name
);
611 if (!entry
->principal_name
) {
615 if (canon_principal
!= NULL
) {
616 entry
->canon_principal
= talloc_strdup(entry
, canon_principal
);
617 if (entry
->canon_principal
== NULL
) {
621 if (canon_realm
!= NULL
) {
622 entry
->canon_realm
= talloc_strdup(entry
, canon_realm
);
623 if (entry
->canon_realm
== NULL
) {
628 entry
->ccname
= talloc_strdup(entry
, ccname
);
629 if (!entry
->ccname
) {
633 entry
->realm
= talloc_strdup(entry
, realm
);
638 entry
->service
= talloc_asprintf(entry
,
643 if (entry
->service
== NULL
) {
647 entry
->create_time
= create_time
;
648 entry
->renew_until
= renew_until
;
650 entry
->ref_count
= 1;
652 if (!lp_winbind_refresh_tickets() || renew_until
<= 0) {
656 if (postponed_request
) {
657 t
= timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
658 add_krb5_ticket_gain_handler_event(entry
, t
);
660 /* Renew at 1/2 the ticket expiration time */
661 #if defined(DEBUG_KRB5_TKT_RENEWAL)
662 t
= timeval_set(time(NULL
)+30, 0);
664 t
= timeval_set(krb5_event_refresh_time(ticket_end
), 0);
666 if (entry
->refresh_time
== 0) {
667 entry
->refresh_time
= t
.tv_sec
;
669 entry
->event
= tevent_add_timer(global_event_context(),
672 krb5_ticket_refresh_handler
,
680 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
684 DLIST_ADD(ccache_list
, entry
);
686 DBG_DEBUG("Added ccache [%s] for user [%s] and service [%s]\n",
687 entry
->ccname
, entry
->username
, entry
->service
);
691 * If we're set up to renew our krb5 tickets, we must
692 * cache the credentials in memory for the ticket
693 * renew function. Fix inspired by patch from
694 * Ian Gordon <ian.gordon@strath.ac.uk> for
698 ntret
= winbindd_add_memory_creds(username
, uid
, pass
);
699 DEBUG(10, ("winbindd_add_memory_creds returned: %s\n",
708 return NT_STATUS_NO_MEMORY
;
711 /*******************************************************************
712 Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer
714 *******************************************************************/
716 NTSTATUS
remove_ccache(const char *username
)
718 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
719 NTSTATUS status
= NT_STATUS_OK
;
725 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
728 if (entry
->ref_count
<= 0) {
729 DEBUG(0,("remove_ccache: logic error. "
730 "ref count for user %s = %d\n",
731 username
, entry
->ref_count
));
732 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
737 if (entry
->ref_count
> 0) {
738 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
739 username
, entry
->ref_count
));
743 /* no references any more */
745 DLIST_REMOVE(ccache_list
, entry
);
746 TALLOC_FREE(entry
->event
); /* unregisters events */
749 ret
= ads_kdestroy(entry
->ccname
);
751 /* we ignore the error when there has been no credential cache */
752 if (ret
== KRB5_FCC_NOFILE
) {
755 DEBUG(0,("remove_ccache: "
756 "failed to destroy user krb5 ccache %s with: %s\n",
757 entry
->ccname
, error_message(ret
)));
759 DEBUG(10,("remove_ccache: "
760 "successfully destroyed krb5 ccache %s for user %s\n",
761 entry
->ccname
, username
));
763 status
= krb5_to_nt_status(ret
);
767 DEBUG(10,("remove_ccache: removed ccache for user %s\n", username
));
772 /*******************************************************************
773 In memory credentials cache code.
774 *******************************************************************/
776 static struct WINBINDD_MEMORY_CREDS
*memory_creds_list
;
778 /***********************************************************
779 Find an entry on the list by name.
780 ***********************************************************/
782 struct WINBINDD_MEMORY_CREDS
*find_memory_creds_by_name(const char *username
)
784 struct WINBINDD_MEMORY_CREDS
*p
;
786 for (p
= memory_creds_list
; p
; p
= p
->next
) {
787 if (strequal(p
->username
, username
)) {
794 /***********************************************************
795 Store the required creds and mlock them.
796 ***********************************************************/
798 static NTSTATUS
store_memory_creds(struct WINBINDD_MEMORY_CREDS
*memcredp
,
801 #if !defined(HAVE_MLOCK)
804 /* new_entry->nt_hash is the base pointer for the block
805 of memory pointed into by new_entry->lm_hash and
806 new_entry->pass (if we're storing plaintext). */
808 memcredp
->len
= NT_HASH_LEN
+ LM_HASH_LEN
;
810 memcredp
->len
+= strlen(pass
)+1;
815 /* aligning the memory on on x86_64 and compiling
816 with gcc 4.1 using -O2 causes a segv in the
817 next memset() --jerry */
818 memcredp
->nt_hash
= SMB_MALLOC_ARRAY(unsigned char, memcredp
->len
);
820 /* On non-linux platforms, mlock()'d memory must be aligned */
821 memcredp
->nt_hash
= SMB_MEMALIGN_ARRAY(unsigned char,
822 getpagesize(), memcredp
->len
);
824 if (!memcredp
->nt_hash
) {
825 return NT_STATUS_NO_MEMORY
;
827 memset(memcredp
->nt_hash
, 0x0, memcredp
->len
);
829 memcredp
->lm_hash
= memcredp
->nt_hash
+ NT_HASH_LEN
;
831 #ifdef DEBUG_PASSWORD
832 DEBUG(10,("mlocking memory: %p\n", memcredp
->nt_hash
));
834 if ((mlock(memcredp
->nt_hash
, memcredp
->len
)) == -1) {
835 DEBUG(0,("failed to mlock memory: %s (%d)\n",
836 strerror(errno
), errno
));
837 SAFE_FREE(memcredp
->nt_hash
);
838 return map_nt_error_from_unix(errno
);
841 #ifdef DEBUG_PASSWORD
842 DEBUG(10,("mlocked memory: %p\n", memcredp
->nt_hash
));
846 /* Create and store the password hashes. */
847 E_md4hash(pass
, memcredp
->nt_hash
);
848 E_deshash(pass
, memcredp
->lm_hash
);
850 memcredp
->pass
= (char *)memcredp
->lm_hash
+ LM_HASH_LEN
;
851 memcpy(memcredp
->pass
, pass
,
852 memcredp
->len
- NT_HASH_LEN
- LM_HASH_LEN
);
859 /***********************************************************
860 Destroy existing creds.
861 ***********************************************************/
863 static NTSTATUS
delete_memory_creds(struct WINBINDD_MEMORY_CREDS
*memcredp
)
865 #if !defined(HAVE_MUNLOCK)
868 if (munlock(memcredp
->nt_hash
, memcredp
->len
) == -1) {
869 DEBUG(0,("failed to munlock memory: %s (%d)\n",
870 strerror(errno
), errno
));
871 return map_nt_error_from_unix(errno
);
873 memset(memcredp
->nt_hash
, '\0', memcredp
->len
);
874 SAFE_FREE(memcredp
->nt_hash
);
875 memcredp
->nt_hash
= NULL
;
876 memcredp
->lm_hash
= NULL
;
877 memcredp
->pass
= NULL
;
883 /***********************************************************
884 Replace the required creds with new ones (password change).
885 ***********************************************************/
887 static NTSTATUS
winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS
*memcredp
,
890 NTSTATUS status
= delete_memory_creds(memcredp
);
891 if (!NT_STATUS_IS_OK(status
)) {
894 return store_memory_creds(memcredp
, pass
);
897 /*************************************************************
898 Store credentials in memory in a list.
899 *************************************************************/
901 static NTSTATUS
winbindd_add_memory_creds_internal(const char *username
,
905 /* Shortcut to ensure we don't store if no mlock. */
906 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
910 struct WINBINDD_MEMORY_CREDS
*memcredp
= NULL
;
912 memcredp
= find_memory_creds_by_name(username
);
913 if (uid
== (uid_t
)-1) {
914 DEBUG(0,("winbindd_add_memory_creds_internal: "
915 "invalid uid for user %s.\n", username
));
916 return NT_STATUS_INVALID_PARAMETER
;
920 /* Already exists. Increment the reference count and replace stored creds. */
921 if (uid
!= memcredp
->uid
) {
922 DEBUG(0,("winbindd_add_memory_creds_internal: "
923 "uid %u for user %s doesn't "
924 "match stored uid %u. Replacing.\n",
925 (unsigned int)uid
, username
,
926 (unsigned int)memcredp
->uid
));
929 memcredp
->ref_count
++;
930 DEBUG(10,("winbindd_add_memory_creds_internal: "
931 "ref count for user %s is now %d\n",
932 username
, memcredp
->ref_count
));
933 return winbindd_replace_memory_creds_internal(memcredp
, pass
);
936 memcredp
= talloc_zero(NULL
, struct WINBINDD_MEMORY_CREDS
);
938 return NT_STATUS_NO_MEMORY
;
940 memcredp
->username
= talloc_strdup(memcredp
, username
);
941 if (!memcredp
->username
) {
942 talloc_destroy(memcredp
);
943 return NT_STATUS_NO_MEMORY
;
946 status
= store_memory_creds(memcredp
, pass
);
947 if (!NT_STATUS_IS_OK(status
)) {
948 talloc_destroy(memcredp
);
953 memcredp
->ref_count
= 1;
954 DLIST_ADD(memory_creds_list
, memcredp
);
956 DEBUG(10,("winbindd_add_memory_creds_internal: "
957 "added entry for user %s\n", username
));
963 /*************************************************************
964 Store users credentials in memory. If we also have a
965 struct WINBINDD_CCACHE_ENTRY for this username with a
966 refresh timer, then store the plaintext of the password
967 and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
968 *************************************************************/
970 NTSTATUS
winbindd_add_memory_creds(const char *username
,
974 struct WINBINDD_CCACHE_ENTRY
*entry
= get_ccache_by_username(username
);
977 status
= winbindd_add_memory_creds_internal(username
, uid
, pass
);
978 if (!NT_STATUS_IS_OK(status
)) {
983 struct WINBINDD_MEMORY_CREDS
*memcredp
= NULL
;
984 memcredp
= find_memory_creds_by_name(username
);
986 entry
->cred_ptr
= memcredp
;
993 /*************************************************************
994 Decrement the in-memory ref count - delete if zero.
995 *************************************************************/
997 NTSTATUS
winbindd_delete_memory_creds(const char *username
)
999 struct WINBINDD_MEMORY_CREDS
*memcredp
= NULL
;
1000 struct WINBINDD_CCACHE_ENTRY
*entry
= NULL
;
1001 NTSTATUS status
= NT_STATUS_OK
;
1003 memcredp
= find_memory_creds_by_name(username
);
1004 entry
= get_ccache_by_username(username
);
1007 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
1009 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1012 if (memcredp
->ref_count
<= 0) {
1013 DEBUG(0,("winbindd_delete_memory_creds: logic error. "
1014 "ref count for user %s = %d\n",
1015 username
, memcredp
->ref_count
));
1016 status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
1019 memcredp
->ref_count
--;
1020 if (memcredp
->ref_count
<= 0) {
1021 delete_memory_creds(memcredp
);
1022 DLIST_REMOVE(memory_creds_list
, memcredp
);
1023 talloc_destroy(memcredp
);
1024 DEBUG(10,("winbindd_delete_memory_creds: "
1025 "deleted entry for user %s\n",
1028 DEBUG(10,("winbindd_delete_memory_creds: "
1029 "entry for user %s ref_count now %d\n",
1030 username
, memcredp
->ref_count
));
1034 /* Ensure we have no dangling references to this. */
1035 entry
->cred_ptr
= NULL
;
1041 /***********************************************************
1042 Replace the required creds with new ones (password change).
1043 ***********************************************************/
1045 NTSTATUS
winbindd_replace_memory_creds(const char *username
,
1048 struct WINBINDD_MEMORY_CREDS
*memcredp
= NULL
;
1050 memcredp
= find_memory_creds_by_name(username
);
1052 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
1054 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1057 DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
1060 return winbindd_replace_memory_creds_internal(memcredp
, pass
);