source3/auth/auth_sam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Password and authentication handling
   4    Copyright (C) Andrew Tridgell              1992-2000
   5    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
   6    Copyright (C) Andrew Bartlett              2001-2003
   7    Copyright (C) Gerald Carter                2003
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "auth.h"
  25 #include "../libcli/auth/libcli_auth.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_AUTH
  29
  30 static NTSTATUS auth_sam_ignoredomain_auth(const struct auth_context *auth_context,
  31                                            void *my_private_data,
  32                                            TALLOC_CTX *mem_ctx,
  33                                            const struct auth_usersupplied_info *user_info,
  34                                            struct auth_serversupplied_info **server_info)
  35 {
  36         if (!user_info || !auth_context) {
  37                 return NT_STATUS_UNSUCCESSFUL;
  38         }
  39         return check_sam_security(&auth_context->challenge, mem_ctx,
  40                                   user_info, server_info);
  41 }
  42
  43 /* module initialisation */
  44 static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
  45 {
  46         struct auth_methods *result;
  47
  48         result = TALLOC_ZERO_P(auth_context, struct auth_methods);
  49         if (result == NULL) {
  50                 return NT_STATUS_NO_MEMORY;
  51         }
  52         result->auth = auth_sam_ignoredomain_auth;
  53         result->name = "sam_ignoredomain";
  54
  55         *auth_method = result;
  56         return NT_STATUS_OK;
  57 }
  58
  59
  60 /****************************************************************************
  61 Check SAM security (above) but with a few extra checks.
  62 ****************************************************************************/
  63
  64 static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context,
  65                                     void *my_private_data,
  66                                     TALLOC_CTX *mem_ctx,
  67                                     const struct auth_usersupplied_info *user_info,
  68                                     struct auth_serversupplied_info **server_info)
  69 {
  70         bool is_local_name, is_my_domain;
  71
  72         if (!user_info || !auth_context) {
  73                 return NT_STATUS_LOGON_FAILURE;
  74         }
  75
  76         DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
  77
  78         is_local_name = is_myname(user_info->mapped.domain_name);
  79         is_my_domain  = strequal(user_info->mapped.domain_name, lp_workgroup());
  80
  81         /* check whether or not we service this domain/workgroup name */
  82
  83         switch ( lp_server_role() ) {
  84                 case ROLE_STANDALONE:
  85                 case ROLE_DOMAIN_MEMBER:
  86                         if ( !is_local_name ) {
  87                                 DEBUG(6,("check_samstrict_security: %s is not one of my local names (%s)\n",
  88                                         user_info->mapped.domain_name, (lp_server_role() == ROLE_DOMAIN_MEMBER
  89                                         ? "ROLE_DOMAIN_MEMBER" : "ROLE_STANDALONE") ));
  90                                 return NT_STATUS_NOT_IMPLEMENTED;
  91                         }
  92                 case ROLE_DOMAIN_PDC:
  93                 case ROLE_DOMAIN_BDC:
  94                         if ( !is_local_name && !is_my_domain ) {
  95                                 DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n",
  96                                         user_info->mapped.domain_name));
  97                                 return NT_STATUS_NOT_IMPLEMENTED;
  98                         }
  99                 default: /* name is ok */
 100                         break;
 101         }
 102
 103         return check_sam_security(&auth_context->challenge, mem_ctx,
 104                                   user_info, server_info);
 105 }
 106
 107 /* module initialisation */
 108 static NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
 109 {
 110         struct auth_methods *result;
 111
 112         result = TALLOC_ZERO_P(auth_context, struct auth_methods);
 113         if (result == NULL) {
 114                 return NT_STATUS_NO_MEMORY;
 115         }
 116         result->auth = auth_samstrict_auth;
 117         result->name = "sam";
 118
 119         *auth_method = result;
 120         return NT_STATUS_OK;
 121 }
 122
 123 NTSTATUS auth_sam_init(void)
 124 {
 125         smb_register_auth(AUTH_INTERFACE_VERSION, "sam", auth_init_sam);
 126         smb_register_auth(AUTH_INTERFACE_VERSION, "sam_ignoredomain", auth_init_sam_ignoredomain);
 127         return NT_STATUS_OK;
 128 }