2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_AUTH
29 extern DOM_SID global_sid_World
;
30 extern DOM_SID global_sid_Network
;
31 extern DOM_SID global_sid_Builtin_Guests
;
32 extern DOM_SID global_sid_Authenticated_Users
;
35 /****************************************************************************
36 Create a UNIX user on demand.
37 ****************************************************************************/
39 static int smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
44 pstrcpy(add_script
, lp_adduser_script());
47 all_string_sub(add_script
, "%u", unix_username
, sizeof(pstring
));
49 all_string_sub(add_script
, "%D", domain
, sizeof(pstring
));
51 all_string_sub(add_script
, "%H", homedir
, sizeof(pstring
));
52 ret
= smbrun(add_script
,NULL
);
53 DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script
,ret
));
57 /****************************************************************************
58 Add and Delete UNIX users on demand, based on NTSTATUS codes.
59 We don't care about RID's here so ignore.
60 ****************************************************************************/
62 void auth_add_user_script(const char *domain
, const char *username
)
66 * User validated ok against Domain controller.
67 * If the admin wants us to try and create a UNIX
68 * user on the fly, do so.
71 if ( *lp_adduser_script() )
72 smb_create_user(domain
, username
, NULL
);
74 DEBUG(10,("auth_add_user_script: no 'add user script'. Asking winbindd\n"));
76 /* should never get here is we a re a domain member running winbindd
77 However, a host set for 'security = server' might run winbindd for
80 if ( !winbind_create_user(username
, NULL
) ) {
81 DEBUG(5,("auth_add_user_script: winbindd_create_user() failed\n"));
87 /****************************************************************************
88 Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
90 ****************************************************************************/
92 NTSTATUS
auth_get_sam_account(const char *user
, SAM_ACCOUNT
**account
)
96 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(account
))) {
101 pdb_ret
= pdb_getsampwnam(*account
, user
);
106 struct passwd
*pass
= Get_Pwnam(user
);
108 return NT_STATUS_NO_SUCH_USER
;
110 if (!NT_STATUS_IS_OK(nt_status
= pdb_fill_sam_pw(*account
, pass
))) {
117 /****************************************************************************
118 Create an auth_usersupplied_data structure
119 ****************************************************************************/
121 static NTSTATUS
make_user_info(auth_usersupplied_info
**user_info
,
122 const char *smb_name
,
123 const char *internal_username
,
124 const char *client_domain
,
126 const char *wksta_name
,
127 DATA_BLOB
*lm_pwd
, DATA_BLOB
*nt_pwd
,
128 DATA_BLOB
*lm_interactive_pwd
, DATA_BLOB
*nt_interactive_pwd
,
129 DATA_BLOB
*plaintext
,
133 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username
, smb_name
));
135 *user_info
= malloc(sizeof(**user_info
));
137 DEBUG(0,("malloc failed for user_info (size %lu)\n", (unsigned long)sizeof(*user_info
)));
138 return NT_STATUS_NO_MEMORY
;
141 ZERO_STRUCTP(*user_info
);
143 DEBUG(5,("making strings for %s's user_info struct\n", internal_username
));
145 (*user_info
)->smb_name
.str
= strdup(smb_name
);
146 if ((*user_info
)->smb_name
.str
) {
147 (*user_info
)->smb_name
.len
= strlen(smb_name
);
149 free_user_info(user_info
);
150 return NT_STATUS_NO_MEMORY
;
153 (*user_info
)->internal_username
.str
= strdup(internal_username
);
154 if ((*user_info
)->internal_username
.str
) {
155 (*user_info
)->internal_username
.len
= strlen(internal_username
);
157 free_user_info(user_info
);
158 return NT_STATUS_NO_MEMORY
;
161 (*user_info
)->domain
.str
= strdup(domain
);
162 if ((*user_info
)->domain
.str
) {
163 (*user_info
)->domain
.len
= strlen(domain
);
165 free_user_info(user_info
);
166 return NT_STATUS_NO_MEMORY
;
169 (*user_info
)->client_domain
.str
= strdup(client_domain
);
170 if ((*user_info
)->client_domain
.str
) {
171 (*user_info
)->client_domain
.len
= strlen(client_domain
);
173 free_user_info(user_info
);
174 return NT_STATUS_NO_MEMORY
;
177 (*user_info
)->wksta_name
.str
= strdup(wksta_name
);
178 if ((*user_info
)->wksta_name
.str
) {
179 (*user_info
)->wksta_name
.len
= strlen(wksta_name
);
181 free_user_info(user_info
);
182 return NT_STATUS_NO_MEMORY
;
185 DEBUG(5,("making blobs for %s's user_info struct\n", internal_username
));
188 (*user_info
)->lm_resp
= data_blob(lm_pwd
->data
, lm_pwd
->length
);
190 (*user_info
)->nt_resp
= data_blob(nt_pwd
->data
, nt_pwd
->length
);
191 if (lm_interactive_pwd
)
192 (*user_info
)->lm_interactive_pwd
= data_blob(lm_interactive_pwd
->data
, lm_interactive_pwd
->length
);
193 if (nt_interactive_pwd
)
194 (*user_info
)->nt_interactive_pwd
= data_blob(nt_interactive_pwd
->data
, nt_interactive_pwd
->length
);
197 (*user_info
)->plaintext_password
= data_blob(plaintext
->data
, plaintext
->length
);
199 (*user_info
)->encrypted
= encrypted
;
201 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted
? "":"un" , internal_username
, smb_name
));
206 /****************************************************************************
207 Create an auth_usersupplied_data structure after appropriate mapping.
208 ****************************************************************************/
210 NTSTATUS
make_user_info_map(auth_usersupplied_info
**user_info
,
211 const char *smb_name
,
212 const char *client_domain
,
213 const char *wksta_name
,
214 DATA_BLOB
*lm_pwd
, DATA_BLOB
*nt_pwd
,
215 DATA_BLOB
*lm_interactive_pwd
, DATA_BLOB
*nt_interactive_pwd
,
216 DATA_BLOB
*plaintext
,
220 fstring internal_username
;
221 fstrcpy(internal_username
, smb_name
);
222 map_username(internal_username
);
224 DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
225 client_domain
, smb_name
, wksta_name
));
227 /* don't allow "" as a domain, fixes a Win9X bug
228 where it doens't supply a domain for logon script
229 'net use' commands. */
231 if ( *client_domain
)
232 domain
= client_domain
;
234 domain
= lp_workgroup();
236 /* do what win2k does. Always map unknown domains to our own
237 and let the "passdb backend" handle unknown users. */
239 if ( !is_trusted_domain(domain
) && !strequal(domain
, get_global_sam_name()) )
240 domain
= get_default_sam_name();
242 /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
244 return make_user_info(user_info
, smb_name
, internal_username
,
245 client_domain
, domain
, wksta_name
,
247 lm_interactive_pwd
, nt_interactive_pwd
,
248 plaintext
, encrypted
);
251 /****************************************************************************
252 Create an auth_usersupplied_data, making the DATA_BLOBs here.
253 Decrypt and encrypt the passwords.
254 ****************************************************************************/
256 BOOL
make_user_info_netlogon_network(auth_usersupplied_info
**user_info
,
257 const char *smb_name
,
258 const char *client_domain
,
259 const char *wksta_name
,
260 const uchar
*lm_network_pwd
, int lm_pwd_len
,
261 const uchar
*nt_network_pwd
, int nt_pwd_len
)
265 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
266 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
268 nt_status
= make_user_info_map(user_info
,
269 smb_name
, client_domain
,
271 lm_pwd_len
? &lm_blob
: NULL
,
272 nt_pwd_len
? &nt_blob
: NULL
,
276 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
278 data_blob_free(&lm_blob
);
279 data_blob_free(&nt_blob
);
283 /****************************************************************************
284 Create an auth_usersupplied_data, making the DATA_BLOBs here.
285 Decrypt and encrypt the passwords.
286 ****************************************************************************/
288 BOOL
make_user_info_netlogon_interactive(auth_usersupplied_info
**user_info
,
289 const char *smb_name
,
290 const char *client_domain
,
291 const char *wksta_name
,
293 const uchar lm_interactive_pwd
[16],
294 const uchar nt_interactive_pwd
[16],
295 const uchar
*dc_sess_key
)
299 unsigned char local_lm_response
[24];
300 unsigned char local_nt_response
[24];
301 unsigned char key
[16];
304 memcpy(key
, dc_sess_key
, 8);
306 if (lm_interactive_pwd
) memcpy(lm_pwd
, lm_interactive_pwd
, sizeof(lm_pwd
));
307 if (nt_interactive_pwd
) memcpy(nt_pwd
, nt_interactive_pwd
, sizeof(nt_pwd
));
309 #ifdef DEBUG_PASSWORD
311 dump_data(100, (char *)key
, sizeof(key
));
313 DEBUG(100,("lm owf password:"));
314 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
316 DEBUG(100,("nt owf password:"));
317 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
320 if (lm_interactive_pwd
)
321 SamOEMhash((uchar
*)lm_pwd
, key
, sizeof(lm_pwd
));
323 if (nt_interactive_pwd
)
324 SamOEMhash((uchar
*)nt_pwd
, key
, sizeof(nt_pwd
));
326 #ifdef DEBUG_PASSWORD
327 DEBUG(100,("decrypt of lm owf password:"));
328 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
330 DEBUG(100,("decrypt of nt owf password:"));
331 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
334 if (lm_interactive_pwd
)
335 SMBOWFencrypt((const unsigned char *)lm_pwd
, chal
, local_lm_response
);
337 if (nt_interactive_pwd
)
338 SMBOWFencrypt((const unsigned char *)nt_pwd
, chal
, local_nt_response
);
340 /* Password info paranoia */
346 DATA_BLOB local_lm_blob
;
347 DATA_BLOB local_nt_blob
;
349 DATA_BLOB lm_interactive_blob
;
350 DATA_BLOB nt_interactive_blob
;
352 if (lm_interactive_pwd
) {
353 local_lm_blob
= data_blob(local_lm_response
, sizeof(local_lm_response
));
354 lm_interactive_blob
= data_blob(lm_pwd
, sizeof(lm_pwd
));
358 if (nt_interactive_pwd
) {
359 local_nt_blob
= data_blob(local_nt_response
, sizeof(local_nt_response
));
360 nt_interactive_blob
= data_blob(nt_pwd
, sizeof(nt_pwd
));
364 nt_status
= make_user_info_map(user_info
,
365 smb_name
, client_domain
,
367 lm_interactive_pwd
? &local_lm_blob
: NULL
,
368 nt_interactive_pwd
? &local_nt_blob
: NULL
,
369 lm_interactive_pwd
? &lm_interactive_blob
: NULL
,
370 nt_interactive_pwd
? &nt_interactive_blob
: NULL
,
374 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
375 data_blob_free(&local_lm_blob
);
376 data_blob_free(&local_nt_blob
);
377 data_blob_free(&lm_interactive_blob
);
378 data_blob_free(&nt_interactive_blob
);
384 /****************************************************************************
385 Create an auth_usersupplied_data structure
386 ****************************************************************************/
388 BOOL
make_user_info_for_reply(auth_usersupplied_info
**user_info
,
389 const char *smb_name
,
390 const char *client_domain
,
392 DATA_BLOB plaintext_password
)
395 DATA_BLOB local_lm_blob
;
396 DATA_BLOB local_nt_blob
;
397 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
400 * Not encrypted - do so.
403 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
405 if (plaintext_password
.data
) {
406 unsigned char local_lm_response
[24];
408 #ifdef DEBUG_PASSWORD
409 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password
.length
));
410 dump_data(100, plaintext_password
.data
, plaintext_password
.length
);
413 SMBencrypt( (const char *)plaintext_password
.data
, (const uchar
*)chal
, local_lm_response
);
414 local_lm_blob
= data_blob(local_lm_response
, 24);
416 /* We can't do an NT hash here, as the password needs to be
418 local_nt_blob
= data_blob(NULL
, 0);
421 local_lm_blob
= data_blob(NULL
, 0);
422 local_nt_blob
= data_blob(NULL
, 0);
425 ret
= make_user_info_map(user_info
, smb_name
,
427 get_remote_machine_name(),
428 local_lm_blob
.data
? &local_lm_blob
: NULL
,
429 local_nt_blob
.data
? &local_nt_blob
: NULL
,
431 plaintext_password
.data
? &plaintext_password
: NULL
,
434 data_blob_free(&local_lm_blob
);
435 return NT_STATUS_IS_OK(ret
) ? True
: False
;
438 /****************************************************************************
439 Create an auth_usersupplied_data structure
440 ****************************************************************************/
442 NTSTATUS
make_user_info_for_reply_enc(auth_usersupplied_info
**user_info
,
443 const char *smb_name
,
444 const char *client_domain
,
445 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
447 return make_user_info_map(user_info
, smb_name
,
449 get_remote_machine_name(),
450 lm_resp
.data
? &lm_resp
: NULL
,
451 nt_resp
.data
? &nt_resp
: NULL
,
456 /****************************************************************************
457 Create a guest user_info blob, for anonymous authenticaion.
458 ****************************************************************************/
460 BOOL
make_user_info_guest(auth_usersupplied_info
**user_info
)
464 nt_status
= make_user_info(user_info
,
473 return NT_STATUS_IS_OK(nt_status
) ? True
: False
;
476 /****************************************************************************
477 prints a NT_USER_TOKEN to debug output.
478 ****************************************************************************/
480 void debug_nt_user_token(int dbg_class
, int dbg_lev
, NT_USER_TOKEN
*token
)
486 DEBUGC(dbg_class
, dbg_lev
, ("NT user token: (NULL)\n"));
490 DEBUGC(dbg_class
, dbg_lev
, ("NT user token of user %s\n",
491 sid_to_string(sid_str
, &token
->user_sids
[0]) ));
492 DEBUGADDC(dbg_class
, dbg_lev
, ("contains %lu SIDs\n", (unsigned long)token
->num_sids
));
493 for (i
= 0; i
< token
->num_sids
; i
++)
494 DEBUGADDC(dbg_class
, dbg_lev
, ("SID[%3lu]: %s\n", (unsigned long)i
,
495 sid_to_string(sid_str
, &token
->user_sids
[i
])));
498 /****************************************************************************
499 prints a UNIX 'token' to debug output.
500 ****************************************************************************/
502 void debug_unix_user_token(int dbg_class
, int dbg_lev
, uid_t uid
, gid_t gid
, int n_groups
, gid_t
*groups
)
505 DEBUGC(dbg_class
, dbg_lev
, ("UNIX token of user %ld\n", (long int)uid
));
507 DEBUGADDC(dbg_class
, dbg_lev
, ("Primary group is %ld and contains %i supplementary groups\n", (long int)gid
, n_groups
));
508 for (i
= 0; i
< n_groups
; i
++)
509 DEBUGADDC(dbg_class
, dbg_lev
, ("Group[%3i]: %ld\n", i
,
510 (long int)groups
[i
]));
513 /****************************************************************************
514 Create the SID list for this user.
515 ****************************************************************************/
517 static NTSTATUS
create_nt_user_token(const DOM_SID
*user_sid
, const DOM_SID
*group_sid
,
518 int n_groupSIDs
, DOM_SID
*groupSIDs
,
519 BOOL is_guest
, NT_USER_TOKEN
**token
)
521 NTSTATUS nt_status
= NT_STATUS_OK
;
522 NT_USER_TOKEN
*ptoken
;
526 if ((ptoken
= malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
) {
527 DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
528 nt_status
= NT_STATUS_NO_MEMORY
;
532 ZERO_STRUCTP(ptoken
);
534 ptoken
->num_sids
= n_groupSIDs
+ 5;
536 if ((ptoken
->user_sids
= (DOM_SID
*)malloc( sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
537 DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
538 nt_status
= NT_STATUS_NO_MEMORY
;
542 memset((char*)ptoken
->user_sids
,0,sizeof(DOM_SID
) * ptoken
->num_sids
);
545 * Note - user SID *MUST* be first in token !
546 * se_access_check depends on this.
548 * Primary group SID is second in token. Convention.
551 sid_copy(&ptoken
->user_sids
[PRIMARY_USER_SID_INDEX
], user_sid
);
553 sid_copy(&ptoken
->user_sids
[PRIMARY_GROUP_SID_INDEX
], group_sid
);
556 * Finally add the "standard" SIDs.
557 * The only difference between guest and "anonymous" (which we
558 * don't really support) is the addition of Authenticated_Users.
561 sid_copy(&ptoken
->user_sids
[2], &global_sid_World
);
562 sid_copy(&ptoken
->user_sids
[3], &global_sid_Network
);
565 sid_copy(&ptoken
->user_sids
[4], &global_sid_Builtin_Guests
);
567 sid_copy(&ptoken
->user_sids
[4], &global_sid_Authenticated_Users
);
569 sid_ndx
= 5; /* next available spot */
571 for (i
= 0; i
< n_groupSIDs
; i
++) {
572 size_t check_sid_idx
;
573 for (check_sid_idx
= 1; check_sid_idx
< ptoken
->num_sids
; check_sid_idx
++) {
574 if (sid_equal(&ptoken
->user_sids
[check_sid_idx
],
580 if (check_sid_idx
>= ptoken
->num_sids
) /* Not found already */ {
581 sid_copy(&ptoken
->user_sids
[sid_ndx
++], &groupSIDs
[i
]);
587 debug_nt_user_token(DBGC_AUTH
, 10, ptoken
);
594 /****************************************************************************
595 Create the SID list for this user.
596 ****************************************************************************/
598 NT_USER_TOKEN
*create_nt_token(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
, BOOL is_guest
)
603 NT_USER_TOKEN
*token
;
606 if (!NT_STATUS_IS_OK(uid_to_sid(&user_sid
, uid
))) {
609 if (!NT_STATUS_IS_OK(gid_to_sid(&group_sid
, gid
))) {
613 group_sids
= malloc(sizeof(DOM_SID
) * ngroups
);
615 DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
619 for (i
= 0; i
< ngroups
; i
++) {
620 if (!NT_STATUS_IS_OK(gid_to_sid(&(group_sids
)[i
], (groups
)[i
]))) {
621 DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups
[i
]));
622 SAFE_FREE(group_sids
);
627 if (!NT_STATUS_IS_OK(create_nt_user_token(&user_sid
, &group_sid
,
628 ngroups
, group_sids
, is_guest
, &token
))) {
629 SAFE_FREE(group_sids
);
633 SAFE_FREE(group_sids
);
638 /******************************************************************************
639 * this function returns the groups (SIDs) of the local SAM the user is in.
640 * If this samba server is a DC of the domain the user belongs to, it returns
641 * both domain groups and local / builtin groups. If the user is in a trusted
642 * domain, or samba is a member server of a domain, then this function returns
643 * local and builtin groups the user is a member of.
645 * currently this is a hack, as there is no sam implementation that is capable
648 * NOTE!! This function will fail if you pass in a winbind user without
650 ******************************************************************************/
652 static NTSTATUS
get_user_groups(const char *username
, uid_t uid
, gid_t gid
,
653 int *n_groups
, DOM_SID
**groups
, gid_t
**unix_groups
)
661 /* Try winbind first */
663 if ( strchr(username
, *lp_winbind_separator()) ) {
664 n_unix_groups
= winbind_getgroups( username
, unix_groups
);
666 DEBUG(10,("get_user_groups: winbind_getgroups(%s): result = %s\n", username
,
667 n_unix_groups
== -1 ? "FAIL" : "SUCCESS"));
669 if ( n_unix_groups
== -1 )
670 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
673 /* fallback to getgrouplist() */
675 n_unix_groups
= groups_max();
677 if ((*unix_groups
= malloc( sizeof(gid_t
) * n_unix_groups
) ) == NULL
) {
678 DEBUG(0, ("get_user_groups: Out of memory allocating unix group list\n"));
679 return NT_STATUS_NO_MEMORY
;
682 if (sys_getgrouplist(username
, gid
, *unix_groups
, &n_unix_groups
) == -1) {
686 groups_tmp
= Realloc(*unix_groups
, sizeof(gid_t
) * n_unix_groups
);
689 SAFE_FREE(*unix_groups
);
690 return NT_STATUS_NO_MEMORY
;
692 *unix_groups
= groups_tmp
;
694 if (sys_getgrouplist(username
, gid
, *unix_groups
, &n_unix_groups
) == -1) {
695 DEBUG(0, ("get_user_groups: failed to get the unix group list\n"));
696 SAFE_FREE(*unix_groups
);
697 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
702 debug_unix_user_token(DBGC_CLASS
, 5, uid
, gid
, n_unix_groups
, *unix_groups
);
704 /* now setup the space for storing the SIDS */
706 if (n_unix_groups
> 0) {
708 *groups
= malloc(sizeof(DOM_SID
) * n_unix_groups
);
711 DEBUG(0, ("get_user_group: malloc() failed for DOM_SID list!\n"));
712 SAFE_FREE(*unix_groups
);
713 return NT_STATUS_NO_MEMORY
;
717 *n_groups
= n_unix_groups
;
719 for (i
= 0; i
< *n_groups
; i
++) {
720 if (!NT_STATUS_IS_OK(gid_to_sid(&(*groups
)[i
], (*unix_groups
)[i
]))) {
721 DEBUG(1, ("get_user_groups: failed to convert gid %ld to a sid!\n",
722 (long int)(*unix_groups
)[i
+1]));
724 SAFE_FREE(*unix_groups
);
725 return NT_STATUS_NO_SUCH_USER
;
732 /***************************************************************************
733 Make a user_info struct
734 ***************************************************************************/
736 static NTSTATUS
make_server_info(auth_serversupplied_info
**server_info
)
738 *server_info
= malloc(sizeof(**server_info
));
740 DEBUG(0,("make_server_info: malloc failed!\n"));
741 return NT_STATUS_NO_MEMORY
;
743 ZERO_STRUCTP(*server_info
);
745 /* Initialise the uid and gid values to something non-zero
746 which may save us from giving away root access if there
747 is a bug in allocating these fields. */
749 (*server_info
)->uid
= -1;
750 (*server_info
)->gid
= -1;
755 /***************************************************************************
756 Fill a server_info struct from a SAM_ACCOUNT with their groups
757 ***************************************************************************/
759 static NTSTATUS
add_user_groups(auth_serversupplied_info
**server_info
,
760 const char * unix_username
,
761 SAM_ACCOUNT
*sampass
,
762 uid_t uid
, gid_t gid
)
765 const DOM_SID
*user_sid
= pdb_get_user_sid(sampass
);
766 const DOM_SID
*group_sid
= pdb_get_group_sid(sampass
);
768 DOM_SID
*groupSIDs
= NULL
;
769 gid_t
*unix_groups
= NULL
;
770 NT_USER_TOKEN
*token
;
774 nt_status
= get_user_groups(unix_username
, uid
, gid
,
775 &n_groupSIDs
, &groupSIDs
, &unix_groups
);
777 if (!NT_STATUS_IS_OK(nt_status
)) {
778 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
779 free_server_info(server_info
);
783 is_guest
= (sid_peek_rid(user_sid
, &rid
) && rid
== DOMAIN_USER_RID_GUEST
);
785 if (!NT_STATUS_IS_OK(nt_status
= create_nt_user_token(user_sid
, group_sid
,
786 n_groupSIDs
, groupSIDs
, is_guest
,
789 DEBUG(4,("create_nt_user_token failed\n"));
790 SAFE_FREE(groupSIDs
);
791 SAFE_FREE(unix_groups
);
792 free_server_info(server_info
);
796 SAFE_FREE(groupSIDs
);
798 (*server_info
)->n_groups
= n_groupSIDs
;
799 (*server_info
)->groups
= unix_groups
;
800 (*server_info
)->ptok
= token
;
805 /***************************************************************************
806 Make (and fill) a user_info struct from a SAM_ACCOUNT
807 ***************************************************************************/
809 NTSTATUS
make_server_info_sam(auth_serversupplied_info
**server_info
,
810 SAM_ACCOUNT
*sampass
)
815 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
)))
818 (*server_info
)->sam_account
= sampass
;
820 if ( !(pwd
= getpwnam_alloc(pdb_get_username(sampass
))) ) {
821 DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
822 pdb_get_username(sampass
)));
823 free_server_info(server_info
);
824 return NT_STATUS_NO_SUCH_USER
;
826 (*server_info
)->unix_name
= smb_xstrdup(pwd
->pw_name
);
827 (*server_info
)->gid
= pwd
->pw_gid
;
828 (*server_info
)->uid
= pwd
->pw_uid
;
832 if (!NT_STATUS_IS_OK(nt_status
= add_user_groups(server_info
, pdb_get_username(sampass
),
835 (*server_info
)->gid
)))
837 free_server_info(server_info
);
841 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
842 DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
843 pdb_get_username(sampass
),
844 (*server_info
)->unix_name
));
849 /***************************************************************************
850 Make (and fill) a user_info struct from a 'struct passwd' by conversion
852 ***************************************************************************/
854 NTSTATUS
make_server_info_pw(auth_serversupplied_info
**server_info
,
859 SAM_ACCOUNT
*sampass
= NULL
;
860 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam_pw(&sampass
, pwd
))) {
863 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
))) {
867 (*server_info
)->sam_account
= sampass
;
869 if (!NT_STATUS_IS_OK(nt_status
= add_user_groups(server_info
, unix_username
,
870 sampass
, pwd
->pw_uid
, pwd
->pw_gid
)))
875 (*server_info
)->unix_name
= smb_xstrdup(unix_username
);
877 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
878 (*server_info
)->uid
= pwd
->pw_uid
;
879 (*server_info
)->gid
= pwd
->pw_gid
;
883 /***************************************************************************
884 Make (and fill) a user_info struct for a guest login.
885 ***************************************************************************/
887 NTSTATUS
make_server_info_guest(auth_serversupplied_info
**server_info
)
890 SAM_ACCOUNT
*sampass
= NULL
;
893 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(&sampass
))) {
897 sid_copy(&guest_sid
, get_global_sam_sid());
898 sid_append_rid(&guest_sid
, DOMAIN_USER_RID_GUEST
);
901 if (!pdb_getsampwsid(sampass
, &guest_sid
)) {
903 return NT_STATUS_NO_SUCH_USER
;
907 nt_status
= make_server_info_sam(server_info
, sampass
);
909 if (NT_STATUS_IS_OK(nt_status
)) {
910 static const char zeros
[16];
911 (*server_info
)->guest
= True
;
913 /* annoying, but the Guest really does have a session key,
914 and it is all zeros! */
915 (*server_info
)->user_session_key
= data_blob(zeros
, sizeof(zeros
));
916 (*server_info
)->lm_session_key
= data_blob(zeros
, sizeof(zeros
));
922 /***************************************************************************
923 Purely internal function for make_server_info_info3
924 Fill the sam account from getpwnam
925 ***************************************************************************/
926 static NTSTATUS
fill_sam_account(TALLOC_CTX
*mem_ctx
,
928 const char *username
,
929 char **found_username
,
930 uid_t
*uid
, gid_t
*gid
,
931 SAM_ACCOUNT
**sam_account
)
934 fstring real_username
;
935 struct passwd
*passwd
;
937 fstr_sprintf(dom_user
, "%s%s%s", domain
, lp_winbind_separator(),
940 /* get the passwd struct but don't create the user if he/she
941 does not exist. We were explicitly called from a following
942 a winbindd authentication request so we should assume that
943 nss_winbindd is working */
945 if ( !(passwd
= smb_getpwnam( dom_user
, real_username
, True
)) )
946 return NT_STATUS_NO_SUCH_USER
;
948 *uid
= passwd
->pw_uid
;
949 *gid
= passwd
->pw_gid
;
951 /* This is pointless -- there is no suport for differing
952 unix and windows names. Make sure to always store the
953 one we actually looked up and succeeded. Have I mentioned
954 why I hate the 'winbind use default domain' parameter?
957 *found_username
= talloc_strdup( mem_ctx
, real_username
);
959 DEBUG(5,("fill_sam_account: located username was [%s]\n",
962 return pdb_init_sam_pw(sam_account
, passwd
);
965 /****************************************************************************
966 Wrapper to allow the getpwnam() call to strip the domain name and
967 try again in case a local UNIX user is already there. Also run through
968 the username if we fallback to the username only.
969 ****************************************************************************/
971 struct passwd
*smb_getpwnam( char *domuser
, fstring save_username
, BOOL create
)
973 struct passwd
*pw
= NULL
;
977 /* we only save a copy of the username it has been mangled
978 by winbindd use default domain */
980 save_username
[0] = '\0';
982 /* don't call map_username() here since it has to be done higher
983 up the stack so we don't call it mutliple times */
985 fstrcpy( username
, domuser
);
987 p
= strchr_m( username
, *lp_winbind_separator() );
989 /* code for a DOMAIN\user string */
992 fstring strip_username
;
994 pw
= Get_Pwnam( domuser
);
996 /* make sure we get the case of the username correct */
997 /* work around 'winbind use default domain = yes' */
999 if ( !strchr_m( pw
->pw_name
, *lp_winbind_separator() ) ) {
1002 /* split the domain and username into 2 strings */
1006 fstr_sprintf(save_username
, "%s%c%s", domain
, *lp_winbind_separator(), pw
->pw_name
);
1009 fstrcpy( save_username
, pw
->pw_name
);
1015 /* setup for lookup of just the username */
1016 /* remember that p and username are overlapping memory */
1019 fstrcpy( strip_username
, p
);
1020 fstrcpy( username
, strip_username
);
1023 /* just lookup a plain username */
1025 pw
= Get_Pwnam(username
);
1027 /* Create local user if requested. */
1029 if ( !pw
&& create
) {
1030 /* Don't add a machine account. */
1031 if (username
[strlen(username
)-1] == '$')
1034 auth_add_user_script(NULL
, username
);
1035 pw
= Get_Pwnam(username
);
1038 /* one last check for a valid passwd struct */
1041 fstrcpy( save_username
, pw
->pw_name
);
1046 /***************************************************************************
1047 Make a server_info struct from the info3 returned by a domain logon
1048 ***************************************************************************/
1050 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
1051 const char *internal_username
,
1052 const char *sent_nt_username
,
1054 auth_serversupplied_info
**server_info
,
1055 NET_USER_INFO_3
*info3
)
1057 static const char zeros
[16];
1059 NTSTATUS nt_status
= NT_STATUS_OK
;
1060 char *found_username
;
1061 const char *nt_domain
;
1062 const char *nt_username
;
1064 SAM_ACCOUNT
*sam_account
= NULL
;
1072 DOM_SID
*lgroupSIDs
= NULL
;
1074 gid_t
*unix_groups
= NULL
;
1075 NT_USER_TOKEN
*token
;
1077 DOM_SID
*all_group_SIDs
;
1081 Here is where we should check the list of
1082 trusted domains, and verify that the SID
1086 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
1087 if (!sid_append_rid(&user_sid
, info3
->user_rid
)) {
1088 return NT_STATUS_INVALID_PARAMETER
;
1091 sid_copy(&group_sid
, &info3
->dom_sid
.sid
);
1092 if (!sid_append_rid(&group_sid
, info3
->group_rid
)) {
1093 return NT_STATUS_INVALID_PARAMETER
;
1096 if (!(nt_username
= unistr2_tdup(mem_ctx
, &(info3
->uni_user_name
)))) {
1097 /* If the server didn't give us one, just use the one we sent them */
1098 nt_username
= sent_nt_username
;
1101 if (!(nt_domain
= unistr2_tdup(mem_ctx
, &(info3
->uni_logon_dom
)))) {
1102 /* If the server didn't give us one, just use the one we sent them */
1106 /* try to fill the SAM account.. If getpwnam() fails, then try the
1107 add user script (2.2.x behavior) */
1109 nt_status
= fill_sam_account(mem_ctx
, nt_domain
, internal_username
,
1110 &found_username
, &uid
, &gid
, &sam_account
);
1112 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
)) {
1113 DEBUG(3,("User %s does not exist, trying to add it\n",
1114 internal_username
));
1115 auth_add_user_script(nt_domain
, internal_username
);
1116 nt_status
= fill_sam_account(mem_ctx
, nt_domain
,
1117 internal_username
, &found_username
,
1118 &uid
, &gid
, &sam_account
);
1121 if (!NT_STATUS_IS_OK(nt_status
)) {
1122 DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
1126 if (!pdb_set_nt_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1127 pdb_free_sam(&sam_account
);
1128 return NT_STATUS_NO_MEMORY
;
1131 if (!pdb_set_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1132 pdb_free_sam(&sam_account
);
1133 return NT_STATUS_NO_MEMORY
;
1136 if (!pdb_set_domain(sam_account
, nt_domain
, PDB_CHANGED
)) {
1137 pdb_free_sam(&sam_account
);
1138 return NT_STATUS_NO_MEMORY
;
1141 if (!pdb_set_user_sid(sam_account
, &user_sid
, PDB_CHANGED
)) {
1142 pdb_free_sam(&sam_account
);
1143 return NT_STATUS_UNSUCCESSFUL
;
1146 if (!pdb_set_group_sid(sam_account
, &group_sid
, PDB_CHANGED
)) {
1147 pdb_free_sam(&sam_account
);
1148 return NT_STATUS_UNSUCCESSFUL
;
1151 if (!pdb_set_fullname(sam_account
, unistr2_static(&(info3
->uni_full_name
)),
1153 pdb_free_sam(&sam_account
);
1154 return NT_STATUS_NO_MEMORY
;
1157 if (!pdb_set_logon_script(sam_account
, unistr2_static(&(info3
->uni_logon_script
)), PDB_CHANGED
)) {
1158 pdb_free_sam(&sam_account
);
1159 return NT_STATUS_NO_MEMORY
;
1162 if (!pdb_set_profile_path(sam_account
, unistr2_static(&(info3
->uni_profile_path
)), PDB_CHANGED
)) {
1163 pdb_free_sam(&sam_account
);
1164 return NT_STATUS_NO_MEMORY
;
1167 if (!pdb_set_homedir(sam_account
, unistr2_static(&(info3
->uni_home_dir
)), PDB_CHANGED
)) {
1168 pdb_free_sam(&sam_account
);
1169 return NT_STATUS_NO_MEMORY
;
1172 if (!pdb_set_dir_drive(sam_account
, unistr2_static(&(info3
->uni_dir_drive
)), PDB_CHANGED
)) {
1173 pdb_free_sam(&sam_account
);
1174 return NT_STATUS_NO_MEMORY
;
1177 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
))) {
1178 DEBUG(4, ("make_server_info failed!\n"));
1179 pdb_free_sam(&sam_account
);
1183 /* save this here to _net_sam_logon() doesn't fail (it assumes a
1184 valid SAM_ACCOUNT) */
1186 (*server_info
)->sam_account
= sam_account
;
1188 (*server_info
)->unix_name
= smb_xstrdup(found_username
);
1190 /* Fill in the unix info we found on the way */
1192 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
1193 (*server_info
)->uid
= uid
;
1194 (*server_info
)->gid
= gid
;
1196 /* Store the user group information in the server_info
1197 returned to the caller. */
1199 nt_status
= get_user_groups((*server_info
)->unix_name
,
1200 uid
, gid
, &n_lgroupSIDs
, &lgroupSIDs
, &unix_groups
);
1202 if ( !NT_STATUS_IS_OK(nt_status
) ) {
1203 DEBUG(4,("get_user_groups failed\n"));
1207 (*server_info
)->groups
= unix_groups
;
1208 (*server_info
)->n_groups
= n_lgroupSIDs
;
1210 /* Create a 'combined' list of all SIDs we might want in the SD */
1212 all_group_SIDs
= malloc(sizeof(DOM_SID
) * (info3
->num_groups2
+ info3
->num_other_sids
+ n_lgroupSIDs
));
1214 if (!all_group_SIDs
) {
1215 DEBUG(0, ("malloc() failed for DOM_SID list!\n"));
1216 SAFE_FREE(lgroupSIDs
);
1217 free_server_info(server_info
);
1218 return NT_STATUS_NO_MEMORY
;
1221 /* and create (by appending rids) the 'domain' sids */
1223 for (i
= 0; i
< info3
->num_groups2
; i
++) {
1225 sid_copy(&all_group_SIDs
[i
], &(info3
->dom_sid
.sid
));
1227 if (!sid_append_rid(&all_group_SIDs
[i
], info3
->gids
[i
].g_rid
)) {
1229 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1231 DEBUG(3,("could not append additional group rid 0x%x\n",
1232 info3
->gids
[i
].g_rid
));
1234 SAFE_FREE(lgroupSIDs
);
1235 SAFE_FREE(all_group_SIDs
);
1236 free_server_info(server_info
);
1243 /* Copy 'other' sids. We need to do sid filtering here to
1244 prevent possible elevation of privileges. See:
1246 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
1249 for (i
= 0; i
< info3
->num_other_sids
; i
++) {
1250 sid_copy(&all_group_SIDs
[info3
->num_groups2
+ i
],
1251 &info3
->other_sids
[i
].sid
);
1255 /* add local alias sids */
1257 for (i
= 0; i
< n_lgroupSIDs
; i
++) {
1258 sid_copy(&all_group_SIDs
[info3
->num_groups2
+
1259 info3
->num_other_sids
+ i
],
1263 /* Where are the 'global' sids... */
1265 /* can the user be guest? if yes, where is it stored? */
1267 nt_status
= create_nt_user_token(&user_sid
, &group_sid
,
1268 info3
->num_groups2
+ info3
->num_other_sids
+ n_lgroupSIDs
,
1269 all_group_SIDs
, False
, &token
);
1271 if ( !NT_STATUS_IS_OK(nt_status
) ) {
1272 DEBUG(4,("create_nt_user_token failed\n"));
1273 SAFE_FREE(lgroupSIDs
);
1274 SAFE_FREE(all_group_SIDs
);
1275 free_server_info(server_info
);
1279 (*server_info
)->ptok
= token
;
1281 SAFE_FREE(lgroupSIDs
);
1282 SAFE_FREE(all_group_SIDs
);
1284 /* ensure we are never given NULL session keys */
1286 if (memcmp(info3
->user_sess_key
, zeros
, sizeof(zeros
)) == 0) {
1287 (*server_info
)->user_session_key
= data_blob(NULL
, 0);
1289 (*server_info
)->user_session_key
= data_blob(info3
->user_sess_key
, sizeof(info3
->user_sess_key
));
1292 if (memcmp(info3
->padding
, zeros
, sizeof(zeros
)) == 0) {
1293 (*server_info
)->lm_session_key
= data_blob(NULL
, 0);
1295 (*server_info
)->lm_session_key
= data_blob(info3
->padding
, 16);
1297 return NT_STATUS_OK
;
1300 /***************************************************************************
1301 Free a user_info struct
1302 ***************************************************************************/
1304 void free_user_info(auth_usersupplied_info
**user_info
)
1306 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
1307 if (*user_info
!= NULL
) {
1308 if ((*user_info
)->smb_name
.str
) {
1309 DEBUG(10,("structure was created for %s\n", (*user_info
)->smb_name
.str
));
1311 SAFE_FREE((*user_info
)->smb_name
.str
);
1312 SAFE_FREE((*user_info
)->internal_username
.str
);
1313 SAFE_FREE((*user_info
)->client_domain
.str
);
1314 SAFE_FREE((*user_info
)->domain
.str
);
1315 SAFE_FREE((*user_info
)->wksta_name
.str
);
1316 data_blob_free(&(*user_info
)->lm_resp
);
1317 data_blob_free(&(*user_info
)->nt_resp
);
1318 data_blob_clear_free(&(*user_info
)->lm_interactive_pwd
);
1319 data_blob_clear_free(&(*user_info
)->nt_interactive_pwd
);
1320 data_blob_clear_free(&(*user_info
)->plaintext_password
);
1321 ZERO_STRUCT(**user_info
);
1323 SAFE_FREE(*user_info
);
1326 /***************************************************************************
1327 Clear out a server_info struct that has been allocated
1328 ***************************************************************************/
1330 void free_server_info(auth_serversupplied_info
**server_info
)
1332 DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
1333 if (*server_info
!= NULL
) {
1334 pdb_free_sam(&(*server_info
)->sam_account
);
1336 /* call pam_end here, unless we know we are keeping it */
1337 delete_nt_token( &(*server_info
)->ptok
);
1338 SAFE_FREE((*server_info
)->groups
);
1339 SAFE_FREE((*server_info
)->unix_name
);
1340 data_blob_free(&(*server_info
)->lm_session_key
);
1341 data_blob_free(&(*server_info
)->user_session_key
);
1342 ZERO_STRUCT(**server_info
);
1344 SAFE_FREE(*server_info
);
1347 /***************************************************************************
1348 Make an auth_methods struct
1349 ***************************************************************************/
1351 BOOL
make_auth_methods(struct auth_context
*auth_context
, auth_methods
**auth_method
)
1353 if (!auth_context
) {
1354 smb_panic("no auth_context supplied to make_auth_methods()!\n");
1358 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
1361 *auth_method
= talloc(auth_context
->mem_ctx
, sizeof(**auth_method
));
1362 if (!*auth_method
) {
1363 DEBUG(0,("make_auth_method: malloc failed!\n"));
1366 ZERO_STRUCTP(*auth_method
);
1371 /****************************************************************************
1373 ****************************************************************************/
1375 void delete_nt_token(NT_USER_TOKEN
**pptoken
)
1378 NT_USER_TOKEN
*ptoken
= *pptoken
;
1379 SAFE_FREE( ptoken
->user_sids
);
1380 ZERO_STRUCTP(ptoken
);
1382 SAFE_FREE(*pptoken
);
1385 /****************************************************************************
1386 Duplicate a SID token.
1387 ****************************************************************************/
1389 NT_USER_TOKEN
*dup_nt_token(NT_USER_TOKEN
*ptoken
)
1391 NT_USER_TOKEN
*token
;
1396 if ((token
= (NT_USER_TOKEN
*)malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
)
1399 ZERO_STRUCTP(token
);
1401 if ((token
->user_sids
= (DOM_SID
*)memdup( ptoken
->user_sids
, sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
1406 token
->num_sids
= ptoken
->num_sids
;
1412 * Verify whether or not given domain is trusted.
1414 * @param domain_name name of the domain to be verified
1415 * @return true if domain is one of the trusted once or
1416 * false if otherwise
1419 BOOL
is_trusted_domain(const char* dom_name
)
1421 DOM_SID trustdom_sid
;
1426 /* no trusted domains for a standalone server */
1428 if ( lp_server_role() == ROLE_STANDALONE
)
1431 /* if we are a DC, then check for a direct trust relationships */
1435 DEBUG (5,("is_trusted_domain: Checking for domain trust with [%s]\n",
1437 ret
= secrets_fetch_trusted_domain_password(dom_name
, &pass
, &trustdom_sid
, &lct
);
1444 /* if winbindd is not up and we are a domain member) then we need to update the
1445 trustdom_cache ourselves */
1447 if ( !winbind_ping() )
1448 update_trustdom_cache();
1451 /* now the trustdom cache should be available a DC could still
1452 * have a transitive trust so fall back to the cache of trusted
1453 * domains (like a domain member would use */
1455 if ( trustdom_cache_fetch(dom_name
, &trustdom_sid
) ) {