2 Unix SMB/Netbios implementation.
4 handle GENSEC authentication, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003,2011
8 Copyright (C) Simo Sorce 2010.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../lib/tsocket/tsocket.h"
27 #include "auth/gensec/gensec.h"
28 #include "lib/param/param.h"
30 #include "auth/kerberos/pac_utils.h"
32 #include "librpc/crypto/gse.h"
33 #include "auth/credentials/credentials.h"
34 #include "lib/param/loadparm.h"
36 static NTSTATUS
auth3_generate_session_info_pac(struct auth4_context
*auth_ctx
,
38 struct smb_krb5_context
*smb_krb5_context
,
40 const char *princ_name
,
41 const struct tsocket_address
*remote_address
,
42 uint32_t session_info_flags
,
43 struct auth_session_info
**session_info
)
46 struct PAC_LOGON_INFO
*logon_info
= NULL
;
47 struct netr_SamInfo3
*info3_copy
= NULL
;
58 tmp_ctx
= talloc_new(mem_ctx
);
60 return NT_STATUS_NO_MEMORY
;
65 status
= kerberos_pac_logon_info(tmp_ctx
, *pac_blob
, NULL
, NULL
,
66 NULL
, NULL
, 0, &logon_info
);
68 status
= NT_STATUS_ACCESS_DENIED
;
70 if (!NT_STATUS_IS_OK(status
)) {
75 rc
= get_remote_hostname(remote_address
,
79 status
= NT_STATUS_NO_MEMORY
;
82 if (strequal(rhost
, "UNKNOWN")) {
83 rhost
= tsocket_address_inet_addr_string(remote_address
,
86 status
= NT_STATUS_NO_MEMORY
;
91 status
= get_user_from_kerberos_info(tmp_ctx
, rhost
,
92 princ_name
, logon_info
,
93 &is_mapped
, &is_guest
,
96 if (!NT_STATUS_IS_OK(status
)) {
97 DEBUG(1, ("Failed to map kerberos principal to system user "
98 "(%s)\n", nt_errstr(status
)));
99 status
= NT_STATUS_ACCESS_DENIED
;
103 /* save the PAC data if we have it */
105 status
= create_info3_from_pac_logon_info(tmp_ctx
,
108 if (!NT_STATUS_IS_OK(status
)) {
111 netsamlogon_cache_store(ntuser
, info3_copy
);
114 /* setup the string used by %U */
115 sub_set_smb_name(username
);
117 /* reload services so that the new %U is taken into account */
118 lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
120 status
= make_session_info_krb5(mem_ctx
,
121 ntuser
, ntdomain
, username
, pw
,
122 info3_copy
, is_guest
, is_mapped
, NULL
/* No session key for now, caller will sort it out */,
124 if (!NT_STATUS_IS_OK(status
)) {
125 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
127 status
= NT_STATUS_ACCESS_DENIED
;
131 DEBUG(5, (__location__
"OK: user: %s domain: %s client: %s\n",
132 ntuser
, ntdomain
, rhost
));
134 status
= NT_STATUS_OK
;
137 TALLOC_FREE(tmp_ctx
);
141 static struct auth4_context
*make_auth4_context_s3(TALLOC_CTX
*mem_ctx
, struct auth_context
*auth_context
)
143 struct auth4_context
*auth4_context
= talloc_zero(mem_ctx
, struct auth4_context
);
144 if (auth4_context
== NULL
) {
145 DEBUG(10, ("failed to allocate auth4_context failed\n"));
148 auth4_context
->generate_session_info_pac
= auth3_generate_session_info_pac
;
149 auth4_context
->generate_session_info
= auth3_generate_session_info
;
150 auth4_context
->get_ntlm_challenge
= auth3_get_challenge
;
151 auth4_context
->set_ntlm_challenge
= auth3_set_challenge
;
152 auth4_context
->check_ntlm_password
= auth3_check_password
;
153 auth4_context
->private_data
= talloc_steal(auth4_context
, auth_context
);
154 return auth4_context
;
157 NTSTATUS
make_auth4_context(TALLOC_CTX
*mem_ctx
, struct auth4_context
**auth4_context_out
)
159 struct auth_context
*auth_context
;
162 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
163 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
165 nt_status
= make_auth_context_subsystem(tmp_ctx
, &auth_context
);
166 if (!NT_STATUS_IS_OK(nt_status
)) {
167 TALLOC_FREE(tmp_ctx
);
171 if (auth_context
->make_auth4_context
) {
172 nt_status
= auth_context
->make_auth4_context(mem_ctx
, auth4_context_out
);
173 TALLOC_FREE(tmp_ctx
);
177 struct auth4_context
*auth4_context
= make_auth4_context_s3(tmp_ctx
, auth_context
);
178 if (auth4_context
== NULL
) {
179 TALLOC_FREE(tmp_ctx
);
180 return NT_STATUS_NO_MEMORY
;
182 *auth4_context_out
= talloc_steal(mem_ctx
, auth4_context
);
183 TALLOC_FREE(tmp_ctx
);
188 NTSTATUS
auth_generic_prepare(TALLOC_CTX
*mem_ctx
,
189 const struct tsocket_address
*remote_address
,
190 struct gensec_security
**gensec_security_out
)
192 struct gensec_security
*gensec_security
;
193 struct auth_context
*auth_context
;
196 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
197 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
199 nt_status
= make_auth_context_subsystem(tmp_ctx
, &auth_context
);
200 if (!NT_STATUS_IS_OK(nt_status
)) {
201 TALLOC_FREE(tmp_ctx
);
205 if (auth_context
->prepare_gensec
) {
206 nt_status
= auth_context
->prepare_gensec(tmp_ctx
,
208 if (!NT_STATUS_IS_OK(nt_status
)) {
209 TALLOC_FREE(tmp_ctx
);
213 struct gensec_settings
*gensec_settings
;
214 struct loadparm_context
*lp_ctx
;
216 struct cli_credentials
*server_credentials
;
217 const char *dns_name
;
218 const char *dns_domain
;
219 struct auth4_context
*auth4_context
= make_auth4_context_s3(tmp_ctx
, auth_context
);
220 if (auth4_context
== NULL
) {
221 TALLOC_FREE(tmp_ctx
);
222 return NT_STATUS_NO_MEMORY
;
225 lp_ctx
= loadparm_init_s3(tmp_ctx
, loadparm_s3_helpers());
226 if (lp_ctx
== NULL
) {
227 DEBUG(10, ("loadparm_init_s3 failed\n"));
228 TALLOC_FREE(tmp_ctx
);
229 return NT_STATUS_INVALID_SERVER_STATE
;
232 gensec_settings
= lpcfg_gensec_settings(tmp_ctx
, lp_ctx
);
233 if (lp_ctx
== NULL
) {
234 DEBUG(10, ("lpcfg_gensec_settings failed\n"));
235 TALLOC_FREE(tmp_ctx
);
236 return NT_STATUS_NO_MEMORY
;
240 * This should be a 'netbios domain -> DNS domain'
241 * mapping, and can currently validly return NULL on
242 * poorly configured systems.
244 * This is used for the NTLMSSP server
247 dns_name
= get_mydnsfullname();
248 if (dns_name
== NULL
) {
252 dns_domain
= get_mydnsdomname(tmp_ctx
);
253 if (dns_domain
== NULL
) {
257 gensec_settings
->server_dns_name
= strlower_talloc(gensec_settings
, dns_name
);
258 if (gensec_settings
->server_dns_name
== NULL
) {
259 TALLOC_FREE(tmp_ctx
);
260 return NT_STATUS_NO_MEMORY
;
263 gensec_settings
->server_dns_domain
= strlower_talloc(gensec_settings
, dns_domain
);
264 if (gensec_settings
->server_dns_domain
== NULL
) {
265 TALLOC_FREE(tmp_ctx
);
266 return NT_STATUS_NO_MEMORY
;
269 gensec_settings
->backends
= talloc_zero_array(gensec_settings
,
270 struct gensec_security_ops
*, 4);
271 if (gensec_settings
->backends
== NULL
) {
272 TALLOC_FREE(tmp_ctx
);
273 return NT_STATUS_NO_MEMORY
;
278 /* These need to be in priority order, krb5 before NTLMSSP */
279 #if defined(HAVE_KRB5)
280 gensec_settings
->backends
[idx
++] = &gensec_gse_krb5_security_ops
;
283 gensec_settings
->backends
[idx
++] = gensec_security_by_oid(NULL
, GENSEC_OID_NTLMSSP
);
285 gensec_settings
->backends
[idx
++] = gensec_security_by_oid(NULL
,
289 * This is anonymous for now, because we just use it
290 * to set the kerberos state at the moment
292 server_credentials
= cli_credentials_init_anon(tmp_ctx
);
293 if (!server_credentials
) {
294 DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
295 return NT_STATUS_NO_MEMORY
;
298 cli_credentials_set_conf(server_credentials
, lp_ctx
);
300 if (lp_security() == SEC_ADS
|| USE_KERBEROS_KEYTAB
) {
301 cli_credentials_set_kerberos_state(server_credentials
, CRED_AUTO_USE_KERBEROS
);
303 cli_credentials_set_kerberos_state(server_credentials
, CRED_DONT_USE_KERBEROS
);
306 nt_status
= gensec_server_start(tmp_ctx
, gensec_settings
,
307 auth4_context
, &gensec_security
);
309 if (!NT_STATUS_IS_OK(nt_status
)) {
310 TALLOC_FREE(tmp_ctx
);
314 gensec_set_credentials(gensec_security
, server_credentials
);
316 talloc_unlink(tmp_ctx
, lp_ctx
);
317 talloc_unlink(tmp_ctx
, server_credentials
);
318 talloc_unlink(tmp_ctx
, gensec_settings
);
319 talloc_unlink(tmp_ctx
, auth4_context
);
322 nt_status
= gensec_set_remote_address(gensec_security
,
324 if (!NT_STATUS_IS_OK(nt_status
)) {
325 TALLOC_FREE(tmp_ctx
);
329 *gensec_security_out
= talloc_steal(mem_ctx
, gensec_security
);
330 TALLOC_FREE(tmp_ctx
);
334 NTSTATUS
auth_check_password_session_info(struct auth4_context
*auth_context
,
336 struct auth_usersupplied_info
*user_info
,
337 struct auth_session_info
**session_info
)
342 nt_status
= auth_context
->check_ntlm_password(auth_context
,
345 &server_info
, NULL
, NULL
);
347 if (NT_STATUS_IS_OK(nt_status
)) {
348 nt_status
= auth_context
->generate_session_info(auth_context
,
351 user_info
->client
.account_name
,
352 AUTH_SESSION_INFO_UNIX_TOKEN
|
353 AUTH_SESSION_INFO_DEFAULT_GROUPS
,
355 TALLOC_FREE(server_info
);