Fix bug #8548 - winbind_samlogon_retry_loop ignores logon_parameters flags.
[Samba.git] / source3 / winbindd / winbindd_pam.c
blobbde16b1d3cb053e823cb49a850386d876c3c2e9b
1 /*
2 Unix SMB/CIFS implementation.
4 Winbind daemon - pam auth funcions
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "includes.h"
26 #include "winbindd.h"
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_samr_c.h"
29 #include "rpc_client/cli_pipe.h"
30 #include "rpc_client/cli_samr.h"
31 #include "../librpc/gen_ndr/ndr_netlogon.h"
32 #include "rpc_client/cli_netlogon.h"
33 #include "smb_krb5.h"
34 #include "../lib/crypto/arcfour.h"
35 #include "../libcli/security/security.h"
36 #include "ads.h"
37 #include "../librpc/gen_ndr/krb5pac.h"
38 #include "passdb/machine_sid.h"
39 #include "auth.h"
41 #undef DBGC_CLASS
42 #define DBGC_CLASS DBGC_WINBIND
44 #define LOGON_KRB5_FAIL_CLOCK_SKEW 0x02000000
46 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
47 struct winbindd_response *resp,
48 struct netr_SamInfo3 *info3)
50 char *ex;
51 uint32_t i;
53 resp->data.auth.info3.logon_time =
54 nt_time_to_unix(info3->base.last_logon);
55 resp->data.auth.info3.logoff_time =
56 nt_time_to_unix(info3->base.last_logoff);
57 resp->data.auth.info3.kickoff_time =
58 nt_time_to_unix(info3->base.acct_expiry);
59 resp->data.auth.info3.pass_last_set_time =
60 nt_time_to_unix(info3->base.last_password_change);
61 resp->data.auth.info3.pass_can_change_time =
62 nt_time_to_unix(info3->base.allow_password_change);
63 resp->data.auth.info3.pass_must_change_time =
64 nt_time_to_unix(info3->base.force_password_change);
66 resp->data.auth.info3.logon_count = info3->base.logon_count;
67 resp->data.auth.info3.bad_pw_count = info3->base.bad_password_count;
69 resp->data.auth.info3.user_rid = info3->base.rid;
70 resp->data.auth.info3.group_rid = info3->base.primary_gid;
71 sid_to_fstring(resp->data.auth.info3.dom_sid, info3->base.domain_sid);
73 resp->data.auth.info3.num_groups = info3->base.groups.count;
74 resp->data.auth.info3.user_flgs = info3->base.user_flags;
76 resp->data.auth.info3.acct_flags = info3->base.acct_flags;
77 resp->data.auth.info3.num_other_sids = info3->sidcount;
79 fstrcpy(resp->data.auth.info3.user_name,
80 info3->base.account_name.string);
81 fstrcpy(resp->data.auth.info3.full_name,
82 info3->base.full_name.string);
83 fstrcpy(resp->data.auth.info3.logon_script,
84 info3->base.logon_script.string);
85 fstrcpy(resp->data.auth.info3.profile_path,
86 info3->base.profile_path.string);
87 fstrcpy(resp->data.auth.info3.home_dir,
88 info3->base.home_directory.string);
89 fstrcpy(resp->data.auth.info3.dir_drive,
90 info3->base.home_drive.string);
92 fstrcpy(resp->data.auth.info3.logon_srv,
93 info3->base.logon_server.string);
94 fstrcpy(resp->data.auth.info3.logon_dom,
95 info3->base.domain.string);
97 ex = talloc_strdup(mem_ctx, "");
98 NT_STATUS_HAVE_NO_MEMORY(ex);
100 for (i=0; i < info3->base.groups.count; i++) {
101 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
102 info3->base.groups.rids[i].rid,
103 info3->base.groups.rids[i].attributes);
104 NT_STATUS_HAVE_NO_MEMORY(ex);
107 for (i=0; i < info3->sidcount; i++) {
108 char *sid;
110 sid = dom_sid_string(mem_ctx, info3->sids[i].sid);
111 NT_STATUS_HAVE_NO_MEMORY(sid);
113 ex = talloc_asprintf_append_buffer(ex, "%s:0x%08X\n",
114 sid,
115 info3->sids[i].attributes);
116 NT_STATUS_HAVE_NO_MEMORY(ex);
118 talloc_free(sid);
121 resp->extra_data.data = ex;
122 resp->length += talloc_get_size(ex);
124 return NT_STATUS_OK;
127 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
128 struct winbindd_response *resp,
129 struct netr_SamInfo3 *info3)
131 DATA_BLOB blob;
132 enum ndr_err_code ndr_err;
134 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
135 (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
136 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
137 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
138 return ndr_map_error2ntstatus(ndr_err);
141 resp->extra_data.data = blob.data;
142 resp->length += blob.length;
144 return NT_STATUS_OK;
147 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
148 struct winbindd_response *resp,
149 const struct netr_SamInfo3 *info3,
150 const char *name_domain,
151 const char *name_user)
153 /* We've been asked to return the unix username, per
154 'winbind use default domain' settings and the like */
156 const char *nt_username, *nt_domain;
158 nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
159 if (!nt_domain) {
160 /* If the server didn't give us one, just use the one
161 * we sent them */
162 nt_domain = name_domain;
165 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
166 if (!nt_username) {
167 /* If the server didn't give us one, just use the one
168 * we sent them */
169 nt_username = name_user;
172 fill_domain_username(resp->data.auth.unix_username,
173 nt_domain, nt_username, true);
175 DEBUG(5, ("Setting unix username to [%s]\n",
176 resp->data.auth.unix_username));
178 return NT_STATUS_OK;
181 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
182 struct winbindd_response *resp,
183 const struct netr_SamInfo3 *info3,
184 const char *name_domain,
185 const char *name_user)
187 char *afsname = NULL;
188 char *cell;
189 char *token;
191 afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
192 if (afsname == NULL) {
193 return NT_STATUS_NO_MEMORY;
196 afsname = talloc_string_sub(mem_ctx,
197 lp_afs_username_map(),
198 "%D", name_domain);
199 afsname = talloc_string_sub(mem_ctx, afsname,
200 "%u", name_user);
201 afsname = talloc_string_sub(mem_ctx, afsname,
202 "%U", name_user);
205 struct dom_sid user_sid;
206 fstring sidstr;
208 sid_compose(&user_sid, info3->base.domain_sid,
209 info3->base.rid);
210 sid_to_fstring(sidstr, &user_sid);
211 afsname = talloc_string_sub(mem_ctx, afsname,
212 "%s", sidstr);
215 if (afsname == NULL) {
216 return NT_STATUS_NO_MEMORY;
219 strlower_m(afsname);
221 DEBUG(10, ("Generating token for user %s\n", afsname));
223 cell = strchr(afsname, '@');
225 if (cell == NULL) {
226 return NT_STATUS_NO_MEMORY;
229 *cell = '\0';
230 cell += 1;
232 token = afs_createtoken_str(afsname, cell);
233 if (token == NULL) {
234 return NT_STATUS_OK;
236 resp->extra_data.data = talloc_strdup(mem_ctx, token);
237 if (resp->extra_data.data == NULL) {
238 return NT_STATUS_NO_MEMORY;
240 resp->length += strlen((const char *)resp->extra_data.data)+1;
242 return NT_STATUS_OK;
245 static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
246 const char *group_sid)
248 * Check whether a user belongs to a group or list of groups.
250 * @param mem_ctx talloc memory context.
251 * @param info3 user information, including group membership info.
252 * @param group_sid One or more groups , separated by commas.
254 * @return NT_STATUS_OK on success,
255 * NT_STATUS_LOGON_FAILURE if the user does not belong,
256 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
259 struct dom_sid *require_membership_of_sid;
260 uint32_t num_require_membership_of_sid;
261 char *req_sid;
262 const char *p;
263 struct dom_sid sid;
264 size_t i;
265 struct security_token *token;
266 TALLOC_CTX *frame = talloc_stackframe();
267 NTSTATUS status;
269 /* Parse the 'required group' SID */
271 if (!group_sid || !group_sid[0]) {
272 /* NO sid supplied, all users may access */
273 return NT_STATUS_OK;
276 token = talloc_zero(talloc_tos(), struct security_token);
277 if (token == NULL) {
278 DEBUG(0, ("talloc failed\n"));
279 TALLOC_FREE(frame);
280 return NT_STATUS_NO_MEMORY;
283 num_require_membership_of_sid = 0;
284 require_membership_of_sid = NULL;
286 p = group_sid;
288 while (next_token_talloc(talloc_tos(), &p, &req_sid, ",")) {
289 if (!string_to_sid(&sid, req_sid)) {
290 DEBUG(0, ("check_info3_in_group: could not parse %s "
291 "as a SID!", req_sid));
292 TALLOC_FREE(frame);
293 return NT_STATUS_INVALID_PARAMETER;
296 status = add_sid_to_array(talloc_tos(), &sid,
297 &require_membership_of_sid,
298 &num_require_membership_of_sid);
299 if (!NT_STATUS_IS_OK(status)) {
300 DEBUG(0, ("add_sid_to_array failed\n"));
301 TALLOC_FREE(frame);
302 return status;
306 status = sid_array_from_info3(talloc_tos(), info3,
307 &token->sids,
308 &token->num_sids,
309 true, false);
310 if (!NT_STATUS_IS_OK(status)) {
311 TALLOC_FREE(frame);
312 return status;
315 if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
316 token))
317 || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
318 token))) {
319 DEBUG(3, ("could not add aliases: %s\n",
320 nt_errstr(status)));
321 TALLOC_FREE(frame);
322 return status;
325 security_token_debug(DBGC_CLASS, 10, token);
327 for (i=0; i<num_require_membership_of_sid; i++) {
328 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
329 &require_membership_of_sid[i])));
330 if (nt_token_check_sid(&require_membership_of_sid[i],
331 token)) {
332 DEBUG(10, ("Access ok\n"));
333 TALLOC_FREE(frame);
334 return NT_STATUS_OK;
338 /* Do not distinguish this error from a wrong username/pw */
340 TALLOC_FREE(frame);
341 return NT_STATUS_LOGON_FAILURE;
344 struct winbindd_domain *find_auth_domain(uint8_t flags,
345 const char *domain_name)
347 struct winbindd_domain *domain;
349 if (IS_DC) {
350 domain = find_domain_from_name_noinit(domain_name);
351 if (domain == NULL) {
352 DEBUG(3, ("Authentication for domain [%s] refused "
353 "as it is not a trusted domain\n",
354 domain_name));
356 return domain;
359 if (strequal(domain_name, get_global_sam_name())) {
360 return find_domain_from_name_noinit(domain_name);
363 /* we can auth against trusted domains */
364 if (flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
365 domain = find_domain_from_name_noinit(domain_name);
366 if (domain == NULL) {
367 DEBUG(3, ("Authentication for domain [%s] skipped "
368 "as it is not a trusted domain\n",
369 domain_name));
370 } else {
371 return domain;
375 return find_our_domain();
378 static void fill_in_password_policy(struct winbindd_response *r,
379 const struct samr_DomInfo1 *p)
381 r->data.auth.policy.min_length_password =
382 p->min_password_length;
383 r->data.auth.policy.password_history =
384 p->password_history_length;
385 r->data.auth.policy.password_properties =
386 p->password_properties;
387 r->data.auth.policy.expire =
388 nt_time_to_unix_abs((NTTIME *)&(p->max_password_age));
389 r->data.auth.policy.min_passwordage =
390 nt_time_to_unix_abs((NTTIME *)&(p->min_password_age));
393 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
394 struct winbindd_response *response)
396 TALLOC_CTX *frame = talloc_stackframe();
397 struct winbindd_methods *methods;
398 NTSTATUS status;
399 struct samr_DomInfo1 password_policy;
401 if ( !winbindd_can_contact_domain( domain ) ) {
402 DEBUG(5,("fillup_password_policy: No inbound trust to "
403 "contact domain %s\n", domain->name));
404 status = NT_STATUS_NOT_SUPPORTED;
405 goto done;
408 methods = domain->methods;
410 status = methods->password_policy(domain, talloc_tos(), &password_policy);
411 if (NT_STATUS_IS_ERR(status)) {
412 goto done;
415 fill_in_password_policy(response, &password_policy);
417 done:
418 TALLOC_FREE(frame);
419 return NT_STATUS_OK;
422 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
423 TALLOC_CTX *mem_ctx,
424 uint16 *lockout_threshold)
426 struct winbindd_methods *methods;
427 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
428 struct samr_DomInfo12 lockout_policy;
430 *lockout_threshold = 0;
432 methods = domain->methods;
434 status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
435 if (NT_STATUS_IS_ERR(status)) {
436 return status;
439 *lockout_threshold = lockout_policy.lockout_threshold;
441 return NT_STATUS_OK;
444 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
445 TALLOC_CTX *mem_ctx,
446 uint32 *password_properties)
448 struct winbindd_methods *methods;
449 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
450 struct samr_DomInfo1 password_policy;
452 *password_properties = 0;
454 methods = domain->methods;
456 status = methods->password_policy(domain, mem_ctx, &password_policy);
457 if (NT_STATUS_IS_ERR(status)) {
458 return status;
461 *password_properties = password_policy.password_properties;
463 return NT_STATUS_OK;
466 #ifdef HAVE_KRB5
468 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
469 const char *type,
470 uid_t uid,
471 const char **user_ccache_file)
473 /* accept FILE and WRFILE as krb5_cc_type from the client and then
474 * build the full ccname string based on the user's uid here -
475 * Guenther*/
477 const char *gen_cc = NULL;
479 if (uid != -1) {
480 if (strequal(type, "FILE")) {
481 gen_cc = talloc_asprintf(
482 mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
484 if (strequal(type, "WRFILE")) {
485 gen_cc = talloc_asprintf(
486 mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
490 *user_ccache_file = gen_cc;
492 if (gen_cc == NULL) {
493 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
495 if (gen_cc == NULL) {
496 DEBUG(0,("out of memory\n"));
497 return NULL;
500 DEBUG(10, ("using ccache: %s%s\n", gen_cc,
501 (*user_ccache_file == NULL) ? " (internal)":""));
503 return gen_cc;
506 #endif
508 uid_t get_uid_from_request(struct winbindd_request *request)
510 uid_t uid;
512 uid = request->data.auth.uid;
514 if (uid < 0) {
515 DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
516 return -1;
518 return uid;
521 /**********************************************************************
522 Authenticate a user with a clear text password using Kerberos and fill up
523 ccache if required
524 **********************************************************************/
526 static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
527 struct winbindd_domain *domain,
528 const char *user,
529 const char *pass,
530 const char *krb5_cc_type,
531 uid_t uid,
532 struct netr_SamInfo3 **info3,
533 fstring krb5ccname)
535 #ifdef HAVE_KRB5
536 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
537 krb5_error_code krb5_ret;
538 const char *cc = NULL;
539 const char *principal_s = NULL;
540 const char *service = NULL;
541 char *realm = NULL;
542 fstring name_domain, name_user;
543 time_t ticket_lifetime = 0;
544 time_t renewal_until = 0;
545 ADS_STRUCT *ads;
546 time_t time_offset = 0;
547 const char *user_ccache_file;
548 struct PAC_LOGON_INFO *logon_info = NULL;
550 *info3 = NULL;
552 /* 1st step:
553 * prepare a krb5_cc_cache string for the user */
555 if (uid == -1) {
556 DEBUG(0,("no valid uid\n"));
559 cc = generate_krb5_ccache(mem_ctx,
560 krb5_cc_type,
561 uid,
562 &user_ccache_file);
563 if (cc == NULL) {
564 return NT_STATUS_NO_MEMORY;
568 /* 2nd step:
569 * get kerberos properties */
571 if (domain->private_data) {
572 ads = (ADS_STRUCT *)domain->private_data;
573 time_offset = ads->auth.time_offset;
577 /* 3rd step:
578 * do kerberos auth and setup ccache as the user */
580 parse_domain_user(user, name_domain, name_user);
582 realm = domain->alt_name;
583 strupper_m(realm);
585 principal_s = talloc_asprintf(mem_ctx, "%s@%s", name_user, realm);
586 if (principal_s == NULL) {
587 return NT_STATUS_NO_MEMORY;
590 service = talloc_asprintf(mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
591 if (service == NULL) {
592 return NT_STATUS_NO_MEMORY;
595 /* if this is a user ccache, we need to act as the user to let the krb5
596 * library handle the chown, etc. */
598 /************************ ENTERING NON-ROOT **********************/
600 if (user_ccache_file != NULL) {
601 set_effective_uid(uid);
602 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
605 result = kerberos_return_pac(mem_ctx,
606 principal_s,
607 pass,
608 time_offset,
609 &ticket_lifetime,
610 &renewal_until,
612 true,
613 true,
614 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
615 NULL,
616 &logon_info);
617 if (user_ccache_file != NULL) {
618 gain_root_privilege();
621 /************************ RETURNED TO ROOT **********************/
623 if (!NT_STATUS_IS_OK(result)) {
624 goto failed;
627 *info3 = &logon_info->info3;
629 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
630 principal_s));
632 /* if we had a user's ccache then return that string for the pam
633 * environment */
635 if (user_ccache_file != NULL) {
637 fstrcpy(krb5ccname, user_ccache_file);
639 result = add_ccache_to_list(principal_s,
641 service,
642 user,
643 realm,
644 uid,
645 time(NULL),
646 ticket_lifetime,
647 renewal_until,
648 false);
650 if (!NT_STATUS_IS_OK(result)) {
651 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
652 nt_errstr(result)));
654 } else {
656 /* need to delete the memory cred cache, it is not used anymore */
658 krb5_ret = ads_kdestroy(cc);
659 if (krb5_ret) {
660 DEBUG(3,("winbindd_raw_kerberos_login: "
661 "could not destroy krb5 credential cache: "
662 "%s\n", error_message(krb5_ret)));
667 return NT_STATUS_OK;
669 failed:
671 /* we could have created a new credential cache with a valid tgt in it
672 * but we werent able to get or verify the service ticket for this
673 * local host and therefor didn't get the PAC, we need to remove that
674 * cache entirely now */
676 krb5_ret = ads_kdestroy(cc);
677 if (krb5_ret) {
678 DEBUG(3,("winbindd_raw_kerberos_login: "
679 "could not destroy krb5 credential cache: "
680 "%s\n", error_message(krb5_ret)));
683 if (!NT_STATUS_IS_OK(remove_ccache(user))) {
684 DEBUG(3,("winbindd_raw_kerberos_login: "
685 "could not remove ccache for user %s\n",
686 user));
689 return result;
690 #else
691 return NT_STATUS_NOT_SUPPORTED;
692 #endif /* HAVE_KRB5 */
695 /****************************************************************
696 ****************************************************************/
698 bool check_request_flags(uint32_t flags)
700 uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
701 WBFLAG_PAM_INFO3_TEXT |
702 WBFLAG_PAM_INFO3_NDR;
704 if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
705 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
706 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
707 !(flags & flags_edata) ) {
708 return true;
711 DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
712 flags));
714 return false;
717 /****************************************************************
718 ****************************************************************/
720 static NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
721 struct winbindd_response *resp,
722 uint32_t request_flags,
723 struct netr_SamInfo3 *info3,
724 const char *name_domain,
725 const char *name_user)
727 NTSTATUS result;
729 if (request_flags & WBFLAG_PAM_USER_SESSION_KEY) {
730 memcpy(resp->data.auth.user_session_key,
731 info3->base.key.key,
732 sizeof(resp->data.auth.user_session_key)
733 /* 16 */);
736 if (request_flags & WBFLAG_PAM_LMKEY) {
737 memcpy(resp->data.auth.first_8_lm_hash,
738 info3->base.LMSessKey.key,
739 sizeof(resp->data.auth.first_8_lm_hash)
740 /* 8 */);
743 if (request_flags & WBFLAG_PAM_UNIX_NAME) {
744 result = append_unix_username(mem_ctx, resp,
745 info3, name_domain, name_user);
746 if (!NT_STATUS_IS_OK(result)) {
747 DEBUG(10,("Failed to append Unix Username: %s\n",
748 nt_errstr(result)));
749 return result;
753 /* currently, anything from here on potentially overwrites extra_data. */
755 if (request_flags & WBFLAG_PAM_INFO3_NDR) {
756 result = append_info3_as_ndr(mem_ctx, resp, info3);
757 if (!NT_STATUS_IS_OK(result)) {
758 DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
759 nt_errstr(result)));
760 return result;
764 if (request_flags & WBFLAG_PAM_INFO3_TEXT) {
765 result = append_info3_as_txt(mem_ctx, resp, info3);
766 if (!NT_STATUS_IS_OK(result)) {
767 DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
768 nt_errstr(result)));
769 return result;
773 if (request_flags & WBFLAG_PAM_AFS_TOKEN) {
774 result = append_afs_token(mem_ctx, resp,
775 info3, name_domain, name_user);
776 if (!NT_STATUS_IS_OK(result)) {
777 DEBUG(10,("Failed to append AFS token: %s\n",
778 nt_errstr(result)));
779 return result;
783 return NT_STATUS_OK;
786 static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
787 struct winbindd_cli_state *state,
788 struct netr_SamInfo3 **info3)
790 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
791 uint16 max_allowed_bad_attempts;
792 fstring name_domain, name_user;
793 struct dom_sid sid;
794 enum lsa_SidType type;
795 uchar new_nt_pass[NT_HASH_LEN];
796 const uint8 *cached_nt_pass;
797 const uint8 *cached_salt;
798 struct netr_SamInfo3 *my_info3;
799 time_t kickoff_time, must_change_time;
800 bool password_good = false;
801 #ifdef HAVE_KRB5
802 struct winbindd_tdc_domain *tdc_domain = NULL;
803 #endif
805 *info3 = NULL;
807 ZERO_STRUCTP(info3);
809 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
811 /* Parse domain and username */
813 parse_domain_user(state->request->data.auth.user, name_domain, name_user);
816 if (!lookup_cached_name(name_domain,
817 name_user,
818 &sid,
819 &type)) {
820 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
821 return NT_STATUS_NO_SUCH_USER;
824 if (type != SID_NAME_USER) {
825 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
826 return NT_STATUS_LOGON_FAILURE;
829 result = winbindd_get_creds(domain,
830 state->mem_ctx,
831 &sid,
832 &my_info3,
833 &cached_nt_pass,
834 &cached_salt);
835 if (!NT_STATUS_IS_OK(result)) {
836 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
837 return result;
840 *info3 = my_info3;
842 E_md4hash(state->request->data.auth.pass, new_nt_pass);
844 dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
845 dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
846 if (cached_salt) {
847 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
850 if (cached_salt) {
851 /* In this case we didn't store the nt_hash itself,
852 but the MD5 combination of salt + nt_hash. */
853 uchar salted_hash[NT_HASH_LEN];
854 E_md5hash(cached_salt, new_nt_pass, salted_hash);
856 password_good = (memcmp(cached_nt_pass, salted_hash,
857 NT_HASH_LEN) == 0);
858 } else {
859 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
860 password_good = (memcmp(cached_nt_pass, new_nt_pass,
861 NT_HASH_LEN) == 0);
864 if (password_good) {
866 /* User *DOES* know the password, update logon_time and reset
867 * bad_pw_count */
869 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
871 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
872 return NT_STATUS_ACCOUNT_LOCKED_OUT;
875 if (my_info3->base.acct_flags & ACB_DISABLED) {
876 return NT_STATUS_ACCOUNT_DISABLED;
879 if (my_info3->base.acct_flags & ACB_WSTRUST) {
880 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
883 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
884 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
887 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
888 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
891 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
892 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
893 my_info3->base.acct_flags));
894 return NT_STATUS_LOGON_FAILURE;
897 kickoff_time = nt_time_to_unix(my_info3->base.acct_expiry);
898 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
899 return NT_STATUS_ACCOUNT_EXPIRED;
902 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
903 if (must_change_time != 0 && must_change_time < time(NULL)) {
904 /* we allow grace logons when the password has expired */
905 my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
906 /* return NT_STATUS_PASSWORD_EXPIRED; */
907 goto success;
910 #ifdef HAVE_KRB5
911 if ((state->request->flags & WBFLAG_PAM_KRB5) &&
912 ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
913 ((tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL) ||
914 /* used to cope with the case winbindd starting without network. */
915 !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
917 uid_t uid = -1;
918 const char *cc = NULL;
919 char *realm = NULL;
920 const char *principal_s = NULL;
921 const char *service = NULL;
922 const char *user_ccache_file;
924 uid = get_uid_from_request(state->request);
925 if (uid == -1) {
926 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
927 return NT_STATUS_INVALID_PARAMETER;
930 cc = generate_krb5_ccache(state->mem_ctx,
931 state->request->data.auth.krb5_cc_type,
932 state->request->data.auth.uid,
933 &user_ccache_file);
934 if (cc == NULL) {
935 return NT_STATUS_NO_MEMORY;
938 realm = domain->alt_name;
939 strupper_m(realm);
941 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
942 if (principal_s == NULL) {
943 return NT_STATUS_NO_MEMORY;
946 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
947 if (service == NULL) {
948 return NT_STATUS_NO_MEMORY;
951 if (user_ccache_file != NULL) {
953 fstrcpy(state->response->data.auth.krb5ccname,
954 user_ccache_file);
956 result = add_ccache_to_list(principal_s,
958 service,
959 state->request->data.auth.user,
960 domain->alt_name,
961 uid,
962 time(NULL),
963 time(NULL) + lp_winbind_cache_time(),
964 time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
965 true);
967 if (!NT_STATUS_IS_OK(result)) {
968 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
969 "to add ccache to list: %s\n",
970 nt_errstr(result)));
974 #endif /* HAVE_KRB5 */
975 success:
976 /* FIXME: we possibly should handle logon hours as well (does xp when
977 * offline?) see auth/auth_sam.c:sam_account_ok for details */
979 unix_to_nt_time(&my_info3->base.last_logon, time(NULL));
980 my_info3->base.bad_password_count = 0;
982 result = winbindd_update_creds_by_info3(domain,
983 state->request->data.auth.user,
984 state->request->data.auth.pass,
985 my_info3);
986 if (!NT_STATUS_IS_OK(result)) {
987 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
988 nt_errstr(result)));
989 return result;
992 return NT_STATUS_OK;
996 /* User does *NOT* know the correct password, modify info3 accordingly, but only if online */
997 if (domain->online == false) {
998 goto failed;
1001 /* failure of this is not critical */
1002 result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1003 if (!NT_STATUS_IS_OK(result)) {
1004 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1005 "Won't be able to honour account lockout policies\n"));
1008 /* increase counter */
1009 my_info3->base.bad_password_count++;
1011 if (max_allowed_bad_attempts == 0) {
1012 goto failed;
1015 /* lockout user */
1016 if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1018 uint32 password_properties;
1020 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1021 if (!NT_STATUS_IS_OK(result)) {
1022 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1025 if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
1026 (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1027 my_info3->base.acct_flags |= ACB_AUTOLOCK;
1031 failed:
1032 result = winbindd_update_creds_by_info3(domain,
1033 state->request->data.auth.user,
1034 NULL,
1035 my_info3);
1037 if (!NT_STATUS_IS_OK(result)) {
1038 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1039 nt_errstr(result)));
1042 return NT_STATUS_LOGON_FAILURE;
1045 static NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1046 struct winbindd_cli_state *state,
1047 struct netr_SamInfo3 **info3)
1049 struct winbindd_domain *contact_domain;
1050 fstring name_domain, name_user;
1051 NTSTATUS result;
1053 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1055 /* Parse domain and username */
1057 parse_domain_user(state->request->data.auth.user, name_domain, name_user);
1059 /* what domain should we contact? */
1061 if ( IS_DC ) {
1062 if (!(contact_domain = find_domain_from_name(name_domain))) {
1063 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1064 state->request->data.auth.user, name_domain, name_user, name_domain));
1065 result = NT_STATUS_NO_SUCH_USER;
1066 goto done;
1069 } else {
1070 if (is_myname(name_domain)) {
1071 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1072 result = NT_STATUS_NO_SUCH_USER;
1073 goto done;
1076 contact_domain = find_domain_from_name(name_domain);
1077 if (contact_domain == NULL) {
1078 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1079 state->request->data.auth.user, name_domain, name_user, name_domain));
1081 contact_domain = find_our_domain();
1085 if (contact_domain->initialized &&
1086 contact_domain->active_directory) {
1087 goto try_login;
1090 if (!contact_domain->initialized) {
1091 init_dc_connection(contact_domain);
1094 if (!contact_domain->active_directory) {
1095 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1096 return NT_STATUS_INVALID_LOGON_TYPE;
1098 try_login:
1099 result = winbindd_raw_kerberos_login(
1100 state->mem_ctx, contact_domain,
1101 state->request->data.auth.user,
1102 state->request->data.auth.pass,
1103 state->request->data.auth.krb5_cc_type,
1104 get_uid_from_request(state->request),
1105 info3, state->response->data.auth.krb5ccname);
1106 done:
1107 return result;
1110 static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
1111 const char *domain, const char *user,
1112 const DATA_BLOB *challenge,
1113 const DATA_BLOB *lm_resp,
1114 const DATA_BLOB *nt_resp,
1115 struct netr_SamInfo3 **pinfo3)
1117 struct auth_usersupplied_info *user_info = NULL;
1118 NTSTATUS status;
1120 status = make_user_info(&user_info, user, user, domain, domain,
1121 global_myname(), lm_resp, nt_resp, NULL, NULL,
1122 NULL, AUTH_PASSWORD_RESPONSE);
1123 if (!NT_STATUS_IS_OK(status)) {
1124 DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
1125 return status;
1128 /* We don't want any more mapping of the username */
1129 user_info->mapped_state = True;
1131 status = check_sam_security_info3(challenge, talloc_tos(), user_info,
1132 pinfo3);
1133 free_user_info(&user_info);
1134 DEBUG(10, ("Authenticaticating user %s\\%s returned %s\n", domain,
1135 user, nt_errstr(status)));
1136 return status;
1139 static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
1140 TALLOC_CTX *mem_ctx,
1141 uint32_t logon_parameters,
1142 const char *server,
1143 const char *username,
1144 const char *domainname,
1145 const char *workstation,
1146 const uint8_t chal[8],
1147 DATA_BLOB lm_response,
1148 DATA_BLOB nt_response,
1149 struct netr_SamInfo3 **info3)
1151 int attempts = 0;
1152 bool retry = false;
1153 NTSTATUS result;
1155 do {
1156 struct rpc_pipe_client *netlogon_pipe;
1157 const struct pipe_auth_data *auth;
1158 uint32_t neg_flags = 0;
1160 ZERO_STRUCTP(info3);
1161 retry = false;
1163 result = cm_connect_netlogon(domain, &netlogon_pipe);
1165 if (!NT_STATUS_IS_OK(result)) {
1166 DEBUG(3,("could not open handle to NETLOGON pipe (error: %s)\n",
1167 nt_errstr(result)));
1168 return result;
1170 auth = netlogon_pipe->auth;
1171 if (netlogon_pipe->dc) {
1172 neg_flags = netlogon_pipe->dc->negotiate_flags;
1175 /* It is really important to try SamLogonEx here,
1176 * because in a clustered environment, we want to use
1177 * one machine account from multiple physical
1178 * computers.
1180 * With a normal SamLogon call, we must keep the
1181 * credentials chain updated and intact between all
1182 * users of the machine account (which would imply
1183 * cross-node communication for every NTLM logon).
1185 * (The credentials chain is not per NETLOGON pipe
1186 * connection, but globally on the server/client pair
1187 * by machine name).
1189 * When using SamLogonEx, the credentials are not
1190 * supplied, but the session key is implied by the
1191 * wrapping SamLogon context.
1193 * -- abartlet 21 April 2008
1195 * It's also important to use NetlogonValidationSamInfo4 (6),
1196 * because it relies on the rpc transport encryption
1197 * and avoids using the global netlogon schannel
1198 * session key to en/decrypt secret information
1199 * like the user_session_key for network logons.
1201 * [MS-APDS] 3.1.5.2 NTLM Network Logon
1202 * says NETLOGON_NEG_CROSS_FOREST_TRUSTS and
1203 * NETLOGON_NEG_AUTHENTICATED_RPC set together
1204 * are the indication that the server supports
1205 * NetlogonValidationSamInfo4 (6). And it must only
1206 * be used if "SealSecureChannel" is used.
1208 * -- metze 4 February 2011
1211 if (auth == NULL) {
1212 domain->can_do_validation6 = false;
1213 } else if (auth->auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
1214 domain->can_do_validation6 = false;
1215 } else if (auth->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
1216 domain->can_do_validation6 = false;
1217 } else if (!(neg_flags & NETLOGON_NEG_CROSS_FOREST_TRUSTS)) {
1218 domain->can_do_validation6 = false;
1219 } else if (!(neg_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
1220 domain->can_do_validation6 = false;
1223 if (domain->can_do_samlogon_ex) {
1224 result = rpccli_netlogon_sam_network_logon_ex(
1225 netlogon_pipe,
1226 mem_ctx,
1227 logon_parameters,
1228 server, /* server name */
1229 username, /* user name */
1230 domainname, /* target domain */
1231 workstation, /* workstation */
1232 chal,
1233 domain->can_do_validation6 ? 6 : 3,
1234 lm_response,
1235 nt_response,
1236 info3);
1237 } else {
1238 result = rpccli_netlogon_sam_network_logon(
1239 netlogon_pipe,
1240 mem_ctx,
1241 logon_parameters,
1242 server, /* server name */
1243 username, /* user name */
1244 domainname, /* target domain */
1245 workstation, /* workstation */
1246 chal,
1247 domain->can_do_validation6 ? 6 : 3,
1248 lm_response,
1249 nt_response,
1250 info3);
1253 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1256 * It's likely that the server also does not support
1257 * validation level 6
1259 domain->can_do_validation6 = false;
1261 if (domain->can_do_samlogon_ex) {
1262 DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1263 "retrying with NetSamLogon\n"));
1264 domain->can_do_samlogon_ex = false;
1265 retry = true;
1266 continue;
1270 /* Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
1271 * (no Ex). This happens against old Samba
1272 * DCs. Drop the connection.
1274 invalidate_cm_connection(&domain->conn);
1275 result = NT_STATUS_LOGON_FAILURE;
1276 break;
1279 if (domain->can_do_validation6 &&
1280 (NT_STATUS_EQUAL(result, NT_STATUS_INVALID_INFO_CLASS) ||
1281 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_PARAMETER) ||
1282 NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL))) {
1283 DEBUG(3,("Got a DC that can not do validation level 6, "
1284 "retrying with level 3\n"));
1285 domain->can_do_validation6 = false;
1286 retry = true;
1287 continue;
1291 * we increment this after the "feature negotiation"
1292 * for can_do_samlogon_ex and can_do_validation6
1294 attempts += 1;
1296 /* We have to try a second time as cm_connect_netlogon
1297 might not yet have noticed that the DC has killed
1298 our connection. */
1300 if (!rpccli_is_connected(netlogon_pipe)) {
1301 retry = true;
1302 continue;
1305 /* if we get access denied, a possible cause was that we had
1306 and open connection to the DC, but someone changed our
1307 machine account password out from underneath us using 'net
1308 rpc changetrustpw' */
1310 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1311 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1312 "ACCESS_DENIED. Maybe the trust account "
1313 "password was changed and we didn't know it. "
1314 "Killing connections to domain %s\n",
1315 domainname));
1316 invalidate_cm_connection(&domain->conn);
1317 retry = true;
1320 } while ( (attempts < 2) && retry );
1322 return result;
1325 static NTSTATUS winbindd_dual_pam_auth_samlogon(TALLOC_CTX *mem_ctx,
1326 struct winbindd_domain *domain,
1327 const char *user,
1328 const char *pass,
1329 uint32_t request_flags,
1330 struct netr_SamInfo3 **info3)
1333 uchar chal[8];
1334 DATA_BLOB lm_resp;
1335 DATA_BLOB nt_resp;
1336 unsigned char local_nt_response[24];
1337 fstring name_domain, name_user;
1338 NTSTATUS result;
1339 struct netr_SamInfo3 *my_info3 = NULL;
1341 *info3 = NULL;
1343 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1345 /* Parse domain and username */
1347 parse_domain_user(user, name_domain, name_user);
1349 /* do password magic */
1351 generate_random_buffer(chal, sizeof(chal));
1353 if (lp_client_ntlmv2_auth()) {
1354 DATA_BLOB server_chal;
1355 DATA_BLOB names_blob;
1356 server_chal = data_blob_const(chal, 8);
1358 /* note that the 'workgroup' here is for the local
1359 machine. The 'server name' must match the
1360 'workstation' passed to the actual SamLogon call.
1362 names_blob = NTLMv2_generate_names_blob(
1363 mem_ctx, global_myname(), lp_workgroup());
1365 if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain,
1366 pass,
1367 &server_chal,
1368 &names_blob,
1369 &lm_resp, &nt_resp, NULL, NULL)) {
1370 data_blob_free(&names_blob);
1371 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1372 result = NT_STATUS_NO_MEMORY;
1373 goto done;
1375 data_blob_free(&names_blob);
1376 } else {
1377 lm_resp = data_blob_null;
1378 SMBNTencrypt(pass, chal, local_nt_response);
1380 nt_resp = data_blob_talloc(mem_ctx, local_nt_response,
1381 sizeof(local_nt_response));
1384 if (strequal(name_domain, get_global_sam_name())) {
1385 DATA_BLOB chal_blob = data_blob_const(chal, sizeof(chal));
1387 result = winbindd_dual_auth_passdb(
1388 mem_ctx, name_domain, name_user,
1389 &chal_blob, &lm_resp, &nt_resp, info3);
1390 goto done;
1393 /* check authentication loop */
1395 result = winbind_samlogon_retry_loop(domain,
1396 mem_ctx,
1398 domain->dcname,
1399 name_user,
1400 name_domain,
1401 global_myname(),
1402 chal,
1403 lm_resp,
1404 nt_resp,
1405 &my_info3);
1406 if (!NT_STATUS_IS_OK(result)) {
1407 goto done;
1410 /* handle the case where a NT4 DC does not fill in the acct_flags in
1411 * the samlogon reply info3. When accurate info3 is required by the
1412 * caller, we look up the account flags ourselve - gd */
1414 if ((request_flags & WBFLAG_PAM_INFO3_TEXT) &&
1415 NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
1417 struct rpc_pipe_client *samr_pipe;
1418 struct policy_handle samr_domain_handle, user_pol;
1419 union samr_UserInfo *info = NULL;
1420 NTSTATUS status_tmp, result_tmp;
1421 uint32 acct_flags;
1422 struct dcerpc_binding_handle *b;
1424 status_tmp = cm_connect_sam(domain, mem_ctx,
1425 &samr_pipe, &samr_domain_handle);
1427 if (!NT_STATUS_IS_OK(status_tmp)) {
1428 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1429 nt_errstr(status_tmp)));
1430 goto done;
1433 b = samr_pipe->binding_handle;
1435 status_tmp = dcerpc_samr_OpenUser(b, mem_ctx,
1436 &samr_domain_handle,
1437 MAXIMUM_ALLOWED_ACCESS,
1438 my_info3->base.rid,
1439 &user_pol,
1440 &result_tmp);
1442 if (!NT_STATUS_IS_OK(status_tmp)) {
1443 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1444 nt_errstr(status_tmp)));
1445 goto done;
1447 if (!NT_STATUS_IS_OK(result_tmp)) {
1448 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1449 nt_errstr(result_tmp)));
1450 goto done;
1453 status_tmp = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1454 &user_pol,
1456 &info,
1457 &result_tmp);
1459 if (!NT_STATUS_IS_OK(status_tmp)) {
1460 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1461 nt_errstr(status_tmp)));
1462 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1463 goto done;
1465 if (!NT_STATUS_IS_OK(result_tmp)) {
1466 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1467 nt_errstr(result_tmp)));
1468 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1469 goto done;
1472 acct_flags = info->info16.acct_flags;
1474 if (acct_flags == 0) {
1475 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1476 goto done;
1479 my_info3->base.acct_flags = acct_flags;
1481 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1483 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1486 *info3 = my_info3;
1487 done:
1488 return result;
1491 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1492 struct winbindd_cli_state *state)
1494 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1495 NTSTATUS krb5_result = NT_STATUS_OK;
1496 fstring name_domain, name_user;
1497 char *mapped_user;
1498 fstring domain_user;
1499 struct netr_SamInfo3 *info3 = NULL;
1500 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
1502 /* Ensure null termination */
1503 state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
1505 /* Ensure null termination */
1506 state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
1508 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1509 state->request->data.auth.user));
1511 /* Parse domain and username */
1513 name_map_status = normalize_name_unmap(state->mem_ctx,
1514 state->request->data.auth.user,
1515 &mapped_user);
1517 /* If the name normalization didnt' actually do anything,
1518 just use the original name */
1520 if (!NT_STATUS_IS_OK(name_map_status) &&
1521 !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
1523 mapped_user = state->request->data.auth.user;
1526 parse_domain_user(mapped_user, name_domain, name_user);
1528 if ( mapped_user != state->request->data.auth.user ) {
1529 fstr_sprintf( domain_user, "%s%c%s", name_domain,
1530 *lp_winbind_separator(),
1531 name_user );
1532 safe_strcpy( state->request->data.auth.user, domain_user,
1533 sizeof(state->request->data.auth.user)-1 );
1536 if (!domain->online) {
1537 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1538 if (domain->startup) {
1539 /* Logons are very important to users. If we're offline and
1540 we get a request within the first 30 seconds of startup,
1541 try very hard to find a DC and go online. */
1543 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1544 "request in startup mode.\n", domain->name ));
1546 winbindd_flush_negative_conn_cache(domain);
1547 result = init_dc_connection(domain);
1551 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1553 /* Check for Kerberos authentication */
1554 if (domain->online && (state->request->flags & WBFLAG_PAM_KRB5)) {
1556 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1557 /* save for later */
1558 krb5_result = result;
1561 if (NT_STATUS_IS_OK(result)) {
1562 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1563 goto process_result;
1564 } else {
1565 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1568 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1569 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1570 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1571 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1572 set_domain_offline( domain );
1573 goto cached_logon;
1576 /* there are quite some NT_STATUS errors where there is no
1577 * point in retrying with a samlogon, we explictly have to take
1578 * care not to increase the bad logon counter on the DC */
1580 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1581 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1582 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1583 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1584 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1585 NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1586 NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1587 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1588 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1589 NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1590 goto done;
1593 if (state->request->flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1594 DEBUG(3,("falling back to samlogon\n"));
1595 goto sam_logon;
1596 } else {
1597 goto cached_logon;
1601 sam_logon:
1602 /* Check for Samlogon authentication */
1603 if (domain->online) {
1604 result = winbindd_dual_pam_auth_samlogon(
1605 state->mem_ctx, domain,
1606 state->request->data.auth.user,
1607 state->request->data.auth.pass,
1608 state->request->flags,
1609 &info3);
1611 if (NT_STATUS_IS_OK(result)) {
1612 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1613 /* add the Krb5 err if we have one */
1614 if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1615 info3->base.user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1617 goto process_result;
1620 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1621 nt_errstr(result)));
1623 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1624 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1625 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1627 DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1628 set_domain_offline( domain );
1629 goto cached_logon;
1632 if (domain->online) {
1633 /* We're still online - fail. */
1634 goto done;
1638 cached_logon:
1639 /* Check for Cached logons */
1640 if (!domain->online && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN) &&
1641 lp_winbind_offline_logon()) {
1643 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1645 if (NT_STATUS_IS_OK(result)) {
1646 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1647 goto process_result;
1648 } else {
1649 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1650 goto done;
1654 process_result:
1656 if (NT_STATUS_IS_OK(result)) {
1658 struct dom_sid user_sid;
1660 /* In all codepaths where result == NT_STATUS_OK info3 must have
1661 been initialized. */
1662 if (!info3) {
1663 result = NT_STATUS_INTERNAL_ERROR;
1664 goto done;
1667 sid_compose(&user_sid, info3->base.domain_sid,
1668 info3->base.rid);
1670 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
1671 &user_sid);
1672 netsamlogon_cache_store(name_user, info3);
1674 /* save name_to_sid info as early as possible (only if
1675 this is our primary domain so we don't invalidate
1676 the cache entry by storing the seq_num for the wrong
1677 domain). */
1678 if ( domain->primary ) {
1679 cache_name2sid(domain, name_domain, name_user,
1680 SID_NAME_USER, &user_sid);
1683 /* Check if the user is in the right group */
1685 result = check_info3_in_group(
1686 info3,
1687 state->request->data.auth.require_membership_of_sid);
1688 if (!NT_STATUS_IS_OK(result)) {
1689 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1690 state->request->data.auth.user,
1691 state->request->data.auth.require_membership_of_sid));
1692 goto done;
1695 result = append_auth_data(state->mem_ctx, state->response,
1696 state->request->flags, info3,
1697 name_domain, name_user);
1698 if (!NT_STATUS_IS_OK(result)) {
1699 goto done;
1702 if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
1703 && lp_winbind_offline_logon()) {
1705 result = winbindd_store_creds(domain,
1706 state->request->data.auth.user,
1707 state->request->data.auth.pass,
1708 info3);
1711 if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
1712 struct winbindd_domain *our_domain = find_our_domain();
1714 /* This is not entirely correct I believe, but it is
1715 consistent. Only apply the password policy settings
1716 too warn users for our own domain. Cannot obtain these
1717 from trusted DCs all the time so don't do it at all.
1718 -- jerry */
1720 result = NT_STATUS_NOT_SUPPORTED;
1721 if (our_domain == domain ) {
1722 result = fillup_password_policy(
1723 our_domain, state->response);
1726 if (!NT_STATUS_IS_OK(result)
1727 && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1729 DEBUG(10,("Failed to get password policies for domain %s: %s\n",
1730 domain->name, nt_errstr(result)));
1731 goto done;
1735 result = NT_STATUS_OK;
1738 done:
1739 /* give us a more useful (more correct?) error code */
1740 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1741 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1742 result = NT_STATUS_NO_LOGON_SERVERS;
1745 set_auth_errors(state->response, result);
1747 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1748 state->request->data.auth.user,
1749 state->response->data.auth.nt_status_string,
1750 state->response->data.auth.pam_error));
1752 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1755 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1756 struct winbindd_cli_state *state)
1758 NTSTATUS result;
1759 struct netr_SamInfo3 *info3 = NULL;
1760 const char *name_user = NULL;
1761 const char *name_domain = NULL;
1762 const char *workstation;
1764 DATA_BLOB lm_resp, nt_resp;
1766 /* This is child-only, so no check for privileged access is needed
1767 anymore */
1769 /* Ensure null termination */
1770 state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
1771 state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
1773 name_user = state->request->data.auth_crap.user;
1774 name_domain = state->request->data.auth_crap.domain;
1775 workstation = state->request->data.auth_crap.workstation;
1777 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1778 name_domain, name_user));
1780 if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
1781 || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
1782 if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
1783 state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
1784 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1785 state->request->data.auth_crap.lm_resp_len,
1786 state->request->data.auth_crap.nt_resp_len));
1787 result = NT_STATUS_INVALID_PARAMETER;
1788 goto done;
1792 lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
1793 state->request->data.auth_crap.lm_resp_len);
1795 if (state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) {
1796 nt_resp = data_blob_talloc(state->mem_ctx,
1797 state->request->extra_data.data,
1798 state->request->data.auth_crap.nt_resp_len);
1799 } else {
1800 nt_resp = data_blob_talloc(state->mem_ctx,
1801 state->request->data.auth_crap.nt_resp,
1802 state->request->data.auth_crap.nt_resp_len);
1805 if (strequal(name_domain, get_global_sam_name())) {
1806 DATA_BLOB chal_blob = data_blob_const(
1807 state->request->data.auth_crap.chal,
1808 sizeof(state->request->data.auth_crap.chal));
1810 result = winbindd_dual_auth_passdb(
1811 state->mem_ctx, name_domain, name_user,
1812 &chal_blob, &lm_resp, &nt_resp, &info3);
1813 goto process_result;
1816 result = winbind_samlogon_retry_loop(domain,
1817 state->mem_ctx,
1818 state->request->data.auth_crap.logon_parameters,
1819 domain->dcname,
1820 name_user,
1821 name_domain,
1822 /* Bug #3248 - found by Stefan Burkei. */
1823 workstation, /* We carefully set this above so use it... */
1824 state->request->data.auth_crap.chal,
1825 lm_resp,
1826 nt_resp,
1827 &info3);
1828 if (!NT_STATUS_IS_OK(result)) {
1829 goto done;
1832 process_result:
1834 if (NT_STATUS_IS_OK(result)) {
1835 struct dom_sid user_sid;
1837 sid_compose(&user_sid, info3->base.domain_sid,
1838 info3->base.rid);
1839 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
1840 &user_sid);
1841 netsamlogon_cache_store(name_user, info3);
1843 /* Check if the user is in the right group */
1845 result = check_info3_in_group(
1846 info3,
1847 state->request->data.auth_crap.require_membership_of_sid);
1848 if (!NT_STATUS_IS_OK(result)) {
1849 DEBUG(3, ("User %s is not in the required group (%s), so "
1850 "crap authentication is rejected\n",
1851 state->request->data.auth_crap.user,
1852 state->request->data.auth_crap.require_membership_of_sid));
1853 goto done;
1856 result = append_auth_data(state->mem_ctx, state->response,
1857 state->request->flags, info3,
1858 name_domain, name_user);
1859 if (!NT_STATUS_IS_OK(result)) {
1860 goto done;
1864 done:
1866 /* give us a more useful (more correct?) error code */
1867 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1868 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1869 result = NT_STATUS_NO_LOGON_SERVERS;
1872 if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1873 result = nt_status_squash(result);
1876 set_auth_errors(state->response, result);
1878 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1879 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1880 name_domain,
1881 name_user,
1882 state->response->data.auth.nt_status_string,
1883 state->response->data.auth.pam_error));
1885 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1888 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1889 struct winbindd_cli_state *state)
1891 char *oldpass;
1892 char *newpass = NULL;
1893 struct policy_handle dom_pol;
1894 struct rpc_pipe_client *cli = NULL;
1895 bool got_info = false;
1896 struct samr_DomInfo1 *info = NULL;
1897 struct userPwdChangeFailureInformation *reject = NULL;
1898 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1899 fstring domain, user;
1900 struct dcerpc_binding_handle *b = NULL;
1902 ZERO_STRUCT(dom_pol);
1904 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1905 state->request->data.auth.user));
1907 if (!parse_domain_user(state->request->data.chauthtok.user, domain, user)) {
1908 goto done;
1911 /* Change password */
1913 oldpass = state->request->data.chauthtok.oldpass;
1914 newpass = state->request->data.chauthtok.newpass;
1916 /* Initialize reject reason */
1917 state->response->data.auth.reject_reason = Undefined;
1919 /* Get sam handle */
1921 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
1922 &dom_pol);
1923 if (!NT_STATUS_IS_OK(result)) {
1924 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
1925 goto done;
1928 b = cli->binding_handle;
1930 result = rpccli_samr_chgpasswd_user3(cli, state->mem_ctx,
1931 user,
1932 newpass,
1933 oldpass,
1934 &info,
1935 &reject);
1937 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
1939 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
1941 fill_in_password_policy(state->response, info);
1943 state->response->data.auth.reject_reason =
1944 reject->extendedFailureReason;
1946 got_info = true;
1949 /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
1950 * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
1951 * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
1952 * short to comply with the samr_ChangePasswordUser3 idl - gd */
1954 /* only fallback when the chgpasswd_user3 call is not supported */
1955 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
1956 NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) ||
1957 NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL) ||
1958 NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
1960 DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
1961 nt_errstr(result)));
1963 result = rpccli_samr_chgpasswd_user2(cli, state->mem_ctx, user, newpass, oldpass);
1965 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
1966 Map to the same status code as Windows 2003. */
1968 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
1969 result = NT_STATUS_PASSWORD_RESTRICTION;
1973 done:
1975 if (NT_STATUS_IS_OK(result)
1976 && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
1977 && lp_winbind_offline_logon()) {
1978 result = winbindd_update_creds_by_name(contact_domain, user,
1979 newpass);
1980 /* Again, this happens when we login from gdm or xdm
1981 * and the password expires, *BUT* cached crendentials
1982 * doesn't exist. winbindd_update_creds_by_name()
1983 * returns NT_STATUS_NO_SUCH_USER.
1984 * This is not a failure.
1985 * --- BoYang
1986 * */
1987 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
1988 result = NT_STATUS_OK;
1991 if (!NT_STATUS_IS_OK(result)) {
1992 DEBUG(10, ("Failed to store creds: %s\n",
1993 nt_errstr(result)));
1994 goto process_result;
1998 if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2000 NTSTATUS policy_ret;
2002 policy_ret = fillup_password_policy(
2003 contact_domain, state->response);
2005 /* failure of this is non critical, it will just provide no
2006 * additional information to the client why the change has
2007 * failed - Guenther */
2009 if (!NT_STATUS_IS_OK(policy_ret)) {
2010 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2011 goto process_result;
2015 process_result:
2017 if (strequal(contact_domain->name, get_global_sam_name())) {
2018 /* FIXME: internal rpc pipe does not cache handles yet */
2019 if (b) {
2020 if (is_valid_policy_hnd(&dom_pol)) {
2021 NTSTATUS _result;
2022 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2024 TALLOC_FREE(cli);
2028 set_auth_errors(state->response, result);
2030 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2031 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2032 domain,
2033 user,
2034 state->response->data.auth.nt_status_string,
2035 state->response->data.auth.pam_error));
2037 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2040 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2041 struct winbindd_cli_state *state)
2043 NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2045 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2046 state->request->data.logoff.user));
2048 if (!(state->request->flags & WBFLAG_PAM_KRB5)) {
2049 result = NT_STATUS_OK;
2050 goto process_result;
2053 if (state->request->data.logoff.krb5ccname[0] == '\0') {
2054 result = NT_STATUS_OK;
2055 goto process_result;
2058 #ifdef HAVE_KRB5
2060 if (state->request->data.logoff.uid < 0) {
2061 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2062 goto process_result;
2065 /* what we need here is to find the corresponding krb5 ccache name *we*
2066 * created for a given username and destroy it */
2068 if (!ccache_entry_exists(state->request->data.logoff.user)) {
2069 result = NT_STATUS_OK;
2070 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2071 goto process_result;
2074 if (!ccache_entry_identical(state->request->data.logoff.user,
2075 state->request->data.logoff.uid,
2076 state->request->data.logoff.krb5ccname)) {
2077 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2078 goto process_result;
2081 result = remove_ccache(state->request->data.logoff.user);
2082 if (!NT_STATUS_IS_OK(result)) {
2083 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2084 nt_errstr(result)));
2085 goto process_result;
2088 #else
2089 result = NT_STATUS_NOT_SUPPORTED;
2090 #endif
2092 process_result:
2095 set_auth_errors(state->response, result);
2097 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2100 /* Change user password with auth crap*/
2102 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2104 NTSTATUS result;
2105 DATA_BLOB new_nt_password;
2106 DATA_BLOB old_nt_hash_enc;
2107 DATA_BLOB new_lm_password;
2108 DATA_BLOB old_lm_hash_enc;
2109 fstring domain,user;
2110 struct policy_handle dom_pol;
2111 struct winbindd_domain *contact_domain = domainSt;
2112 struct rpc_pipe_client *cli = NULL;
2113 struct dcerpc_binding_handle *b = NULL;
2115 ZERO_STRUCT(dom_pol);
2117 /* Ensure null termination */
2118 state->request->data.chng_pswd_auth_crap.user[
2119 sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
2120 state->request->data.chng_pswd_auth_crap.domain[
2121 sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
2122 *domain = 0;
2123 *user = 0;
2125 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2126 (unsigned long)state->pid,
2127 state->request->data.chng_pswd_auth_crap.domain,
2128 state->request->data.chng_pswd_auth_crap.user));
2130 if (lp_winbind_offline_logon()) {
2131 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2132 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2133 result = NT_STATUS_ACCESS_DENIED;
2134 goto done;
2137 if (*state->request->data.chng_pswd_auth_crap.domain) {
2138 fstrcpy(domain,state->request->data.chng_pswd_auth_crap.domain);
2139 } else {
2140 parse_domain_user(state->request->data.chng_pswd_auth_crap.user,
2141 domain, user);
2143 if(!*domain) {
2144 DEBUG(3,("no domain specified with username (%s) - "
2145 "failing auth\n",
2146 state->request->data.chng_pswd_auth_crap.user));
2147 result = NT_STATUS_NO_SUCH_USER;
2148 goto done;
2152 if (!*domain && lp_winbind_use_default_domain()) {
2153 fstrcpy(domain,(char *)lp_workgroup());
2156 if(!*user) {
2157 fstrcpy(user, state->request->data.chng_pswd_auth_crap.user);
2160 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2161 (unsigned long)state->pid, domain, user));
2163 /* Change password */
2164 new_nt_password = data_blob_const(
2165 state->request->data.chng_pswd_auth_crap.new_nt_pswd,
2166 state->request->data.chng_pswd_auth_crap.new_nt_pswd_len);
2168 old_nt_hash_enc = data_blob_const(
2169 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
2170 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2172 if(state->request->data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2173 new_lm_password = data_blob_const(
2174 state->request->data.chng_pswd_auth_crap.new_lm_pswd,
2175 state->request->data.chng_pswd_auth_crap.new_lm_pswd_len);
2177 old_lm_hash_enc = data_blob_const(
2178 state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
2179 state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2180 } else {
2181 new_lm_password.length = 0;
2182 old_lm_hash_enc.length = 0;
2185 /* Get sam handle */
2187 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2188 if (!NT_STATUS_IS_OK(result)) {
2189 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2190 goto done;
2193 b = cli->binding_handle;
2195 result = rpccli_samr_chng_pswd_auth_crap(
2196 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2197 new_lm_password, old_lm_hash_enc);
2199 done:
2201 if (strequal(contact_domain->name, get_global_sam_name())) {
2202 /* FIXME: internal rpc pipe does not cache handles yet */
2203 if (b) {
2204 if (is_valid_policy_hnd(&dom_pol)) {
2205 NTSTATUS _result;
2206 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2208 TALLOC_FREE(cli);
2212 set_auth_errors(state->response, result);
2214 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2215 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2216 domain, user,
2217 state->response->data.auth.nt_status_string,
2218 state->response->data.auth.pam_error));
2220 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;