smbXsrv_session: Remove a "can't happen" NULL check

[Samba.git] / source3 / winbindd / winbindd_pam.c

/*
   Unix SMB/CIFS implementation.

   Winbind daemon - pam auth functions

   Copyright (C) Andrew Tridgell 2000
   Copyright (C) Tim Potter 2001
   Copyright (C) Andrew Bartlett 2001-2002
   Copyright (C) Guenther Deschner 2005

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "ntdomain.h"
#include "winbindd.h"
#include "libsmb/namequery.h"
#include "../libcli/auth/libcli_auth.h"
#include "libcli/auth/pam_errors.h"
#include "../librpc/gen_ndr/ndr_samr_c.h"
#include "librpc/rpc/dcesrv_core.h"
#include "librpc/gen_ndr/ndr_winbind.h"
#include "rpc_client/cli_pipe.h"
#include "rpc_client/cli_samr.h"
#include "../librpc/gen_ndr/ndr_netlogon.h"
#include "rpc_client/cli_netlogon.h"
#include "smb_krb5.h"
#include "../libcli/security/security.h"
#include "ads.h"
#include "../librpc/gen_ndr/krb5pac.h"
#include "passdb/machine_sid.h"
#include "auth.h"
#include "../lib/tsocket/tsocket.h"
#include "auth/kerberos/pac_utils.h"
#include "auth/gensec/gensec.h"
#include "librpc/crypto/gse_krb5.h"
#include "lib/afs/afs_funcs.h"
#include "libsmb/samlogon_cache.h"
#include "rpc_client/util_netlogon.h"
#include "param/param.h"
#include "messaging/messaging.h"
#include "lib/util/string_wrappers.h"
#include "lib/crypto/gnutls_helpers.h"

#include "lib/crypto/gnutls_helpers.h"
#include <gnutls/crypto.h>
#include "lib/global_contexts.h"

#undef DBGC_CLASS
#define DBGC_CLASS DBGC_WINBIND

#define LOGON_KRB5_FAIL_CLOCK_SKEW      0x02000000

static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
                                    struct winbindd_response *resp,
                                    uint16_t validation_level,
                                    union netr_Validation *validation)
{
        struct netr_SamInfo3 *info3 = NULL;
        char *ex = NULL;
        uint32_t i;
        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
        TALLOC_CTX *frame = talloc_stackframe();

        status = map_validation_to_info3(frame,
                                         validation_level,
                                         validation,
                                         &info3);
        if (!NT_STATUS_IS_OK(status)) {
                goto out;
        }

        resp->data.auth.info3.logon_time =
                nt_time_to_unix(info3->base.logon_time);
        resp->data.auth.info3.logoff_time =
                nt_time_to_unix(info3->base.logoff_time);
        resp->data.auth.info3.kickoff_time =
                nt_time_to_unix(info3->base.kickoff_time);
        resp->data.auth.info3.pass_last_set_time =
                nt_time_to_unix(info3->base.last_password_change);
        resp->data.auth.info3.pass_can_change_time =
                nt_time_to_unix(info3->base.allow_password_change);
        resp->data.auth.info3.pass_must_change_time =
                nt_time_to_unix(info3->base.force_password_change);

        resp->data.auth.info3.logon_count = info3->base.logon_count;
        resp->data.auth.info3.bad_pw_count = info3->base.bad_password_count;

        resp->data.auth.info3.user_rid = info3->base.rid;
        resp->data.auth.info3.group_rid = info3->base.primary_gid;
        sid_to_fstring(resp->data.auth.info3.dom_sid, info3->base.domain_sid);

        resp->data.auth.info3.num_groups = info3->base.groups.count;
        resp->data.auth.info3.user_flgs = info3->base.user_flags;

        resp->data.auth.info3.acct_flags = info3->base.acct_flags;
        resp->data.auth.info3.num_other_sids = info3->sidcount;

        fstrcpy(resp->data.auth.info3.user_name,
                info3->base.account_name.string);
        fstrcpy(resp->data.auth.info3.full_name,
                info3->base.full_name.string);
        fstrcpy(resp->data.auth.info3.logon_script,
                info3->base.logon_script.string);
        fstrcpy(resp->data.auth.info3.profile_path,
                info3->base.profile_path.string);
        fstrcpy(resp->data.auth.info3.home_dir,
                info3->base.home_directory.string);
        fstrcpy(resp->data.auth.info3.dir_drive,
                info3->base.home_drive.string);

        fstrcpy(resp->data.auth.info3.logon_srv,
                info3->base.logon_server.string);
        fstrcpy(resp->data.auth.info3.logon_dom,
                info3->base.logon_domain.string);

        resp->data.auth.validation_level = validation_level;
        if (validation_level == 6) {
                fstrcpy(resp->data.auth.info6.dns_domainname,
                        validation->sam6->dns_domainname.string);
                fstrcpy(resp->data.auth.info6.principal_name,
                        validation->sam6->principal_name.string);
        }

        ex = talloc_strdup(frame, "");
        if (ex == NULL) {
                status = NT_STATUS_NO_MEMORY;
                goto out;
        }

        for (i=0; i < info3->base.groups.count; i++) {
                ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
                                                   info3->base.groups.rids[i].rid,
                                                   info3->base.groups.rids[i].attributes);
                if (ex == NULL) {
                        status = NT_STATUS_NO_MEMORY;
                        goto out;
                }
        }

        for (i=0; i < info3->sidcount; i++) {
                struct dom_sid_buf sidbuf;

                ex = talloc_asprintf_append_buffer(
                        ex,
                        "%s:0x%08X\n",
                        dom_sid_str_buf(info3->sids[i].sid, &sidbuf),
                        info3->sids[i].attributes);
                if (ex == NULL) {
                        status = NT_STATUS_NO_MEMORY;
                        goto out;
                }
        }

        resp->length += talloc_get_size(ex);
        resp->extra_data.data = talloc_move(mem_ctx, &ex);

        status = NT_STATUS_OK;
out:
        TALLOC_FREE(frame);
        return status;
}

static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
                                    struct winbindd_response *resp,
                                    struct netr_SamInfo3 *info3)
{
        DATA_BLOB blob;
        enum ndr_err_code ndr_err;

        ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
                                       (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                DEBUG(0,("append_info3_as_ndr: failed to append\n"));
                return ndr_map_error2ntstatus(ndr_err);
        }

        resp->extra_data.data = blob.data;
        resp->length += blob.length;

        return NT_STATUS_OK;
}

static NTSTATUS append_unix_username(uint16_t validation_level,
                                     union netr_Validation  *validation,
                                     const char *name_domain,
                                     const char *name_user,
                                     TALLOC_CTX *mem_ctx,
                                     char **_unix_username)
{
        TALLOC_CTX *tmp_ctx = NULL;
        const char *nt_username = NULL;
        const char *nt_domain = NULL;
        char *unix_username = NULL;
        struct netr_SamBaseInfo *base_info = NULL;
        NTSTATUS status;

        tmp_ctx = talloc_new(mem_ctx);
        if (tmp_ctx == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        /* We've been asked to return the unix username, per
           'winbind use default domain' settings and the like */

        switch (validation_level) {
        case 3:
                base_info = &validation->sam3->base;
                break;
        case 6:
                base_info = &validation->sam6->base;
                break;
        default:
                DBG_ERR("Invalid validation level %d\n", validation_level);
                status = NT_STATUS_INTERNAL_ERROR;
                goto out;
        }

        nt_domain = talloc_strdup(tmp_ctx, base_info->logon_domain.string);
        if (!nt_domain) {
                /* If the server didn't give us one, just use the one
                 * we sent them */
                nt_domain = name_domain;
        }

        nt_username = talloc_strdup(tmp_ctx, base_info->account_name.string);
        if (!nt_username) {
                /* If the server didn't give us one, just use the one
                 * we sent them */
                nt_username = name_user;
        }

        unix_username = fill_domain_username_talloc(tmp_ctx,
                                                    nt_domain,
                                                    nt_username,
                                                    true);
        if (unix_username == NULL) {
                status = NT_STATUS_NO_MEMORY;
                goto out;
        }

        DBG_INFO("Setting unix username to [%s]\n", unix_username);

        *_unix_username = talloc_move(mem_ctx, &unix_username);

        status = NT_STATUS_OK;
out:
        TALLOC_FREE(tmp_ctx);

        return status;
}

static NTSTATUS append_afs_token(uint16_t validation_level,
                                 union netr_Validation  *validation,
                                 const char *name_domain,
                                 const char *name_user,
                                 TALLOC_CTX *mem_ctx,
                                 DATA_BLOB *_blob)
{
        TALLOC_CTX *tmp_ctx = NULL;
        char *afsname = NULL;
        char *cell;
        char *token;
        struct netr_SamBaseInfo *base_info = NULL;
        NTSTATUS status;

        tmp_ctx = talloc_new(mem_ctx);
        if (tmp_ctx == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        switch (validation_level) {
        case 3:
                base_info = &validation->sam3->base;
                break;
        case 6:
                base_info = &validation->sam6->base;
                break;
        default:
                DBG_ERR("Invalid validation level %d\n", validation_level);
                status = NT_STATUS_INTERNAL_ERROR;
                goto out;
        }

        afsname = talloc_strdup(tmp_ctx, lp_afs_username_map());
        if (afsname == NULL) {
                status = NT_STATUS_NO_MEMORY;
                goto out;
        }

        afsname = talloc_string_sub(tmp_ctx,
                                    lp_afs_username_map(),
                                    "%D", name_domain);
        afsname = talloc_string_sub(tmp_ctx, afsname,
                                    "%u", name_user);
        afsname = talloc_string_sub(tmp_ctx, afsname,
                                    "%U", name_user);

        {
                struct dom_sid user_sid;
                struct dom_sid_buf sidstr;

                sid_compose(&user_sid, base_info->domain_sid, base_info->rid);
                afsname = talloc_string_sub(
                        tmp_ctx,
                        afsname,
                        "%s",
                        dom_sid_str_buf(&user_sid, &sidstr));
        }

        if (afsname == NULL) {
                status = NT_STATUS_NO_MEMORY;
                goto out;
        }

        if (!strlower_m(afsname)) {
                status = NT_STATUS_INVALID_PARAMETER;
                goto out;
        }

        DEBUG(10, ("Generating token for user %s\n", afsname));

        cell = strchr(afsname, '@');

        if (cell == NULL) {
                status = NT_STATUS_NO_MEMORY;
                goto out;
        }

        *cell = '\0';
        cell += 1;

        token = afs_createtoken_str(afsname, cell);
        if (token == NULL) {
                status = NT_STATUS_OK;
                goto out;
        }

        talloc_steal(mem_ctx, token);
        *_blob = data_blob_string_const_null(token);

        status = NT_STATUS_OK;
out:
        TALLOC_FREE(tmp_ctx);

        return status;
}

NTSTATUS extra_data_to_sid_array(const char *group_sid,
                                TALLOC_CTX *mem_ctx,
                                struct wbint_SidArray **_sid_array)
{
        TALLOC_CTX *tmp_ctx = NULL;
        struct wbint_SidArray *sid_array = NULL;
        struct dom_sid *require_membership_of_sid = NULL;
        uint32_t num_require_membership_of_sid = 0;
        char *req_sid = NULL;
        const char *p = NULL;
        NTSTATUS status;

        if (_sid_array == NULL) {
                return NT_STATUS_INVALID_PARAMETER;
        }

        *_sid_array = NULL;

        tmp_ctx = talloc_new(mem_ctx);
        if (tmp_ctx == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        sid_array = talloc_zero(tmp_ctx, struct wbint_SidArray);
        if (sid_array == NULL) {
                status = NT_STATUS_NO_MEMORY;
                goto fail;
        }

        if (!group_sid || !group_sid[0]) {
                /* NO sid supplied, all users may access */
                status = NT_STATUS_OK;
                /*
                 * Always return an allocated wbint_SidArray,
                 * even if the array is empty.
                 */
                goto out;
        }

        num_require_membership_of_sid = 0;
        require_membership_of_sid = NULL;
        p = group_sid;

        while (next_token_talloc(tmp_ctx, &p, &req_sid, ",")) {
                struct dom_sid sid;

                if (!string_to_sid(&sid, req_sid)) {
                        DBG_ERR("check_info3_in_group: could not parse %s "
                                "as a SID!\n", req_sid);
                        status = NT_STATUS_INVALID_PARAMETER;
                        goto fail;
                }

                status = add_sid_to_array(tmp_ctx, &sid,
                                          &require_membership_of_sid,
                                          &num_require_membership_of_sid);
                if (!NT_STATUS_IS_OK(status)) {
                        DBG_ERR("add_sid_to_array failed\n");
                        goto fail;
                }
        }

        sid_array->num_sids = num_require_membership_of_sid;
        sid_array->sids = talloc_move(sid_array, &require_membership_of_sid);

        status = NT_STATUS_OK;
out:
        *_sid_array = talloc_move(mem_ctx, &sid_array);

fail:
        TALLOC_FREE(tmp_ctx);

        return status;
}

static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
                                     struct wbint_SidArray *sid_array)
/**
 * Check whether a user belongs to a group or list of groups.
 *
 * @param mem_ctx talloc memory context.
 * @param info3 user information, including group membership info.
 * @param group_sid One or more groups , separated by commas.
 *
 * @return NT_STATUS_OK on success,
 *    NT_STATUS_LOGON_FAILURE if the user does not belong,
 *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
 */
{
        size_t i;
        struct security_token *token;
        NTSTATUS status;

        /* Parse the 'required group' SID */

        if (sid_array == NULL || sid_array->num_sids == 0) {
                /* NO sid supplied, all users may access */
                return NT_STATUS_OK;
        }

        /*
         * This is a limited-use security_token for the purpose of
         * checking the SID list below, so no claims need to be added
         * and se_access_check() will never run.
         */
        token = security_token_initialise(talloc_tos(),
                                          CLAIMS_EVALUATION_INVALID_STATE);
        if (token == NULL) {
                DEBUG(0, ("talloc failed\n"));
                return NT_STATUS_NO_MEMORY;
        }

        status = sid_array_from_info3(token, info3,
                                      &token->sids,
                                      &token->num_sids,
                                      true);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }

        if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
                                                  token))
            || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
                                                     token))) {
                DEBUG(3, ("could not add aliases: %s\n",
                          nt_errstr(status)));
                return status;
        }

        security_token_debug(DBGC_CLASS, 10, token);

        for (i=0; i<sid_array->num_sids; i++) {
                struct dom_sid_buf buf;
                DEBUG(10, ("Checking SID %s\n",
                           dom_sid_str_buf(&sid_array->sids[i],
                                           &buf)));
                if (nt_token_check_sid(&sid_array->sids[i],
                                       token)) {
                        DEBUG(10, ("Access ok\n"));
                        return NT_STATUS_OK;
                }
        }

        /* Do not distinguish this error from a wrong username/pw */

        return NT_STATUS_LOGON_FAILURE;
}

struct winbindd_domain *find_auth_domain(uint8_t flags,
                                         const char *domain_name)
{
        struct winbindd_domain *domain;

        if (IS_DC) {
                domain = find_domain_from_name_noinit(domain_name);
                if (domain == NULL) {
                        DEBUG(3, ("Authentication for domain [%s] refused "
                                  "as it is not a trusted domain\n",
                                  domain_name));
                        return NULL;
                }

                if (domain->secure_channel_type != SEC_CHAN_NULL) {
                        return domain;
                }

                return domain->routing_domain;
        }

        if (strequal(domain_name, get_global_sam_name())) {
                return find_domain_from_name_noinit(domain_name);
        }

        if (lp_winbind_use_krb5_enterprise_principals()) {
                /*
                 * If we use enterprise principals
                 * we always go through our primary domain
                 * and follow the WRONG_REALM replies.
                 */
                flags &= ~WBFLAG_PAM_CONTACT_TRUSTDOM;
        }

        /* we can auth against trusted domains */
        if (flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
                domain = find_domain_from_name_noinit(domain_name);
                if (domain == NULL) {
                        DEBUG(3, ("Authentication for domain [%s] skipped "
                                  "as it is not a trusted domain\n",
                                  domain_name));
                } else {
                        return domain;
                }
        }

        return find_our_domain();
}

static NTSTATUS get_password_policy(struct winbindd_domain *domain,
                                    TALLOC_CTX *mem_ctx,
                                    struct samr_DomInfo1 **_policy)
{
        NTSTATUS status;
        struct samr_DomInfo1 *policy = NULL;

        if ( !winbindd_can_contact_domain( domain ) ) {
                DBG_INFO("No inbound trust to contact domain %s\n",
                         domain->name);
                return NT_STATUS_NOT_SUPPORTED;
        }

        policy = talloc_zero(mem_ctx, struct samr_DomInfo1);
        if (policy == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        status = wb_cache_password_policy(domain, mem_ctx, policy);
        if (NT_STATUS_IS_ERR(status)) {
                TALLOC_FREE(policy);
                return status;
        }

        *_policy = talloc_move(mem_ctx, &policy);

        return NT_STATUS_OK;
}

static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
                                                         TALLOC_CTX *mem_ctx,
                                                         uint16_t *lockout_threshold)
{
        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
        struct samr_DomInfo12 lockout_policy;

        *lockout_threshold = 0;

        status = wb_cache_lockout_policy(domain, mem_ctx, &lockout_policy);
        if (NT_STATUS_IS_ERR(status)) {
                return status;
        }

        *lockout_threshold = lockout_policy.lockout_threshold;

        return NT_STATUS_OK;
}

static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
                                   TALLOC_CTX *mem_ctx,
                                   uint32_t *password_properties)
{
        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
        struct samr_DomInfo1 password_policy;

        *password_properties = 0;

        status = wb_cache_password_policy(domain, mem_ctx, &password_policy);
        if (NT_STATUS_IS_ERR(status)) {
                return status;
        }

        *password_properties = password_policy.password_properties;

        return NT_STATUS_OK;
}

#ifdef HAVE_KRB5

static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
                                        const char *type,
                                        uid_t uid,
                                        const char **user_ccache_file)
{
        /* accept FILE and WRFILE as krb5_cc_type from the client and then
         * build the full ccname string based on the user's uid here -
         * Guenther*/

        const char *gen_cc = NULL;

        if (uid != -1) {
                if (strequal(type, "FILE")) {
                        gen_cc = talloc_asprintf(
                                mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
                }
                if (strequal(type, "WRFILE")) {
                        gen_cc = talloc_asprintf(
                                mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
                }
                if (strequal(type, "KEYRING")) {
                        gen_cc = talloc_asprintf(
                                mem_ctx, "KEYRING:persistent:%d", uid);
                }
                if (strequal(type, "KCM")) {
                        gen_cc = talloc_asprintf(mem_ctx,
                                                 "KCM:%d",
                                                 uid);
                }

                if (strnequal(type, "FILE:/", 6) ||
                    strnequal(type, "WRFILE:/", 8) ||
                    strnequal(type, "DIR:/", 5)) {

                        /* we allow only one "%u" substitution */

                        char *p;

                        p = strchr(type, '%');
                        if (p != NULL) {

                                p++;

                                if (p != NULL && *p == 'u' && strchr(p, '%') == NULL) {
                                        char uid_str[sizeof("18446744073709551615")];

                                        snprintf(uid_str, sizeof(uid_str), "%u", uid);

                                        gen_cc = talloc_string_sub2(mem_ctx,
                                                        type,
                                                        "%u",
                                                        uid_str,
                                                        /* remove_unsafe_characters */
                                                        false,
                                                        /* replace_once */
                                                        true,
                                                        /* allow_trailing_dollar */
                                                        false);
                                }
                        }
                }
        }

        *user_ccache_file = gen_cc;

        if (gen_cc == NULL) {
                gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
        }
        if (gen_cc == NULL) {
                DEBUG(0,("out of memory\n"));
                return NULL;
        }

        DEBUG(10, ("using ccache: %s%s\n", gen_cc,
                   (*user_ccache_file == NULL) ? " (internal)":""));

        return gen_cc;
}

#endif

uid_t get_uid_from_request(struct winbindd_request *request)
{
        uid_t uid;

        uid = request->data.auth.uid;

        if (uid == (uid_t)-1) {
                DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
                return -1;
        }
        return uid;
}

/**********************************************************************
 Authenticate a user with a clear text password using Kerberos and fill up
 ccache if required
 **********************************************************************/

static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
                                            struct winbindd_domain *domain,
                                            const char *user,
                                            const char *pass,
                                            const char *krb5_cc_type,
                                            uid_t uid,
                                            struct netr_SamInfo6 **info6,
                                            const char **_krb5ccname)
{
#ifdef HAVE_KRB5
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        krb5_error_code krb5_ret;
        const char *cc = NULL;
        const char *principal_s = NULL;
        char *realm = NULL;
        char *name_namespace = NULL;
        char *name_domain = NULL;
        char *name_user = NULL;
        time_t ticket_lifetime = 0;
        time_t renewal_until = 0;
        time_t time_offset = 0;
        const char *user_ccache_file;
        struct PAC_LOGON_INFO *logon_info = NULL;
        struct PAC_UPN_DNS_INFO *upn_dns_info = NULL;
        struct PAC_DATA *pac_data = NULL;
        struct PAC_DATA_CTR *pac_data_ctr = NULL;
        const char *local_service;
        uint32_t i;
        struct netr_SamInfo6 *info6_copy = NULL;
        char *canon_principal = NULL;
        char *canon_realm = NULL;
        bool ok;

        *info6 = NULL;

        if (domain->alt_name == NULL) {
                return NT_STATUS_INVALID_PARAMETER;
        }

        if (_krb5ccname != NULL) {
                *_krb5ccname = NULL;
        }

        /* 1st step:
         * prepare a krb5_cc_cache string for the user */

        if (uid == -1) {
                DEBUG(0,("no valid uid\n"));
        }

        cc = generate_krb5_ccache(mem_ctx,
                                  krb5_cc_type,
                                  uid,
                                  &user_ccache_file);
        if (cc == NULL) {
                return NT_STATUS_NO_MEMORY;
        }


        /* 2nd step:
         * get kerberos properties */

        if (domain->backend_data.ads_conn != NULL) {
                time_offset = domain->backend_data.ads_conn->auth.time_offset;
        }


        /* 3rd step:
         * do kerberos auth and setup ccache as the user */

        ok = parse_domain_user(mem_ctx,
                        user,
                        &name_namespace,
                        &name_domain,
                        &name_user);
        if (!ok) {
                return NT_STATUS_INVALID_PARAMETER;
        }

        realm = talloc_strdup(mem_ctx, domain->alt_name);
        if (realm == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        if (!strupper_m(realm)) {
                return NT_STATUS_INVALID_PARAMETER;
        }

        if (lp_winbind_use_krb5_enterprise_principals() &&
            name_namespace[0] != '\0')
        {
                principal_s = talloc_asprintf(mem_ctx,
                                              "%s@%s@%s",
                                              name_user,
                                              name_namespace,
                                              realm);
        } else {
                principal_s = talloc_asprintf(mem_ctx,
                                              "%s@%s",
                                              name_user,
                                              realm);
        }
        if (principal_s == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        local_service = talloc_asprintf(mem_ctx, "%s$@%s",
                                        lp_netbios_name(), lp_realm());
        if (local_service == NULL) {
                return NT_STATUS_NO_MEMORY;
        }


        /* if this is a user ccache, we need to act as the user to let the krb5
         * library handle the chown, etc. */

        /************************ ENTERING NON-ROOT **********************/

        if (user_ccache_file != NULL) {
                set_effective_uid(uid);
                DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
        }

        result = kerberos_return_pac(mem_ctx,
                                     principal_s,
                                     pass,
                                     time_offset,
                                     &ticket_lifetime,
                                     &renewal_until,
                                     cc,
                                     true,
                                     true,
                                     WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
                                     NULL,
                                     local_service,
                                     &canon_principal,
                                     &canon_realm,
                                     &pac_data_ctr);
        if (user_ccache_file != NULL) {
                gain_root_privilege();
        }

        /************************ RETURNED TO ROOT **********************/

        if (!NT_STATUS_IS_OK(result)) {
                goto failed;
        }

        if (pac_data_ctr == NULL) {
                goto failed;
        }

        pac_data = pac_data_ctr->pac_data;
        if (pac_data == NULL) {
                goto failed;
        }

        for (i=0; i < pac_data->num_buffers; i++) {

                if (pac_data->buffers[i].type == PAC_TYPE_LOGON_INFO) {
                        logon_info = pac_data->buffers[i].info->logon_info.info;
                        continue;
                }

                if (pac_data->buffers[i].type == PAC_TYPE_UPN_DNS_INFO) {
                        upn_dns_info = &pac_data->buffers[i].info->upn_dns_info;
                        continue;
                }
        }

        if (logon_info == NULL) {
                DEBUG(10,("Missing logon_info in ticket of %s\n",
                        principal_s));
                return NT_STATUS_INVALID_PARAMETER;
        }

        DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
                principal_s));

        result = create_info6_from_pac(mem_ctx, logon_info,
                                       upn_dns_info, &info6_copy);
        if (!NT_STATUS_IS_OK(result)) {
                goto failed;
        }

        /* if we had a user's ccache then return that string for the pam
         * environment */

        if (user_ccache_file != NULL) {

                if (_krb5ccname != NULL) {
                        *_krb5ccname = talloc_steal(mem_ctx, user_ccache_file);
                }

                result = add_ccache_to_list(principal_s,
                                            cc,
                                            user,
                                            pass,
                                            realm,
                                            uid,
                                            time(NULL),
                                            ticket_lifetime,
                                            renewal_until,
                                            false,
                                            canon_principal,
                                            canon_realm);

                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
                                nt_errstr(result)));
                }
        } else {

                /* need to delete the memory cred cache, it is not used anymore */

                krb5_ret = ads_kdestroy(cc);
                if (krb5_ret) {
                        DEBUG(3,("winbindd_raw_kerberos_login: "
                                 "could not destroy krb5 credential cache: "
                                 "%s\n", error_message(krb5_ret)));
                }

        }
        *info6 = info6_copy;
        return NT_STATUS_OK;

failed:
        /*
         * Do not delete an existing valid credential cache, if the user
         * e.g. enters a wrong password
         */
        if ((strequal(krb5_cc_type, "FILE") || strequal(krb5_cc_type, "WRFILE"))
            && user_ccache_file != NULL) {
                return result;
        }

        /* we could have created a new credential cache with a valid tgt in it
         * but we weren't able to get or verify the service ticket for this
         * local host and therefore didn't get the PAC, we need to remove that
         * cache entirely now */

        krb5_ret = ads_kdestroy(cc);
        if (krb5_ret) {
                DEBUG(3,("winbindd_raw_kerberos_login: "
                         "could not destroy krb5 credential cache: "
                         "%s\n", error_message(krb5_ret)));
        }

        if (!NT_STATUS_IS_OK(remove_ccache(user))) {
                DEBUG(3,("winbindd_raw_kerberos_login: "
                          "could not remove ccache for user %s\n",
                        user));
        }

        return result;
#else
        return NT_STATUS_NOT_SUPPORTED;
#endif /* HAVE_KRB5 */
}

/****************************************************************
****************************************************************/

bool check_request_flags(uint32_t flags)
{
        uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
                               WBFLAG_PAM_INFO3_TEXT |
                               WBFLAG_PAM_INFO3_NDR;

        if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
             ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
             ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
              !(flags & flags_edata) ) {
                return true;
        }

        DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
                  flags));

        return false;
}

/****************************************************************
****************************************************************/

NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
                          struct winbindd_response *resp,
                          uint32_t request_flags,
                          uint16_t validation_level,
                          union netr_Validation *validation,
                          const char *name_domain,
                          const char *name_user)
{
        struct netr_SamInfo3 *info3 = NULL;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;

        result = map_validation_to_info3(talloc_tos(),
                                         validation_level,
                                         validation,
                                         &info3);
        if (!NT_STATUS_IS_OK(result)) {
                goto out;
        }

        if (request_flags & WBFLAG_PAM_USER_SESSION_KEY) {
                memcpy(resp->data.auth.user_session_key,
                       info3->base.key.key,
                       sizeof(resp->data.auth.user_session_key)
                       /* 16 */);
        }

        if (request_flags & WBFLAG_PAM_LMKEY) {
                memcpy(resp->data.auth.first_8_lm_hash,
                       info3->base.LMSessKey.key,
                       sizeof(resp->data.auth.first_8_lm_hash)
                       /* 8 */);
        }

        if (request_flags & WBFLAG_PAM_UNIX_NAME) {
                char *unix_username = NULL;
                result = append_unix_username(validation_level,
                                              validation,
                                              name_domain,
                                              name_user,
                                              mem_ctx,
                                              &unix_username);
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("Failed to append Unix Username: %s\n",
                                nt_errstr(result)));
                        goto out;
                }
                fstrcpy(resp->data.auth.unix_username, unix_username);
                TALLOC_FREE(unix_username);
        }

        /* currently, anything from here on potentially overwrites extra_data. */

        if (request_flags & WBFLAG_PAM_INFO3_NDR) {
                result = append_info3_as_ndr(mem_ctx, resp, info3);
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
                                nt_errstr(result)));
                        goto out;
                }
        }

        if (request_flags & WBFLAG_PAM_INFO3_TEXT) {
                result = append_info3_as_txt(mem_ctx, resp,
                                             validation_level,
                                             validation);
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
                                nt_errstr(result)));
                        goto out;
                }
        }

        if (request_flags & WBFLAG_PAM_AFS_TOKEN) {
                DATA_BLOB blob = data_blob_null;
                result = append_afs_token(validation_level,
                                          validation,
                                          name_domain,
                                          name_user,
                                          mem_ctx,
                                          &blob);
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("Failed to append AFS token: %s\n",
                                nt_errstr(result)));
                        goto out;
                }
                resp->extra_data.data = blob.data;
                resp->length += blob.length;
        }

        result = NT_STATUS_OK;
out:
        TALLOC_FREE(info3);
        return result;
}

static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
                                              bool krb5_auth,
                                              const char *user,
                                              const char *pass,
                                              const char *krb5_cc_type,
                                              uid_t uid,
                                              TALLOC_CTX *mem_ctx,
                                              uint16_t *_validation_level,
                                              union netr_Validation **_validation,
                                              const char **_krb5ccname)
{
        TALLOC_CTX *tmp_ctx = NULL;
        NTSTATUS result = NT_STATUS_LOGON_FAILURE;
        uint16_t max_allowed_bad_attempts;
        char *name_namespace = NULL;
        char *name_domain = NULL;
        char *name_user = NULL;
        struct dom_sid sid;
        enum lsa_SidType type;
        uchar new_nt_pass[NT_HASH_LEN];
        const uint8_t *cached_nt_pass;
        const uint8_t *cached_salt;
        struct netr_SamInfo3 *my_info3;
        time_t kickoff_time, must_change_time;
        bool password_good = false;
        bool ok;
#ifdef HAVE_KRB5
        struct winbindd_tdc_domain *tdc_domain = NULL;
#endif

        if (_validation == NULL) {
                return NT_STATUS_INVALID_PARAMETER;
        }
        *_validation = NULL;

        if (_krb5ccname != NULL) {
                *_krb5ccname = NULL;
        }

        DEBUG(10,("winbindd_dual_pam_auth_cached\n"));

        tmp_ctx = talloc_new(mem_ctx);
        if (tmp_ctx == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        /* Parse domain and username */

        ok = parse_domain_user(tmp_ctx,
                        user,
                        &name_namespace,
                        &name_domain,
                        &name_user);
        if (!ok) {
                DBG_DEBUG("parse_domain_user failed\n");
                result = NT_STATUS_NO_SUCH_USER;
                goto out;
        }

        if (!lookup_cached_name(name_namespace,
                                name_domain,
                                name_user,
                                &sid,
                                &type)) {
                DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
                result = NT_STATUS_NO_SUCH_USER;
                goto out;
        }

        if (type != SID_NAME_USER) {
                DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
                result = NT_STATUS_LOGON_FAILURE;
                goto out;
        }

        result = winbindd_get_creds(domain,
                                    tmp_ctx,
                                    &sid,
                                    &my_info3,
                                    &cached_nt_pass,
                                    &cached_salt);
        if (!NT_STATUS_IS_OK(result)) {
                DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
                goto out;
        }

        E_md4hash(pass, new_nt_pass);

        dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
        dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
        if (cached_salt) {
                dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
        }

        if (cached_salt) {
                /* In this case we didn't store the nt_hash itself,
                   but the MD5 combination of salt + nt_hash. */
                uchar salted_hash[NT_HASH_LEN];
                gnutls_hash_hd_t hash_hnd = NULL;
                int rc;

                rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
                if (rc < 0) {
                        result = gnutls_error_to_ntstatus(
                                        rc, NT_STATUS_HASH_NOT_SUPPORTED);
                        goto out;
                }

                rc = gnutls_hash(hash_hnd, cached_salt, 16);
                if (rc < 0) {
                        gnutls_hash_deinit(hash_hnd, NULL);
                        result = gnutls_error_to_ntstatus(
                                        rc, NT_STATUS_HASH_NOT_SUPPORTED);
                        goto out;
                }
                rc = gnutls_hash(hash_hnd, new_nt_pass, 16);
                if (rc < 0) {
                        gnutls_hash_deinit(hash_hnd, NULL);
                        result = gnutls_error_to_ntstatus(
                                        rc, NT_STATUS_HASH_NOT_SUPPORTED);
                        goto out;
                }
                gnutls_hash_deinit(hash_hnd, salted_hash);

                password_good = mem_equal_const_time(cached_nt_pass, salted_hash,
                                                     NT_HASH_LEN);
        } else {
                /* Old cached cred - direct store of nt_hash (bad bad bad !). */
                password_good = mem_equal_const_time(cached_nt_pass, new_nt_pass,
                                                     NT_HASH_LEN);
        }

        if (password_good) {

                /* User *DOES* know the password, update logon_time and reset
                 * bad_pw_count */

                my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;

                if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
                        result = NT_STATUS_ACCOUNT_LOCKED_OUT;
                        goto out;
                }

                if (my_info3->base.acct_flags & ACB_DISABLED) {
                        result = NT_STATUS_ACCOUNT_DISABLED;
                        goto out;
                }

                if (my_info3->base.acct_flags & ACB_WSTRUST) {
                        result = NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
                        goto out;
                }

                if (my_info3->base.acct_flags & ACB_SVRTRUST) {
                        result = NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
                        goto out;
                }

                if (my_info3->base.acct_flags & ACB_DOMTRUST) {
                        result = NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
                        goto out;
                }

                if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
                        DEBUG(0,("winbindd_dual_pam_auth_cached: what's wrong with that one?: 0x%08x\n",
                                my_info3->base.acct_flags));
                        result = NT_STATUS_LOGON_FAILURE;
                        goto out;
                }

                kickoff_time = nt_time_to_unix(my_info3->base.kickoff_time);
                if (kickoff_time != 0 && time(NULL) > kickoff_time) {
                        result = NT_STATUS_ACCOUNT_EXPIRED;
                        goto out;
                }

                must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
                if (must_change_time != 0 && must_change_time < time(NULL)) {
                        /* we allow grace logons when the password has expired */
                        my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
                        /* return NT_STATUS_PASSWORD_EXPIRED; */
                        goto success;
                }

#ifdef HAVE_KRB5
                if ((krb5_auth) &&
                    ((tdc_domain = wcache_tdc_fetch_domain(tmp_ctx, name_domain)) != NULL) &&
                    ((tdc_domain->trust_type & LSA_TRUST_TYPE_UPLEVEL) ||
                    /* used to cope with the case winbindd starting without network. */
                    !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
                        const char *cc = NULL;
                        char *realm = NULL;
                        const char *principal_s = NULL;
                        const char *user_ccache_file;

                        if (domain->alt_name == NULL) {
                                result = NT_STATUS_INVALID_PARAMETER;
                                goto out;
                        }

                        if (uid == -1) {
                                DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
                                result = NT_STATUS_INVALID_PARAMETER;
                                goto out;
                        }

                        cc = generate_krb5_ccache(tmp_ctx,
                                                  krb5_cc_type,
                                                  uid,
                                                  &user_ccache_file);
                        if (cc == NULL) {
                                result = NT_STATUS_NO_MEMORY;
                                goto out;
                        }

                        realm = talloc_strdup(tmp_ctx, domain->alt_name);
                        if (realm == NULL) {
                                result = NT_STATUS_NO_MEMORY;
                                goto out;
                        }

                        if (!strupper_m(realm)) {
                                result = NT_STATUS_INVALID_PARAMETER;
                                goto out;
                        }

                        principal_s = talloc_asprintf(tmp_ctx, "%s@%s", name_user, realm);
                        if (principal_s == NULL) {
                                result = NT_STATUS_NO_MEMORY;
                                goto out;
                        }

                        if (user_ccache_file != NULL) {

                                if (_krb5ccname != NULL) {
                                        *_krb5ccname = talloc_move(mem_ctx,
                                                        &user_ccache_file);
                                }

                                result = add_ccache_to_list(principal_s,
                                                            cc,
                                                            user,
                                                            pass,
                                                            realm,
                                                            uid,
                                                            time(NULL),
                                                            time(NULL) + lp_winbind_cache_time(),
                                                            time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
                                                            true,
                                                            principal_s,
                                                            realm);

                                if (!NT_STATUS_IS_OK(result)) {
                                        DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
                                                "to add ccache to list: %s\n",
                                                nt_errstr(result)));
                                }
                        }
                }
#endif /* HAVE_KRB5 */
 success:
                /* FIXME: we possibly should handle logon hours as well (does xp when
                 * offline?) see auth/auth_sam.c:sam_account_ok for details */

                unix_to_nt_time(&my_info3->base.logon_time, time(NULL));
                my_info3->base.bad_password_count = 0;

                result = winbindd_update_creds_by_info3(domain,
                                                        user,
                                                        pass,
                                                        my_info3);
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
                                nt_errstr(result)));
                        goto out;
                }

                result = map_info3_to_validation(mem_ctx,
                                                 my_info3,
                                                 _validation_level,
                                                 _validation);
                if (!NT_STATUS_IS_OK(result)) {
                        DBG_ERR("map_info3_to_validation failed: %s\n",
                                nt_errstr(result));
                        goto out;
                }

                result = NT_STATUS_OK;
                goto out;
        }

        /* User does *NOT* know the correct password, modify info3 accordingly, but only if online */
        if (domain->online == false) {
                goto failed;
        }

        /* failure of this is not critical */
        result = get_max_bad_attempts_from_lockout_policy(domain, tmp_ctx, &max_allowed_bad_attempts);
        if (!NT_STATUS_IS_OK(result)) {
                DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
                          "Won't be able to honour account lockout policies\n"));
        }

        /* increase counter */
        my_info3->base.bad_password_count++;

        if (max_allowed_bad_attempts == 0) {
                goto failed;
        }

        /* lockout user */
        if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {

                uint32_t password_properties;

                result = get_pwd_properties(domain, tmp_ctx, &password_properties);
                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
                }

                if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
                    (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
                        my_info3->base.acct_flags |= ACB_AUTOLOCK;
                }
        }

failed:
        result = winbindd_update_creds_by_info3(domain, user, NULL, my_info3);
        if (!NT_STATUS_IS_OK(result)) {
                DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
                        nt_errstr(result)));
        }

        result = NT_STATUS_LOGON_FAILURE;

out:
        TALLOC_FREE(tmp_ctx);

        return result;
}

static NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
                                                const char *user,
                                                const char *pass,
                                                const char *krb5_cc_type,
                                                uid_t uid,
                                                TALLOC_CTX *mem_ctx,
                                                uint16_t *_validation_level,
                                                union netr_Validation **_validation,
                                                const char **_krb5ccname)
{
        struct netr_SamInfo6 *info6 = NULL;
        struct winbindd_domain *contact_domain;
        char *name_namespace = NULL;
        char *name_domain = NULL;
        char *name_user = NULL;
        NTSTATUS result;
        bool ok;

        DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));

        /* Parse domain and username */

        ok = parse_domain_user(mem_ctx,
                               user,
                               &name_namespace,
                               &name_domain,
                               &name_user);
        if (!ok) {
                result = NT_STATUS_INVALID_PARAMETER;
                goto done;
        }

        /* what domain should we contact? */

        if (lp_winbind_use_krb5_enterprise_principals()) {
                contact_domain = find_auth_domain(0, name_namespace);
        } else {
                contact_domain = find_domain_from_name(name_namespace);
        }
        if (contact_domain == NULL) {
                DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
                          user, name_domain, name_user, name_namespace));
                result = NT_STATUS_NO_SUCH_USER;
                goto done;
        }

        if (contact_domain->initialized &&
            contact_domain->active_directory) {
                goto try_login;
        }

        if (!contact_domain->initialized) {
                init_dc_connection(contact_domain, false);
        }

        if (!contact_domain->active_directory) {
                DEBUG(3,("krb5 auth requested but domain (%s) is not Active Directory\n",
                      contact_domain->name));
                return NT_STATUS_INVALID_LOGON_TYPE;
        }
try_login:
        result = winbindd_raw_kerberos_login(
                mem_ctx,
                contact_domain,
                user,
                pass,
                krb5_cc_type,
                uid,
                &info6,
                _krb5ccname);
        if (!NT_STATUS_IS_OK(result)) {
                goto done;
        }

        result = map_info6_to_validation(mem_ctx,
                                         info6,
                                         _validation_level,
                                         _validation);
        TALLOC_FREE(info6);
        if (!NT_STATUS_IS_OK(result)) {
                DBG_ERR("map_info6_to_validation failed: %s\n",
                        nt_errstr(result));
        }

done:
        return result;
}

static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
                                          uint32_t logon_parameters,
                                          const char *domain,
                                          const char *user,
                                          const uint64_t logon_id,
                                          const char *client_name,
                                          const int client_pid,
                                          const DATA_BLOB *challenge,
                                          const DATA_BLOB *lm_resp,
                                          const DATA_BLOB *nt_resp,
                                          const struct tsocket_address *remote,
                                          const struct tsocket_address *local,
                                          bool interactive,
                                          uint8_t *pauthoritative,
                                          struct netr_SamInfo3 **pinfo3)
{
        struct auth_context *auth_context;
        struct auth_serversupplied_info *server_info;
        struct auth_usersupplied_info *user_info = NULL;
        struct netr_SamInfo3 *info3;
        NTSTATUS status;
        bool ok;
        TALLOC_CTX *frame = talloc_stackframe();

        /*
         * We are authoritative by default
         */
        *pauthoritative = 1;

        status = make_user_info(frame, &user_info, user, user, domain, domain,
                                lp_netbios_name(), remote, local,
                                "winbind",
                                lm_resp, nt_resp, NULL, NULL,
                                NULL, AUTH_PASSWORD_RESPONSE);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
                TALLOC_FREE(frame);
                return status;
        }

        user_info->logon_parameters = logon_parameters;
        user_info->logon_id = logon_id;
        user_info->auth_description = talloc_asprintf(
                frame, "PASSDB, %s, %d", client_name, client_pid);
        if (user_info->auth_description == NULL) {
                TALLOC_FREE(frame);
                return NT_STATUS_NO_MEMORY;
        }

        /* We don't want to come back to winbindd or to do PAM account checks */
        user_info->flags |= USER_INFO_INFO3_AND_NO_AUTHZ;

        if (interactive) {
                user_info->flags |= USER_INFO_INTERACTIVE_LOGON;
        }

        status = make_auth3_context_for_winbind(frame, &auth_context);
        if (!NT_STATUS_IS_OK(status)) {
                DBG_ERR("make_auth3_context_for_winbind failed: %s\n",
                        nt_errstr(status));
                TALLOC_FREE(frame);
                return status;
        }

        ok = auth3_context_set_challenge(auth_context,
                                         challenge->data, "fixed");
        if (!ok) {
                TALLOC_FREE(frame);
                return NT_STATUS_NO_MEMORY;
        }

        status = auth_check_ntlm_password(mem_ctx,
                                          auth_context,
                                          user_info,
                                          &server_info,
                                          pauthoritative);
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(frame);
                return status;
        }

        info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
        if (info3 == NULL) {
                TALLOC_FREE(frame);
                return NT_STATUS_NO_MEMORY;
        }

        status = serverinfo_to_SamInfo3(server_info, info3);
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(frame);
                TALLOC_FREE(info3);
                DEBUG(0, ("serverinfo_to_SamInfo3 failed: %s\n",
                          nt_errstr(status)));
                return status;
        }

        *pinfo3 = info3;
        DBG_DEBUG("Authenticating user %s\\%s returned %s\n",
                  domain,
                  user,
                  nt_errstr(status));
        TALLOC_FREE(frame);
        return status;
}

static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
                                            TALLOC_CTX *mem_ctx,
                                            uint32_t logon_parameters,
                                            const char *username,
                                            const char *password,
                                            const char *domainname,
                                            const char *workstation,
                                            const uint64_t logon_id,
                                            bool plaintext_given,
                                            DATA_BLOB chal,
                                            DATA_BLOB lm_response,
                                            DATA_BLOB nt_response,
                                            bool interactive,
                                            uint8_t *authoritative,
                                            uint32_t *flags,
                                            uint16_t *_validation_level,
                                            union netr_Validation **_validation)
{
        int attempts = 0;
        int netr_attempts = 0;
        bool retry = false;
        bool valid_result = false;
        NTSTATUS result;
        enum netr_LogonInfoClass logon_type_i;
        enum netr_LogonInfoClass logon_type_n;
        uint16_t validation_level = UINT16_MAX;
        union netr_Validation *validation = NULL;
        TALLOC_CTX *base_ctx = NULL;
        struct netr_SamBaseInfo *base_info = NULL;

        do {
                struct rpc_pipe_client *netlogon_pipe;
                struct netlogon_creds_cli_context *netlogon_creds_ctx = NULL;

                /*
                 * We should always reset authoritative to 1
                 * before calling a server again.
                 *
                 * Otherwise we could treat a local problem as
                 * non-authoritative.
                 */
                *authoritative = 1;

                retry = false;

                D_DEBUG("Creating a DCERPC netlogon connection for SAM logon. "
                        "netlogon attempt: %d, samlogon attempt: %d.\n",
                        netr_attempts,
                        attempts);
                result = cm_connect_netlogon_secure(domain, &netlogon_pipe,
                                                    &netlogon_creds_ctx);

                if (NT_STATUS_EQUAL(result,
                                    NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
                        /*
                         * This means we don't have a trust account.
                         */
                        *authoritative = 0;
                        result = NT_STATUS_NO_SUCH_USER;
                        break;
                }

                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(3,("Could not open handle to NETLOGON pipe "
                                 "(error: %s, attempts: %d)\n",
                                  nt_errstr(result), netr_attempts));

                        reset_cm_connection_on_error(domain, NULL, result);

                        /* After the first retry always close the connection */
                        if (netr_attempts > 0) {
                                DEBUG(3, ("This is again a problem for this "
                                          "particular call, forcing the close "
                                          "of this connection\n"));
                                invalidate_cm_connection(domain);
                        }

                        /* After the second retry failover to the next DC */
                        if (netr_attempts > 1) {
                                /*
                                 * If the netlogon server is not reachable then
                                 * it is possible that the DC is rebuilding
                                 * sysvol and shutdown netlogon for that time.
                                 * We should failover to the next dc.
                                 */
                                DEBUG(3, ("This is the third problem for this "
                                          "particular call, adding DC to the "
                                          "negative cache list: %s %s\n", domain->name, domain->dcname));
                                add_failed_connection_entry(domain->name,
                                                            domain->dcname,
                                                            result);
                                saf_delete(domain->name);
                        }

                        /* Only allow 3 retries */
                        if (netr_attempts < 3) {
                                DEBUG(3, ("The connection to netlogon "
                                          "failed, retrying\n"));
                                netr_attempts++;
                                retry = true;
                                continue;
                        }
                        return result;
                }

                logon_type_i = NetlogonInteractiveInformation;
                logon_type_n = NetlogonNetworkInformation;
                if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_WITHIN_FOREST) {
                        logon_type_i = NetlogonInteractiveTransitiveInformation;
                        logon_type_n = NetlogonNetworkTransitiveInformation;
                }

                if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE) {
                        logon_type_i = NetlogonInteractiveTransitiveInformation;
                        logon_type_n = NetlogonNetworkTransitiveInformation;
                }

                if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE) {
                        logon_type_i = NetlogonInteractiveInformation;
                        logon_type_n = NetlogonNetworkInformation;
                }

                if (domain->domain_trust_attribs & LSA_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) {
                        logon_type_i = NetlogonInteractiveInformation;
                        logon_type_n = NetlogonNetworkInformation;
                }

                netr_attempts = 0;
                if (plaintext_given) {
                        result = rpccli_netlogon_password_logon(
                                netlogon_creds_ctx,
                                netlogon_pipe->binding_handle,
                                mem_ctx,
                                logon_parameters,
                                domainname,
                                username,
                                password,
                                workstation,
                                logon_id,
                                logon_type_i,
                                authoritative,
                                flags,
                                &validation_level,
                                &validation);
                } else if (interactive) {
                        result = rpccli_netlogon_interactive_logon(
                                netlogon_creds_ctx,
                                netlogon_pipe->binding_handle,
                                mem_ctx,
                                logon_parameters,
                                username,
                                domainname,
                                workstation,
                                logon_id,
                                lm_response,
                                nt_response,
                                logon_type_i,
                                authoritative,
                                flags,
                                &validation_level,
                                &validation);
                } else {
                        result = rpccli_netlogon_network_logon(
                                netlogon_creds_ctx,
                                netlogon_pipe->binding_handle,
                                mem_ctx,
                                logon_parameters,
                                username,
                                domainname,
                                workstation,
                                logon_id,
                                chal,
                                lm_response,
                                nt_response,
                                logon_type_n,
                                authoritative,
                                flags,
                                &validation_level,
                                &validation);
                }

                /*
                 * we increment this after the "feature negotiation"
                 * for can_do_samlogon_ex and can_do_validation6
                 */
                attempts += 1;

                /* We have to try a second time as cm_connect_netlogon
                   might not yet have noticed that the DC has killed
                   our connection. */

                retry = reset_cm_connection_on_error(domain,
                                                     netlogon_pipe->binding_handle,
                                                     result);
                if (retry) {
                        DBG_PREFIX(attempts > 1 ? DBGLVL_NOTICE : DBGLVL_INFO, (
                                   "This is problem %d for this "
                                   "particular call,"
                                   "DOMAIN[%s] DC[%s] - %s\n",
                                   attempts,
                                   domain->name,
                                   domain->dcname,
                                   nt_errstr(result)));
                        continue;
                }

                valid_result = true;

                if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
                        /*
                         * Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
                         * (no Ex). This happens against old Samba
                         * DCs, if LogonSamLogonEx() fails with an error
                         * e.g. NT_STATUS_NO_SUCH_USER or NT_STATUS_WRONG_PASSWORD.
                         *
                         * The server will log something like this:
                         * api_net_sam_logon_ex: Failed to marshall NET_R_SAM_LOGON_EX.
                         *
                         * This sets the whole connection into a fault_state mode
                         * and all following request get NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE.
                         *
                         * This also happens to our retry with LogonSamLogonWithFlags()
                         * and LogonSamLogon().
                         *
                         * In order to recover from this situation, we need to
                         * drop the connection.
                         */
                        invalidate_cm_connection(domain);
                        result = NT_STATUS_LOGON_FAILURE;
                        break;
                }

        } while ( (attempts < 3) && retry );

        if (!valid_result) {
                /*
                 * This matches what windows does. In a chain of transitive
                 * trusts the ACCESS_DENIED/authoritative=0 is not propagated
                 * instead of NT_STATUS_NO_LOGON_SERVERS/authoritative=1 is
                 * passed along the chain if there's no other DC is available.
                 */
                DBG_WARNING("Mapping %s/authoritative=%u to "
                            "NT_STATUS_NO_LOGON_SERVERS/authoritative=1 for"
                            "USERNAME[%s] USERDOMAIN[%s] REMOTE-DOMAIN[%s] \n",
                            nt_errstr(result),
                            *authoritative,
                            username,
                            domainname,
                            domain->name);
                *authoritative = 1;
                return NT_STATUS_NO_LOGON_SERVERS;
        }

        if (!NT_STATUS_IS_OK(result)) {
                return result;
        }

        switch (validation_level) {
        case 3:
                base_ctx = validation->sam3;
                base_info = &validation->sam3->base;
                break;
        case 6:
                base_ctx = validation->sam6;
                base_info = &validation->sam6->base;
                break;
        default:
                smb_panic(__location__);
        }

        if (base_info->acct_flags == 0 || base_info->account_name.string == NULL) {
                struct dom_sid user_sid;
                struct dom_sid_buf sid_buf;
                const char *acct_flags_src = "server";
                const char *acct_name_src = "server";

                /*
                 * Handle the case where a NT4 DC does not fill in the acct_flags in
                 * the samlogon reply info3. Yes, in 2021, there are still admins
                 * around with real NT4 DCs.
                 *
                 * We used to call dcerpc_samr_QueryUserInfo(level=16) to fetch
                 * acct_flags, but as NT4 DCs reject authentication with workstation
                 * accounts with NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT, even if
                 * MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT is specified, we only ever got
                 * ACB_NORMAL back (maybe with ACB_PWNOEXP in addition).
                 *
                 * For network logons NT4 DCs also skip the
                 * account_name, so we have to fallback to the
                 * one given by the client.
                 */

                if (base_info->acct_flags == 0) {
                        base_info->acct_flags = ACB_NORMAL;
                        if (base_info->force_password_change == NTTIME_MAX) {
                                base_info->acct_flags |= ACB_PWNOEXP;
                        }
                        acct_flags_src = "calculated";
                }

                if (base_info->account_name.string == NULL) {
                        base_info->account_name.string = talloc_strdup(base_ctx,
                                                                       username);
                        if (base_info->account_name.string == NULL) {
                                TALLOC_FREE(validation);
                                return NT_STATUS_NO_MEMORY;
                        }
                        acct_name_src = "client";
                }

                sid_compose(&user_sid, base_info->domain_sid, base_info->rid);

                DBG_DEBUG("Fallback to %s_acct_flags[0x%x] %s_acct_name[%s] for %s\n",
                          acct_flags_src,
                          base_info->acct_flags,
                          acct_name_src,
                          base_info->account_name.string,
                          dom_sid_str_buf(&user_sid, &sid_buf));
        }

        *_validation_level = validation_level;
        *_validation = validation;
        return NT_STATUS_OK;
}

static NTSTATUS nt_dual_auth_passdb(TALLOC_CTX *mem_ctx,
                                    fstring name_user,
                                    fstring name_domain,
                                    const char *pass,
                                    uint64_t logon_id,
                                    const char *client_name,
                                    const int client_pid,
                                    const struct tsocket_address *remote,
                                    const struct tsocket_address *local,
                                    uint8_t *authoritative,
                                    struct netr_SamInfo3 **info3)
{
        unsigned char local_nt_response[24];
        uchar chal[8];
        DATA_BLOB chal_blob;
        DATA_BLOB lm_resp;
        DATA_BLOB nt_resp;

        /* do password magic */

        generate_random_buffer(chal, sizeof(chal));
        chal_blob = data_blob_const(chal, sizeof(chal));

        if (lp_client_ntlmv2_auth()) {
                DATA_BLOB server_chal;
                DATA_BLOB names_blob;
                server_chal = data_blob_const(chal, 8);

                /* note that the 'workgroup' here is for the local
                   machine.  The 'server name' must match the
                   'workstation' passed to the actual SamLogon call.
                */
                names_blob = NTLMv2_generate_names_blob(mem_ctx,
                                                        lp_netbios_name(),
                                                        lp_workgroup());

                if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain,
                                      pass, &server_chal, &names_blob,
                                      &lm_resp, &nt_resp, NULL, NULL)) {
                        data_blob_free(&names_blob);
                        DEBUG(0, ("SMBNTLMv2encrypt() failed!\n"));
                        return NT_STATUS_NO_MEMORY;
                }
                data_blob_free(&names_blob);
        } else {
                int rc;
                lm_resp = data_blob_null;

                rc = SMBNTencrypt(pass, chal, local_nt_response);
                if (rc != 0) {
                        DEBUG(0, ("SMBNTencrypt() failed!\n"));
                        return gnutls_error_to_ntstatus(rc,
                                    NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
                }

                nt_resp = data_blob_talloc(mem_ctx, local_nt_response,
                                           sizeof(local_nt_response));
        }

        return winbindd_dual_auth_passdb(talloc_tos(), 0, name_domain,
                                         name_user, logon_id, client_name,
                                         client_pid, &chal_blob, &lm_resp,
                                         &nt_resp, remote, local,
                                         true, /* interactive */
                                         authoritative, info3);
}

static NTSTATUS winbindd_dual_pam_auth_samlogon(
        TALLOC_CTX *mem_ctx,
        struct winbindd_domain *domain,
        const char *user,
        const char *pass,
        uint64_t logon_id,
        const char *client_name,
        const int client_pid,
        uint32_t request_flags,
        const struct tsocket_address *remote,
        const struct tsocket_address *local,
        uint16_t *_validation_level,
        union netr_Validation **_validation)
{
        char *name_namespace = NULL;
        char *name_domain = NULL;
        char *name_user = NULL;
        NTSTATUS result;
        uint8_t authoritative = 1;
        uint32_t flags = 0;
        uint16_t validation_level = 0;
        union netr_Validation *validation = NULL;
        bool ok;

        DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));

        /* Parse domain and username */

        ok = parse_domain_user(mem_ctx,
                        user,
                        &name_namespace,
                        &name_domain,
                        &name_user);
        if (!ok) {
                return NT_STATUS_INVALID_PARAMETER;
        }

        /*
         * We check against domain->name instead of
         * name_domain, as find_auth_domain() ->
         * find_domain_from_name_noinit() already decided
         * that we are in a child for the correct domain.
         *
         * name_domain can also be lp_realm()
         * we need to check against domain->name.
         */
        if (strequal(domain->name, get_global_sam_name())) {
                struct netr_SamInfo3 *info3 = NULL;

                result = nt_dual_auth_passdb(mem_ctx, name_user, name_domain,
                                             pass, logon_id, client_name,
                                             client_pid, remote, local,
                                             &authoritative, &info3);

                /*
                 * We need to try the remote NETLOGON server if this is
                 * not authoritative (for example on the RODC).
                 */
                if (authoritative != 0) {
                        if (!NT_STATUS_IS_OK(result)) {
                                return result;
                        }
                        result = map_info3_to_validation(mem_ctx,
                                                         info3,
                                                         &validation_level,
                                                         &validation);
                        TALLOC_FREE(info3);
                        if (!NT_STATUS_IS_OK(result)) {
                                return result;
                        }

                        goto done;
                }
        }

        /* check authentication loop */

        result = winbind_samlogon_retry_loop(domain,
                                             mem_ctx,
                                             0,
                                             name_user,
                                             pass,
                                             name_domain,
                                             lp_netbios_name(),
                                             logon_id,
                                             true, /* plaintext_given */
                                             data_blob_null,
                                             data_blob_null, data_blob_null,
                                             true, /* interactive */
                                             &authoritative,
                                             &flags,
                                             &validation_level,
                                             &validation);
        if (!NT_STATUS_IS_OK(result)) {
                return result;
        }

done:
        *_validation_level = validation_level;
        *_validation = validation;

        return NT_STATUS_OK;
}

/*
 * @brief generate an authentication message in the logs.
 *
 */
static void log_authentication(
        TALLOC_CTX *mem_ctx,
        const struct winbindd_domain *domain,
        const char *client_name,
        pid_t client_pid,
        uint16_t validation_level,
        union netr_Validation *validation,
        const struct timeval start_time,
        const uint64_t logon_id,
        const char *command,
        const char *user_name,
        const char *domain_name,
        const char *workstation,
        const DATA_BLOB lm_resp,
        const DATA_BLOB nt_resp,
        const struct tsocket_address *remote,
        const struct tsocket_address *local,
        NTSTATUS result)
{
        struct auth_usersupplied_info *ui = NULL;
        struct dom_sid *sid = NULL;
        struct loadparm_context *lp_ctx = NULL;
        struct imessaging_context *msg_ctx = NULL;
        struct netr_SamBaseInfo *base_info = NULL;

        if (validation != NULL) {
                switch (validation_level) {
                case 3:
                        base_info = &validation->sam3->base;
                        break;
                case 6:
                        base_info = &validation->sam6->base;
                        break;
                default:
                        DBG_WARNING("Unexpected validation level '%d'\n",
                                    validation_level);
                        break;
                }
        }

        ui = talloc_zero(mem_ctx, struct auth_usersupplied_info);
        ui->logon_id = logon_id;
        ui->service_description = "winbind";
        ui->password.response.nt.length = nt_resp.length;
        ui->password.response.nt.data = nt_resp.data;
        ui->password.response.lanman.length = lm_resp.length;
        ui->password.response.lanman.data = lm_resp.data;
        if (nt_resp.length == 0 && lm_resp.length == 0) {
                ui->password_state = AUTH_PASSWORD_PLAIN;
        } else {
                ui->password_state = AUTH_PASSWORD_RESPONSE;
        }
        /*
         * In the event of a failure ui->auth_description will be null,
         * the logging code handles this correctly so it can be ignored.
         */
        ui->auth_description = talloc_asprintf(
                ui,
                "%s, %s, %d",
                command,
                client_name,
                client_pid);
        if (ui->auth_description == NULL) {
                DBG_ERR("OOM Unable to create auth_description\n");
        }
        ui->client.account_name = user_name;
        ui->client.domain_name = domain_name;
        ui->workstation_name = workstation;
        ui->remote_host = remote;
        ui->local_host = local;

        if (base_info != NULL) {
                sid = dom_sid_dup(ui, base_info->domain_sid);
                if (sid != NULL) {
                        sid_append_rid(sid, base_info->rid);
                }
        }

        if (lp_auth_event_notification()) {
                lp_ctx = loadparm_init_s3(ui, loadparm_s3_helpers());
                msg_ctx = imessaging_client_init(
                    ui, lp_ctx, global_event_context());
        }
        log_authentication_event(
            msg_ctx,
            lp_ctx,
            &start_time,
            ui,
            result,
            base_info != NULL ? base_info->logon_domain.string : "",
            base_info != NULL ? base_info->account_name.string : "",
            sid,
            NULL /* client_audit_info */,
            NULL /* server_audit_info */);
        TALLOC_FREE(ui);
}

NTSTATUS _wbint_PamAuth(struct pipes_struct *p,
                        struct wbint_PamAuth *r)
{
        struct winbindd_domain *domain = wb_child_domain();
        NTSTATUS result = NT_STATUS_LOGON_FAILURE;
        NTSTATUS krb5_result = NT_STATUS_OK;
        char *name_namespace = NULL;
        char *name_domain = NULL;
        char *name_user = NULL;
        char *mapped_user = NULL;
        const char *domain_user = NULL;
        uint16_t validation_level = UINT16_MAX;
        union netr_Validation *validation = NULL;
        struct netr_SamBaseInfo *base_info = NULL;
        NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
        bool ok;
        uint64_t logon_id = 0;
        const struct timeval start_time = timeval_current();
        const struct tsocket_address *remote = NULL;
        const struct tsocket_address *local = NULL;
        const char *krb5ccname = NULL;
        uid_t uid;
        pid_t client_pid;

        if (domain == NULL) {
                return NT_STATUS_REQUEST_NOT_ACCEPTED;
        }

        /* Cut client_pid to 32bit */
        client_pid = r->in.client_pid;
        if ((uint64_t)client_pid != r->in.client_pid) {
                DBG_DEBUG("pid out of range\n");
                return NT_STATUS_INVALID_PARAMETER;
        }

        /* Cut uid to 32bit */
        uid = r->in.info->uid;
        if ((uint64_t)uid != r->in.info->uid) {
                DBG_DEBUG("uid out of range\n");
                return NT_STATUS_INVALID_PARAMETER;
        }

        /*
         * Generate a logon_id for this session.
         */
        logon_id = generate_random_u64();
        remote = dcesrv_connection_get_remote_address(p->dce_call->conn);
        local = dcesrv_connection_get_local_address(p->dce_call->conn);
        DEBUG(3, ("[%"PRIu32"]: dual pam auth %s\n", client_pid,
                  r->in.info->username));

        /* Parse domain and username */

        name_map_status = normalize_name_unmap(p->mem_ctx,
                                               r->in.info->username,
                                               &mapped_user);

        /* If the name normalization didn't actually do anything,
           just use the original name */

        if (!NT_STATUS_IS_OK(name_map_status) &&
            !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
        {
                mapped_user = discard_const(r->in.info->username);
        }

        ok = parse_domain_user(p->mem_ctx,
                               mapped_user,
                               &name_namespace,
                               &name_domain,
                               &name_user);
        if (!ok) {
                result = NT_STATUS_INVALID_PARAMETER;
                goto done;
        }

        if (mapped_user != r->in.info->username) {
                domain_user = talloc_asprintf(talloc_tos(),
                                              "%s%c%s",
                                              name_domain,
                                              *lp_winbind_separator(),
                                              name_user);
                if (domain_user == NULL) {
                        result = NT_STATUS_NO_MEMORY;
                        goto done;
                }
                r->in.info->username = domain_user;
        }

        if (!domain->online) {
                result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
                if (domain->startup) {
                        /* Logons are very important to users. If we're offline and
                           we get a request within the first 30 seconds of startup,
                           try very hard to find a DC and go online. */

                        DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
                                "request in startup mode.\n", domain->name ));

                        winbindd_flush_negative_conn_cache(domain);
                        result = init_dc_connection(domain, false);
                }
        }

        DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));

        /* Check for Kerberos authentication */
        if (domain->online && (r->in.flags & WBFLAG_PAM_KRB5)) {
                result = winbindd_dual_pam_auth_kerberos(
                                domain,
                                r->in.info->username,
                                r->in.info->password,
                                r->in.info->krb5_cc_type,
                                uid,
                                p->mem_ctx,
                                &validation_level,
                                &validation,
                                &krb5ccname);

                /* save for later */
                krb5_result = result;

                if (NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
                        goto process_result;
                }

                DBG_DEBUG("winbindd_dual_pam_auth_kerberos failed: %s\n",
                          nt_errstr(result));

                if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
                        DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
                        set_domain_offline( domain );
                        goto cached_logon;
                }

                /* there are quite some NT_STATUS errors where there is no
                 * point in retrying with a samlogon, we explicitly have to take
                 * care not to increase the bad logon counter on the DC */

                if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
                        goto done;
                }

                if (r->in.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
                        DEBUG(3,("falling back to samlogon\n"));
                        goto sam_logon;
                } else {
                        goto cached_logon;
                }
        }

sam_logon:
        /* Check for Samlogon authentication */
        if (domain->online) {
                result = winbindd_dual_pam_auth_samlogon(
                        p->mem_ctx,
                        domain,
                        r->in.info->username,
                        r->in.info->password,
                        logon_id,
                        r->in.client_name,
                        client_pid,
                        r->in.flags,
                        remote,
                        local,
                        &validation_level,
                        &validation);

                if (NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));

                        switch (validation_level) {
                        case 3:
                                base_info = &validation->sam3->base;
                                break;
                        case 6:
                                base_info = &validation->sam6->base;
                                break;
                        default:
                                DBG_ERR("Bad validation level %d\n",
                                        validation_level);
                                result = NT_STATUS_INTERNAL_ERROR;
                                goto done;
                        }

                        /* add the Krb5 err if we have one */
                        if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
                                base_info->user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
                        }

                        goto process_result;
                }

                DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
                          nt_errstr(result)));

                if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
                    NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
                {
                        DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
                        set_domain_offline( domain );
                        goto cached_logon;
                }

                if (domain->online) {
                        /* We're still online - fail. */
                        goto done;
                }
        }

cached_logon:
        /* Check for Cached logons */
        if (!domain->online && (r->in.flags & WBFLAG_PAM_CACHED_LOGIN) &&
            lp_winbind_offline_logon()) {
                result = winbindd_dual_pam_auth_cached(domain,
                                (r->in.flags & WBFLAG_PAM_KRB5),
                                r->in.info->username,
                                r->in.info->password,
                                r->in.info->krb5_cc_type,
                                uid,
                                p->mem_ctx,
                                &validation_level,
                                &validation,
                                &krb5ccname);

                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
                        goto done;
                }
                DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
        }

process_result:

        if (NT_STATUS_IS_OK(result)) {
                struct dom_sid user_sid;
                TALLOC_CTX *base_ctx = NULL;
                struct netr_SamInfo3 *info3 = NULL;

                switch (validation_level) {
                case 3:
                        base_ctx = validation->sam3;
                        base_info = &validation->sam3->base;
                        break;
                case 6:
                        base_ctx = validation->sam6;
                        base_info = &validation->sam6->base;
                        break;
                default:
                        DBG_ERR("Bad validation level %d\n", validation_level);
                        result = NT_STATUS_INTERNAL_ERROR;
                        goto done;
                }

                sid_compose(&user_sid, base_info->domain_sid, base_info->rid);

                if (base_info->full_name.string == NULL) {
                        struct netr_SamInfo3 *cached_info3;

                        cached_info3 = netsamlogon_cache_get(p->mem_ctx,
                                                             &user_sid);
                        if (cached_info3 != NULL &&
                            cached_info3->base.full_name.string != NULL) {
                                base_info->full_name.string = talloc_strdup(
                                        base_ctx,
                                        cached_info3->base.full_name.string);
                                if (base_info->full_name.string == NULL) {
                                        result = NT_STATUS_NO_MEMORY;
                                        goto done;
                                }
                        } else {

                                /* this might fail so we don't check the return code */
                                wcache_query_user_fullname(domain,
                                                base_ctx,
                                                &user_sid,
                                                &base_info->full_name.string);
                        }
                }

                result = map_validation_to_info3(talloc_tos(),
                                                 validation_level,
                                                 validation,
                                                 &info3);
                if (!NT_STATUS_IS_OK(result)) {
                        goto done;
                }

                wcache_invalidate_samlogon(find_domain_from_name(name_domain),
                                           &user_sid);
                netsamlogon_cache_store(name_user, info3);

                /* save name_to_sid info as early as possible (only if
                   this is our primary domain so we don't invalidate
                   the cache entry by storing the seq_num for the wrong
                   domain). */
                if ( domain->primary ) {
                        cache_name2sid(domain, name_domain, name_user,
                                       SID_NAME_USER, &user_sid);
                }

                /* Check if the user is in the right group */

                result = check_info3_in_group(info3,
                                              r->in.require_membership_of_sid);
                if (!NT_STATUS_IS_OK(result)) {
                        char *s = NDR_PRINT_STRUCT_STRING(p->mem_ctx,
                                        wbint_SidArray,
                                        r->in.require_membership_of_sid);
                        DBG_NOTICE("User %s is not in the required groups:\n",
                                   r->in.info->username);
                        DEBUGADD(DBGLVL_NOTICE, ("%s", s));
                        DEBUGADD(DBGLVL_NOTICE,
                                 ("Plaintext authentication is rejected\n"));
                        goto done;
                }

                if (!is_allowed_domain(info3->base.logon_domain.string)) {
                        DBG_NOTICE("Authentication failed for user [%s] "
                                   "from firewalled domain [%s]\n",
                                   info3->base.account_name.string,
                                   info3->base.logon_domain.string);
                        result = NT_STATUS_AUTHENTICATION_FIREWALL_FAILED;
                        goto done;
                }

                r->out.validation = talloc_zero(p->mem_ctx,
                                                struct wbint_Validation);
                if (r->out.validation == NULL) {
                        result = NT_STATUS_NO_MEMORY;
                        goto done;
                }

                r->out.validation->level = validation_level;
                r->out.validation->validation = talloc_steal(r->out.validation,
                                                             validation);
                r->out.validation->krb5ccname = talloc_steal(r->out.validation,
                                                             krb5ccname);
                if ((r->in.flags & WBFLAG_PAM_CACHED_LOGIN)
                    && lp_winbind_offline_logon()) {

                        result = winbindd_store_creds(domain,
                                                      r->in.info->username,
                                                      r->in.info->password,
                                                      info3);
                }

                result = NT_STATUS_OK;
        }

done:
        /* give us a more useful (more correct?) error code */
        if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
            (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
                result = NT_STATUS_NO_LOGON_SERVERS;
        }

        DBG_PREFIX(NT_STATUS_IS_OK(result) ? 5 : 2,
                   ("Plain-text authentication for user %s returned %s"
                   " (PAM: %d)\n",
                   r->in.info->username,
                   nt_errstr(result),
                   nt_status_to_pam(result)));

        /*
         * Log the winbind pam authentication, the logon_id will tie this to
         * any of the logons invoked from this request.
         */

        log_authentication(
            p->mem_ctx,
            domain,
            r->in.client_name,
            client_pid,
            validation_level,
            validation,
            start_time,
            logon_id,
            "PAM_AUTH",
            name_user,
            name_domain,
            NULL,
            data_blob_null,
            data_blob_null,
            remote,
            local,
            result);

        if (NT_STATUS_IS_OK(result)) {
                gpupdate_user_init(r->in.info->username);
        }

        return result;
}

NTSTATUS winbind_dual_SamLogon(struct winbindd_domain *domain,
                               TALLOC_CTX *mem_ctx,
                               bool interactive,
                               uint32_t logon_parameters,
                               const char *name_user,
                               const char *name_domain,
                               const char *workstation,
                               const uint64_t logon_id,
                               const char* client_name,
                               const int client_pid,
                               DATA_BLOB chal_blob,
                               DATA_BLOB lm_response,
                               DATA_BLOB nt_response,
                               const struct tsocket_address *remote,
                               const struct tsocket_address *local,
                               uint8_t *authoritative,
                               bool skip_sam,
                               uint32_t *flags,
                               uint16_t *_validation_level,
                               union netr_Validation **_validation)
{
        uint16_t validation_level = 0;
        union netr_Validation *validation = NULL;
        NTSTATUS result;

        /*
         * We check against domain->name instead of
         * name_domain, as find_auth_domain() ->
         * find_domain_from_name_noinit() already decided
         * that we are in a child for the correct domain.
         *
         * name_domain can also be lp_realm()
         * we need to check against domain->name.
         */
        if (!skip_sam && strequal(domain->name, get_global_sam_name())) {
                struct netr_SamInfo3 *info3 = NULL;

                result = winbindd_dual_auth_passdb(
                        talloc_tos(),
                        logon_parameters,
                        name_domain, name_user,
                        logon_id,
                        client_name,
                        client_pid,
                        &chal_blob, &lm_response, &nt_response,
                        remote,
                        local,
                        interactive,
                        authoritative,
                        &info3);
                if (NT_STATUS_IS_OK(result)) {
                        result = map_info3_to_validation(mem_ctx,
                                                         info3,
                                                         &validation_level,
                                                         &validation);
                        TALLOC_FREE(info3);
                        if (!NT_STATUS_IS_OK(result)) {
                                goto done;
                        }
                }

                /*
                 * We need to try the remote NETLOGON server if this is
                 * not authoritative.
                 */
                if (*authoritative != 0) {
                        *flags = 0;
                        goto process_result;
                }
        }

        result = winbind_samlogon_retry_loop(domain,
                                             mem_ctx,
                                             logon_parameters,
                                             name_user,
                                             NULL, /* password */
                                             name_domain,
                                             /* Bug #3248 - found by Stefan Burkei. */
                                             workstation, /* We carefully set this above so use it... */
                                             logon_id,
                                             false, /* plaintext_given */
                                             chal_blob,
                                             lm_response,
                                             nt_response,
                                             interactive,
                                             authoritative,
                                             flags,
                                             &validation_level,
                                             &validation);
        if (!NT_STATUS_IS_OK(result)) {
                goto done;
        }

process_result:

        if (NT_STATUS_IS_OK(result)) {
                struct dom_sid user_sid;
                TALLOC_CTX *base_ctx = NULL;
                struct netr_SamBaseInfo *base_info = NULL;
                struct netr_SamInfo3 *info3 = NULL;

                switch (validation_level) {
                case 3:
                        base_ctx = validation->sam3;
                        base_info = &validation->sam3->base;
                        break;
                case 6:
                        base_ctx = validation->sam6;
                        base_info = &validation->sam6->base;
                        break;
                default:
                        result = NT_STATUS_INTERNAL_ERROR;
                        goto done;
                }

                sid_compose(&user_sid, base_info->domain_sid, base_info->rid);

                if (base_info->full_name.string == NULL) {
                        struct netr_SamInfo3 *cached_info3;

                        cached_info3 = netsamlogon_cache_get(mem_ctx,
                                                             &user_sid);
                        if (cached_info3 != NULL &&
                            cached_info3->base.full_name.string != NULL)
                        {
                                base_info->full_name.string = talloc_strdup(
                                        base_ctx,
                                        cached_info3->base.full_name.string);
                        } else {

                                /* this might fail so we don't check the return code */
                                wcache_query_user_fullname(domain,
                                                base_ctx,
                                                &user_sid,
                                                &base_info->full_name.string);
                        }
                }

                result = map_validation_to_info3(talloc_tos(),
                                                 validation_level,
                                                 validation,
                                                 &info3);
                if (!NT_STATUS_IS_OK(result)) {
                        goto done;
                }
                wcache_invalidate_samlogon(find_domain_from_name(name_domain),
                                           &user_sid);
                netsamlogon_cache_store(name_user, info3);
                TALLOC_FREE(info3);
        }

done:

        /* give us a more useful (more correct?) error code */
        if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
            (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
                result = NT_STATUS_NO_LOGON_SERVERS;
        }

        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
              ("NTLM CRAP authentication for user [%s]\\[%s] returned %s\n",
               name_domain,
               name_user,
               nt_errstr(result)));

        if (!NT_STATUS_IS_OK(result)) {
                return result;
        }

        *_validation_level = validation_level;
        *_validation = validation;
        return NT_STATUS_OK;
}

NTSTATUS _wbint_PamAuthCrap(struct pipes_struct *p, struct wbint_PamAuthCrap *r)
{
        struct winbindd_domain *domain = wb_child_domain();
        NTSTATUS result;
        uint64_t logon_id = 0;
        uint8_t authoritative = 1;
        uint32_t flags = 0;
        uint16_t validation_level = UINT16_MAX;
        union netr_Validation *validation = NULL;
        const struct timeval start_time = timeval_current();
        const struct tsocket_address *remote = NULL;
        const struct tsocket_address *local = NULL;
        struct netr_SamInfo3 *info3 = NULL;
        pid_t client_pid;

        if (domain == NULL) {
                return NT_STATUS_REQUEST_NOT_ACCEPTED;
        }

        /* Cut client_pid to 32bit */
        client_pid = r->in.client_pid;
        if ((uint64_t)client_pid != r->in.client_pid) {
                DBG_DEBUG("pid out of range\n");
                return NT_STATUS_INVALID_PARAMETER;
        }

        logon_id = generate_random_u64();
        remote = dcesrv_connection_get_remote_address(p->dce_call->conn);
        local = dcesrv_connection_get_local_address(p->dce_call->conn);

        DBG_NOTICE("[%"PRIu32"]: pam auth crap domain: %s user: %s\n",
                   client_pid, r->in.domain, r->in.user);

        result = winbind_dual_SamLogon(domain,
                                       p->mem_ctx,
                                       false, /* interactive */
                                       r->in.logon_parameters,
                                       r->in.user,
                                       r->in.domain,
                                       r->in.workstation,
                                       logon_id,
                                       r->in.client_name,
                                       client_pid,
                                       r->in.chal,
                                       r->in.lm_resp,
                                       r->in.nt_resp,
                                       remote,
                                       local,
                                       &authoritative,
                                       false,
                                       &flags,
                                       &validation_level,
                                       &validation);
        if (!NT_STATUS_IS_OK(result)) {
                goto done;
        }

        result = map_validation_to_info3(p->mem_ctx,
                                         validation_level,
                                         validation,
                                         &info3);
        if (!NT_STATUS_IS_OK(result)) {
                goto done;
        }

        /* Check if the user is in the right group */
        result = check_info3_in_group(info3, r->in.require_membership_of_sid);
        if (!NT_STATUS_IS_OK(result)) {
                char *s = NDR_PRINT_STRUCT_STRING(p->mem_ctx,
                                                  wbint_SidArray,
                                                  r->in.require_membership_of_sid);
                DBG_NOTICE("User %s is not in the required groups:\n",
                           r->in.user);
                DEBUGADD(DBGLVL_NOTICE, ("%s", s));
                DEBUGADD(DBGLVL_NOTICE,
                         ("CRAP authentication is rejected\n"));
                goto done;
        }

        if (!is_allowed_domain(info3->base.logon_domain.string)) {
                DBG_NOTICE("Authentication failed for user [%s] "
                           "from firewalled domain [%s]\n",
                           info3->base.account_name.string,
                           info3->base.logon_domain.string);
                result = NT_STATUS_AUTHENTICATION_FIREWALL_FAILED;
                goto done;
        }

        r->out.validation = talloc_zero(p->mem_ctx,
                                        struct wbint_PamAuthCrapValidation);
        if (r->out.validation == NULL) {
                result = NT_STATUS_NO_MEMORY;
                goto done;
        }

        r->out.validation->level = validation_level;
        r->out.validation->validation = talloc_move(r->out.validation,
                                                    &validation);
done:

        if (r->in.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
                result = nt_status_squash(result);
        }

        *r->out.authoritative = authoritative;

        /*
         * Log the winbind pam authentication, the logon_id will tie this to
         * any of the logons invoked from this request.
         */
        log_authentication(
            p->mem_ctx,
            domain,
            r->in.client_name,
            client_pid,
            r->out.validation->level,
            r->out.validation->validation,
            start_time,
            logon_id,
            "NTLM_AUTH",
            r->in.user,
            r->in.domain,
            r->in.workstation,
            r->in.lm_resp,
            r->in.nt_resp,
            remote,
            local,
            result);

        return result;
}

NTSTATUS _wbint_PamAuthChangePassword(struct pipes_struct *p,
                                      struct wbint_PamAuthChangePassword *r)
{
        struct winbindd_domain *contact_domain = wb_child_domain();
        struct policy_handle dom_pol;
        struct rpc_pipe_client *cli = NULL;
        bool got_info = false;
        struct samr_DomInfo1 *info = NULL;
        struct userPwdChangeFailureInformation *reject = NULL;
        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
        NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
        char *namespace = NULL;
        char *domain = NULL;
        char *user = NULL;
        struct dcerpc_binding_handle *b = NULL;
        bool ok;
        pid_t client_pid;

        ZERO_STRUCT(dom_pol);

        if (contact_domain == NULL) {
                return NT_STATUS_REQUEST_NOT_ACCEPTED;
        }

        /* Cut client_pid to 32bit */
        client_pid = r->in.client_pid;
        if ((uint64_t)client_pid != r->in.client_pid) {
                DBG_DEBUG("pid out of range\n");
                return NT_STATUS_INVALID_PARAMETER;
        }

        DBG_NOTICE("[%"PRIu32"]: dual pam chauthtok %s\n",
                   client_pid, r->in.user);

        ok = parse_domain_user(p->mem_ctx,
                               r->in.user,
                               &namespace,
                               &domain,
                               &user);
        if (!ok) {
                goto done;
        }

        if (!is_allowed_domain(domain)) {
                DBG_NOTICE("Authentication failed for user [%s] "
                           "from firewalled domain [%s]\n",
                           user, domain);
                result = NT_STATUS_AUTHENTICATION_FIREWALL_FAILED;
                goto done;
        }

        /* Initialize reject reason */
        *r->out.reject_reason = Undefined;

        /* Get sam handle */

        result = cm_connect_sam(contact_domain,
                                p->mem_ctx,
                                true,
                                &cli,
                                &dom_pol);
        if (!NT_STATUS_IS_OK(result)) {
                DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
                goto done;
        }

        b = cli->binding_handle;

        status = dcerpc_samr_chgpasswd_user4(cli->binding_handle,
                                             p->mem_ctx,
                                             cli->srv_name_slash,
                                             user,
                                             r->in.old_password,
                                             r->in.new_password,
                                             &result);
        if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
                /* Password successfully changed. */
                goto done;
        }
        if (!NT_STATUS_IS_OK(status)) {
                if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
                    NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
                    NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
                        /* DO NOT FALLBACK TO RC4 */
                        if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED) {
                                result = NT_STATUS_STRONG_CRYPTO_NOT_SUPPORTED;
                                goto process_result;
                        }
                }
        } else {
                /* Password change was unsuccessful. */
                if (!NT_STATUS_IS_OK(result)) {
                        goto done;
                }
        }

        result = rpccli_samr_chgpasswd_user3(cli,
                                             p->mem_ctx,
                                             user,
                                             r->in.new_password,
                                             r->in.old_password,
                                             &info,
                                             &reject);

        /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */

        if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {

                *r->out.dominfo = talloc_steal(p->mem_ctx, info);
                *r->out.reject_reason = reject->extendedFailureReason;

                got_info = true;
        }

        /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
         * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
         * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
         * short to comply with the samr_ChangePasswordUser3 idl - gd */

        /* only fallback when the chgpasswd_user3 call is not supported */
        if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
            NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) ||
            NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL) ||
            NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {

                DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
                        nt_errstr(result)));

                result = rpccli_samr_chgpasswd_user2(cli,
                                                     p->mem_ctx,
                                                     user,
                                                     r->in.new_password,
                                                     r->in.old_password);

                /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
                   Map to the same status code as Windows 2003. */

                if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
                        result = NT_STATUS_PASSWORD_RESTRICTION;
                }
        }

done:

        if (NT_STATUS_IS_OK(result)
            && (r->in.flags & WBFLAG_PAM_CACHED_LOGIN)
            && lp_winbind_offline_logon()) {
                result = winbindd_update_creds_by_name(contact_domain, user,
                                                       r->in.new_password);
                /* Again, this happens when we login from gdm or xdm
                 * and the password expires, *BUT* cached credentials
                 * don't exist. winbindd_update_creds_by_name()
                 * returns NT_STATUS_NO_SUCH_USER.
                 * This is not a failure.
                 * --- BoYang
                 * */
                if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
                        result = NT_STATUS_OK;
                }

                if (!NT_STATUS_IS_OK(result)) {
                        DEBUG(10, ("Failed to store creds: %s\n",
                                   nt_errstr(result)));
                        goto process_result;
                }
        }

        if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {

                NTSTATUS policy_ret;

                policy_ret = get_password_policy(contact_domain,
                                                 p->mem_ctx,
                                                 &info);

                /* failure of this is non critical, it will just provide no
                 * additional information to the client why the change has
                 * failed - Guenther */

                if (!NT_STATUS_IS_OK(policy_ret)) {
                        DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
                        goto process_result;
                }

                *r->out.dominfo = talloc_steal(p->mem_ctx, info);
        }

process_result:

        if (strequal(contact_domain->name, get_global_sam_name())) {
                /* FIXME: internal rpc pipe does not cache handles yet */
                if (b) {
                        if (is_valid_policy_hnd(&dom_pol)) {
                                NTSTATUS _result;
                                dcerpc_samr_Close(b,
                                                  p->mem_ctx,
                                                  &dom_pol,
                                                  &_result);
                        }
                        TALLOC_FREE(cli);
                }
        }

        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
              ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
               domain,
               user,
               nt_errstr(result),
               nt_status_to_pam(result)));

        return result;
}

NTSTATUS _wbint_PamLogOff(struct pipes_struct *p, struct wbint_PamLogOff *r)
{
        struct winbindd_domain *domain = wb_child_domain();
        NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
        pid_t client_pid;
        uid_t user_uid;

        if (domain == NULL) {
                return NT_STATUS_REQUEST_NOT_ACCEPTED;
        }

        /* Cut client_pid to 32bit */
        client_pid = r->in.client_pid;
        if ((uint64_t)client_pid != r->in.client_pid) {
                DBG_DEBUG("pid out of range\n");
                return NT_STATUS_INVALID_PARAMETER;
        }

        /* Cut uid to 32bit */
        user_uid = r->in.uid;
        if ((uint64_t)user_uid != r->in.uid) {
                DBG_DEBUG("uid out of range\n");
                return NT_STATUS_INVALID_PARAMETER;
        }

        DBG_NOTICE("[%"PRIu32"]: pam dual logoff %s\n", client_pid, r->in.user);

        if (!(r->in.flags & WBFLAG_PAM_KRB5)) {
                result = NT_STATUS_OK;
                goto process_result;
        }

        if ((r->in.krb5ccname == NULL) || (strlen(r->in.krb5ccname) == 0)) {
                result = NT_STATUS_OK;
                goto process_result;
        }

#ifdef HAVE_KRB5

        if (user_uid == (uid_t)-1) {
                DBG_DEBUG("Invalid uid for user '%s'\n", r->in.user);
                goto process_result;
        }

        /* what we need here is to find the corresponding krb5 ccache name *we*
         * created for a given username and destroy it */

        if (!ccache_entry_exists(r->in.user)) {
                result = NT_STATUS_OK;
                DBG_DEBUG("No entry found for user '%s'.\n", r->in.user);
                goto process_result;
        }

        if (!ccache_entry_identical(r->in.user, user_uid, r->in.krb5ccname)) {
                DBG_DEBUG("Cached entry differs for user '%s'\n", r->in.user);
                goto process_result;
        }

        result = remove_ccache(r->in.user);
        if (!NT_STATUS_IS_OK(result)) {
                DBG_DEBUG("Failed to remove ccache for user '%s': %s\n",
                          r->in.user, nt_errstr(result));
                goto process_result;
        }

        /*
         * Remove any mlock'ed memory creds in the child
         * we might be using for krb5 ticket renewal.
         */

        winbindd_delete_memory_creds(r->in.user);

#else
        result = NT_STATUS_NOT_SUPPORTED;
#endif

process_result:

        return result;
}

/* Change user password with auth crap*/

NTSTATUS _wbint_PamAuthCrapChangePassword(struct pipes_struct *p,
                                struct wbint_PamAuthCrapChangePassword *r)
{
        NTSTATUS result;
        char *namespace = NULL;
        char *domain = NULL;
        char *user = NULL;
        struct policy_handle dom_pol;
        struct winbindd_domain *contact_domain = wb_child_domain();
        struct rpc_pipe_client *cli = NULL;
        struct dcerpc_binding_handle *b = NULL;
        TALLOC_CTX *frame = talloc_stackframe();
        pid_t client_pid;

        ZERO_STRUCT(dom_pol);

        if (contact_domain == NULL) {
                return NT_STATUS_REQUEST_NOT_ACCEPTED;
        }

        /* Cut client_pid to 32bit */
        client_pid = r->in.client_pid;
        if ((uint64_t)client_pid != r->in.client_pid) {
                DBG_DEBUG("pid out of range\n");
                return NT_STATUS_INVALID_PARAMETER;
        }

        DBG_NOTICE("[%"PRIu32"]: pam change pswd auth crap domain: %s "
                   "user: %s\n", client_pid, r->in.domain, r->in.user);

        if (lp_winbind_offline_logon()) {
                DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
                DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
                result = NT_STATUS_ACCESS_DENIED;
                goto done;
        }

        if (r->in.domain != NULL && strlen(r->in.domain) > 0) {
                user = talloc_strdup(frame, "");
                namespace = talloc_strdup(frame, "");
                domain = talloc_strdup(frame, r->in.domain);
                if (domain == NULL || user == NULL || namespace == NULL) {
                        result = NT_STATUS_NO_MEMORY;
                        goto done;
                }

        } else {
                bool ok;

                ok = parse_domain_user(frame,
                                       r->in.user,
                                       &namespace,
                                       &domain,
                                       &user);
                if (!ok) {
                        result = NT_STATUS_INVALID_PARAMETER;
                        goto done;
                }

                if (strlen(domain) == 0) {
                        DBG_NOTICE("no domain specified with username (%s) - "
                                   "failing auth\n", r->in.user);
                        result = NT_STATUS_NO_SUCH_USER;
                        goto done;
                }
        }

        if (!*domain && lp_winbind_use_default_domain()) {
                TALLOC_FREE(domain);
                domain = talloc_strdup(frame, lp_workgroup());
                if (domain == NULL) {
                        result = NT_STATUS_NO_MEMORY;
                        goto done;
                }
        }

        if (!is_allowed_domain(domain)) {
                DBG_NOTICE("Authentication failed for user [%s] "
                           "from firewalled domain [%s]\n",
                           r->in.user,
                           domain);
                result = NT_STATUS_AUTHENTICATION_FIREWALL_FAILED;
                goto done;
        }

        if(!*user) {
                TALLOC_FREE(user);
                user = talloc_strdup(frame, r->in.user);
                if (user == NULL) {
                        result = NT_STATUS_NO_SUCH_USER;
                        goto done;
                }
        }

        /* Get sam handle */

        result = cm_connect_sam(contact_domain,
                                p->mem_ctx,
                                true,
                                &cli,
                                &dom_pol);
        if (!NT_STATUS_IS_OK(result)) {
                DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
                goto done;
        }

        b = cli->binding_handle;

        result = rpccli_samr_chng_pswd_auth_crap(cli,
                                                 p->mem_ctx,
                                                 user,
                                                 r->in.new_nt_pswd,
                                                 r->in.old_nt_hash_enc,
                                                 r->in.new_lm_pswd,
                                                 r->in.old_lm_hash_enc);

 done:

        if (strequal(contact_domain->name, get_global_sam_name())) {
                /* FIXME: internal rpc pipe does not cache handles yet */
                if (b) {
                        if (is_valid_policy_hnd(&dom_pol)) {
                                NTSTATUS _result;
                                dcerpc_samr_Close(b,
                                                  p->mem_ctx,
                                                  &dom_pol,
                                                  &_result);
                        }
                        TALLOC_FREE(cli);
                }
        }

        DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
              ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
               domain, user,
               nt_errstr(result),
               nt_status_to_pam(result)));
        TALLOC_FREE(frame);
        return result;
}

#ifdef HAVE_KRB5
static NTSTATUS extract_pac_vrfy_sigs(TALLOC_CTX *mem_ctx, DATA_BLOB pac_blob,
                                      struct PAC_DATA **p_pac_data)
{
        krb5_context krbctx = NULL;
        krb5_error_code k5ret;
        krb5_keytab keytab;
        krb5_kt_cursor cursor;
        krb5_keytab_entry entry;
        NTSTATUS status = NT_STATUS_UNSUCCESSFUL;

        ZERO_STRUCT(entry);
        ZERO_STRUCT(cursor);

        k5ret = smb_krb5_init_context_common(&krbctx);
        if (k5ret) {
                DBG_ERR("kerberos init context failed (%s)\n",
                        error_message(k5ret));
                status = krb5_to_nt_status(k5ret);
                goto out;
        }

        k5ret =  gse_krb5_get_server_keytab(krbctx, &keytab);
        if (k5ret) {
                DEBUG(1, ("Failed to get keytab: %s\n",
                          error_message(k5ret)));
                status = krb5_to_nt_status(k5ret);
                goto out_free;
        }

        k5ret = krb5_kt_start_seq_get(krbctx, keytab, &cursor);
        if (k5ret) {
                DEBUG(1, ("Failed to start seq: %s\n",
                          error_message(k5ret)));
                status = krb5_to_nt_status(k5ret);
                goto out_keytab;
        }

        k5ret = krb5_kt_next_entry(krbctx, keytab, &entry, &cursor);
        while (k5ret == 0) {
                status = kerberos_decode_pac(mem_ctx,
                                             pac_blob,
                                             krbctx,
                                             NULL, /* krbtgt_keyblock */
                                             KRB5_KT_KEY(&entry), /* service_keyblock */
                                             NULL, /* client_principal */
                                             0, /* tgs_authtime */
                                             p_pac_data);
                if (NT_STATUS_IS_OK(status)) {
                        break;
                }
                k5ret = smb_krb5_kt_free_entry(krbctx, &entry);
                k5ret = krb5_kt_next_entry(krbctx, keytab, &entry, &cursor);
        }

        k5ret = krb5_kt_end_seq_get(krbctx, keytab, &cursor);
        if (k5ret) {
                DEBUG(1, ("Failed to end seq: %s\n",
                          error_message(k5ret)));
        }
out_keytab:
        k5ret = krb5_kt_close(krbctx, keytab);
        if (k5ret) {
                DEBUG(1, ("Failed to close keytab: %s\n",
                          error_message(k5ret)));
        }
out_free:
        krb5_free_context(krbctx);
out:
        return status;
}

NTSTATUS winbindd_pam_auth_pac_verify(struct winbindd_cli_state *state,
                                      TALLOC_CTX *mem_ctx,
                                      bool *p_is_trusted,
                                      uint16_t *p_validation_level,
                                      union netr_Validation **p_validation)
{
        struct winbindd_request *req = state->request;
        DATA_BLOB pac_blob;
        struct PAC_DATA *pac_data = NULL;
        struct PAC_LOGON_INFO *logon_info = NULL;
        struct PAC_UPN_DNS_INFO *upn_dns_info = NULL;
        struct netr_SamInfo6 *info6 = NULL;
        uint16_t validation_level = 0;
        union netr_Validation *validation = NULL;
        struct netr_SamInfo3 *info3_copy = NULL;
        NTSTATUS result;
        bool is_trusted = false;
        uint32_t i;
        TALLOC_CTX *tmp_ctx = NULL;

        tmp_ctx = talloc_new(mem_ctx);
        if (tmp_ctx == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        *p_is_trusted = false;
        *p_validation_level = 0;
        *p_validation = NULL;

        pac_blob = data_blob_const(req->extra_data.data, req->extra_len);
        result = extract_pac_vrfy_sigs(tmp_ctx, pac_blob, &pac_data);
        if (NT_STATUS_IS_OK(result)) {
                is_trusted = true;
        }
        if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
                /* Try without signature verification */
                result = kerberos_decode_pac(tmp_ctx,
                                             pac_blob,
                                             NULL, /* krb5_context */
                                             NULL, /* krbtgt_keyblock */
                                             NULL, /* service_keyblock */
                                             NULL, /* client_principal */
                                             0, /* tgs_authtime */
                                             &pac_data);
        }
        if (!NT_STATUS_IS_OK(result)) {
                DEBUG(1, ("Error during PAC signature verification: %s\n",
                          nt_errstr(result)));
                goto out;
        }

        for (i=0; i < pac_data->num_buffers; i++) {
                if (pac_data->buffers[i].type == PAC_TYPE_LOGON_INFO) {
                        logon_info = pac_data->buffers[i].info->logon_info.info;
                        continue;
                }
                if (pac_data->buffers[i].type == PAC_TYPE_UPN_DNS_INFO) {
                        upn_dns_info = &pac_data->buffers[i].info->upn_dns_info;
                        continue;
                }
        }

        result = create_info6_from_pac(tmp_ctx,
                                       logon_info,
                                       upn_dns_info,
                                       &info6);
        if (!NT_STATUS_IS_OK(result)) {
                goto out;
        }

        if (!is_allowed_domain(info6->base.logon_domain.string)) {
                DBG_NOTICE("Authentication failed for user [%s] "
                           "from firewalled domain [%s]\n",
                           info6->base.account_name.string,
                           info6->base.logon_domain.string);
                result = NT_STATUS_AUTHENTICATION_FIREWALL_FAILED;
                goto out;
        }

        result = map_info6_to_validation(tmp_ctx,
                                         info6,
                                         &validation_level,
                                         &validation);
        if (!NT_STATUS_IS_OK(result)) {
                goto out;
        }

        result = map_validation_to_info3(tmp_ctx,
                                         validation_level,
                                         validation,
                                         &info3_copy);
        if (!NT_STATUS_IS_OK(result)) {
                goto out;
        }

        if (is_trusted) {
                /*
                 * Signature verification succeeded, we can
                 * trust the PAC and prime the netsamlogon
                 * and name2sid caches. DO NOT DO THIS
                 * in the signature verification failed
                 * code path.
                 */
                struct winbindd_domain *domain = NULL;

                netsamlogon_cache_store(NULL, info3_copy);

                /*
                 * We're in the parent here, so find the child
                 * pointer from the PAC domain name.
                 */
                domain = find_lookup_domain_from_name(
                                info3_copy->base.logon_domain.string);
                if (domain && domain->primary ) {
                        struct dom_sid user_sid;
                        struct dom_sid_buf buf;

                        sid_compose(&user_sid,
                                info3_copy->base.domain_sid,
                                info3_copy->base.rid);

                        cache_name2sid_trusted(domain,
                                info3_copy->base.logon_domain.string,
                                info3_copy->base.account_name.string,
                                SID_NAME_USER,
                                &user_sid);

                        DBG_INFO("PAC for user %s\\%s SID %s primed cache\n",
                                info3_copy->base.logon_domain.string,
                                info3_copy->base.account_name.string,
                                dom_sid_str_buf(&user_sid, &buf));
                }
        }

        *p_is_trusted = is_trusted;
        *p_validation_level = validation_level;
        *p_validation = talloc_move(mem_ctx, &validation);

        result = NT_STATUS_OK;
out:
        TALLOC_FREE(tmp_ctx);
        return result;
}
#else /* HAVE_KRB5 */
NTSTATUS winbindd_pam_auth_pac_verify(struct winbindd_cli_state *state,
                                      TALLOC_CTX *mem_ctx,
                                      bool *p_is_trusted,
                                      uint16_t *p_validation_level,
                                      union netr_Validation **p_validation);
{

        *p_is_trusted = false;
        *p_validation_level = 0;
        *p_validation = NULL;
        return NT_STATUS_NO_SUCH_USER;
}
#endif /* HAVE_KRB5 */