2 Unix SMB/Netbios implementation.
4 handle GENSEC authentication, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003,2011
8 Copyright (C) Simo Sorce 2010.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../lib/tsocket/tsocket.h"
27 #include "auth/gensec/gensec.h"
28 #include "lib/param/param.h"
30 #include "auth/kerberos/pac_utils.h"
32 #include "librpc/crypto/gse.h"
33 #include "auth/credentials/credentials.h"
34 #include "lib/param/loadparm.h"
35 #include "librpc/gen_ndr/dcerpc.h"
37 static NTSTATUS
auth3_generate_session_info_pac(struct auth4_context
*auth_ctx
,
39 struct smb_krb5_context
*smb_krb5_context
,
41 const char *princ_name
,
42 const struct tsocket_address
*remote_address
,
43 uint32_t session_info_flags
,
44 struct auth_session_info
**session_info
)
47 struct PAC_LOGON_INFO
*logon_info
= NULL
;
58 tmp_ctx
= talloc_new(mem_ctx
);
60 return NT_STATUS_NO_MEMORY
;
65 status
= kerberos_pac_logon_info(tmp_ctx
, *pac_blob
, NULL
, NULL
,
66 NULL
, NULL
, 0, &logon_info
);
68 status
= NT_STATUS_ACCESS_DENIED
;
70 if (!NT_STATUS_IS_OK(status
)) {
75 rc
= get_remote_hostname(remote_address
,
79 status
= NT_STATUS_NO_MEMORY
;
82 if (strequal(rhost
, "UNKNOWN")) {
83 rhost
= tsocket_address_inet_addr_string(remote_address
,
86 status
= NT_STATUS_NO_MEMORY
;
91 status
= get_user_from_kerberos_info(tmp_ctx
, rhost
,
92 princ_name
, logon_info
,
93 &is_mapped
, &is_guest
,
96 if (!NT_STATUS_IS_OK(status
)) {
97 DEBUG(1, ("Failed to map kerberos principal to system user "
98 "(%s)\n", nt_errstr(status
)));
99 status
= NT_STATUS_ACCESS_DENIED
;
103 /* save the PAC data if we have it */
105 netsamlogon_cache_store(ntuser
, &logon_info
->info3
);
108 /* setup the string used by %U */
109 sub_set_smb_name(username
);
111 /* reload services so that the new %U is taken into account */
112 lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
114 status
= make_session_info_krb5(mem_ctx
,
115 ntuser
, ntdomain
, username
, pw
,
116 logon_info
, is_guest
, is_mapped
, NULL
/* No session key for now, caller will sort it out */,
118 if (!NT_STATUS_IS_OK(status
)) {
119 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
121 status
= NT_STATUS_ACCESS_DENIED
;
125 DEBUG(5, (__location__
"OK: user: %s domain: %s client: %s\n",
126 ntuser
, ntdomain
, rhost
));
128 status
= NT_STATUS_OK
;
131 TALLOC_FREE(tmp_ctx
);
135 static struct auth4_context
*make_auth4_context_s3(TALLOC_CTX
*mem_ctx
, struct auth_context
*auth_context
)
137 struct auth4_context
*auth4_context
= talloc_zero(mem_ctx
, struct auth4_context
);
138 if (auth4_context
== NULL
) {
139 DEBUG(10, ("failed to allocate auth4_context failed\n"));
142 auth4_context
->generate_session_info_pac
= auth3_generate_session_info_pac
;
143 auth4_context
->generate_session_info
= auth3_generate_session_info
;
144 auth4_context
->get_ntlm_challenge
= auth3_get_challenge
;
145 auth4_context
->set_ntlm_challenge
= auth3_set_challenge
;
146 auth4_context
->check_ntlm_password
= auth3_check_password
;
147 auth4_context
->private_data
= talloc_steal(auth4_context
, auth_context
);
148 return auth4_context
;
151 NTSTATUS
make_auth4_context(TALLOC_CTX
*mem_ctx
, struct auth4_context
**auth4_context_out
)
153 struct auth_context
*auth_context
;
156 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
157 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
159 nt_status
= make_auth_context_subsystem(tmp_ctx
, &auth_context
);
160 if (!NT_STATUS_IS_OK(nt_status
)) {
161 TALLOC_FREE(tmp_ctx
);
165 if (auth_context
->make_auth4_context
) {
166 nt_status
= auth_context
->make_auth4_context(auth_context
, mem_ctx
, auth4_context_out
);
167 TALLOC_FREE(tmp_ctx
);
171 struct auth4_context
*auth4_context
= make_auth4_context_s3(tmp_ctx
, auth_context
);
172 if (auth4_context
== NULL
) {
173 TALLOC_FREE(tmp_ctx
);
174 return NT_STATUS_NO_MEMORY
;
176 *auth4_context_out
= talloc_steal(mem_ctx
, auth4_context
);
177 TALLOC_FREE(tmp_ctx
);
182 NTSTATUS
auth_generic_prepare(TALLOC_CTX
*mem_ctx
,
183 const struct tsocket_address
*remote_address
,
184 struct gensec_security
**gensec_security_out
)
186 struct gensec_security
*gensec_security
;
187 struct auth_context
*auth_context
;
190 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
191 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
193 nt_status
= make_auth_context_subsystem(tmp_ctx
, &auth_context
);
194 if (!NT_STATUS_IS_OK(nt_status
)) {
195 TALLOC_FREE(tmp_ctx
);
199 if (auth_context
->prepare_gensec
) {
200 nt_status
= auth_context
->prepare_gensec(auth_context
, tmp_ctx
,
202 if (!NT_STATUS_IS_OK(nt_status
)) {
203 TALLOC_FREE(tmp_ctx
);
207 const struct gensec_security_ops
**backends
= NULL
;
208 struct gensec_settings
*gensec_settings
;
209 struct loadparm_context
*lp_ctx
;
211 struct cli_credentials
*server_credentials
;
212 const char *dns_name
;
213 const char *dns_domain
;
214 struct auth4_context
*auth4_context
= make_auth4_context_s3(tmp_ctx
, auth_context
);
215 if (auth4_context
== NULL
) {
216 TALLOC_FREE(tmp_ctx
);
217 return NT_STATUS_NO_MEMORY
;
220 lp_ctx
= loadparm_init_s3(tmp_ctx
, loadparm_s3_helpers());
221 if (lp_ctx
== NULL
) {
222 DEBUG(10, ("loadparm_init_s3 failed\n"));
223 TALLOC_FREE(tmp_ctx
);
224 return NT_STATUS_INVALID_SERVER_STATE
;
227 gensec_settings
= lpcfg_gensec_settings(tmp_ctx
, lp_ctx
);
228 if (lp_ctx
== NULL
) {
229 DEBUG(10, ("lpcfg_gensec_settings failed\n"));
230 TALLOC_FREE(tmp_ctx
);
231 return NT_STATUS_NO_MEMORY
;
235 * This should be a 'netbios domain -> DNS domain'
236 * mapping, and can currently validly return NULL on
237 * poorly configured systems.
239 * This is used for the NTLMSSP server
242 dns_name
= get_mydnsfullname();
243 if (dns_name
== NULL
) {
247 dns_domain
= get_mydnsdomname(tmp_ctx
);
248 if (dns_domain
== NULL
) {
252 gensec_settings
->server_dns_name
= strlower_talloc(gensec_settings
, dns_name
);
253 if (gensec_settings
->server_dns_name
== NULL
) {
254 TALLOC_FREE(tmp_ctx
);
255 return NT_STATUS_NO_MEMORY
;
258 gensec_settings
->server_dns_domain
= strlower_talloc(gensec_settings
, dns_domain
);
259 if (gensec_settings
->server_dns_domain
== NULL
) {
260 TALLOC_FREE(tmp_ctx
);
261 return NT_STATUS_NO_MEMORY
;
264 backends
= talloc_zero_array(gensec_settings
,
265 const struct gensec_security_ops
*, 6);
266 if (backends
== NULL
) {
267 TALLOC_FREE(tmp_ctx
);
268 return NT_STATUS_NO_MEMORY
;
270 gensec_settings
->backends
= backends
;
274 /* These need to be in priority order, krb5 before NTLMSSP */
275 #if defined(HAVE_KRB5)
276 backends
[idx
++] = &gensec_gse_krb5_security_ops
;
279 backends
[idx
++] = gensec_security_by_oid(NULL
, GENSEC_OID_NTLMSSP
);
281 backends
[idx
++] = gensec_security_by_oid(NULL
, GENSEC_OID_SPNEGO
);
283 backends
[idx
++] = gensec_security_by_auth_type(NULL
, DCERPC_AUTH_TYPE_SCHANNEL
);
285 backends
[idx
++] = gensec_security_by_auth_type(NULL
, DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM
);
288 * This is anonymous for now, because we just use it
289 * to set the kerberos state at the moment
291 server_credentials
= cli_credentials_init_anon(tmp_ctx
);
292 if (!server_credentials
) {
293 DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
294 return NT_STATUS_NO_MEMORY
;
297 cli_credentials_set_conf(server_credentials
, lp_ctx
);
299 if (lp_security() == SEC_ADS
|| USE_KERBEROS_KEYTAB
) {
300 cli_credentials_set_kerberos_state(server_credentials
, CRED_AUTO_USE_KERBEROS
);
302 cli_credentials_set_kerberos_state(server_credentials
, CRED_DONT_USE_KERBEROS
);
305 nt_status
= gensec_server_start(tmp_ctx
, gensec_settings
,
306 auth4_context
, &gensec_security
);
308 if (!NT_STATUS_IS_OK(nt_status
)) {
309 TALLOC_FREE(tmp_ctx
);
313 gensec_set_credentials(gensec_security
, server_credentials
);
315 talloc_unlink(tmp_ctx
, lp_ctx
);
316 talloc_unlink(tmp_ctx
, server_credentials
);
317 talloc_unlink(tmp_ctx
, gensec_settings
);
318 talloc_unlink(tmp_ctx
, auth4_context
);
321 nt_status
= gensec_set_remote_address(gensec_security
,
323 if (!NT_STATUS_IS_OK(nt_status
)) {
324 TALLOC_FREE(tmp_ctx
);
328 *gensec_security_out
= talloc_steal(mem_ctx
, gensec_security
);
329 TALLOC_FREE(tmp_ctx
);
333 NTSTATUS
auth_check_password_session_info(struct auth4_context
*auth_context
,
335 struct auth_usersupplied_info
*user_info
,
336 struct auth_session_info
**session_info
)
341 nt_status
= auth_context
->check_ntlm_password(auth_context
,
344 &server_info
, NULL
, NULL
);
346 if (NT_STATUS_IS_OK(nt_status
)) {
347 nt_status
= auth_context
->generate_session_info(auth_context
,
350 user_info
->client
.account_name
,
351 AUTH_SESSION_INFO_UNIX_TOKEN
|
352 AUTH_SESSION_INFO_DEFAULT_GROUPS
,
354 TALLOC_FREE(server_info
);