2 Unix SMB/CIFS implementation.
4 Call out to a shell script for an authentication check.
6 Copyright (C) Jeremy Allison 2005.
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #define DBGC_CLASS DBGC_AUTH
30 /* Create a string containing the supplied :
33 * ascii hex challenge\n
34 * ascii hex LM response\n
35 * ascii hex NT response\n\0
36 * and execute a shell script to check this.
37 * Allows external programs to create users on demand.
38 * Script returns zero on success, non-zero on fail.
41 static NTSTATUS
script_check_user_credentials(const struct auth_context
*auth_context
,
42 void *my_private_data
,
44 const auth_usersupplied_info
*user_info
,
45 auth_serversupplied_info
**server_info
)
47 const char *script
= lp_parm_const_string( GLOBAL_SECTION_SNUM
, "auth_script", "script", NULL
);
49 size_t secret_str_len
;
54 return NT_STATUS_INVALID_PARAMETER
;
58 return NT_STATUS_INVALID_PARAMETER
;
62 DEBUG(3,("script_check_user_credentials: no auth_info !\n"));
63 return NT_STATUS_INVALID_PARAMETER
;
66 secret_str_len
= strlen(user_info
->domain
) + 1 +
67 strlen(user_info
->smb_name
) + 1 +
68 16 + 1 + /* 8 bytes of challenge going to 16 */
69 48 + 1 + /* 24 bytes of challenge going to 48 */
72 secret_str
= malloc(secret_str_len
);
74 return NT_STATUS_NO_MEMORY
;
77 safe_strcpy( secret_str
, user_info
->domain
, secret_str_len
- 1);
78 safe_strcat( secret_str
, "\n", secret_str_len
- 1);
79 safe_strcat( secret_str
, user_info
->smb_name
, secret_str_len
- 1);
80 safe_strcat( secret_str
, "\n", secret_str_len
- 1);
82 for (i
= 0; i
< 8; i
++) {
83 slprintf(&hex_str
[i
*2], 3, "%02X", auth_context
->challenge
.data
[i
]);
85 safe_strcat( secret_str
, hex_str
, secret_str_len
- 1);
86 safe_strcat( secret_str
, "\n", secret_str_len
- 1);
88 if (user_info
->lm_resp
.data
) {
89 for (i
= 0; i
< 24; i
++) {
90 slprintf(&hex_str
[i
*2], 3, "%02X", user_info
->lm_resp
.data
[i
]);
92 safe_strcat( secret_str
, hex_str
, secret_str_len
- 1);
94 safe_strcat( secret_str
, "\n", secret_str_len
- 1);
96 if (user_info
->nt_resp
.data
) {
97 for (i
= 0; i
< 24; i
++) {
98 slprintf(&hex_str
[i
*2], 3, "%02X", user_info
->nt_resp
.data
[i
]);
100 safe_strcat( secret_str
, hex_str
, secret_str_len
- 1);
102 safe_strcat( secret_str
, "\n", secret_str_len
- 1);
104 DEBUG(10,("script_check_user_credentials: running %s with parameters:\n%s\n",
105 script
, secret_str
));
107 ret
= smbrunsecret( script
, secret_str
);
109 SAFE_FREE(secret_str
);
112 DEBUG(1,("script_check_user_credentials: failed to authenticate %s\\%s\n",
113 user_info
->domain
, user_info
->smb_name
));
115 return NT_STATUS_NO_SUCH_USER
;
118 /* Cause the auth system to keep going.... */
119 return NT_STATUS_NOT_IMPLEMENTED
;
122 /* module initialisation */
123 static NTSTATUS
auth_init_script(struct auth_context
*auth_context
, const char *param
, auth_methods
**auth_method
)
125 if (!make_auth_methods(auth_context
, auth_method
)) {
126 return NT_STATUS_NO_MEMORY
;
129 (*auth_method
)->name
= "script";
130 (*auth_method
)->auth
= script_check_user_credentials
;
132 if (param
&& *param
) {
133 /* we load the 'fallback' module - if script isn't here, call this
135 if (!load_auth_module(auth_context
, param
, (auth_methods
**)&(*auth_method
)->private_data
)) {
136 return NT_STATUS_UNSUCCESSFUL
;
144 /* Define this to build static. */
145 NTSTATUS
auth_script_init(void)
147 return smb_register_auth(AUTH_INTERFACE_VERSION
, "script", auth_init_script
);
150 /* Define this to build shared. */
151 NTSTATUS
init_module(void)
153 return smb_register_auth(AUTH_INTERFACE_VERSION
, "script", auth_init_script
);