?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-pam_smbpass: Fix set_ctrl() return value.
[Samba.git] / nsswitch / libwbclient / wbc_pam.c
blobe243538b818d31f66367081a88a77eff74b0e248
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind client API
5
6 Copyright (C) Gerald (Jerry) Carter 2007
7 Copyright (C) Guenther Deschner 2008
8 Copyright (C) Volker Lendecke 2009
9
10 This library is free software; you can redistribute it and/or
11 modify it under the terms of the GNU Lesser General Public
12 License as published by the Free Software Foundation; either
13 version 3 of the License, or (at your option) any later version.
14
15 This library is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Library General Public License for more details.
19
20 You should have received a copy of the GNU Lesser General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /* Required Headers */
25
26 #include "replace.h"
27 #include "libwbclient.h"
28 #include "../winbind_client.h"
29
30 /* Authenticate a username/password pair */
31 wbcErr wbcAuthenticateUser(const char *username,
32 const char *password)
33 {
34 wbcErr wbc_status = WBC_ERR_SUCCESS;
35 struct wbcAuthUserParams params;
36
37 ZERO_STRUCT(params);
38
39 params.account_name = username;
40 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
41 params.password.plaintext = password;
42
43 wbc_status = wbcAuthenticateUserEx(&params, NULL, NULL);
44 BAIL_ON_WBC_ERROR(wbc_status);
45
46 done:
47 return wbc_status;
48 }
49
50 static bool sid_attr_compose(struct wbcSidWithAttr *s,
51 const struct wbcDomainSid *d,
52 uint32_t rid, uint32_t attr)
53 {
54 if (d->num_auths >= WBC_MAXSUBAUTHS) {
55 return false;
56 }
57 s->sid = *d;
58 s->sid.sub_auths[s->sid.num_auths++] = rid;
59 s->attributes = attr;
60 return true;
61 }
62
63 static void wbcAuthUserInfoDestructor(void *ptr)
64 {
65 struct wbcAuthUserInfo *i = (struct wbcAuthUserInfo *)ptr;
66 free(i->account_name);
67 free(i->user_principal);
68 free(i->full_name);
69 free(i->domain_name);
70 free(i->dns_domain_name);
71 free(i->logon_server);
72 free(i->logon_script);
73 free(i->profile_path);
74 free(i->home_directory);
75 free(i->home_drive);
76 free(i->sids);
77 }
78
79 static wbcErr wbc_create_auth_info(const struct winbindd_response *resp,
80 struct wbcAuthUserInfo **_i)
81 {
82 wbcErr wbc_status = WBC_ERR_SUCCESS;
83 struct wbcAuthUserInfo *i;
84 struct wbcDomainSid domain_sid;
85 char *p;
86 uint32_t sn = 0;
87 uint32_t j;
88
89 i = (struct wbcAuthUserInfo *)wbcAllocateMemory(
90 1, sizeof(struct wbcAuthUserInfo),
91 wbcAuthUserInfoDestructor);
92 BAIL_ON_PTR_ERROR(i, wbc_status);
93
94 i->user_flags = resp->data.auth.info3.user_flgs;
95
96 i->account_name = strdup(resp->data.auth.info3.user_name);
97 BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
98 i->user_principal= NULL;
99 i->full_name = strdup(resp->data.auth.info3.full_name);
100 BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
101 i->domain_name = strdup(resp->data.auth.info3.logon_dom);
102 BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
103 i->dns_domain_name= NULL;
104
105 i->acct_flags = resp->data.auth.info3.acct_flags;
106 memcpy(i->user_session_key,
107 resp->data.auth.user_session_key,
108 sizeof(i->user_session_key));
109 memcpy(i->lm_session_key,
110 resp->data.auth.first_8_lm_hash,
111 sizeof(i->lm_session_key));
112
113 i->logon_count = resp->data.auth.info3.logon_count;
114 i->bad_password_count = resp->data.auth.info3.bad_pw_count;
115
116 i->logon_time = resp->data.auth.info3.logon_time;
117 i->logoff_time = resp->data.auth.info3.logoff_time;
118 i->kickoff_time = resp->data.auth.info3.kickoff_time;
119 i->pass_last_set_time = resp->data.auth.info3.pass_last_set_time;
120 i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
121 i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
122
123 i->logon_server = strdup(resp->data.auth.info3.logon_srv);
124 BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
125 i->logon_script = strdup(resp->data.auth.info3.logon_script);
126 BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
127 i->profile_path = strdup(resp->data.auth.info3.profile_path);
128 BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
129 i->home_directory= strdup(resp->data.auth.info3.home_dir);
130 BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
131 i->home_drive = strdup(resp->data.auth.info3.dir_drive);
132 BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
133
134 i->num_sids = 2;
135 i->num_sids += resp->data.auth.info3.num_groups;
136 i->num_sids += resp->data.auth.info3.num_other_sids;
137
138 i->sids = (struct wbcSidWithAttr *)calloc(
139 sizeof(struct wbcSidWithAttr), i->num_sids);
140 BAIL_ON_PTR_ERROR(i->sids, wbc_status);
141
142 wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
143 &domain_sid);
144 BAIL_ON_WBC_ERROR(wbc_status);
145
146 sn = 0;
147 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
148 resp->data.auth.info3.user_rid, 0)) {
149 wbc_status = WBC_ERR_INVALID_SID;
150 goto done;
151 }
152 sn++;
153 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
154 resp->data.auth.info3.group_rid, 0)) {
155 wbc_status = WBC_ERR_INVALID_SID;
156 goto done;
157 }
158 sn++;
159
160 p = (char *)resp->extra_data.data;
161 if (!p) {
162 wbc_status = WBC_ERR_INVALID_RESPONSE;
163 BAIL_ON_WBC_ERROR(wbc_status);
164 }
165
166 for (j=0; j < resp->data.auth.info3.num_groups; j++) {
167 uint32_t rid;
168 uint32_t attrs;
169 int ret;
170 char *s = p;
171 char *e = strchr(p, '\n');
172 if (!e) {
173 wbc_status = WBC_ERR_INVALID_RESPONSE;
174 BAIL_ON_WBC_ERROR(wbc_status);
175 }
176 e[0] = '\0';
177 p = &e[1];
178
179 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
180 if (ret != 2) {
181 wbc_status = WBC_ERR_INVALID_RESPONSE;
182 BAIL_ON_WBC_ERROR(wbc_status);
183 }
184
185 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
186 rid, attrs)) {
187 wbc_status = WBC_ERR_INVALID_SID;
188 goto done;
189 }
190 sn++;
191 }
192
193 for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
194 uint32_t attrs;
195 int ret;
196 char *s = p;
197 char *a;
198 char *e = strchr(p, '\n');
199 if (!e) {
200 wbc_status = WBC_ERR_INVALID_RESPONSE;
201 BAIL_ON_WBC_ERROR(wbc_status);
202 }
203 e[0] = '\0';
204 p = &e[1];
205
206 e = strchr(s, ':');
207 if (!e) {
208 wbc_status = WBC_ERR_INVALID_RESPONSE;
209 BAIL_ON_WBC_ERROR(wbc_status);
210 }
211 e[0] = '\0';
212 a = &e[1];
213
214 ret = sscanf(a, "0x%08X",
215 &attrs);
216 if (ret != 1) {
217 wbc_status = WBC_ERR_INVALID_RESPONSE;
218 BAIL_ON_WBC_ERROR(wbc_status);
219 }
220
221 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
222 BAIL_ON_WBC_ERROR(wbc_status);
223
224 i->sids[sn].attributes = attrs;
225 sn++;
226 }
227
228 i->num_sids = sn;
229
230 *_i = i;
231 i = NULL;
232 done:
233 wbcFreeMemory(i);
234 return wbc_status;
235 }
236
237 static void wbcAuthErrorInfoDestructor(void *ptr)
238 {
239 struct wbcAuthErrorInfo *e = (struct wbcAuthErrorInfo *)ptr;
240 free(e->nt_string);
241 free(e->display_string);
242 }
243
244 static wbcErr wbc_create_error_info(const struct winbindd_response *resp,
245 struct wbcAuthErrorInfo **_e)
246 {
247 wbcErr wbc_status = WBC_ERR_SUCCESS;
248 struct wbcAuthErrorInfo *e;
249
250 e = (struct wbcAuthErrorInfo *)wbcAllocateMemory(
251 1, sizeof(struct wbcAuthErrorInfo),
252 wbcAuthErrorInfoDestructor);
253 BAIL_ON_PTR_ERROR(e, wbc_status);
254
255 e->nt_status = resp->data.auth.nt_status;
256 e->pam_error = resp->data.auth.pam_error;
257 e->nt_string = strdup(resp->data.auth.nt_status_string);
258 BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
259
260 e->display_string = strdup(resp->data.auth.error_string);
261 BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
262
263 *_e = e;
264 e = NULL;
265
266 done:
267 wbcFreeMemory(e);
268 return wbc_status;
269 }
270
271 static wbcErr wbc_create_password_policy_info(const struct winbindd_response *resp,
272 struct wbcUserPasswordPolicyInfo **_i)
273 {
274 wbcErr wbc_status = WBC_ERR_SUCCESS;
275 struct wbcUserPasswordPolicyInfo *i;
276
277 i = (struct wbcUserPasswordPolicyInfo *)wbcAllocateMemory(
278 1, sizeof(struct wbcUserPasswordPolicyInfo), NULL);
279 BAIL_ON_PTR_ERROR(i, wbc_status);
280
281 i->min_passwordage = resp->data.auth.policy.min_passwordage;
282 i->min_length_password = resp->data.auth.policy.min_length_password;
283 i->password_history = resp->data.auth.policy.password_history;
284 i->password_properties = resp->data.auth.policy.password_properties;
285 i->expire = resp->data.auth.policy.expire;
286
287 *_i = i;
288 i = NULL;
289
290 done:
291 wbcFreeMemory(i);
292 return wbc_status;
293 }
294
295 static void wbcLogonUserInfoDestructor(void *ptr)
296 {
297 struct wbcLogonUserInfo *i = (struct wbcLogonUserInfo *)ptr;
298 wbcFreeMemory(i->info);
299 wbcFreeMemory(i->blobs);
300 }
301
302 static wbcErr wbc_create_logon_info(struct winbindd_response *resp,
303 struct wbcLogonUserInfo **_i)
304 {
305 wbcErr wbc_status = WBC_ERR_SUCCESS;
306 struct wbcLogonUserInfo *i;
307
308 i = (struct wbcLogonUserInfo *)wbcAllocateMemory(
309 1, sizeof(struct wbcLogonUserInfo),
310 wbcLogonUserInfoDestructor);
311 BAIL_ON_PTR_ERROR(i, wbc_status);
312
313 wbc_status = wbc_create_auth_info(resp, &i->info);
314 BAIL_ON_WBC_ERROR(wbc_status);
315
316 if (resp->data.auth.krb5ccname[0] != '\0') {
317 wbc_status = wbcAddNamedBlob(&i->num_blobs,
318 &i->blobs,
319 "krb5ccname",
320 0,
321 (uint8_t *)resp->data.auth.krb5ccname,
322 strlen(resp->data.auth.krb5ccname)+1);
323 BAIL_ON_WBC_ERROR(wbc_status);
324 }
325
326 if (resp->data.auth.unix_username[0] != '\0') {
327 wbc_status = wbcAddNamedBlob(&i->num_blobs,
328 &i->blobs,
329 "unix_username",
330 0,
331 (uint8_t *)resp->data.auth.unix_username,
332 strlen(resp->data.auth.unix_username)+1);
333 BAIL_ON_WBC_ERROR(wbc_status);
334 }
335
336 *_i = i;
337 i = NULL;
338 done:
339 wbcFreeMemory(i);
340 return wbc_status;
341 }
342
343
344 /* Authenticate with more detailed information */
345 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
346 struct wbcAuthUserInfo **info,
347 struct wbcAuthErrorInfo **error)
348 {
349 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
350 int cmd = 0;
351 struct winbindd_request request;
352 struct winbindd_response response;
353
354 ZERO_STRUCT(request);
355 ZERO_STRUCT(response);
356
357 if (error) {
358 *error = NULL;
359 }
360
361 if (!params) {
362 wbc_status = WBC_ERR_INVALID_PARAM;
363 BAIL_ON_WBC_ERROR(wbc_status);
364 }
365
366 if (params->level != WBC_AUTH_USER_LEVEL_PAC && !params->account_name) {
367 wbc_status = WBC_ERR_INVALID_PARAM;
368 BAIL_ON_WBC_ERROR(wbc_status);
369 }
370
371 /* Initialize request */
372
373 switch (params->level) {
374 case WBC_AUTH_USER_LEVEL_PLAIN:
375 cmd = WINBINDD_PAM_AUTH;
376 request.flags = WBFLAG_PAM_INFO3_TEXT |
377 WBFLAG_PAM_USER_SESSION_KEY |
378 WBFLAG_PAM_LMKEY;
379
380 if (!params->password.plaintext) {
381 wbc_status = WBC_ERR_INVALID_PARAM;
382 BAIL_ON_WBC_ERROR(wbc_status);
383 }
384
385 if (params->domain_name && params->domain_name[0]) {
386 /* We need to get the winbind separator :-( */
387 struct winbindd_response sep_response;
388
389 ZERO_STRUCT(sep_response);
390
391 wbc_status = wbcRequestResponse(WINBINDD_INFO,
392 NULL, &sep_response);
393 BAIL_ON_WBC_ERROR(wbc_status);
394
395 snprintf(request.data.auth.user,
396 sizeof(request.data.auth.user)-1,
397 "%s%c%s",
398 params->domain_name,
399 sep_response.data.info.winbind_separator,
400 params->account_name);
401 } else {
402 strncpy(request.data.auth.user,
403 params->account_name,
404 sizeof(request.data.auth.user)-1);
405 }
406
407 strncpy(request.data.auth.pass,
408 params->password.plaintext,
409 sizeof(request.data.auth.pass)-1);
410 break;
411
412 case WBC_AUTH_USER_LEVEL_HASH:
413 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
414 BAIL_ON_WBC_ERROR(wbc_status);
415 break;
416
417 case WBC_AUTH_USER_LEVEL_RESPONSE:
418 cmd = WINBINDD_PAM_AUTH_CRAP;
419 request.flags = WBFLAG_PAM_INFO3_TEXT |
420 WBFLAG_PAM_USER_SESSION_KEY |
421 WBFLAG_PAM_LMKEY;
422
423 if (params->password.response.lm_length &&
424 !params->password.response.lm_data) {
425 wbc_status = WBC_ERR_INVALID_PARAM;
426 BAIL_ON_WBC_ERROR(wbc_status);
427 }
428 if (params->password.response.lm_length == 0 &&
429 params->password.response.lm_data) {
430 wbc_status = WBC_ERR_INVALID_PARAM;
431 BAIL_ON_WBC_ERROR(wbc_status);
432 }
433
434 if (params->password.response.nt_length &&
435 !params->password.response.nt_data) {
436 wbc_status = WBC_ERR_INVALID_PARAM;
437 BAIL_ON_WBC_ERROR(wbc_status);
438 }
439 if (params->password.response.nt_length == 0&&
440 params->password.response.nt_data) {
441 wbc_status = WBC_ERR_INVALID_PARAM;
442 BAIL_ON_WBC_ERROR(wbc_status);
443 }
444
445 strncpy(request.data.auth_crap.user,
446 params->account_name,
447 sizeof(request.data.auth_crap.user)-1);
448 if (params->domain_name) {
449 strncpy(request.data.auth_crap.domain,
450 params->domain_name,
451 sizeof(request.data.auth_crap.domain)-1);
452 }
453 if (params->workstation_name) {
454 strncpy(request.data.auth_crap.workstation,
455 params->workstation_name,
456 sizeof(request.data.auth_crap.workstation)-1);
457 }
458
459 request.data.auth_crap.logon_parameters =
460 params->parameter_control;
461
462 memcpy(request.data.auth_crap.chal,
463 params->password.response.challenge,
464 sizeof(request.data.auth_crap.chal));
465
466 request.data.auth_crap.lm_resp_len =
467 MIN(params->password.response.lm_length,
468 sizeof(request.data.auth_crap.lm_resp));
469 if (params->password.response.lm_data) {
470 memcpy(request.data.auth_crap.lm_resp,
471 params->password.response.lm_data,
472 request.data.auth_crap.lm_resp_len);
473 }
474 request.data.auth_crap.nt_resp_len = params->password.response.nt_length;
475 if (params->password.response.nt_length > sizeof(request.data.auth_crap.nt_resp)) {
476 request.flags |= WBFLAG_BIG_NTLMV2_BLOB;
477 request.extra_len = params->password.response.nt_length;
478 request.extra_data.data = (char *)malloc(
479 request.extra_len);
480 if (request.extra_data.data == NULL) {
481 wbc_status = WBC_ERR_NO_MEMORY;
482 BAIL_ON_WBC_ERROR(wbc_status);
483 }
484 memcpy(request.extra_data.data,
485 params->password.response.nt_data,
486 request.data.auth_crap.nt_resp_len);
487 } else if (params->password.response.nt_data) {
488 memcpy(request.data.auth_crap.nt_resp,
489 params->password.response.nt_data,
490 request.data.auth_crap.nt_resp_len);
491 }
492 break;
493
494 case WBC_AUTH_USER_LEVEL_PAC:
495 cmd = WINBINDD_PAM_AUTH_CRAP;
496 request.flags = WBFLAG_PAM_AUTH_PAC | WBFLAG_PAM_INFO3_TEXT;
497 request.extra_data.data = malloc(params->password.pac.length);
498 if (request.extra_data.data == NULL) {
499 wbc_status = WBC_ERR_NO_MEMORY;
500 BAIL_ON_WBC_ERROR(wbc_status);
501 }
502 memcpy(request.extra_data.data, params->password.pac.data,
503 params->password.pac.length);
504 request.extra_len = params->password.pac.length;
505 break;
506
507 default:
508 break;
509 }
510
511 if (cmd == 0) {
512 wbc_status = WBC_ERR_INVALID_PARAM;
513 BAIL_ON_WBC_ERROR(wbc_status);
514 }
515
516 if (params->flags) {
517 request.flags |= params->flags;
518 }
519
520 if (cmd == WINBINDD_PAM_AUTH_CRAP) {
521 wbc_status = wbcRequestResponsePriv(cmd, &request, &response);
522 } else {
523 wbc_status = wbcRequestResponse(cmd, &request, &response);
524 }
525 if (response.data.auth.nt_status != 0) {
526 if (error) {
527 wbc_status = wbc_create_error_info(&response,
528 error);
529 BAIL_ON_WBC_ERROR(wbc_status);
530 }
531
532 wbc_status = WBC_ERR_AUTH_ERROR;
533 BAIL_ON_WBC_ERROR(wbc_status);
534 }
535 BAIL_ON_WBC_ERROR(wbc_status);
536
537 if (info) {
538 wbc_status = wbc_create_auth_info(&response, info);
539 BAIL_ON_WBC_ERROR(wbc_status);
540 }
541
542 done:
543 winbindd_free_response(&response);
544
545 free(request.extra_data.data);
546
547 return wbc_status;
548 }
549
550 /* Trigger a verification of the trust credentials of a specific domain */
551 wbcErr wbcCheckTrustCredentials(const char *domain,
552 struct wbcAuthErrorInfo **error)
553 {
554 struct winbindd_request request;
555 struct winbindd_response response;
556 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
557
558 ZERO_STRUCT(request);
559 ZERO_STRUCT(response);
560
561 if (domain) {
562 strncpy(request.domain_name, domain,
563 sizeof(request.domain_name)-1);
564 }
565
566 /* Send request */
567
568 wbc_status = wbcRequestResponsePriv(WINBINDD_CHECK_MACHACC,
569 &request, &response);
570 if (response.data.auth.nt_status != 0) {
571 if (error) {
572 wbc_status = wbc_create_error_info(&response,
573 error);
574 BAIL_ON_WBC_ERROR(wbc_status);
575 }
576
577 wbc_status = WBC_ERR_AUTH_ERROR;
578 BAIL_ON_WBC_ERROR(wbc_status);
579 }
580 BAIL_ON_WBC_ERROR(wbc_status);
581
582 done:
583 return wbc_status;
584 }
585
586 /* Trigger a change of the trust credentials for a specific domain */
587 wbcErr wbcChangeTrustCredentials(const char *domain,
588 struct wbcAuthErrorInfo **error)
589 {
590 struct winbindd_request request;
591 struct winbindd_response response;
592 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
593
594 ZERO_STRUCT(request);
595 ZERO_STRUCT(response);
596
597 if (domain) {
598 strncpy(request.domain_name, domain,
599 sizeof(request.domain_name)-1);
600 }
601
602 /* Send request */
603
604 wbc_status = wbcRequestResponsePriv(WINBINDD_CHANGE_MACHACC,
605 &request, &response);
606 if (response.data.auth.nt_status != 0) {
607 if (error) {
608 wbc_status = wbc_create_error_info(&response,
609 error);
610 BAIL_ON_WBC_ERROR(wbc_status);
611 }
612
613 wbc_status = WBC_ERR_AUTH_ERROR;
614 BAIL_ON_WBC_ERROR(wbc_status);
615 }
616 BAIL_ON_WBC_ERROR(wbc_status);
617
618 done:
619 return wbc_status;
620 }
621
622 /*
623 * Trigger a no-op NETLOGON call. Lightweight version of
624 * wbcCheckTrustCredentials
625 */
626 wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
627 {
628 return wbcPingDc2(domain, error, NULL);
629 }
630
631 /*
632 * Trigger a no-op NETLOGON call. Lightweight version of
633 * wbcCheckTrustCredentials, optionally return attempted DC
634 */
635 wbcErr wbcPingDc2(const char *domain, struct wbcAuthErrorInfo **error,
636 char **dcname)
637 {
638 struct winbindd_request request;
639 struct winbindd_response response;
640 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
641
642 ZERO_STRUCT(request);
643 ZERO_STRUCT(response);
644
645 if (domain) {
646 strncpy(request.domain_name, domain,
647 sizeof(request.domain_name)-1);
648 }
649
650 /* Send request */
651
652 wbc_status = wbcRequestResponse(WINBINDD_PING_DC,
653 &request,
654 &response);
655
656 if (dcname && response.extra_data.data) {
657 size_t len;
658
659 len = response.length - sizeof(struct winbindd_response);
660 *dcname = wbcAllocateMemory(1, len, NULL);
661 BAIL_ON_PTR_ERROR(*dcname, wbc_status);
662
663 strlcpy(*dcname, response.extra_data.data, len);
664 }
665
666 if (response.data.auth.nt_status != 0) {
667 if (error) {
668 wbc_status = wbc_create_error_info(&response,
669 error);
670 BAIL_ON_WBC_ERROR(wbc_status);
671 }
672
673 wbc_status = WBC_ERR_AUTH_ERROR;
674 BAIL_ON_WBC_ERROR(wbc_status);
675 }
676 BAIL_ON_WBC_ERROR(wbc_status);
677
678 done:
679 return wbc_status;
680 }
681
682 /* Trigger an extended logoff notification to Winbind for a specific user */
683 wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
684 struct wbcAuthErrorInfo **error)
685 {
686 struct winbindd_request request;
687 struct winbindd_response response;
688 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
689 int i;
690
691 /* validate input */
692
693 if (!params || !params->username) {
694 wbc_status = WBC_ERR_INVALID_PARAM;
695 BAIL_ON_WBC_ERROR(wbc_status);
696 }
697
698 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
699 wbc_status = WBC_ERR_INVALID_PARAM;
700 BAIL_ON_WBC_ERROR(wbc_status);
701 }
702 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
703 wbc_status = WBC_ERR_INVALID_PARAM;
704 BAIL_ON_WBC_ERROR(wbc_status);
705 }
706
707 ZERO_STRUCT(request);
708 ZERO_STRUCT(response);
709
710 strncpy(request.data.logoff.user, params->username,
711 sizeof(request.data.logoff.user)-1);
712
713 for (i=0; i<params->num_blobs; i++) {
714
715 if (strcasecmp(params->blobs[i].name, "ccfilename") == 0) {
716 if (params->blobs[i].blob.data) {
717 strncpy(request.data.logoff.krb5ccname,
718 (const char *)params->blobs[i].blob.data,
719 sizeof(request.data.logoff.krb5ccname) - 1);
720 }
721 continue;
722 }
723
724 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
725 if (params->blobs[i].blob.data) {
726 memcpy(&request.data.logoff.uid,
727 params->blobs[i].blob.data,
728 MIN(params->blobs[i].blob.length,
729 sizeof(request.data.logoff.uid)));
730 }
731 continue;
732 }
733
734 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
735 if (params->blobs[i].blob.data) {
736 memcpy(&request.flags,
737 params->blobs[i].blob.data,
738 MIN(params->blobs[i].blob.length,
739 sizeof(request.flags)));
740 }
741 continue;
742 }
743 }
744
745 /* Send request */
746
747 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
748 &request,
749 &response);
750
751 /* Take the response above and return it to the caller */
752 if (response.data.auth.nt_status != 0) {
753 if (error) {
754 wbc_status = wbc_create_error_info(&response,
755 error);
756 BAIL_ON_WBC_ERROR(wbc_status);
757 }
758
759 wbc_status = WBC_ERR_AUTH_ERROR;
760 BAIL_ON_WBC_ERROR(wbc_status);
761 }
762 BAIL_ON_WBC_ERROR(wbc_status);
763
764 done:
765 return wbc_status;
766 }
767
768 /* Trigger a logoff notification to Winbind for a specific user */
769 wbcErr wbcLogoffUser(const char *username,
770 uid_t uid,
771 const char *ccfilename)
772 {
773 struct winbindd_request request;
774 struct winbindd_response response;
775 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
776
777 /* validate input */
778
779 if (!username) {
780 wbc_status = WBC_ERR_INVALID_PARAM;
781 BAIL_ON_WBC_ERROR(wbc_status);
782 }
783
784 ZERO_STRUCT(request);
785 ZERO_STRUCT(response);
786
787 strncpy(request.data.logoff.user, username,
788 sizeof(request.data.logoff.user)-1);
789 request.data.logoff.uid = uid;
790
791 if (ccfilename) {
792 strncpy(request.data.logoff.krb5ccname, ccfilename,
793 sizeof(request.data.logoff.krb5ccname)-1);
794 }
795
796 /* Send request */
797
798 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
799 &request,
800 &response);
801
802 /* Take the response above and return it to the caller */
803
804 done:
805 return wbc_status;
806 }
807
808 /* Change a password for a user with more detailed information upon failure */
809 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
810 struct wbcAuthErrorInfo **error,
811 enum wbcPasswordChangeRejectReason *reject_reason,
812 struct wbcUserPasswordPolicyInfo **policy)
813 {
814 struct winbindd_request request;
815 struct winbindd_response response;
816 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
817 int cmd = 0;
818
819 /* validate input */
820
821 if (!params->account_name) {
822 wbc_status = WBC_ERR_INVALID_PARAM;
823 goto done;
824 }
825
826 if (error) {
827 *error = NULL;
828 }
829
830 if (policy) {
831 *policy = NULL;
832 }
833
834 if (reject_reason) {
835 *reject_reason = -1;
836 }
837
838 ZERO_STRUCT(request);
839 ZERO_STRUCT(response);
840
841 switch (params->level) {
842 case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
843 cmd = WINBINDD_PAM_CHAUTHTOK;
844
845 if (!params->account_name) {
846 wbc_status = WBC_ERR_INVALID_PARAM;
847 goto done;
848 }
849
850 strncpy(request.data.chauthtok.user, params->account_name,
851 sizeof(request.data.chauthtok.user) - 1);
852
853 if (params->old_password.plaintext) {
854 strncpy(request.data.chauthtok.oldpass,
855 params->old_password.plaintext,
856 sizeof(request.data.chauthtok.oldpass) - 1);
857 }
858
859 if (params->new_password.plaintext) {
860 strncpy(request.data.chauthtok.newpass,
861 params->new_password.plaintext,
862 sizeof(request.data.chauthtok.newpass) - 1);
863 }
864 break;
865
866 case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
867 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
868
869 if (!params->account_name || !params->domain_name) {
870 wbc_status = WBC_ERR_INVALID_PARAM;
871 goto done;
872 }
873
874 if (params->old_password.response.old_lm_hash_enc_length &&
875 !params->old_password.response.old_lm_hash_enc_data) {
876 wbc_status = WBC_ERR_INVALID_PARAM;
877 goto done;
878 }
879
880 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
881 params->old_password.response.old_lm_hash_enc_data) {
882 wbc_status = WBC_ERR_INVALID_PARAM;
883 goto done;
884 }
885
886 if (params->old_password.response.old_nt_hash_enc_length &&
887 !params->old_password.response.old_nt_hash_enc_data) {
888 wbc_status = WBC_ERR_INVALID_PARAM;
889 goto done;
890 }
891
892 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
893 params->old_password.response.old_nt_hash_enc_data) {
894 wbc_status = WBC_ERR_INVALID_PARAM;
895 goto done;
896 }
897
898 if (params->new_password.response.lm_length &&
899 !params->new_password.response.lm_data) {
900 wbc_status = WBC_ERR_INVALID_PARAM;
901 goto done;
902 }
903
904 if (params->new_password.response.lm_length == 0 &&
905 params->new_password.response.lm_data) {
906 wbc_status = WBC_ERR_INVALID_PARAM;
907 goto done;
908 }
909
910 if (params->new_password.response.nt_length &&
911 !params->new_password.response.nt_data) {
912 wbc_status = WBC_ERR_INVALID_PARAM;
913 goto done;
914 }
915
916 if (params->new_password.response.nt_length == 0 &&
917 params->new_password.response.nt_data) {
918 wbc_status = WBC_ERR_INVALID_PARAM;
919 goto done;
920 }
921
922 strncpy(request.data.chng_pswd_auth_crap.user,
923 params->account_name,
924 sizeof(request.data.chng_pswd_auth_crap.user) - 1);
925
926 strncpy(request.data.chng_pswd_auth_crap.domain,
927 params->domain_name,
928 sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
929
930 if (params->new_password.response.nt_data) {
931 request.data.chng_pswd_auth_crap.new_nt_pswd_len =
932 params->new_password.response.nt_length;
933 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
934 params->new_password.response.nt_data,
935 request.data.chng_pswd_auth_crap.new_nt_pswd_len);
936 }
937
938 if (params->new_password.response.lm_data) {
939 request.data.chng_pswd_auth_crap.new_lm_pswd_len =
940 params->new_password.response.lm_length;
941 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
942 params->new_password.response.lm_data,
943 request.data.chng_pswd_auth_crap.new_lm_pswd_len);
944 }
945
946 if (params->old_password.response.old_nt_hash_enc_data) {
947 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
948 params->old_password.response.old_nt_hash_enc_length;
949 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
950 params->old_password.response.old_nt_hash_enc_data,
951 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
952 }
953
954 if (params->old_password.response.old_lm_hash_enc_data) {
955 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
956 params->old_password.response.old_lm_hash_enc_length;
957 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
958 params->old_password.response.old_lm_hash_enc_data,
959 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
960 }
961
962 break;
963 default:
964 wbc_status = WBC_ERR_INVALID_PARAM;
965 goto done;
966 break;
967 }
968
969 /* Send request */
970
971 wbc_status = wbcRequestResponse(cmd,
972 &request,
973 &response);
974 if (WBC_ERROR_IS_OK(wbc_status)) {
975 goto done;
976 }
977
978 /* Take the response above and return it to the caller */
979
980 if (response.data.auth.nt_status != 0) {
981 if (error) {
982 wbc_status = wbc_create_error_info(&response,
983 error);
984 BAIL_ON_WBC_ERROR(wbc_status);
985 }
986
987 }
988
989 if (policy) {
990 wbc_status = wbc_create_password_policy_info(&response,
991 policy);
992 BAIL_ON_WBC_ERROR(wbc_status);
993 }
994
995 if (reject_reason) {
996 *reject_reason = response.data.auth.reject_reason;
997 }
998
999 wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
1000 BAIL_ON_WBC_ERROR(wbc_status);
1001
1002 done:
1003 return wbc_status;
1004 }
1005
1006 /* Change a password for a user */
1007 wbcErr wbcChangeUserPassword(const char *username,
1008 const char *old_password,
1009 const char *new_password)
1010 {
1011 wbcErr wbc_status = WBC_ERR_SUCCESS;
1012 struct wbcChangePasswordParams params;
1013
1014 ZERO_STRUCT(params);
1015
1016 params.account_name = username;
1017 params.level = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
1018 params.old_password.plaintext = old_password;
1019 params.new_password.plaintext = new_password;
1020
1021 wbc_status = wbcChangeUserPasswordEx(&params,
1022 NULL,
1023 NULL,
1024 NULL);
1025 BAIL_ON_WBC_ERROR(wbc_status);
1026
1027 done:
1028 return wbc_status;
1029 }
1030
1031 /* Logon a User */
1032 wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
1033 struct wbcLogonUserInfo **info,
1034 struct wbcAuthErrorInfo **error,
1035 struct wbcUserPasswordPolicyInfo **policy)
1036 {
1037 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1038 struct winbindd_request request;
1039 struct winbindd_response response;
1040 uint32_t i;
1041
1042 ZERO_STRUCT(request);
1043 ZERO_STRUCT(response);
1044
1045 if (info) {
1046 *info = NULL;
1047 }
1048 if (error) {
1049 *error = NULL;
1050 }
1051 if (policy) {
1052 *policy = NULL;
1053 }
1054
1055 if (!params) {
1056 wbc_status = WBC_ERR_INVALID_PARAM;
1057 BAIL_ON_WBC_ERROR(wbc_status);
1058 }
1059
1060 if (!params->username) {
1061 wbc_status = WBC_ERR_INVALID_PARAM;
1062 BAIL_ON_WBC_ERROR(wbc_status);
1063 }
1064
1065 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
1066 wbc_status = WBC_ERR_INVALID_PARAM;
1067 BAIL_ON_WBC_ERROR(wbc_status);
1068 }
1069 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
1070 wbc_status = WBC_ERR_INVALID_PARAM;
1071 BAIL_ON_WBC_ERROR(wbc_status);
1072 }
1073
1074 /* Initialize request */
1075
1076 request.flags = WBFLAG_PAM_INFO3_TEXT |
1077 WBFLAG_PAM_USER_SESSION_KEY |
1078 WBFLAG_PAM_LMKEY;
1079
1080 if (!params->password) {
1081 wbc_status = WBC_ERR_INVALID_PARAM;
1082 BAIL_ON_WBC_ERROR(wbc_status);
1083 }
1084
1085 strncpy(request.data.auth.user,
1086 params->username,
1087 sizeof(request.data.auth.user)-1);
1088
1089 strncpy(request.data.auth.pass,
1090 params->password,
1091 sizeof(request.data.auth.pass)-1);
1092
1093 for (i=0; i<params->num_blobs; i++) {
1094
1095 if (strcasecmp(params->blobs[i].name, "krb5_cc_type") == 0) {
1096 if (params->blobs[i].blob.data) {
1097 strncpy(request.data.auth.krb5_cc_type,
1098 (const char *)params->blobs[i].blob.data,
1099 sizeof(request.data.auth.krb5_cc_type) - 1);
1100 }
1101 continue;
1102 }
1103
1104 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
1105 if (params->blobs[i].blob.data) {
1106 memcpy(&request.data.auth.uid,
1107 params->blobs[i].blob.data,
1108 MIN(sizeof(request.data.auth.uid),
1109 params->blobs[i].blob.length));
1110 }
1111 continue;
1112 }
1113
1114 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
1115 if (params->blobs[i].blob.data) {
1116 uint32_t flags;
1117 memcpy(&flags,
1118 params->blobs[i].blob.data,
1119 MIN(sizeof(flags),
1120 params->blobs[i].blob.length));
1121 request.flags |= flags;
1122 }
1123 continue;
1124 }
1125
1126 if (strcasecmp(params->blobs[i].name, "membership_of") == 0) {
1127 if (params->blobs[i].blob.data &&
1128 params->blobs[i].blob.data[0] > 0) {
1129 strncpy(request.data.auth.require_membership_of_sid,
1130 (const char *)params->blobs[i].blob.data,
1131 sizeof(request.data.auth.require_membership_of_sid) - 1);
1132 }
1133 continue;
1134 }
1135 }
1136
1137 wbc_status = wbcRequestResponse(WINBINDD_PAM_AUTH,
1138 &request,
1139 &response);
1140
1141 if (response.data.auth.nt_status != 0) {
1142 if (error) {
1143 wbc_status = wbc_create_error_info(&response,
1144 error);
1145 BAIL_ON_WBC_ERROR(wbc_status);
1146 }
1147
1148 wbc_status = WBC_ERR_AUTH_ERROR;
1149 BAIL_ON_WBC_ERROR(wbc_status);
1150 }
1151 BAIL_ON_WBC_ERROR(wbc_status);
1152
1153 if (info) {
1154 wbc_status = wbc_create_logon_info(&response,
1155 info);
1156 BAIL_ON_WBC_ERROR(wbc_status);
1157 }
1158
1159 if (policy) {
1160 wbc_status = wbc_create_password_policy_info(&response,
1161 policy);
1162 BAIL_ON_WBC_ERROR(wbc_status);
1163 }
1164
1165 done:
1166 winbindd_free_response(&response);
1167
1168 return wbc_status;
1169 }
1170
1171 static void wbcCredentialCacheInfoDestructor(void *ptr)
1172 {
1173 struct wbcCredentialCacheInfo *i =
1174 (struct wbcCredentialCacheInfo *)ptr;
1175 wbcFreeMemory(i->blobs);
1176 }
1177
1178 /* Authenticate a user with cached credentials */
1179 wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
1180 struct wbcCredentialCacheInfo **info,
1181 struct wbcAuthErrorInfo **error)
1182 {
1183 wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
1184 struct wbcCredentialCacheInfo *result = NULL;
1185 struct winbindd_request request;
1186 struct winbindd_response response;
1187 struct wbcNamedBlob *initial_blob = NULL;
1188 struct wbcNamedBlob *challenge_blob = NULL;
1189 int i;
1190
1191 ZERO_STRUCT(request);
1192 ZERO_STRUCT(response);
1193
1194 *info = NULL;
1195
1196 if (error != NULL) {
1197 *error = NULL;
1198 }
1199 if ((params == NULL)
1200 || (params->account_name == NULL)
1201 || (params->level != WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP)) {
1202 status = WBC_ERR_INVALID_PARAM;
1203 goto fail;
1204 }
1205
1206 for (i=0; i<params->num_blobs; i++) {
1207 if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) {
1208 if (initial_blob != NULL) {
1209 status = WBC_ERR_INVALID_PARAM;
1210 goto fail;
1211 }
1212 initial_blob = &params->blobs[i];
1213 continue;
1214 }
1215 if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
1216 if (challenge_blob != NULL) {
1217 status = WBC_ERR_INVALID_PARAM;
1218 goto fail;
1219 }
1220 challenge_blob = &params->blobs[i];
1221 continue;
1222 }
1223 }
1224
1225 if (params->domain_name != NULL) {
1226 status = wbcRequestResponse(WINBINDD_INFO, NULL, &response);
1227 if (!WBC_ERROR_IS_OK(status)) {
1228 goto fail;
1229 }
1230 snprintf(request.data.ccache_ntlm_auth.user,
1231 sizeof(request.data.ccache_ntlm_auth.user)-1,
1232 "%s%c%s", params->domain_name,
1233 response.data.info.winbind_separator,
1234 params->account_name);
1235 } else {
1236 strncpy(request.data.ccache_ntlm_auth.user,
1237 params->account_name,
1238 sizeof(request.data.ccache_ntlm_auth.user)-1);
1239 }
1240 request.data.ccache_ntlm_auth.uid = getuid();
1241
1242 request.data.ccache_ntlm_auth.initial_blob_len = 0;
1243 request.data.ccache_ntlm_auth.challenge_blob_len = 0;
1244 request.extra_len = 0;
1245
1246 if (initial_blob != NULL) {
1247 request.data.ccache_ntlm_auth.initial_blob_len =
1248 initial_blob->blob.length;
1249 request.extra_len += initial_blob->blob.length;
1250 }
1251 if (challenge_blob != NULL) {
1252 request.data.ccache_ntlm_auth.challenge_blob_len =
1253 challenge_blob->blob.length;
1254 request.extra_len += challenge_blob->blob.length;
1255 }
1256
1257 if (request.extra_len != 0) {
1258 request.extra_data.data = (char *)malloc(request.extra_len);
1259 if (request.extra_data.data == NULL) {
1260 status = WBC_ERR_NO_MEMORY;
1261 goto fail;
1262 }
1263 }
1264 if (initial_blob != NULL) {
1265 memcpy(request.extra_data.data,
1266 initial_blob->blob.data, initial_blob->blob.length);
1267 }
1268 if (challenge_blob != NULL) {
1269 memcpy(request.extra_data.data
1270 + request.data.ccache_ntlm_auth.initial_blob_len,
1271 challenge_blob->blob.data,
1272 challenge_blob->blob.length);
1273 }
1274
1275 status = wbcRequestResponse(WINBINDD_CCACHE_NTLMAUTH, &request,
1276 &response);
1277 if (!WBC_ERROR_IS_OK(status)) {
1278 goto fail;
1279 }
1280
1281 result = (struct wbcCredentialCacheInfo *)wbcAllocateMemory(
1282 1, sizeof(struct wbcCredentialCacheInfo),
1283 wbcCredentialCacheInfoDestructor);
1284 if (result == NULL) {
1285 status = WBC_ERR_NO_MEMORY;
1286 goto fail;
1287 }
1288 result->num_blobs = 0;
1289 result->blobs = NULL;
1290 status = wbcAddNamedBlob(&result->num_blobs, &result->blobs,
1291 "auth_blob", 0,
1292 (uint8_t *)response.extra_data.data,
1293 response.data.ccache_ntlm_auth.auth_blob_len);
1294 if (!WBC_ERROR_IS_OK(status)) {
1295 goto fail;
1296 }
1297 status = wbcAddNamedBlob(
1298 &result->num_blobs, &result->blobs, "session_key", 0,
1299 response.data.ccache_ntlm_auth.session_key,
1300 sizeof(response.data.ccache_ntlm_auth.session_key));
1301 if (!WBC_ERROR_IS_OK(status)) {
1302 goto fail;
1303 }
1304
1305 *info = result;
1306 result = NULL;
1307 status = WBC_ERR_SUCCESS;
1308 fail:
1309 free(request.extra_data.data);
1310 winbindd_free_response(&response);
1311 wbcFreeMemory(result);
1312 return status;
1313 }
1314
1315 /* Authenticate a user with cached credentials */
1316 wbcErr wbcCredentialSave(const char *user, const char *password)
1317 {
1318 struct winbindd_request request;
1319 struct winbindd_response response;
1320
1321 ZERO_STRUCT(request);
1322 ZERO_STRUCT(response);
1323
1324 strncpy(request.data.ccache_save.user, user,
1325 sizeof(request.data.ccache_save.user)-1);
1326 strncpy(request.data.ccache_save.pass, password,
1327 sizeof(request.data.ccache_save.pass)-1);
1328 request.data.ccache_save.uid = getuid();
1329
1330 return wbcRequestResponse(WINBINDD_CCACHE_SAVE, &request, &response);
1331 }
Samba GIT mirror