2 Unix SMB/CIFS implementation.
3 Standardised Authentication types
4 Copyright (C) Andrew Bartlett 2001-2010
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #ifndef AUTH_COMMON_AUTH_H
21 #define AUTH_COMMON_AUTH_H
23 #include "librpc/gen_ndr/auth.h"
25 #define USER_INFO_CASE_INSENSITIVE_USERNAME 0x01 /* username may be in any case */
26 #define USER_INFO_CASE_INSENSITIVE_PASSWORD 0x02 /* password may be in any case */
27 #define USER_INFO_DONT_CHECK_UNIX_ACCOUNT 0x04 /* don't check unix account status */
28 #define USER_INFO_INTERACTIVE_LOGON 0x08 /* Interactive logon */
29 /*unused #define USER_INFO_LOCAL_SAM_ONLY 0x10 Only authenticate against the local SAM, do not map missing passwords to NO_SUCH_USER */
30 #define USER_INFO_INFO3_AND_NO_AUTHZ 0x20 /* Only fill in server_info->info3 and do not do any authorization steps */
32 enum auth_password_state
{
33 AUTH_PASSWORD_PLAIN
= 1,
34 AUTH_PASSWORD_HASH
= 2,
35 AUTH_PASSWORD_RESPONSE
= 3
38 #define AUTH_SESSION_INFO_DEFAULT_GROUPS 0x01 /* Add the user to the default world and network groups */
39 #define AUTH_SESSION_INFO_AUTHENTICATED 0x02 /* Add the user to the 'authenticated users' group */
40 #define AUTH_SESSION_INFO_SIMPLE_PRIVILEGES 0x04 /* Use a trivial map between users and privilages, rather than a DB */
41 #define AUTH_SESSION_INFO_UNIX_TOKEN 0x08 /* The returned token must have the unix_token and unix_info elements provided */
42 #define AUTH_SESSION_INFO_NTLM 0x10 /* The returned token must have authenticated-with-NTLM flag set */
44 struct auth_usersupplied_info
46 const char *workstation_name
;
47 const struct tsocket_address
*remote_host
;
48 const struct tsocket_address
*local_host
;
50 uint32_t logon_parameters
;
54 /* the values the client gives us */
56 const char *account_name
;
57 const char *domain_name
;
60 enum auth_password_state password_state
;
68 struct samr_Password
*lanman
;
69 struct samr_Password
*nt
;
77 uint32_t negotiate_flags
;
78 enum netr_SchannelType secure_channel_type
;
79 const char *computer_name
; /* [charset(UTF8)] */
80 const char *account_name
; /* [charset(UTF8)] */
81 struct dom_sid
*sid
; /* [unique] */
82 } netlogon_trust_account
;
84 const char *service_description
;
87 struct auth_method_context
;
88 struct tevent_context
;
89 struct imessaging_context
;
90 struct loadparm_context
;
92 struct smb_krb5_context
;
94 struct auth4_context
{
96 /* Who set this up in the first place? */
102 /* methods, in the order they should be called */
103 struct auth_method_context
*methods
;
105 /* the event context to use for calls that can block */
106 struct tevent_context
*event_ctx
;
108 /* the messaging context which can be used by backends */
109 struct imessaging_context
*msg_ctx
;
111 /* loadparm context */
112 struct loadparm_context
*lp_ctx
;
114 /* SAM database for this local machine - to fill in local groups, or to authenticate local NTLM users */
115 struct ldb_context
*sam_ctx
;
117 /* Private data for the callbacks on this auth context */
120 NTSTATUS (*check_ntlm_password
)(struct auth4_context
*auth_ctx
,
122 const struct auth_usersupplied_info
*user_info
,
123 uint8_t *pauthoritative
,
124 void **server_returned_info
,
125 DATA_BLOB
*nt_session_key
, DATA_BLOB
*lm_session_key
);
127 NTSTATUS (*get_ntlm_challenge
)(struct auth4_context
*auth_ctx
, uint8_t chal
[8]);
129 NTSTATUS (*set_ntlm_challenge
)(struct auth4_context
*auth_ctx
, const uint8_t chal
[8], const char *set_by
);
131 NTSTATUS (*generate_session_info
)(struct auth4_context
*auth_context
,
133 void *server_returned_info
,
134 const char *original_user_name
,
135 uint32_t session_info_flags
,
136 struct auth_session_info
**session_info
);
138 NTSTATUS (*generate_session_info_pac
)(struct auth4_context
*auth_ctx
,
140 struct smb_krb5_context
*smb_krb5_context
,
142 const char *principal_name
,
143 const struct tsocket_address
*remote_address
,
144 uint32_t session_info_flags
,
145 struct auth_session_info
**session_info
);