3 Copyright Andrew Tridgell <tridge@samba.org> 2000
4 Copyright Tim Potter <tpot@samba.org> 2000
5 Copyright Andrew Bartlett <abartlet@samba.org> 2002
6 Copyright Guenther Deschner <gd@samba.org> 2005-2008
8 largely based on pam_userdb by Cristian Gafton <gafton@redhat.com> also
9 contains large slabs of code from pam_unix by Elliot Lee
10 <sopwith@redhat.com> (see copyright below for full details)
13 #include "pam_winbind.h"
15 static const char *_pam_error_code_str(int err
)
21 return "PAM_OPEN_ERR";
23 return "PAM_SYMBOL_ERR";
25 return "PAM_SERVICE_ERR";
27 return "PAM_SYSTEM_ERR";
31 return "PAM_PERM_DENIED";
33 return "PAM_AUTH_ERR";
34 case PAM_CRED_INSUFFICIENT
:
35 return "PAM_CRED_INSUFFICIENT";
36 case PAM_AUTHINFO_UNAVAIL
:
37 return "PAM_AUTHINFO_UNAVAIL";
38 case PAM_USER_UNKNOWN
:
39 return "PAM_USER_UNKNOWN";
41 return "PAM_MAXTRIES";
42 case PAM_NEW_AUTHTOK_REQD
:
43 return "PAM_NEW_AUTHTOK_REQD";
44 case PAM_ACCT_EXPIRED
:
45 return "PAM_ACCT_EXPIRED";
47 return "PAM_SESSION_ERR";
48 case PAM_CRED_UNAVAIL
:
49 return "PAM_CRED_UNAVAIL";
50 case PAM_CRED_EXPIRED
:
51 return "PAM_CRED_EXPIRED";
53 return "PAM_CRED_ERR";
54 case PAM_NO_MODULE_DATA
:
55 return "PAM_NO_MODULE_DATA";
57 return "PAM_CONV_ERR";
59 return "PAM_AUTHTOK_ERR";
60 case PAM_AUTHTOK_RECOVERY_ERR
:
61 return "PAM_AUTHTOK_RECOVERY_ERR";
62 case PAM_AUTHTOK_LOCK_BUSY
:
63 return "PAM_AUTHTOK_LOCK_BUSY";
64 case PAM_AUTHTOK_DISABLE_AGING
:
65 return "PAM_AUTHTOK_DISABLE_AGING";
67 return "PAM_TRY_AGAIN";
72 case PAM_AUTHTOK_EXPIRED
:
73 return "PAM_AUTHTOK_EXPIRED";
74 #ifdef PAM_MODULE_UNKNOWN
75 case PAM_MODULE_UNKNOWN
:
76 return "PAM_MODULE_UNKNOWN";
80 return "PAM_BAD_ITEM";
84 return "PAM_CONV_AGAIN";
88 return "PAM_INCOMPLETE";
95 #define _PAM_LOG_FUNCTION_ENTER(function, ctx) \
97 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] ENTER: " \
98 function " (flags: 0x%04x)", ctx->pamh, ctx->flags); \
99 _pam_log_state(ctx); \
102 #define _PAM_LOG_FUNCTION_LEAVE(function, ctx, retval) \
104 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] LEAVE: " \
105 function " returning %d (%s)", ctx->pamh, retval, \
106 _pam_error_code_str(retval)); \
107 _pam_log_state(ctx); \
112 #define MAX_PASSWD_TRIES 3
115 static char initialized
= 0;
117 static inline void textdomain_init(void);
118 static inline void textdomain_init(void)
121 bindtextdomain(MODULE_NAME
, dyn_LOCALEDIR
);
130 * Work around the pam API that has functions with void ** as parameters
131 * These lead to strict aliasing warnings with gcc.
133 static int _pam_get_item(const pam_handle_t
*pamh
,
137 const void **item
= (const void **)_item
;
138 return pam_get_item(pamh
, item_type
, item
);
140 static int _pam_get_data(const pam_handle_t
*pamh
,
141 const char *module_data_name
,
144 const void **data
= (const void **)_data
;
145 return pam_get_data(pamh
, module_data_name
, data
);
148 /* some syslogging */
150 #ifdef HAVE_PAM_VSYSLOG
151 static void _pam_log_int(const pam_handle_t
*pamh
,
156 pam_vsyslog(pamh
, err
, format
, args
);
159 static void _pam_log_int(const pam_handle_t
*pamh
,
164 char *format2
= NULL
;
167 _pam_get_item(pamh
, PAM_SERVICE
, &service
);
169 format2
= (char *)malloc(strlen(MODULE_NAME
)+strlen(format
)+strlen(service
)+5);
170 if (format2
== NULL
) {
171 /* what else todo ? */
172 vsyslog(err
, format
, args
);
176 sprintf(format2
, "%s(%s): %s", MODULE_NAME
, service
, format
);
177 vsyslog(err
, format2
, args
);
180 #endif /* HAVE_PAM_VSYSLOG */
182 static bool _pam_log_is_silent(int ctrl
)
184 return on(ctrl
, WINBIND_SILENT
);
187 static void _pam_log(struct pwb_context
*r
, int err
, const char *format
, ...) PRINTF_ATTRIBUTE(3,4);
188 static void _pam_log(struct pwb_context
*r
, int err
, const char *format
, ...)
192 if (_pam_log_is_silent(r
->ctrl
)) {
196 va_start(args
, format
);
197 _pam_log_int(r
->pamh
, err
, format
, args
);
200 static void __pam_log(const pam_handle_t
*pamh
, int ctrl
, int err
, const char *format
, ...) PRINTF_ATTRIBUTE(4,5);
201 static void __pam_log(const pam_handle_t
*pamh
, int ctrl
, int err
, const char *format
, ...)
205 if (_pam_log_is_silent(ctrl
)) {
209 va_start(args
, format
);
210 _pam_log_int(pamh
, err
, format
, args
);
214 static bool _pam_log_is_debug_enabled(int ctrl
)
220 if (_pam_log_is_silent(ctrl
)) {
224 if (!(ctrl
& WINBIND_DEBUG_ARG
)) {
231 static bool _pam_log_is_debug_state_enabled(int ctrl
)
233 if (!(ctrl
& WINBIND_DEBUG_STATE
)) {
237 return _pam_log_is_debug_enabled(ctrl
);
240 static void _pam_log_debug(struct pwb_context
*r
, int err
, const char *format
, ...) PRINTF_ATTRIBUTE(3,4);
241 static void _pam_log_debug(struct pwb_context
*r
, int err
, const char *format
, ...)
245 if (!_pam_log_is_debug_enabled(r
->ctrl
)) {
249 va_start(args
, format
);
250 _pam_log_int(r
->pamh
, err
, format
, args
);
253 static void __pam_log_debug(const pam_handle_t
*pamh
, int ctrl
, int err
, const char *format
, ...) PRINTF_ATTRIBUTE(4,5);
254 static void __pam_log_debug(const pam_handle_t
*pamh
, int ctrl
, int err
, const char *format
, ...)
258 if (!_pam_log_is_debug_enabled(ctrl
)) {
262 va_start(args
, format
);
263 _pam_log_int(pamh
, err
, format
, args
);
267 static void _pam_log_state_datum(struct pwb_context
*ctx
,
272 const void *data
= NULL
;
273 if (item_type
!= 0) {
274 pam_get_item(ctx
->pamh
, item_type
, &data
);
276 pam_get_data(ctx
->pamh
, key
, &data
);
279 const char *type
= (item_type
!= 0) ? "ITEM" : "DATA";
280 if (is_string
!= 0) {
281 _pam_log_debug(ctx
, LOG_DEBUG
,
282 "[pamh: %p] STATE: %s(%s) = \"%s\" (%p)",
283 ctx
->pamh
, type
, key
, (const char *)data
,
286 _pam_log_debug(ctx
, LOG_DEBUG
,
287 "[pamh: %p] STATE: %s(%s) = %p",
288 ctx
->pamh
, type
, key
, data
);
293 #define _PAM_LOG_STATE_DATA_POINTER(ctx, module_data_name) \
294 _pam_log_state_datum(ctx, 0, module_data_name, 0)
296 #define _PAM_LOG_STATE_DATA_STRING(ctx, module_data_name) \
297 _pam_log_state_datum(ctx, 0, module_data_name, 1)
299 #define _PAM_LOG_STATE_ITEM_POINTER(ctx, item_type) \
300 _pam_log_state_datum(ctx, item_type, #item_type, 0)
302 #define _PAM_LOG_STATE_ITEM_STRING(ctx, item_type) \
303 _pam_log_state_datum(ctx, item_type, #item_type, 1)
305 #ifdef DEBUG_PASSWORD
306 #define _LOG_PASSWORD_AS_STRING 1
308 #define _LOG_PASSWORD_AS_STRING 0
311 #define _PAM_LOG_STATE_ITEM_PASSWORD(ctx, item_type) \
312 _pam_log_state_datum(ctx, item_type, #item_type, \
313 _LOG_PASSWORD_AS_STRING)
315 static void _pam_log_state(struct pwb_context
*ctx
)
317 if (!_pam_log_is_debug_state_enabled(ctx
->ctrl
)) {
321 _PAM_LOG_STATE_ITEM_STRING(ctx
, PAM_SERVICE
);
322 _PAM_LOG_STATE_ITEM_STRING(ctx
, PAM_USER
);
323 _PAM_LOG_STATE_ITEM_STRING(ctx
, PAM_TTY
);
324 _PAM_LOG_STATE_ITEM_STRING(ctx
, PAM_RHOST
);
325 _PAM_LOG_STATE_ITEM_STRING(ctx
, PAM_RUSER
);
326 _PAM_LOG_STATE_ITEM_PASSWORD(ctx
, PAM_OLDAUTHTOK
);
327 _PAM_LOG_STATE_ITEM_PASSWORD(ctx
, PAM_AUTHTOK
);
328 _PAM_LOG_STATE_ITEM_STRING(ctx
, PAM_USER_PROMPT
);
329 _PAM_LOG_STATE_ITEM_POINTER(ctx
, PAM_CONV
);
330 #ifdef PAM_FAIL_DELAY
331 _PAM_LOG_STATE_ITEM_POINTER(ctx
, PAM_FAIL_DELAY
);
333 #ifdef PAM_REPOSITORY
334 _PAM_LOG_STATE_ITEM_POINTER(ctx
, PAM_REPOSITORY
);
337 _PAM_LOG_STATE_DATA_STRING(ctx
, PAM_WINBIND_HOMEDIR
);
338 _PAM_LOG_STATE_DATA_STRING(ctx
, PAM_WINBIND_LOGONSCRIPT
);
339 _PAM_LOG_STATE_DATA_STRING(ctx
, PAM_WINBIND_LOGONSERVER
);
340 _PAM_LOG_STATE_DATA_STRING(ctx
, PAM_WINBIND_PROFILEPATH
);
341 _PAM_LOG_STATE_DATA_STRING(ctx
,
342 PAM_WINBIND_NEW_AUTHTOK_REQD
);
343 /* Use atoi to get PAM result code */
344 _PAM_LOG_STATE_DATA_STRING(ctx
,
345 PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH
);
346 _PAM_LOG_STATE_DATA_POINTER(ctx
, PAM_WINBIND_PWD_LAST_SET
);
349 static int _pam_parse(const pam_handle_t
*pamh
,
353 dictionary
**result_d
)
356 const char *config_file
= NULL
;
359 dictionary
*d
= NULL
;
361 if (flags
& PAM_SILENT
) {
362 ctrl
|= WINBIND_SILENT
;
365 for (i
=argc
,v
=argv
; i
-- > 0; ++v
) {
366 if (!strncasecmp(*v
, "config", strlen("config"))) {
367 ctrl
|= WINBIND_CONFIG_FILE
;
373 if (config_file
== NULL
) {
374 config_file
= PAM_WINBIND_CONFIG_FILE
;
377 d
= iniparser_load(config_file
);
379 goto config_from_pam
;
382 if (iniparser_getboolean(d
, "global:debug", false)) {
383 ctrl
|= WINBIND_DEBUG_ARG
;
386 if (iniparser_getboolean(d
, "global:debug_state", false)) {
387 ctrl
|= WINBIND_DEBUG_STATE
;
390 if (iniparser_getboolean(d
, "global:cached_login", false)) {
391 ctrl
|= WINBIND_CACHED_LOGIN
;
394 if (iniparser_getboolean(d
, "global:krb5_auth", false)) {
395 ctrl
|= WINBIND_KRB5_AUTH
;
398 if (iniparser_getboolean(d
, "global:silent", false)) {
399 ctrl
|= WINBIND_SILENT
;
402 if (iniparser_getstr(d
, "global:krb5_ccache_type") != NULL
) {
403 ctrl
|= WINBIND_KRB5_CCACHE_TYPE
;
406 if ((iniparser_getstr(d
, "global:require-membership-of") != NULL
) ||
407 (iniparser_getstr(d
, "global:require_membership_of") != NULL
)) {
408 ctrl
|= WINBIND_REQUIRED_MEMBERSHIP
;
411 if (iniparser_getboolean(d
, "global:try_first_pass", false)) {
412 ctrl
|= WINBIND_TRY_FIRST_PASS_ARG
;
415 if (iniparser_getint(d
, "global:warn_pwd_expire", 0)) {
416 ctrl
|= WINBIND_WARN_PWD_EXPIRE
;
420 /* step through arguments */
421 for (i
=argc
,v
=argv
; i
-- > 0; ++v
) {
423 /* generic options */
424 if (!strcmp(*v
,"debug"))
425 ctrl
|= WINBIND_DEBUG_ARG
;
426 else if (!strcasecmp(*v
, "debug_state"))
427 ctrl
|= WINBIND_DEBUG_STATE
;
428 else if (!strcasecmp(*v
, "silent"))
429 ctrl
|= WINBIND_SILENT
;
430 else if (!strcasecmp(*v
, "use_authtok"))
431 ctrl
|= WINBIND_USE_AUTHTOK_ARG
;
432 else if (!strcasecmp(*v
, "use_first_pass"))
433 ctrl
|= WINBIND_USE_FIRST_PASS_ARG
;
434 else if (!strcasecmp(*v
, "try_first_pass"))
435 ctrl
|= WINBIND_TRY_FIRST_PASS_ARG
;
436 else if (!strcasecmp(*v
, "unknown_ok"))
437 ctrl
|= WINBIND_UNKNOWN_OK_ARG
;
438 else if (!strncasecmp(*v
, "require_membership_of",
439 strlen("require_membership_of")))
440 ctrl
|= WINBIND_REQUIRED_MEMBERSHIP
;
441 else if (!strncasecmp(*v
, "require-membership-of",
442 strlen("require-membership-of")))
443 ctrl
|= WINBIND_REQUIRED_MEMBERSHIP
;
444 else if (!strcasecmp(*v
, "krb5_auth"))
445 ctrl
|= WINBIND_KRB5_AUTH
;
446 else if (!strncasecmp(*v
, "krb5_ccache_type",
447 strlen("krb5_ccache_type")))
448 ctrl
|= WINBIND_KRB5_CCACHE_TYPE
;
449 else if (!strcasecmp(*v
, "cached_login"))
450 ctrl
|= WINBIND_CACHED_LOGIN
;
452 __pam_log(pamh
, ctrl
, LOG_ERR
,
453 "pam_parse: unknown option: %s", *v
);
463 iniparser_freedict(d
);
470 static void _pam_winbind_free_context(struct pwb_context
*ctx
)
473 iniparser_freedict(ctx
->dict
);
479 static int _pam_winbind_init_context(pam_handle_t
*pamh
,
483 struct pwb_context
**ctx_p
)
485 struct pwb_context
*r
= NULL
;
491 r
= (struct pwb_context
*)malloc(sizeof(struct pwb_context
));
502 r
->ctrl
= _pam_parse(pamh
, flags
, argc
, argv
, &r
->dict
);
504 _pam_winbind_free_context(r
);
505 return PAM_SYSTEM_ERR
;
513 static void _pam_winbind_cleanup_func(pam_handle_t
*pamh
,
517 int ctrl
= _pam_parse(pamh
, 0, 0, NULL
, NULL
);
518 if (_pam_log_is_debug_state_enabled(ctrl
)) {
519 __pam_log_debug(pamh
, ctrl
, LOG_DEBUG
,
520 "[pamh: %p] CLEAN: cleaning up PAM data %p "
521 "(error_status = %d)", pamh
, data
,
528 static const struct ntstatus_errors
{
529 const char *ntstatus_string
;
530 const char *error_string
;
531 } ntstatus_errors
[] = {
534 {"NT_STATUS_BACKUP_CONTROLLER",
535 N_("No primary Domain Controler available")},
536 {"NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
537 N_("No domain controllers found")},
538 {"NT_STATUS_NO_LOGON_SERVERS",
539 N_("No logon servers")},
540 {"NT_STATUS_PWD_TOO_SHORT",
541 N_("Password too short")},
542 {"NT_STATUS_PWD_TOO_RECENT",
543 N_("The password of this user is too recent to change")},
544 {"NT_STATUS_PWD_HISTORY_CONFLICT",
545 N_("Password is already in password history")},
546 {"NT_STATUS_PASSWORD_EXPIRED",
547 N_("Your password has expired")},
548 {"NT_STATUS_PASSWORD_MUST_CHANGE",
549 N_("You need to change your password now")},
550 {"NT_STATUS_INVALID_WORKSTATION",
551 N_("You are not allowed to logon from this workstation")},
552 {"NT_STATUS_INVALID_LOGON_HOURS",
553 N_("You are not allowed to logon at this time")},
554 {"NT_STATUS_ACCOUNT_EXPIRED",
555 N_("Your account has expired. ")
556 N_("Please contact your System administrator")}, /* SCNR */
557 {"NT_STATUS_ACCOUNT_DISABLED",
558 N_("Your account is disabled. ")
559 N_("Please contact your System administrator")}, /* SCNR */
560 {"NT_STATUS_ACCOUNT_LOCKED_OUT",
561 N_("Your account has been locked. ")
562 N_("Please contact your System administrator")}, /* SCNR */
563 {"NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
564 N_("Invalid Trust Account")},
565 {"NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT",
566 N_("Invalid Trust Account")},
567 {"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
568 N_("Invalid Trust Account")},
569 {"NT_STATUS_ACCESS_DENIED",
570 N_("Access is denied")},
574 static const char *_get_ntstatus_error_string(const char *nt_status_string
)
577 for (i
=0; ntstatus_errors
[i
].ntstatus_string
!= NULL
; i
++) {
578 if (!strcasecmp(ntstatus_errors
[i
].ntstatus_string
,
580 return _(ntstatus_errors
[i
].error_string
);
586 /* --- authentication management functions --- */
588 /* Attempt a conversation */
590 static int converse(const pam_handle_t
*pamh
,
592 struct pam_message
**message
,
593 struct pam_response
**response
)
596 struct pam_conv
*conv
;
598 retval
= _pam_get_item(pamh
, PAM_CONV
, &conv
);
599 if (retval
== PAM_SUCCESS
) {
600 retval
= conv
->conv(nargs
,
601 (const struct pam_message
**)message
,
602 response
, conv
->appdata_ptr
);
605 return retval
; /* propagate error status */
609 static int _make_remark(struct pwb_context
*ctx
,
613 int retval
= PAM_SUCCESS
;
615 struct pam_message
*pmsg
[1], msg
[1];
616 struct pam_response
*resp
;
618 if (ctx
->flags
& WINBIND_SILENT
) {
623 msg
[0].msg
= discard_const_p(char, text
);
624 msg
[0].msg_style
= type
;
627 retval
= converse(ctx
->pamh
, 1, pmsg
, &resp
);
630 _pam_drop_reply(resp
, 1);
635 static int _make_remark_v(struct pwb_context
*ctx
,
643 ret
= vasprintf(&var
, format
, args
);
645 _pam_log(ctx
, LOG_ERR
, "memory allocation failure");
649 ret
= _make_remark(ctx
, type
, var
);
654 static int _make_remark_format(struct pwb_context
*ctx
, int type
, const char *format
, ...) PRINTF_ATTRIBUTE(3,4);
655 static int _make_remark_format(struct pwb_context
*ctx
, int type
, const char *format
, ...)
660 va_start(args
, format
);
661 ret
= _make_remark_v(ctx
, type
, format
, args
);
666 static int pam_winbind_request(struct pwb_context
*ctx
,
667 enum winbindd_cmd req_type
,
668 struct winbindd_request
*request
,
669 struct winbindd_response
*response
)
671 /* Fill in request and send down pipe */
672 winbindd_init_request(request
, req_type
);
674 if (winbind_write_sock(request
, sizeof(*request
), 0, 0) == -1) {
675 _pam_log(ctx
, LOG_ERR
,
676 "pam_winbind_request: write to socket failed!");
677 winbind_close_sock();
678 return PAM_SERVICE_ERR
;
682 if (winbindd_read_reply(response
) == -1) {
683 _pam_log(ctx
, LOG_ERR
,
684 "pam_winbind_request: read from socket failed!");
685 winbind_close_sock();
686 return PAM_SERVICE_ERR
;
689 /* We are done with the socket - close it and avoid mischeif */
690 winbind_close_sock();
692 /* Copy reply data from socket */
693 if (response
->result
== WINBINDD_OK
) {
697 /* no need to check for pam_error codes for getpwnam() */
700 case WINBINDD_GETPWNAM
:
701 case WINBINDD_LOOKUPNAME
:
702 if (strlen(response
->data
.auth
.nt_status_string
) > 0) {
703 _pam_log(ctx
, LOG_ERR
,
704 "request failed, NT error was %s",
705 response
->data
.auth
.nt_status_string
);
707 _pam_log(ctx
, LOG_ERR
, "request failed");
709 return PAM_USER_UNKNOWN
;
714 if (response
->data
.auth
.pam_error
!= PAM_SUCCESS
) {
715 _pam_log(ctx
, LOG_ERR
,
716 "request failed: %s, "
717 "PAM error was %s (%d), NT error was %s",
718 response
->data
.auth
.error_string
,
719 pam_strerror(ctx
->pamh
, response
->data
.auth
.pam_error
),
720 response
->data
.auth
.pam_error
,
721 response
->data
.auth
.nt_status_string
);
722 return response
->data
.auth
.pam_error
;
725 _pam_log(ctx
, LOG_ERR
, "request failed, but PAM error 0!");
727 return PAM_SERVICE_ERR
;
730 static int pam_winbind_request_log(struct pwb_context
*ctx
,
731 enum winbindd_cmd req_type
,
732 struct winbindd_request
*request
,
733 struct winbindd_response
*response
,
738 retval
= pam_winbind_request(ctx
, req_type
, request
, response
);
742 /* incorrect password */
743 _pam_log(ctx
, LOG_WARNING
, "user '%s' denied access "
744 "(incorrect password or invalid membership)", user
);
746 case PAM_ACCT_EXPIRED
:
747 /* account expired */
748 _pam_log(ctx
, LOG_WARNING
, "user '%s' account expired",
751 case PAM_AUTHTOK_EXPIRED
:
752 /* password expired */
753 _pam_log(ctx
, LOG_WARNING
, "user '%s' password expired",
756 case PAM_NEW_AUTHTOK_REQD
:
757 /* new password required */
758 _pam_log(ctx
, LOG_WARNING
, "user '%s' new password "
761 case PAM_USER_UNKNOWN
:
762 /* the user does not exist */
763 _pam_log_debug(ctx
, LOG_NOTICE
, "user '%s' not found",
765 if (ctx
->ctrl
& WINBIND_UNKNOWN_OK_ARG
) {
770 /* Otherwise, the authentication looked good */
774 case WINBINDD_PAM_AUTH
:
775 _pam_log(ctx
, LOG_NOTICE
,
776 "user '%s' granted access", user
);
778 case WINBINDD_PAM_CHAUTHTOK
:
779 _pam_log(ctx
, LOG_NOTICE
,
780 "user '%s' password changed", user
);
783 _pam_log(ctx
, LOG_NOTICE
,
784 "user '%s' OK", user
);
790 /* we don't know anything about this return value */
791 _pam_log(ctx
, LOG_ERR
,
792 "internal module error (retval = %d, user = '%s')",
799 * send a password expiry message if required
801 * @param ctx PAM winbind context.
802 * @param next_change expected (calculated) next expiry date.
803 * @param already_expired pointer to a boolean to indicate if the password is
806 * @return boolean Returns true if message has been sent, false if not.
809 static bool _pam_send_password_expiry_message(struct pwb_context
*ctx
,
813 bool *already_expired
)
816 struct tm tm_now
, tm_next_change
;
818 if (already_expired
) {
819 *already_expired
= false;
822 if (next_change
<= now
) {
823 PAM_WB_REMARK_DIRECT(ctx
, "NT_STATUS_PASSWORD_EXPIRED");
824 if (already_expired
) {
825 *already_expired
= true;
830 if ((next_change
< 0) ||
831 (next_change
> now
+ warn_pwd_expire
* SECONDS_PER_DAY
)) {
835 if ((localtime_r(&now
, &tm_now
) == NULL
) ||
836 (localtime_r(&next_change
, &tm_next_change
) == NULL
)) {
840 days
= (tm_next_change
.tm_yday
+tm_next_change
.tm_year
*365) -
841 (tm_now
.tm_yday
+tm_now
.tm_year
*365);
844 _make_remark(ctx
, PAM_TEXT_INFO
,
845 _("Your password expires today"));
849 if (days
> 0 && days
< warn_pwd_expire
) {
850 _make_remark_format(ctx
, PAM_TEXT_INFO
,
851 _("Your password will expire in %d %s"),
852 days
, (days
> 1) ? _("days"):_("day"));
860 * Send a warning if the password expires in the near future
862 * @param ctx PAM winbind context.
863 * @param response The full authentication response structure.
864 * @param already_expired boolean, is the pwd already expired?
869 static void _pam_warn_password_expiry(struct pwb_context
*ctx
,
870 const struct winbindd_response
*response
,
872 bool *already_expired
)
874 time_t now
= time(NULL
);
875 time_t next_change
= 0;
877 if (already_expired
) {
878 *already_expired
= false;
881 /* accounts with ACB_PWNOEXP set never receive a warning */
882 if (response
->data
.auth
.info3
.acct_flags
& ACB_PWNOEXP
) {
886 /* no point in sending a warning if this is a grace logon */
887 if (PAM_WB_GRACE_LOGON(response
->data
.auth
.info3
.user_flgs
)) {
891 /* check if the info3 must change timestamp has been set */
892 next_change
= response
->data
.auth
.info3
.pass_must_change_time
;
894 if (_pam_send_password_expiry_message(ctx
, next_change
, now
,
900 /* now check for the global password policy */
901 /* good catch from Ralf Haferkamp: an expiry of "never" is translated
903 if (response
->data
.auth
.policy
.expire
<= 0) {
907 next_change
= response
->data
.auth
.info3
.pass_last_set_time
+
908 response
->data
.auth
.policy
.expire
;
910 if (_pam_send_password_expiry_message(ctx
, next_change
, now
,
916 /* no warning sent */
919 #define IS_SID_STRING(name) (strncmp("S-", name, 2) == 0)
922 * Append a string, making sure not to overflow and to always return a
923 * NULL-terminated string.
925 * @param dest Destination string buffer (must already be NULL-terminated).
926 * @param src Source string buffer.
927 * @param dest_buffer_size Size of dest buffer in bytes.
929 * @return false if dest buffer is not big enough (no bytes copied), true on
933 static bool safe_append_string(char *dest
,
935 int dest_buffer_size
)
937 int dest_length
= strlen(dest
);
938 int src_length
= strlen(src
);
940 if (dest_length
+ src_length
+ 1 > dest_buffer_size
) {
944 memcpy(dest
+ dest_length
, src
, src_length
+ 1);
949 * Convert a names into a SID string, appending it to a buffer.
951 * @param ctx PAM winbind context.
952 * @param user User in PAM request.
953 * @param name Name to convert.
954 * @param sid_list_buffer Where to append the string sid.
955 * @param sid_list_buffer Size of sid_list_buffer (in bytes).
957 * @return false on failure, true on success.
959 static bool winbind_name_to_sid_string(struct pwb_context
*ctx
,
962 char *sid_list_buffer
,
963 int sid_list_buffer_size
)
965 const char* sid_string
;
966 struct winbindd_response sid_response
;
969 if (IS_SID_STRING(name
)) {
972 struct winbindd_request sid_request
;
974 ZERO_STRUCT(sid_request
);
975 ZERO_STRUCT(sid_response
);
977 _pam_log_debug(ctx
, LOG_DEBUG
,
978 "no sid given, looking up: %s\n", name
);
980 /* fortunatly winbindd can handle non-separated names */
981 strncpy(sid_request
.data
.name
.name
, name
,
982 sizeof(sid_request
.data
.name
.name
) - 1);
984 if (pam_winbind_request_log(ctx
, WINBINDD_LOOKUPNAME
,
985 &sid_request
, &sid_response
,
987 _pam_log(ctx
, LOG_INFO
,
988 "could not lookup name: %s\n", name
);
992 sid_string
= sid_response
.data
.sid
.sid
;
995 if (!safe_append_string(sid_list_buffer
, sid_string
,
996 sid_list_buffer_size
)) {
1004 * Convert a list of names into a list of sids.
1006 * @param ctx PAM winbind context.
1007 * @param user User in PAM request.
1008 * @param name_list List of names or string sids, separated by commas.
1009 * @param sid_list_buffer Where to put the list of string sids.
1010 * @param sid_list_buffer Size of sid_list_buffer (in bytes).
1012 * @return false on failure, true on success.
1014 static bool winbind_name_list_to_sid_string_list(struct pwb_context
*ctx
,
1016 const char *name_list
,
1017 char *sid_list_buffer
,
1018 int sid_list_buffer_size
)
1020 bool result
= false;
1021 char *current_name
= NULL
;
1022 const char *search_location
;
1025 if (sid_list_buffer_size
> 0) {
1026 sid_list_buffer
[0] = 0;
1029 search_location
= name_list
;
1030 while ((comma
= strstr(search_location
, ",")) != NULL
) {
1031 current_name
= strndup(search_location
,
1032 comma
- search_location
);
1033 if (NULL
== current_name
) {
1037 if (!winbind_name_to_sid_string(ctx
, user
,
1040 sid_list_buffer_size
)) {
1044 SAFE_FREE(current_name
);
1046 if (!safe_append_string(sid_list_buffer
, ",",
1047 sid_list_buffer_size
)) {
1051 search_location
= comma
+ 1;
1054 if (!winbind_name_to_sid_string(ctx
, user
, search_location
,
1056 sid_list_buffer_size
)) {
1063 SAFE_FREE(current_name
);
1068 * put krb5ccname variable into environment
1070 * @param ctx PAM winbind context.
1071 * @param krb5ccname env variable retrieved from winbindd.
1076 static void _pam_setup_krb5_env(struct pwb_context
*ctx
,
1077 const char *krb5ccname
)
1082 if (off(ctx
->ctrl
, WINBIND_KRB5_AUTH
)) {
1086 if (!krb5ccname
|| (strlen(krb5ccname
) == 0)) {
1090 _pam_log_debug(ctx
, LOG_DEBUG
,
1091 "request returned KRB5CCNAME: %s", krb5ccname
);
1093 if (snprintf(var
, sizeof(var
), "KRB5CCNAME=%s", krb5ccname
) == -1) {
1097 ret
= pam_putenv(ctx
->pamh
, var
);
1099 _pam_log(ctx
, LOG_ERR
,
1100 "failed to set KRB5CCNAME to %s: %s",
1101 var
, pam_strerror(ctx
->pamh
, ret
));
1106 * Set string into the PAM stack.
1108 * @param ctx PAM winbind context.
1109 * @param data_name Key name for pam_set_data.
1110 * @param value String value.
1115 static void _pam_set_data_string(struct pwb_context
*ctx
,
1116 const char *data_name
,
1121 if (!data_name
|| !value
|| (strlen(data_name
) == 0) ||
1122 (strlen(value
) == 0)) {
1126 ret
= pam_set_data(ctx
->pamh
, data_name
, (void *)strdup(value
),
1127 _pam_winbind_cleanup_func
);
1129 _pam_log_debug(ctx
, LOG_DEBUG
,
1130 "Could not set data %s: %s\n",
1131 data_name
, pam_strerror(ctx
->pamh
, ret
));
1137 * Set info3 strings into the PAM stack.
1139 * @param ctx PAM winbind context.
1140 * @param data_name Key name for pam_set_data.
1141 * @param value String value.
1146 static void _pam_set_data_info3(struct pwb_context
*ctx
,
1147 struct winbindd_response
*response
)
1149 _pam_set_data_string(ctx
, PAM_WINBIND_HOMEDIR
,
1150 response
->data
.auth
.info3
.home_dir
);
1151 _pam_set_data_string(ctx
, PAM_WINBIND_LOGONSCRIPT
,
1152 response
->data
.auth
.info3
.logon_script
);
1153 _pam_set_data_string(ctx
, PAM_WINBIND_LOGONSERVER
,
1154 response
->data
.auth
.info3
.logon_srv
);
1155 _pam_set_data_string(ctx
, PAM_WINBIND_PROFILEPATH
,
1156 response
->data
.auth
.info3
.profile_path
);
1160 * Free info3 strings in the PAM stack.
1162 * @param pamh PAM handle
1167 static void _pam_free_data_info3(pam_handle_t
*pamh
)
1169 pam_set_data(pamh
, PAM_WINBIND_HOMEDIR
, NULL
, NULL
);
1170 pam_set_data(pamh
, PAM_WINBIND_LOGONSCRIPT
, NULL
, NULL
);
1171 pam_set_data(pamh
, PAM_WINBIND_LOGONSERVER
, NULL
, NULL
);
1172 pam_set_data(pamh
, PAM_WINBIND_PROFILEPATH
, NULL
, NULL
);
1176 * Send PAM_ERROR_MSG for cached or grace logons.
1178 * @param ctx PAM winbind context.
1179 * @param username User in PAM request.
1180 * @param info3_user_flgs Info3 flags containing logon type bits.
1185 static void _pam_warn_logon_type(struct pwb_context
*ctx
,
1186 const char *username
,
1187 uint32_t info3_user_flgs
)
1189 /* inform about logon type */
1190 if (PAM_WB_GRACE_LOGON(info3_user_flgs
)) {
1192 _make_remark(ctx
, PAM_ERROR_MSG
,
1194 "Please change your password as soon you're "
1196 _pam_log_debug(ctx
, LOG_DEBUG
,
1197 "User %s logged on using grace logon\n",
1200 } else if (PAM_WB_CACHED_LOGON(info3_user_flgs
)) {
1202 _make_remark(ctx
, PAM_ERROR_MSG
,
1203 _("Domain Controller unreachable, "
1204 "using cached credentials instead. "
1205 "Network resources may be unavailable"));
1206 _pam_log_debug(ctx
, LOG_DEBUG
,
1207 "User %s logged on using cached credentials\n",
1213 * Send PAM_ERROR_MSG for krb5 errors.
1215 * @param ctx PAM winbind context.
1216 * @param username User in PAM request.
1217 * @param info3_user_flgs Info3 flags containing logon type bits.
1222 static void _pam_warn_krb5_failure(struct pwb_context
*ctx
,
1223 const char *username
,
1224 uint32_t info3_user_flgs
)
1226 if (PAM_WB_KRB5_CLOCK_SKEW(info3_user_flgs
)) {
1227 _make_remark(ctx
, PAM_ERROR_MSG
,
1228 _("Failed to establish your Kerberos Ticket cache "
1229 "due time differences\n"
1230 "with the domain controller. "
1231 "Please verify the system time.\n"));
1232 _pam_log_debug(ctx
, LOG_DEBUG
,
1233 "User %s: Clock skew when getting Krb5 TGT\n",
1239 * Compose Password Restriction String for a PAM_ERROR_MSG conversation.
1241 * @param response The struct winbindd_response.
1243 * @return string (caller needs to free).
1246 static char *_pam_compose_pwd_restriction_string(struct winbindd_response
*response
)
1249 size_t offset
= 0, ret
= 0, str_size
= 1024;
1251 str
= (char *)malloc(str_size
);
1256 memset(str
, '\0', str_size
);
1258 offset
= snprintf(str
, str_size
, _("Your password "));
1263 if (response
->data
.auth
.policy
.min_length_password
> 0) {
1264 ret
= snprintf(str
+offset
, str_size
-offset
,
1265 _("must be at least %d characters; "),
1266 response
->data
.auth
.policy
.min_length_password
);
1273 if (response
->data
.auth
.policy
.password_history
> 0) {
1274 ret
= snprintf(str
+offset
, str_size
-offset
,
1275 _("cannot repeat any of your previous %d "
1277 response
->data
.auth
.policy
.password_history
);
1284 if (response
->data
.auth
.policy
.password_properties
&
1285 DOMAIN_PASSWORD_COMPLEX
) {
1286 ret
= snprintf(str
+offset
, str_size
-offset
,
1287 _("must contain capitals, numerals "
1289 "and cannot contain your account "
1297 ret
= snprintf(str
+offset
, str_size
-offset
,
1298 _("Please type a different password. "
1299 "Type a password which meets these requirements in "
1300 "both text boxes."));
1312 /* talk to winbindd */
1313 static int winbind_auth_request(struct pwb_context
*ctx
,
1318 const int warn_pwd_expire
,
1319 struct winbindd_response
*p_response
,
1320 time_t *pwd_last_set
,
1323 struct winbindd_request request
;
1324 struct winbindd_response response
;
1326 bool already_expired
= false;
1328 ZERO_STRUCT(request
);
1329 ZERO_STRUCT(response
);
1335 strncpy(request
.data
.auth
.user
, user
,
1336 sizeof(request
.data
.auth
.user
)-1);
1338 strncpy(request
.data
.auth
.pass
, pass
,
1339 sizeof(request
.data
.auth
.pass
)-1);
1341 request
.data
.auth
.krb5_cc_type
[0] = '\0';
1342 request
.data
.auth
.uid
= -1;
1344 request
.flags
= WBFLAG_PAM_INFO3_TEXT
| WBFLAG_PAM_GET_PWD_POLICY
;
1346 /* Krb5 auth always has to go against the KDC of the user's realm */
1348 if (ctx
->ctrl
& WINBIND_KRB5_AUTH
) {
1349 request
.flags
|= WBFLAG_PAM_CONTACT_TRUSTDOM
;
1352 if (ctx
->ctrl
& (WINBIND_KRB5_AUTH
|WINBIND_CACHED_LOGIN
)) {
1353 struct passwd
*pwd
= NULL
;
1355 pwd
= getpwnam(user
);
1357 return PAM_USER_UNKNOWN
;
1359 request
.data
.auth
.uid
= pwd
->pw_uid
;
1362 if (ctx
->ctrl
& WINBIND_KRB5_AUTH
) {
1364 _pam_log_debug(ctx
, LOG_DEBUG
,
1365 "enabling krb5 login flag\n");
1367 request
.flags
|= WBFLAG_PAM_KRB5
|
1368 WBFLAG_PAM_FALLBACK_AFTER_KRB5
;
1371 if (ctx
->ctrl
& WINBIND_CACHED_LOGIN
) {
1372 _pam_log_debug(ctx
, LOG_DEBUG
,
1373 "enabling cached login flag\n");
1374 request
.flags
|= WBFLAG_PAM_CACHED_LOGIN
;
1379 request
.flags
|= WBFLAG_PAM_UNIX_NAME
;
1382 if (cctype
!= NULL
) {
1383 strncpy(request
.data
.auth
.krb5_cc_type
, cctype
,
1384 sizeof(request
.data
.auth
.krb5_cc_type
) - 1);
1385 _pam_log_debug(ctx
, LOG_DEBUG
,
1386 "enabling request for a %s krb5 ccache\n",
1390 request
.data
.auth
.require_membership_of_sid
[0] = '\0';
1392 if (member
!= NULL
) {
1394 if (!winbind_name_list_to_sid_string_list(ctx
, user
,
1396 request
.data
.auth
.require_membership_of_sid
,
1397 sizeof(request
.data
.auth
.require_membership_of_sid
))) {
1399 _pam_log_debug(ctx
, LOG_ERR
,
1400 "failed to serialize membership of sid "
1401 "\"%s\"\n", member
);
1402 return PAM_AUTH_ERR
;
1406 ret
= pam_winbind_request_log(ctx
, WINBINDD_PAM_AUTH
,
1407 &request
, &response
, user
);
1410 *pwd_last_set
= response
.data
.auth
.info3
.pass_last_set_time
;
1414 /* We want to process the response in the caller. */
1415 *p_response
= response
;
1420 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1421 "NT_STATUS_PASSWORD_EXPIRED");
1422 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1423 "NT_STATUS_PASSWORD_MUST_CHANGE");
1424 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1425 "NT_STATUS_INVALID_WORKSTATION");
1426 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1427 "NT_STATUS_INVALID_LOGON_HOURS");
1428 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1429 "NT_STATUS_ACCOUNT_EXPIRED");
1430 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1431 "NT_STATUS_ACCOUNT_DISABLED");
1432 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1433 "NT_STATUS_ACCOUNT_LOCKED_OUT");
1434 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1435 "NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT");
1436 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1437 "NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT");
1438 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1439 "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT");
1440 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1441 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
1442 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1443 "NT_STATUS_NO_LOGON_SERVERS");
1444 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1445 "NT_STATUS_WRONG_PASSWORD");
1446 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1447 "NT_STATUS_ACCESS_DENIED");
1450 if (ret
== PAM_SUCCESS
) {
1452 /* warn a user if the password is about to expire soon */
1453 _pam_warn_password_expiry(ctx
, &response
,
1457 if (already_expired
== true) {
1458 SMB_TIME_T last_set
;
1459 last_set
= response
.data
.auth
.info3
.pass_last_set_time
;
1460 _pam_log_debug(ctx
, LOG_DEBUG
,
1461 "Password has expired "
1462 "(Password was last set: %lld, "
1463 "the policy says it should expire here "
1464 "%lld (now it's: %lu))\n",
1465 (long long int)last_set
,
1466 (long long int)last_set
+
1467 response
.data
.auth
.policy
.expire
,
1470 return PAM_AUTHTOK_EXPIRED
;
1473 /* inform about logon type */
1474 _pam_warn_logon_type(ctx
, user
,
1475 response
.data
.auth
.info3
.user_flgs
);
1477 /* inform about krb5 failures */
1478 _pam_warn_krb5_failure(ctx
, user
,
1479 response
.data
.auth
.info3
.user_flgs
);
1481 /* set some info3 info for other modules in the stack */
1482 _pam_set_data_info3(ctx
, &response
);
1484 /* put krb5ccname into env */
1485 _pam_setup_krb5_env(ctx
, response
.data
.auth
.krb5ccname
);
1487 /* If winbindd returned a username, return the pointer to it
1489 if (user_ret
&& response
.data
.auth
.unix_username
[0]) {
1490 /* We have to trust it's a null terminated string. */
1491 *user_ret
= strndup(response
.data
.auth
.unix_username
,
1492 sizeof(response
.data
.auth
.unix_username
) - 1);
1499 /* talk to winbindd */
1500 static int winbind_chauthtok_request(struct pwb_context
*ctx
,
1502 const char *oldpass
,
1503 const char *newpass
,
1504 time_t pwd_last_set
)
1506 struct winbindd_request request
;
1507 struct winbindd_response response
;
1510 ZERO_STRUCT(request
);
1511 ZERO_STRUCT(response
);
1513 if (request
.data
.chauthtok
.user
== NULL
) {
1517 strncpy(request
.data
.chauthtok
.user
, user
,
1518 sizeof(request
.data
.chauthtok
.user
) - 1);
1520 if (oldpass
!= NULL
) {
1521 strncpy(request
.data
.chauthtok
.oldpass
, oldpass
,
1522 sizeof(request
.data
.chauthtok
.oldpass
) - 1);
1524 request
.data
.chauthtok
.oldpass
[0] = '\0';
1527 if (newpass
!= NULL
) {
1528 strncpy(request
.data
.chauthtok
.newpass
, newpass
,
1529 sizeof(request
.data
.chauthtok
.newpass
) - 1);
1531 request
.data
.chauthtok
.newpass
[0] = '\0';
1534 if (ctx
->ctrl
& WINBIND_KRB5_AUTH
) {
1535 request
.flags
= WBFLAG_PAM_KRB5
|
1536 WBFLAG_PAM_CONTACT_TRUSTDOM
;
1539 if (ctx
->ctrl
& WINBIND_CACHED_LOGIN
) {
1540 request
.flags
|= WBFLAG_PAM_CACHED_LOGIN
;
1543 ret
= pam_winbind_request_log(ctx
, WINBINDD_PAM_CHAUTHTOK
,
1544 &request
, &response
, user
);
1546 if (ret
== PAM_SUCCESS
) {
1550 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1551 "NT_STATUS_BACKUP_CONTROLLER");
1552 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1553 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
1554 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1555 "NT_STATUS_NO_LOGON_SERVERS");
1556 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1557 "NT_STATUS_ACCESS_DENIED");
1559 /* TODO: tell the min pwd length ? */
1560 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1561 "NT_STATUS_PWD_TOO_SHORT");
1563 /* TODO: tell the minage ? */
1564 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1565 "NT_STATUS_PWD_TOO_RECENT");
1567 /* TODO: tell the history length ? */
1568 PAM_WB_REMARK_CHECK_RESPONSE_RET(ctx
, response
,
1569 "NT_STATUS_PWD_HISTORY_CONFLICT");
1571 if (!strcasecmp(response
.data
.auth
.nt_status_string
,
1572 "NT_STATUS_PASSWORD_RESTRICTION")) {
1574 char *pwd_restriction_string
= NULL
;
1575 SMB_TIME_T min_pwd_age
;
1576 uint32_t reject_reason
= response
.data
.auth
.reject_reason
;
1577 min_pwd_age
= response
.data
.auth
.policy
.min_passwordage
;
1579 /* FIXME: avoid to send multiple PAM messages after another */
1580 switch (reject_reason
) {
1583 case SAMR_REJECT_OTHER
:
1584 if ((min_pwd_age
> 0) &&
1585 (pwd_last_set
+ min_pwd_age
> time(NULL
))) {
1586 PAM_WB_REMARK_DIRECT(ctx
,
1587 "NT_STATUS_PWD_TOO_RECENT");
1590 case SAMR_REJECT_TOO_SHORT
:
1591 PAM_WB_REMARK_DIRECT(ctx
,
1592 "NT_STATUS_PWD_TOO_SHORT");
1594 case SAMR_REJECT_IN_HISTORY
:
1595 PAM_WB_REMARK_DIRECT(ctx
,
1596 "NT_STATUS_PWD_HISTORY_CONFLICT");
1598 case SAMR_REJECT_COMPLEXITY
:
1599 _make_remark(ctx
, PAM_ERROR_MSG
,
1600 _("Password does not meet "
1601 "complexity requirements"));
1604 _pam_log_debug(ctx
, LOG_DEBUG
,
1605 "unknown password change "
1606 "reject reason: %d",
1611 pwd_restriction_string
=
1612 _pam_compose_pwd_restriction_string(&response
);
1613 if (pwd_restriction_string
) {
1614 _make_remark(ctx
, PAM_ERROR_MSG
,
1615 pwd_restriction_string
);
1616 SAFE_FREE(pwd_restriction_string
);
1624 * Checks if a user has an account
1627 * 1 = User not found
1631 static int valid_user(struct pwb_context
*ctx
,
1634 /* check not only if the user is available over NSS calls, also make
1635 * sure it's really a winbind user, this is important when stacking PAM
1636 * modules in the 'account' or 'password' facility. */
1638 struct passwd
*pwd
= NULL
;
1639 struct winbindd_request request
;
1640 struct winbindd_response response
;
1643 ZERO_STRUCT(request
);
1644 ZERO_STRUCT(response
);
1646 pwd
= getpwnam(user
);
1651 strncpy(request
.data
.username
, user
,
1652 sizeof(request
.data
.username
) - 1);
1654 ret
= pam_winbind_request_log(ctx
, WINBINDD_GETPWNAM
,
1655 &request
, &response
, user
);
1658 case PAM_USER_UNKNOWN
:
1668 static char *_pam_delete(register char *xx
)
1676 * obtain a password from the user
1679 static int _winbind_read_password(struct pwb_context
*ctx
,
1681 const char *comment
,
1682 const char *prompt1
,
1683 const char *prompt2
,
1691 _pam_log(ctx
, LOG_DEBUG
, "getting password (0x%08x)", ctrl
);
1694 * make sure nothing inappropriate gets returned
1697 *pass
= token
= NULL
;
1700 * which authentication token are we getting?
1703 if (on(WINBIND__OLD_PASSWORD
, ctrl
)) {
1704 authtok_flag
= PAM_OLDAUTHTOK
;
1706 authtok_flag
= PAM_AUTHTOK
;
1710 * should we obtain the password from a PAM item ?
1713 if (on(WINBIND_TRY_FIRST_PASS_ARG
, ctrl
) ||
1714 on(WINBIND_USE_FIRST_PASS_ARG
, ctrl
)) {
1715 retval
= _pam_get_item(ctx
->pamh
, authtok_flag
, &item
);
1716 if (retval
!= PAM_SUCCESS
) {
1718 _pam_log(ctx
, LOG_ALERT
,
1719 "pam_get_item returned error "
1720 "to unix-read-password");
1722 } else if (item
!= NULL
) { /* we have a password! */
1725 _pam_log(ctx
, LOG_DEBUG
,
1726 "pam_get_item returned a password");
1728 } else if (on(WINBIND_USE_FIRST_PASS_ARG
, ctrl
)) {
1729 return PAM_AUTHTOK_RECOVER_ERR
; /* didn't work */
1730 } else if (on(WINBIND_USE_AUTHTOK_ARG
, ctrl
)
1731 && off(WINBIND__OLD_PASSWORD
, ctrl
)) {
1732 return PAM_AUTHTOK_RECOVER_ERR
;
1736 * getting here implies we will have to get the password from the
1741 struct pam_message msg
[3], *pmsg
[3];
1742 struct pam_response
*resp
;
1745 /* prepare to converse */
1747 if (comment
!= NULL
&& off(ctrl
, WINBIND_SILENT
)) {
1749 msg
[0].msg_style
= PAM_TEXT_INFO
;
1750 msg
[0].msg
= discard_const_p(char, comment
);
1757 msg
[i
].msg_style
= PAM_PROMPT_ECHO_OFF
;
1758 msg
[i
++].msg
= discard_const_p(char, prompt1
);
1761 if (prompt2
!= NULL
) {
1763 msg
[i
].msg_style
= PAM_PROMPT_ECHO_OFF
;
1764 msg
[i
++].msg
= discard_const_p(char, prompt2
);
1767 /* so call the conversation expecting i responses */
1769 retval
= converse(ctx
->pamh
, i
, pmsg
, &resp
);
1771 if (retval
== PAM_SUCCESS
) {
1772 retval
= PAM_AUTHTOK_RECOVER_ERR
;
1776 if (retval
!= PAM_SUCCESS
) {
1777 _pam_drop_reply(resp
, i
);
1781 /* interpret the response */
1783 token
= x_strdup(resp
[i
- replies
].resp
);
1785 _pam_log(ctx
, LOG_NOTICE
,
1786 "could not recover "
1787 "authentication token");
1788 retval
= PAM_AUTHTOK_RECOVER_ERR
;
1793 /* verify that password entered correctly */
1794 if (!resp
[i
- 1].resp
||
1795 strcmp(token
, resp
[i
- 1].resp
)) {
1796 _pam_delete(token
); /* mistyped */
1797 retval
= PAM_AUTHTOK_RECOVER_ERR
;
1798 _make_remark(ctx
, PAM_ERROR_MSG
,
1804 * tidy up the conversation (resp_retcode) is ignored
1805 * -- what is it for anyway? AGM
1807 _pam_drop_reply(resp
, i
);
1811 if (retval
!= PAM_SUCCESS
) {
1812 _pam_log_debug(ctx
, LOG_DEBUG
,
1813 "unable to obtain a password");
1816 /* 'token' is the entered password */
1818 /* we store this password as an item */
1820 retval
= pam_set_item(ctx
->pamh
, authtok_flag
, token
);
1821 _pam_delete(token
); /* clean it up */
1822 if (retval
!= PAM_SUCCESS
||
1823 (retval
= _pam_get_item(ctx
->pamh
, authtok_flag
, &item
)) != PAM_SUCCESS
) {
1825 _pam_log(ctx
, LOG_CRIT
, "error manipulating password");
1831 item
= NULL
; /* break link to password */
1836 static const char *get_conf_item_string(struct pwb_context
*ctx
,
1841 const char *parm_opt
= NULL
;
1843 if (!(ctx
->ctrl
& config_flag
)) {
1847 /* let the pam opt take precedence over the pam_winbind.conf option */
1848 for (i
=0; i
<ctx
->argc
; i
++) {
1850 if ((strncmp(ctx
->argv
[i
], item
, strlen(item
)) == 0)) {
1853 if ((p
= strchr(ctx
->argv
[i
], '=')) == NULL
) {
1854 _pam_log(ctx
, LOG_INFO
,
1855 "no \"=\" delimiter for \"%s\" found\n",
1859 _pam_log_debug(ctx
, LOG_INFO
,
1860 "PAM config: %s '%s'\n", item
, p
+1);
1868 if (!asprintf(&key
, "global:%s", item
)) {
1872 parm_opt
= iniparser_getstr(ctx
->dict
, key
);
1875 _pam_log_debug(ctx
, LOG_INFO
, "CONFIG file: %s '%s'\n",
1882 static int get_config_item_int(struct pwb_context
*ctx
,
1886 int i
, parm_opt
= -1;
1888 if (!(ctx
->ctrl
& config_flag
)) {
1892 /* let the pam opt take precedence over the pam_winbind.conf option */
1893 for (i
= 0; i
< ctx
->argc
; i
++) {
1895 if ((strncmp(ctx
->argv
[i
], item
, strlen(item
)) == 0)) {
1898 if ((p
= strchr(ctx
->argv
[i
], '=')) == NULL
) {
1899 _pam_log(ctx
, LOG_INFO
,
1900 "no \"=\" delimiter for \"%s\" found\n",
1904 parm_opt
= atoi(p
+ 1);
1905 _pam_log_debug(ctx
, LOG_INFO
,
1906 "PAM config: %s '%d'\n",
1915 if (!asprintf(&key
, "global:%s", item
)) {
1919 parm_opt
= iniparser_getint(ctx
->dict
, key
, -1);
1922 _pam_log_debug(ctx
, LOG_INFO
,
1923 "CONFIG file: %s '%d'\n",
1930 static const char *get_krb5_cc_type_from_config(struct pwb_context
*ctx
)
1932 return get_conf_item_string(ctx
, "krb5_ccache_type",
1933 WINBIND_KRB5_CCACHE_TYPE
);
1936 static const char *get_member_from_config(struct pwb_context
*ctx
)
1938 const char *ret
= NULL
;
1939 ret
= get_conf_item_string(ctx
, "require_membership_of",
1940 WINBIND_REQUIRED_MEMBERSHIP
);
1944 return get_conf_item_string(ctx
, "require-membership-of",
1945 WINBIND_REQUIRED_MEMBERSHIP
);
1948 static int get_warn_pwd_expire_from_config(struct pwb_context
*ctx
)
1951 ret
= get_config_item_int(ctx
, "warn_pwd_expire",
1952 WINBIND_WARN_PWD_EXPIRE
);
1953 /* no or broken setting */
1955 return DEFAULT_DAYS_TO_WARN_BEFORE_PWD_EXPIRES
;
1961 * Retrieve the winbind separator.
1963 * @param ctx PAM winbind context.
1965 * @return string separator character. NULL on failure.
1968 static char winbind_get_separator(struct pwb_context
*ctx
)
1970 struct winbindd_request request
;
1971 struct winbindd_response response
;
1973 ZERO_STRUCT(request
);
1974 ZERO_STRUCT(response
);
1976 if (pam_winbind_request_log(ctx
, WINBINDD_INFO
,
1977 &request
, &response
, NULL
)) {
1981 return response
.data
.info
.winbind_separator
;
1985 * Convert a upn to a name.
1987 * @param ctx PAM winbind context.
1988 * @param upn USer UPN to be trabslated.
1990 * @return converted name. NULL pointer on failure. Caller needs to free.
1993 static char* winbind_upn_to_username(struct pwb_context
*ctx
,
1996 struct winbindd_request req
;
1997 struct winbindd_response resp
;
2000 int account_name_len
;
2003 /* This cannot work when the winbind separator = @ */
2005 sep
= winbind_get_separator(ctx
);
2006 if (!sep
|| sep
== '@') {
2010 /* Convert the UPN to a SID */
2015 strncpy(req
.data
.name
.dom_name
, "",
2016 sizeof(req
.data
.name
.dom_name
) - 1);
2017 strncpy(req
.data
.name
.name
, upn
,
2018 sizeof(req
.data
.name
.name
) - 1);
2019 retval
= pam_winbind_request_log(ctx
, WINBINDD_LOOKUPNAME
,
2021 if (retval
!= PAM_SUCCESS
) {
2025 /* Convert the the SID back to the sAMAccountName */
2028 strncpy(req
.data
.sid
, resp
.data
.sid
.sid
, sizeof(req
.data
.sid
)-1);
2030 retval
= pam_winbind_request_log(ctx
, WINBINDD_LOOKUPSID
,
2032 if (retval
!= PAM_SUCCESS
) {
2036 account_name_len
= asprintf(&account_name
, "%s\\%s",
2037 resp
.data
.name
.dom_name
,
2038 resp
.data
.name
.name
);
2040 return account_name
;
2044 int pam_sm_authenticate(pam_handle_t
*pamh
, int flags
,
2045 int argc
, const char **argv
)
2047 const char *username
;
2048 const char *password
;
2049 const char *member
= NULL
;
2050 const char *cctype
= NULL
;
2051 int warn_pwd_expire
;
2052 int retval
= PAM_AUTH_ERR
;
2053 char *username_ret
= NULL
;
2054 char *new_authtok_required
= NULL
;
2055 char *real_username
= NULL
;
2056 struct pwb_context
*ctx
= NULL
;
2058 retval
= _pam_winbind_init_context(pamh
, flags
, argc
, argv
, &ctx
);
2063 _PAM_LOG_FUNCTION_ENTER("pam_sm_authenticate", ctx
);
2065 /* Get the username */
2066 retval
= pam_get_user(pamh
, &username
, NULL
);
2067 if ((retval
!= PAM_SUCCESS
) || (!username
)) {
2068 _pam_log_debug(ctx
, LOG_DEBUG
,
2069 "can not get the username");
2070 retval
= PAM_SERVICE_ERR
;
2076 /* Decode the user name since AIX does not support logn user
2077 names by default. The name is encoded as _#uid. */
2079 if (username
[0] == '_') {
2080 uid_t id
= atoi(&username
[1]);
2081 struct passwd
*pw
= NULL
;
2083 if ((id
!=0) && ((pw
= getpwuid(id
)) != NULL
)) {
2084 real_username
= strdup(pw
->pw_name
);
2089 if (!real_username
) {
2090 /* Just making a copy of the username we got from PAM */
2091 if ((real_username
= strdup(username
)) == NULL
) {
2092 _pam_log_debug(ctx
, LOG_DEBUG
,
2093 "memory allocation failure when copying "
2095 retval
= PAM_SERVICE_ERR
;
2100 /* Maybe this was a UPN */
2102 if (strchr(real_username
, '@') != NULL
) {
2103 char *samaccountname
= NULL
;
2105 samaccountname
= winbind_upn_to_username(ctx
,
2107 if (samaccountname
) {
2108 free(real_username
);
2109 real_username
= samaccountname
;
2113 retval
= _winbind_read_password(ctx
, ctx
->ctrl
, NULL
,
2114 _("Password: "), NULL
,
2117 if (retval
!= PAM_SUCCESS
) {
2118 _pam_log(ctx
, LOG_ERR
,
2119 "Could not retrieve user's password");
2120 retval
= PAM_AUTHTOK_ERR
;
2124 /* Let's not give too much away in the log file */
2126 #ifdef DEBUG_PASSWORD
2127 _pam_log_debug(ctx
, LOG_INFO
,
2128 "Verify user '%s' with password '%s'",
2129 real_username
, password
);
2131 _pam_log_debug(ctx
, LOG_INFO
,
2132 "Verify user '%s'", real_username
);
2135 member
= get_member_from_config(ctx
);
2136 cctype
= get_krb5_cc_type_from_config(ctx
);
2137 warn_pwd_expire
= get_warn_pwd_expire_from_config(ctx
);
2139 /* Now use the username to look up password */
2140 retval
= winbind_auth_request(ctx
, real_username
, password
,
2141 member
, cctype
, warn_pwd_expire
, NULL
,
2142 NULL
, &username_ret
);
2144 if (retval
== PAM_NEW_AUTHTOK_REQD
||
2145 retval
== PAM_AUTHTOK_EXPIRED
) {
2147 char *new_authtok_required_during_auth
= NULL
;
2149 if (!asprintf(&new_authtok_required
, "%d", retval
)) {
2150 retval
= PAM_BUF_ERR
;
2154 pam_set_data(pamh
, PAM_WINBIND_NEW_AUTHTOK_REQD
,
2155 new_authtok_required
,
2156 _pam_winbind_cleanup_func
);
2158 retval
= PAM_SUCCESS
;
2160 if (!asprintf(&new_authtok_required_during_auth
, "%d", true)) {
2161 retval
= PAM_BUF_ERR
;
2165 pam_set_data(pamh
, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH
,
2166 new_authtok_required_during_auth
,
2167 _pam_winbind_cleanup_func
);
2174 pam_set_item (pamh
, PAM_USER
, username_ret
);
2175 _pam_log_debug(ctx
, LOG_INFO
,
2176 "Returned user was '%s'", username_ret
);
2180 if (real_username
) {
2181 free(real_username
);
2184 if (!new_authtok_required
) {
2185 pam_set_data(pamh
, PAM_WINBIND_NEW_AUTHTOK_REQD
, NULL
, NULL
);
2188 if (retval
!= PAM_SUCCESS
) {
2189 _pam_free_data_info3(pamh
);
2192 _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx
, retval
);
2194 _pam_winbind_free_context(ctx
);
2200 int pam_sm_setcred(pam_handle_t
*pamh
, int flags
,
2201 int argc
, const char **argv
)
2203 int ret
= PAM_SYSTEM_ERR
;
2204 struct pwb_context
*ctx
= NULL
;
2206 ret
= _pam_winbind_init_context(pamh
, flags
, argc
, argv
, &ctx
);
2211 _PAM_LOG_FUNCTION_ENTER("pam_sm_setcred", ctx
);
2213 switch (flags
& ~PAM_SILENT
) {
2215 case PAM_DELETE_CRED
:
2216 ret
= pam_sm_close_session(pamh
, flags
, argc
, argv
);
2218 case PAM_REFRESH_CRED
:
2219 _pam_log_debug(ctx
, LOG_WARNING
,
2220 "PAM_REFRESH_CRED not implemented");
2223 case PAM_REINITIALIZE_CRED
:
2224 _pam_log_debug(ctx
, LOG_WARNING
,
2225 "PAM_REINITIALIZE_CRED not implemented");
2228 case PAM_ESTABLISH_CRED
:
2229 _pam_log_debug(ctx
, LOG_WARNING
,
2230 "PAM_ESTABLISH_CRED not implemented");
2234 ret
= PAM_SYSTEM_ERR
;
2240 _PAM_LOG_FUNCTION_LEAVE("pam_sm_setcred", ctx
, ret
);
2242 _pam_winbind_free_context(ctx
);
2248 * Account management. We want to verify that the account exists
2249 * before returning PAM_SUCCESS
2252 int pam_sm_acct_mgmt(pam_handle_t
*pamh
, int flags
,
2253 int argc
, const char **argv
)
2255 const char *username
;
2256 int ret
= PAM_USER_UNKNOWN
;
2258 struct pwb_context
*ctx
= NULL
;
2260 ret
= _pam_winbind_init_context(pamh
, flags
, argc
, argv
, &ctx
);
2265 _PAM_LOG_FUNCTION_ENTER("pam_sm_acct_mgmt", ctx
);
2268 /* Get the username */
2269 ret
= pam_get_user(pamh
, &username
, NULL
);
2270 if ((ret
!= PAM_SUCCESS
) || (!username
)) {
2271 _pam_log_debug(ctx
, LOG_DEBUG
,
2272 "can not get the username");
2273 ret
= PAM_SERVICE_ERR
;
2277 /* Verify the username */
2278 ret
= valid_user(ctx
, username
);
2281 /* some sort of system error. The log was already printed */
2282 ret
= PAM_SERVICE_ERR
;
2285 /* the user does not exist */
2286 _pam_log_debug(ctx
, LOG_NOTICE
, "user '%s' not found",
2288 if (ctx
->ctrl
& WINBIND_UNKNOWN_OK_ARG
) {
2292 ret
= PAM_USER_UNKNOWN
;
2295 pam_get_data(pamh
, PAM_WINBIND_NEW_AUTHTOK_REQD
,
2296 (const void **)&tmp
);
2298 ret
= atoi((const char *)tmp
);
2300 case PAM_AUTHTOK_EXPIRED
:
2301 /* fall through, since new token is required in this case */
2302 case PAM_NEW_AUTHTOK_REQD
:
2303 _pam_log(ctx
, LOG_WARNING
,
2304 "pam_sm_acct_mgmt success but %s is set",
2305 PAM_WINBIND_NEW_AUTHTOK_REQD
);
2306 _pam_log(ctx
, LOG_NOTICE
,
2307 "user '%s' needs new password",
2309 /* PAM_AUTHTOKEN_REQD does not exist, but is documented in the manpage */
2310 ret
= PAM_NEW_AUTHTOK_REQD
;
2313 _pam_log(ctx
, LOG_WARNING
,
2314 "pam_sm_acct_mgmt success");
2315 _pam_log(ctx
, LOG_NOTICE
,
2316 "user '%s' granted access", username
);
2322 /* Otherwise, the authentication looked good */
2323 _pam_log(ctx
, LOG_NOTICE
,
2324 "user '%s' granted access", username
);
2328 /* we don't know anything about this return value */
2329 _pam_log(ctx
, LOG_ERR
,
2330 "internal module error (ret = %d, user = '%s')",
2332 ret
= PAM_SERVICE_ERR
;
2336 /* should not be reached */
2341 _PAM_LOG_FUNCTION_LEAVE("pam_sm_acct_mgmt", ctx
, ret
);
2343 _pam_winbind_free_context(ctx
);
2349 int pam_sm_open_session(pam_handle_t
*pamh
, int flags
,
2350 int argc
, const char **argv
)
2352 int ret
= PAM_SYSTEM_ERR
;
2353 struct pwb_context
*ctx
= NULL
;
2355 ret
= _pam_winbind_init_context(pamh
, flags
, argc
, argv
, &ctx
);
2360 _PAM_LOG_FUNCTION_ENTER("pam_sm_open_session", ctx
);
2365 _PAM_LOG_FUNCTION_LEAVE("pam_sm_open_session", ctx
, ret
);
2367 _pam_winbind_free_context(ctx
);
2373 int pam_sm_close_session(pam_handle_t
*pamh
, int flags
,
2374 int argc
, const char **argv
)
2376 int retval
= PAM_SUCCESS
;
2377 struct pwb_context
*ctx
= NULL
;
2379 retval
= _pam_winbind_init_context(pamh
, flags
, argc
, argv
, &ctx
);
2384 _PAM_LOG_FUNCTION_ENTER("pam_sm_close_session", ctx
);
2386 if (!(flags
& PAM_DELETE_CRED
)) {
2387 retval
= PAM_SUCCESS
;
2391 if (ctx
->ctrl
& WINBIND_KRB5_AUTH
) {
2393 /* destroy the ccache here */
2394 struct winbindd_request request
;
2395 struct winbindd_response response
;
2397 const char *ccname
= NULL
;
2398 struct passwd
*pwd
= NULL
;
2400 ZERO_STRUCT(request
);
2401 ZERO_STRUCT(response
);
2403 retval
= pam_get_user(pamh
, &user
, _("Username: "));
2405 _pam_log(ctx
, LOG_ERR
,
2406 "could not identify user");
2411 _pam_log(ctx
, LOG_ERR
,
2412 "username was NULL!");
2413 retval
= PAM_USER_UNKNOWN
;
2417 _pam_log_debug(ctx
, LOG_DEBUG
,
2418 "username [%s] obtained", user
);
2420 ccname
= pam_getenv(pamh
, "KRB5CCNAME");
2421 if (ccname
== NULL
) {
2422 _pam_log_debug(ctx
, LOG_DEBUG
,
2423 "user has no KRB5CCNAME environment");
2426 strncpy(request
.data
.logoff
.user
, user
,
2427 sizeof(request
.data
.logoff
.user
) - 1);
2430 strncpy(request
.data
.logoff
.krb5ccname
, ccname
,
2431 sizeof(request
.data
.logoff
.krb5ccname
) - 1);
2434 pwd
= getpwnam(user
);
2436 retval
= PAM_USER_UNKNOWN
;
2439 request
.data
.logoff
.uid
= pwd
->pw_uid
;
2441 request
.flags
= WBFLAG_PAM_KRB5
|
2442 WBFLAG_PAM_CONTACT_TRUSTDOM
;
2444 retval
= pam_winbind_request_log(ctx
,
2445 WINBINDD_PAM_LOGOFF
,
2446 &request
, &response
, user
);
2451 * Delete the krb5 ccname variable from the PAM environment
2452 * if it was set by winbind.
2454 if (ctx
->ctrl
& WINBIND_KRB5_AUTH
) {
2455 pam_putenv(pamh
, "KRB5CCNAME");
2458 _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx
, retval
);
2460 _pam_winbind_free_context(ctx
);
2466 * evaluate whether we need to re-authenticate with kerberos after a
2469 * @param ctx PAM winbind context.
2470 * @param user The username
2472 * @return boolean Returns true if required, false if not.
2475 static bool _pam_require_krb5_auth_after_chauthtok(struct pwb_context
*ctx
,
2479 /* Make sure that we only do this if a) the chauthtok got initiated
2480 * during a logon attempt (authenticate->acct_mgmt->chauthtok) b) any
2481 * later password change via the "passwd" command if done by the user
2483 * NB. If we login from gdm or xdm and the password expires,
2484 * we change the password, but there is no memory cache.
2485 * Thus, even for passthrough login, we should do the
2486 * authentication again to update memory cache.
2490 char *new_authtok_reqd_during_auth
= NULL
;
2491 struct passwd
*pwd
= NULL
;
2493 _pam_get_data(ctx
->pamh
, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH
,
2494 &new_authtok_reqd_during_auth
);
2495 pam_set_data(ctx
->pamh
, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH
,
2498 if (new_authtok_reqd_during_auth
) {
2502 pwd
= getpwnam(user
);
2507 if (getuid() == pwd
->pw_uid
) {
2516 int pam_sm_chauthtok(pam_handle_t
* pamh
, int flags
,
2517 int argc
, const char **argv
)
2521 bool cached_login
= false;
2523 /* <DO NOT free() THESE> */
2525 char *pass_old
, *pass_new
;
2526 /* </DO NOT free() THESE> */
2531 char *username_ret
= NULL
;
2532 struct winbindd_response response
;
2533 struct pwb_context
*ctx
= NULL
;
2535 ZERO_STRUCT(response
);
2537 ret
= _pam_winbind_init_context(pamh
, flags
, argc
, argv
, &ctx
);
2542 _PAM_LOG_FUNCTION_ENTER("pam_sm_chauthtok", ctx
);
2544 cached_login
= (ctx
->ctrl
& WINBIND_CACHED_LOGIN
);
2546 /* clearing offline bit for auth */
2547 ctx
->ctrl
&= ~WINBIND_CACHED_LOGIN
;
2550 * First get the name of a user
2552 ret
= pam_get_user(pamh
, &user
, _("Username: "));
2554 _pam_log(ctx
, LOG_ERR
,
2555 "password - could not identify user");
2560 _pam_log(ctx
, LOG_ERR
, "username was NULL!");
2561 ret
= PAM_USER_UNKNOWN
;
2565 _pam_log_debug(ctx
, LOG_DEBUG
, "username [%s] obtained", user
);
2567 /* check if this is really a user in winbindd, not only in NSS */
2568 ret
= valid_user(ctx
, user
);
2571 ret
= PAM_USER_UNKNOWN
;
2574 ret
= PAM_SYSTEM_ERR
;
2581 * obtain and verify the current password (OLDAUTHTOK) for
2585 if (flags
& PAM_PRELIM_CHECK
) {
2586 time_t pwdlastset_prelim
= 0;
2588 /* instruct user what is happening */
2589 #define greeting _("Changing password for ")
2590 Announce
= (char *) malloc(sizeof(greeting
) + strlen(user
));
2591 if (Announce
== NULL
) {
2592 _pam_log(ctx
, LOG_CRIT
,
2593 "password - out of memory");
2597 (void) strcpy(Announce
, greeting
);
2598 (void) strcpy(Announce
+ sizeof(greeting
) - 1, user
);
2601 lctrl
= ctx
->ctrl
| WINBIND__OLD_PASSWORD
;
2602 ret
= _winbind_read_password(ctx
, lctrl
,
2604 _("(current) NT password: "),
2606 (const char **) &pass_old
);
2607 if (ret
!= PAM_SUCCESS
) {
2608 _pam_log(ctx
, LOG_NOTICE
,
2609 "password - (old) token not obtained");
2613 /* verify that this is the password for this user */
2615 ret
= winbind_auth_request(ctx
, user
, pass_old
,
2616 NULL
, NULL
, 0, &response
,
2617 &pwdlastset_prelim
, NULL
);
2619 if (ret
!= PAM_ACCT_EXPIRED
&&
2620 ret
!= PAM_AUTHTOK_EXPIRED
&&
2621 ret
!= PAM_NEW_AUTHTOK_REQD
&&
2622 ret
!= PAM_SUCCESS
) {
2627 pam_set_data(pamh
, PAM_WINBIND_PWD_LAST_SET
,
2628 (void *)pwdlastset_prelim
, NULL
);
2630 ret
= pam_set_item(pamh
, PAM_OLDAUTHTOK
,
2631 (const void *) pass_old
);
2633 if (ret
!= PAM_SUCCESS
) {
2634 _pam_log(ctx
, LOG_CRIT
,
2635 "failed to set PAM_OLDAUTHTOK");
2637 } else if (flags
& PAM_UPDATE_AUTHTOK
) {
2639 time_t pwdlastset_update
= 0;
2642 * obtain the proposed password
2646 * get the old token back.
2649 ret
= _pam_get_item(pamh
, PAM_OLDAUTHTOK
, &pass_old
);
2651 if (ret
!= PAM_SUCCESS
) {
2652 _pam_log(ctx
, LOG_NOTICE
,
2653 "user not authenticated");
2657 lctrl
= ctx
->ctrl
& ~WINBIND_TRY_FIRST_PASS_ARG
;
2659 if (on(WINBIND_USE_AUTHTOK_ARG
, lctrl
)) {
2660 lctrl
|= WINBIND_USE_FIRST_PASS_ARG
;
2663 ret
= PAM_AUTHTOK_ERR
;
2664 while ((ret
!= PAM_SUCCESS
) && (retry
++ < MAX_PASSWD_TRIES
)) {
2666 * use_authtok is to force the use of a previously entered
2667 * password -- needed for pluggable password strength checking
2670 ret
= _winbind_read_password(ctx
, lctrl
,
2672 _("Enter new NT password: "),
2673 _("Retype new NT password: "),
2674 (const char **)&pass_new
);
2676 if (ret
!= PAM_SUCCESS
) {
2677 _pam_log_debug(ctx
, LOG_ALERT
,
2679 "new password not obtained");
2680 pass_old
= NULL
;/* tidy up */
2685 * At this point we know who the user is and what they
2686 * propose as their new password. Verify that the new
2687 * password is acceptable.
2690 if (pass_new
[0] == '\0') {/* "\0" password = NULL */
2696 * By reaching here we have approved the passwords and must now
2697 * rebuild the password database file.
2699 _pam_get_data(pamh
, PAM_WINBIND_PWD_LAST_SET
,
2700 &pwdlastset_update
);
2703 * if cached creds were enabled, make sure to set the
2704 * WINBIND_CACHED_LOGIN bit here in order to have winbindd
2705 * update the cached creds storage - gd
2708 ctx
->ctrl
|= WINBIND_CACHED_LOGIN
;
2711 ret
= winbind_chauthtok_request(ctx
, user
, pass_old
,
2712 pass_new
, pwdlastset_update
);
2714 _pam_overwrite(pass_new
);
2715 _pam_overwrite(pass_old
);
2716 pass_old
= pass_new
= NULL
;
2720 if (_pam_require_krb5_auth_after_chauthtok(ctx
, user
)) {
2722 const char *member
= NULL
;
2723 const char *cctype
= NULL
;
2724 int warn_pwd_expire
;
2726 member
= get_member_from_config(ctx
);
2727 cctype
= get_krb5_cc_type_from_config(ctx
);
2728 warn_pwd_expire
= get_warn_pwd_expire_from_config(ctx
);
2730 /* Keep WINBIND_CACHED_LOGIN bit for
2731 * authentication after changing the password.
2732 * This will update the cached credentials in case
2733 * that winbindd_dual_pam_chauthtok() fails
2738 ret
= winbind_auth_request(ctx
, user
, pass_new
,
2739 member
, cctype
, 0, &response
,
2740 NULL
, &username_ret
);
2741 _pam_overwrite(pass_new
);
2742 _pam_overwrite(pass_old
);
2743 pass_old
= pass_new
= NULL
;
2745 if (ret
== PAM_SUCCESS
) {
2747 /* warn a user if the password is about to
2749 _pam_warn_password_expiry(ctx
, &response
,
2753 /* set some info3 info for other modules in the
2755 _pam_set_data_info3(ctx
, &response
);
2757 /* put krb5ccname into env */
2758 _pam_setup_krb5_env(ctx
,
2759 response
.data
.auth
.krb5ccname
);
2762 pam_set_item(pamh
, PAM_USER
,
2764 _pam_log_debug(ctx
, LOG_INFO
,
2765 "Returned user was '%s'",
2774 ret
= PAM_SERVICE_ERR
;
2779 /* Deal with offline errors. */
2780 PAM_WB_REMARK_CHECK_RESPONSE(ctx
, response
,
2781 "NT_STATUS_NO_LOGON_SERVERS");
2782 PAM_WB_REMARK_CHECK_RESPONSE(ctx
, response
,
2783 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
2784 PAM_WB_REMARK_CHECK_RESPONSE(ctx
, response
,
2785 "NT_STATUS_ACCESS_DENIED");
2787 _PAM_LOG_FUNCTION_LEAVE("pam_sm_chauthtok", ctx
, ret
);
2789 _pam_winbind_free_context(ctx
);
2796 /* static module data */
2798 struct pam_module _pam_winbind_modstruct
= {
2800 pam_sm_authenticate
,
2803 pam_sm_open_session
,
2804 pam_sm_close_session
,
2811 * Copyright (c) Andrew Tridgell <tridge@samba.org> 2000
2812 * Copyright (c) Tim Potter <tpot@samba.org> 2000
2813 * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
2814 * Copyright (c) Guenther Deschner <gd@samba.org> 2005-2008
2815 * Copyright (c) Jan Rêkorajski 1999.
2816 * Copyright (c) Andrew G. Morgan 1996-8.
2817 * Copyright (c) Alex O. Yuriev, 1996.
2818 * Copyright (c) Cristian Gafton 1996.
2819 * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
2821 * Redistribution and use in source and binary forms, with or without
2822 * modification, are permitted provided that the following conditions
2824 * 1. Redistributions of source code must retain the above copyright
2825 * notice, and the entire permission notice in its entirety,
2826 * including the disclaimer of warranties.
2827 * 2. Redistributions in binary form must reproduce the above copyright
2828 * notice, this list of conditions and the following disclaimer in the
2829 * documentation and/or other materials provided with the distribution.
2830 * 3. The name of the author may not be used to endorse or promote
2831 * products derived from this software without specific prior
2832 * written permission.
2834 * ALTERNATIVELY, this product may be distributed under the terms of
2835 * the GNU Public License, in which case the provisions of the GPL are
2836 * required INSTEAD OF the above restrictions. (This clause is
2837 * necessary due to a potential bad interaction between the GPL and
2838 * the restrictions contained in a BSD-style copyright.)
2840 * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
2841 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
2842 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
2843 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
2844 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
2845 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
2846 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2847 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
2848 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
2849 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
2850 * OF THE POSSIBILITY OF SUCH DAMAGE.