?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:net idmap: remove call to lp_idmap_backend() - this is useless.
[Samba.git] / nsswitch / libwbclient / wbc_pam.c
blobf183cc61b1e41fb64505444b82f1d27be2985cc1
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind client API
5
6 Copyright (C) Gerald (Jerry) Carter 2007
7 Copyright (C) Guenther Deschner 2008
8 Copyright (C) Volker Lendecke 2009
9
10 This library is free software; you can redistribute it and/or
11 modify it under the terms of the GNU Lesser General Public
12 License as published by the Free Software Foundation; either
13 version 3 of the License, or (at your option) any later version.
14
15 This library is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Library General Public License for more details.
19
20 You should have received a copy of the GNU Lesser General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /* Required Headers */
25
26 #define UID_WRAPPER_NOT_REPLACE
27 #include "replace.h"
28 #include "libwbclient.h"
29 #include "../winbind_client.h"
30
31 /* Authenticate a username/password pair */
32 wbcErr wbcAuthenticateUser(const char *username,
33 const char *password)
34 {
35 wbcErr wbc_status = WBC_ERR_SUCCESS;
36 struct wbcAuthUserParams params;
37
38 ZERO_STRUCT(params);
39
40 params.account_name = username;
41 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
42 params.password.plaintext = password;
43
44 wbc_status = wbcAuthenticateUserEx(&params, NULL, NULL);
45 BAIL_ON_WBC_ERROR(wbc_status);
46
47 done:
48 return wbc_status;
49 }
50
51 static bool sid_attr_compose(struct wbcSidWithAttr *s,
52 const struct wbcDomainSid *d,
53 uint32_t rid, uint32_t attr)
54 {
55 if (d->num_auths >= WBC_MAXSUBAUTHS) {
56 return false;
57 }
58 s->sid = *d;
59 s->sid.sub_auths[s->sid.num_auths++] = rid;
60 s->attributes = attr;
61 return true;
62 }
63
64 static void wbcAuthUserInfoDestructor(void *ptr)
65 {
66 struct wbcAuthUserInfo *i = (struct wbcAuthUserInfo *)ptr;
67 free(i->account_name);
68 free(i->user_principal);
69 free(i->full_name);
70 free(i->domain_name);
71 free(i->dns_domain_name);
72 free(i->logon_server);
73 free(i->logon_script);
74 free(i->profile_path);
75 free(i->home_directory);
76 free(i->home_drive);
77 free(i->sids);
78 }
79
80 static wbcErr wbc_create_auth_info(const struct winbindd_response *resp,
81 struct wbcAuthUserInfo **_i)
82 {
83 wbcErr wbc_status = WBC_ERR_SUCCESS;
84 struct wbcAuthUserInfo *i;
85 struct wbcDomainSid domain_sid;
86 char *p;
87 uint32_t sn = 0;
88 uint32_t j;
89
90 i = (struct wbcAuthUserInfo *)wbcAllocateMemory(
91 1, sizeof(struct wbcAuthUserInfo),
92 wbcAuthUserInfoDestructor);
93 BAIL_ON_PTR_ERROR(i, wbc_status);
94
95 i->user_flags = resp->data.auth.info3.user_flgs;
96
97 i->account_name = strdup(resp->data.auth.info3.user_name);
98 BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
99 i->user_principal= NULL;
100 i->full_name = strdup(resp->data.auth.info3.full_name);
101 BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
102 i->domain_name = strdup(resp->data.auth.info3.logon_dom);
103 BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
104 i->dns_domain_name= NULL;
105
106 i->acct_flags = resp->data.auth.info3.acct_flags;
107 memcpy(i->user_session_key,
108 resp->data.auth.user_session_key,
109 sizeof(i->user_session_key));
110 memcpy(i->lm_session_key,
111 resp->data.auth.first_8_lm_hash,
112 sizeof(i->lm_session_key));
113
114 i->logon_count = resp->data.auth.info3.logon_count;
115 i->bad_password_count = resp->data.auth.info3.bad_pw_count;
116
117 i->logon_time = resp->data.auth.info3.logon_time;
118 i->logoff_time = resp->data.auth.info3.logoff_time;
119 i->kickoff_time = resp->data.auth.info3.kickoff_time;
120 i->pass_last_set_time = resp->data.auth.info3.pass_last_set_time;
121 i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
122 i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
123
124 i->logon_server = strdup(resp->data.auth.info3.logon_srv);
125 BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
126 i->logon_script = strdup(resp->data.auth.info3.logon_script);
127 BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
128 i->profile_path = strdup(resp->data.auth.info3.profile_path);
129 BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
130 i->home_directory= strdup(resp->data.auth.info3.home_dir);
131 BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
132 i->home_drive = strdup(resp->data.auth.info3.dir_drive);
133 BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
134
135 i->num_sids = 2;
136 i->num_sids += resp->data.auth.info3.num_groups;
137 i->num_sids += resp->data.auth.info3.num_other_sids;
138
139 i->sids = (struct wbcSidWithAttr *)calloc(
140 sizeof(struct wbcSidWithAttr), i->num_sids);
141 BAIL_ON_PTR_ERROR(i->sids, wbc_status);
142
143 wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
144 &domain_sid);
145 BAIL_ON_WBC_ERROR(wbc_status);
146
147 sn = 0;
148 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
149 resp->data.auth.info3.user_rid, 0)) {
150 wbc_status = WBC_ERR_INVALID_SID;
151 goto done;
152 }
153 sn++;
154 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
155 resp->data.auth.info3.group_rid, 0)) {
156 wbc_status = WBC_ERR_INVALID_SID;
157 goto done;
158 }
159 sn++;
160
161 p = (char *)resp->extra_data.data;
162 if (!p) {
163 wbc_status = WBC_ERR_INVALID_RESPONSE;
164 BAIL_ON_WBC_ERROR(wbc_status);
165 }
166
167 for (j=0; j < resp->data.auth.info3.num_groups; j++) {
168 uint32_t rid;
169 uint32_t attrs;
170 int ret;
171 char *s = p;
172 char *e = strchr(p, '\n');
173 if (!e) {
174 wbc_status = WBC_ERR_INVALID_RESPONSE;
175 BAIL_ON_WBC_ERROR(wbc_status);
176 }
177 e[0] = '\0';
178 p = &e[1];
179
180 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
181 if (ret != 2) {
182 wbc_status = WBC_ERR_INVALID_RESPONSE;
183 BAIL_ON_WBC_ERROR(wbc_status);
184 }
185
186 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
187 rid, attrs)) {
188 wbc_status = WBC_ERR_INVALID_SID;
189 goto done;
190 }
191 sn++;
192 }
193
194 for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
195 uint32_t attrs;
196 int ret;
197 char *s = p;
198 char *a;
199 char *e = strchr(p, '\n');
200 if (!e) {
201 wbc_status = WBC_ERR_INVALID_RESPONSE;
202 BAIL_ON_WBC_ERROR(wbc_status);
203 }
204 e[0] = '\0';
205 p = &e[1];
206
207 e = strchr(s, ':');
208 if (!e) {
209 wbc_status = WBC_ERR_INVALID_RESPONSE;
210 BAIL_ON_WBC_ERROR(wbc_status);
211 }
212 e[0] = '\0';
213 a = &e[1];
214
215 ret = sscanf(a, "0x%08X",
216 &attrs);
217 if (ret != 1) {
218 wbc_status = WBC_ERR_INVALID_RESPONSE;
219 BAIL_ON_WBC_ERROR(wbc_status);
220 }
221
222 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
223 BAIL_ON_WBC_ERROR(wbc_status);
224
225 i->sids[sn].attributes = attrs;
226 sn++;
227 }
228
229 i->num_sids = sn;
230
231 *_i = i;
232 i = NULL;
233 done:
234 wbcFreeMemory(i);
235 return wbc_status;
236 }
237
238 static void wbcAuthErrorInfoDestructor(void *ptr)
239 {
240 struct wbcAuthErrorInfo *e = (struct wbcAuthErrorInfo *)ptr;
241 free(e->nt_string);
242 free(e->display_string);
243 }
244
245 static wbcErr wbc_create_error_info(const struct winbindd_response *resp,
246 struct wbcAuthErrorInfo **_e)
247 {
248 wbcErr wbc_status = WBC_ERR_SUCCESS;
249 struct wbcAuthErrorInfo *e;
250
251 e = (struct wbcAuthErrorInfo *)wbcAllocateMemory(
252 1, sizeof(struct wbcAuthErrorInfo),
253 wbcAuthErrorInfoDestructor);
254 BAIL_ON_PTR_ERROR(e, wbc_status);
255
256 e->nt_status = resp->data.auth.nt_status;
257 e->pam_error = resp->data.auth.pam_error;
258 e->nt_string = strdup(resp->data.auth.nt_status_string);
259 BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
260
261 e->display_string = strdup(resp->data.auth.error_string);
262 BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
263
264 *_e = e;
265 e = NULL;
266
267 done:
268 wbcFreeMemory(e);
269 return wbc_status;
270 }
271
272 static wbcErr wbc_create_password_policy_info(const struct winbindd_response *resp,
273 struct wbcUserPasswordPolicyInfo **_i)
274 {
275 wbcErr wbc_status = WBC_ERR_SUCCESS;
276 struct wbcUserPasswordPolicyInfo *i;
277
278 i = (struct wbcUserPasswordPolicyInfo *)wbcAllocateMemory(
279 1, sizeof(struct wbcUserPasswordPolicyInfo), NULL);
280 BAIL_ON_PTR_ERROR(i, wbc_status);
281
282 i->min_passwordage = resp->data.auth.policy.min_passwordage;
283 i->min_length_password = resp->data.auth.policy.min_length_password;
284 i->password_history = resp->data.auth.policy.password_history;
285 i->password_properties = resp->data.auth.policy.password_properties;
286 i->expire = resp->data.auth.policy.expire;
287
288 *_i = i;
289 i = NULL;
290
291 done:
292 wbcFreeMemory(i);
293 return wbc_status;
294 }
295
296 static void wbcLogonUserInfoDestructor(void *ptr)
297 {
298 struct wbcLogonUserInfo *i = (struct wbcLogonUserInfo *)ptr;
299 wbcFreeMemory(i->info);
300 wbcFreeMemory(i->blobs);
301 }
302
303 static wbcErr wbc_create_logon_info(struct winbindd_response *resp,
304 struct wbcLogonUserInfo **_i)
305 {
306 wbcErr wbc_status = WBC_ERR_SUCCESS;
307 struct wbcLogonUserInfo *i;
308
309 i = (struct wbcLogonUserInfo *)wbcAllocateMemory(
310 1, sizeof(struct wbcLogonUserInfo),
311 wbcLogonUserInfoDestructor);
312 BAIL_ON_PTR_ERROR(i, wbc_status);
313
314 wbc_status = wbc_create_auth_info(resp, &i->info);
315 BAIL_ON_WBC_ERROR(wbc_status);
316
317 if (resp->data.auth.krb5ccname[0] != '\0') {
318 wbc_status = wbcAddNamedBlob(&i->num_blobs,
319 &i->blobs,
320 "krb5ccname",
321 0,
322 (uint8_t *)resp->data.auth.krb5ccname,
323 strlen(resp->data.auth.krb5ccname)+1);
324 BAIL_ON_WBC_ERROR(wbc_status);
325 }
326
327 if (resp->data.auth.unix_username[0] != '\0') {
328 wbc_status = wbcAddNamedBlob(&i->num_blobs,
329 &i->blobs,
330 "unix_username",
331 0,
332 (uint8_t *)resp->data.auth.unix_username,
333 strlen(resp->data.auth.unix_username)+1);
334 BAIL_ON_WBC_ERROR(wbc_status);
335 }
336
337 *_i = i;
338 i = NULL;
339 done:
340 wbcFreeMemory(i);
341 return wbc_status;
342 }
343
344
345 /* Authenticate with more detailed information */
346 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
347 struct wbcAuthUserInfo **info,
348 struct wbcAuthErrorInfo **error)
349 {
350 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
351 int cmd = 0;
352 struct winbindd_request request;
353 struct winbindd_response response;
354
355 ZERO_STRUCT(request);
356 ZERO_STRUCT(response);
357
358 if (error) {
359 *error = NULL;
360 }
361
362 if (!params) {
363 wbc_status = WBC_ERR_INVALID_PARAM;
364 BAIL_ON_WBC_ERROR(wbc_status);
365 }
366
367 if (params->level != WBC_AUTH_USER_LEVEL_PAC && !params->account_name) {
368 wbc_status = WBC_ERR_INVALID_PARAM;
369 BAIL_ON_WBC_ERROR(wbc_status);
370 }
371
372 /* Initialize request */
373
374 switch (params->level) {
375 case WBC_AUTH_USER_LEVEL_PLAIN:
376 cmd = WINBINDD_PAM_AUTH;
377 request.flags = WBFLAG_PAM_INFO3_TEXT |
378 WBFLAG_PAM_USER_SESSION_KEY |
379 WBFLAG_PAM_LMKEY;
380
381 if (!params->password.plaintext) {
382 wbc_status = WBC_ERR_INVALID_PARAM;
383 BAIL_ON_WBC_ERROR(wbc_status);
384 }
385
386 if (params->domain_name && params->domain_name[0]) {
387 /* We need to get the winbind separator :-( */
388 struct winbindd_response sep_response;
389
390 ZERO_STRUCT(sep_response);
391
392 wbc_status = wbcRequestResponse(WINBINDD_INFO,
393 NULL, &sep_response);
394 BAIL_ON_WBC_ERROR(wbc_status);
395
396 snprintf(request.data.auth.user,
397 sizeof(request.data.auth.user)-1,
398 "%s%c%s",
399 params->domain_name,
400 sep_response.data.info.winbind_separator,
401 params->account_name);
402 } else {
403 strncpy(request.data.auth.user,
404 params->account_name,
405 sizeof(request.data.auth.user)-1);
406 }
407
408 strncpy(request.data.auth.pass,
409 params->password.plaintext,
410 sizeof(request.data.auth.pass)-1);
411 break;
412
413 case WBC_AUTH_USER_LEVEL_HASH:
414 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
415 BAIL_ON_WBC_ERROR(wbc_status);
416 break;
417
418 case WBC_AUTH_USER_LEVEL_RESPONSE:
419 cmd = WINBINDD_PAM_AUTH_CRAP;
420 request.flags = WBFLAG_PAM_INFO3_TEXT |
421 WBFLAG_PAM_USER_SESSION_KEY |
422 WBFLAG_PAM_LMKEY;
423
424 if (params->password.response.lm_length &&
425 !params->password.response.lm_data) {
426 wbc_status = WBC_ERR_INVALID_PARAM;
427 BAIL_ON_WBC_ERROR(wbc_status);
428 }
429 if (params->password.response.lm_length == 0 &&
430 params->password.response.lm_data) {
431 wbc_status = WBC_ERR_INVALID_PARAM;
432 BAIL_ON_WBC_ERROR(wbc_status);
433 }
434
435 if (params->password.response.nt_length &&
436 !params->password.response.nt_data) {
437 wbc_status = WBC_ERR_INVALID_PARAM;
438 BAIL_ON_WBC_ERROR(wbc_status);
439 }
440 if (params->password.response.nt_length == 0&&
441 params->password.response.nt_data) {
442 wbc_status = WBC_ERR_INVALID_PARAM;
443 BAIL_ON_WBC_ERROR(wbc_status);
444 }
445
446 strncpy(request.data.auth_crap.user,
447 params->account_name,
448 sizeof(request.data.auth_crap.user)-1);
449 if (params->domain_name) {
450 strncpy(request.data.auth_crap.domain,
451 params->domain_name,
452 sizeof(request.data.auth_crap.domain)-1);
453 }
454 if (params->workstation_name) {
455 strncpy(request.data.auth_crap.workstation,
456 params->workstation_name,
457 sizeof(request.data.auth_crap.workstation)-1);
458 }
459
460 request.data.auth_crap.logon_parameters =
461 params->parameter_control;
462
463 memcpy(request.data.auth_crap.chal,
464 params->password.response.challenge,
465 sizeof(request.data.auth_crap.chal));
466
467 request.data.auth_crap.lm_resp_len =
468 MIN(params->password.response.lm_length,
469 sizeof(request.data.auth_crap.lm_resp));
470 if (params->password.response.lm_data) {
471 memcpy(request.data.auth_crap.lm_resp,
472 params->password.response.lm_data,
473 request.data.auth_crap.lm_resp_len);
474 }
475 request.data.auth_crap.nt_resp_len = params->password.response.nt_length;
476 if (params->password.response.nt_length > sizeof(request.data.auth_crap.nt_resp)) {
477 request.flags |= WBFLAG_BIG_NTLMV2_BLOB;
478 request.extra_len = params->password.response.nt_length;
479 request.extra_data.data = (char *)malloc(
480 request.extra_len);
481 if (request.extra_data.data == NULL) {
482 wbc_status = WBC_ERR_NO_MEMORY;
483 BAIL_ON_WBC_ERROR(wbc_status);
484 }
485 memcpy(request.extra_data.data,
486 params->password.response.nt_data,
487 request.data.auth_crap.nt_resp_len);
488 } else if (params->password.response.nt_data) {
489 memcpy(request.data.auth_crap.nt_resp,
490 params->password.response.nt_data,
491 request.data.auth_crap.nt_resp_len);
492 }
493 break;
494
495 case WBC_AUTH_USER_LEVEL_PAC:
496 cmd = WINBINDD_PAM_AUTH_CRAP;
497 request.flags = WBFLAG_PAM_AUTH_PAC | WBFLAG_PAM_INFO3_TEXT;
498 request.extra_data.data = malloc(params->password.pac.length);
499 if (request.extra_data.data == NULL) {
500 wbc_status = WBC_ERR_NO_MEMORY;
501 BAIL_ON_WBC_ERROR(wbc_status);
502 }
503 memcpy(request.extra_data.data, params->password.pac.data,
504 params->password.pac.length);
505 request.extra_len = params->password.pac.length;
506 break;
507
508 default:
509 break;
510 }
511
512 if (cmd == 0) {
513 wbc_status = WBC_ERR_INVALID_PARAM;
514 BAIL_ON_WBC_ERROR(wbc_status);
515 }
516
517 if (params->flags) {
518 request.flags |= params->flags;
519 }
520
521 if (cmd == WINBINDD_PAM_AUTH_CRAP) {
522 wbc_status = wbcRequestResponsePriv(cmd, &request, &response);
523 } else {
524 wbc_status = wbcRequestResponse(cmd, &request, &response);
525 }
526 if (response.data.auth.nt_status != 0) {
527 if (error) {
528 wbc_status = wbc_create_error_info(&response,
529 error);
530 BAIL_ON_WBC_ERROR(wbc_status);
531 }
532
533 wbc_status = WBC_ERR_AUTH_ERROR;
534 BAIL_ON_WBC_ERROR(wbc_status);
535 }
536 BAIL_ON_WBC_ERROR(wbc_status);
537
538 if (info) {
539 wbc_status = wbc_create_auth_info(&response, info);
540 BAIL_ON_WBC_ERROR(wbc_status);
541 }
542
543 done:
544 winbindd_free_response(&response);
545
546 free(request.extra_data.data);
547
548 return wbc_status;
549 }
550
551 /* Trigger a verification of the trust credentials of a specific domain */
552 wbcErr wbcCheckTrustCredentials(const char *domain,
553 struct wbcAuthErrorInfo **error)
554 {
555 struct winbindd_request request;
556 struct winbindd_response response;
557 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
558
559 ZERO_STRUCT(request);
560 ZERO_STRUCT(response);
561
562 if (domain) {
563 strncpy(request.domain_name, domain,
564 sizeof(request.domain_name)-1);
565 }
566
567 /* Send request */
568
569 wbc_status = wbcRequestResponsePriv(WINBINDD_CHECK_MACHACC,
570 &request, &response);
571 if (response.data.auth.nt_status != 0) {
572 if (error) {
573 wbc_status = wbc_create_error_info(&response,
574 error);
575 BAIL_ON_WBC_ERROR(wbc_status);
576 }
577
578 wbc_status = WBC_ERR_AUTH_ERROR;
579 BAIL_ON_WBC_ERROR(wbc_status);
580 }
581 BAIL_ON_WBC_ERROR(wbc_status);
582
583 done:
584 return wbc_status;
585 }
586
587 /* Trigger a change of the trust credentials for a specific domain */
588 wbcErr wbcChangeTrustCredentials(const char *domain,
589 struct wbcAuthErrorInfo **error)
590 {
591 struct winbindd_request request;
592 struct winbindd_response response;
593 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
594
595 ZERO_STRUCT(request);
596 ZERO_STRUCT(response);
597
598 if (domain) {
599 strncpy(request.domain_name, domain,
600 sizeof(request.domain_name)-1);
601 }
602
603 /* Send request */
604
605 wbc_status = wbcRequestResponsePriv(WINBINDD_CHANGE_MACHACC,
606 &request, &response);
607 if (response.data.auth.nt_status != 0) {
608 if (error) {
609 wbc_status = wbc_create_error_info(&response,
610 error);
611 BAIL_ON_WBC_ERROR(wbc_status);
612 }
613
614 wbc_status = WBC_ERR_AUTH_ERROR;
615 BAIL_ON_WBC_ERROR(wbc_status);
616 }
617 BAIL_ON_WBC_ERROR(wbc_status);
618
619 done:
620 return wbc_status;
621 }
622
623 /*
624 * Trigger a no-op NETLOGON call. Lightweight version of
625 * wbcCheckTrustCredentials
626 */
627 wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
628 {
629 return wbcPingDc2(domain, error, NULL);
630 }
631
632 /*
633 * Trigger a no-op NETLOGON call. Lightweight version of
634 * wbcCheckTrustCredentials, optionally return attempted DC
635 */
636 wbcErr wbcPingDc2(const char *domain, struct wbcAuthErrorInfo **error,
637 char **dcname)
638 {
639 struct winbindd_request request;
640 struct winbindd_response response;
641 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
642
643 if (domain) {
644 /*
645 * the current protocol doesn't support
646 * specifying a domain
647 */
648 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
649 BAIL_ON_WBC_ERROR(wbc_status);
650 }
651
652 ZERO_STRUCT(request);
653 ZERO_STRUCT(response);
654
655 /* Send request */
656
657 wbc_status = wbcRequestResponse(WINBINDD_PING_DC,
658 &request,
659 &response);
660
661 if (dcname && response.extra_data.data) {
662 size_t len;
663
664 len = response.length - sizeof(struct winbindd_response);
665 *dcname = wbcAllocateMemory(1, len, NULL);
666 BAIL_ON_PTR_ERROR(*dcname, wbc_status);
667
668 strlcpy(*dcname, response.extra_data.data, len);
669 }
670
671 if (response.data.auth.nt_status != 0) {
672 if (error) {
673 wbc_status = wbc_create_error_info(&response,
674 error);
675 BAIL_ON_WBC_ERROR(wbc_status);
676 }
677
678 wbc_status = WBC_ERR_AUTH_ERROR;
679 BAIL_ON_WBC_ERROR(wbc_status);
680 }
681 BAIL_ON_WBC_ERROR(wbc_status);
682
683 done:
684 return wbc_status;
685 }
686
687 /* Trigger an extended logoff notification to Winbind for a specific user */
688 wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
689 struct wbcAuthErrorInfo **error)
690 {
691 struct winbindd_request request;
692 struct winbindd_response response;
693 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
694 int i;
695
696 /* validate input */
697
698 if (!params || !params->username) {
699 wbc_status = WBC_ERR_INVALID_PARAM;
700 BAIL_ON_WBC_ERROR(wbc_status);
701 }
702
703 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
704 wbc_status = WBC_ERR_INVALID_PARAM;
705 BAIL_ON_WBC_ERROR(wbc_status);
706 }
707 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
708 wbc_status = WBC_ERR_INVALID_PARAM;
709 BAIL_ON_WBC_ERROR(wbc_status);
710 }
711
712 ZERO_STRUCT(request);
713 ZERO_STRUCT(response);
714
715 strncpy(request.data.logoff.user, params->username,
716 sizeof(request.data.logoff.user)-1);
717
718 for (i=0; i<params->num_blobs; i++) {
719
720 if (strcasecmp(params->blobs[i].name, "ccfilename") == 0) {
721 if (params->blobs[i].blob.data) {
722 strncpy(request.data.logoff.krb5ccname,
723 (const char *)params->blobs[i].blob.data,
724 sizeof(request.data.logoff.krb5ccname) - 1);
725 }
726 continue;
727 }
728
729 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
730 if (params->blobs[i].blob.data) {
731 memcpy(&request.data.logoff.uid,
732 params->blobs[i].blob.data,
733 MIN(params->blobs[i].blob.length,
734 sizeof(request.data.logoff.uid)));
735 }
736 continue;
737 }
738
739 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
740 if (params->blobs[i].blob.data) {
741 memcpy(&request.flags,
742 params->blobs[i].blob.data,
743 MIN(params->blobs[i].blob.length,
744 sizeof(request.flags)));
745 }
746 continue;
747 }
748 }
749
750 /* Send request */
751
752 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
753 &request,
754 &response);
755
756 /* Take the response above and return it to the caller */
757 if (response.data.auth.nt_status != 0) {
758 if (error) {
759 wbc_status = wbc_create_error_info(&response,
760 error);
761 BAIL_ON_WBC_ERROR(wbc_status);
762 }
763
764 wbc_status = WBC_ERR_AUTH_ERROR;
765 BAIL_ON_WBC_ERROR(wbc_status);
766 }
767 BAIL_ON_WBC_ERROR(wbc_status);
768
769 done:
770 return wbc_status;
771 }
772
773 /* Trigger a logoff notification to Winbind for a specific user */
774 wbcErr wbcLogoffUser(const char *username,
775 uid_t uid,
776 const char *ccfilename)
777 {
778 struct winbindd_request request;
779 struct winbindd_response response;
780 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
781
782 /* validate input */
783
784 if (!username) {
785 wbc_status = WBC_ERR_INVALID_PARAM;
786 BAIL_ON_WBC_ERROR(wbc_status);
787 }
788
789 ZERO_STRUCT(request);
790 ZERO_STRUCT(response);
791
792 strncpy(request.data.logoff.user, username,
793 sizeof(request.data.logoff.user)-1);
794 request.data.logoff.uid = uid;
795
796 if (ccfilename) {
797 strncpy(request.data.logoff.krb5ccname, ccfilename,
798 sizeof(request.data.logoff.krb5ccname)-1);
799 }
800
801 /* Send request */
802
803 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
804 &request,
805 &response);
806
807 /* Take the response above and return it to the caller */
808
809 done:
810 return wbc_status;
811 }
812
813 /* Change a password for a user with more detailed information upon failure */
814 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
815 struct wbcAuthErrorInfo **error,
816 enum wbcPasswordChangeRejectReason *reject_reason,
817 struct wbcUserPasswordPolicyInfo **policy)
818 {
819 struct winbindd_request request;
820 struct winbindd_response response;
821 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
822 int cmd = 0;
823
824 /* validate input */
825
826 if (!params->account_name) {
827 wbc_status = WBC_ERR_INVALID_PARAM;
828 goto done;
829 }
830
831 if (error) {
832 *error = NULL;
833 }
834
835 if (policy) {
836 *policy = NULL;
837 }
838
839 if (reject_reason) {
840 *reject_reason = -1;
841 }
842
843 ZERO_STRUCT(request);
844 ZERO_STRUCT(response);
845
846 switch (params->level) {
847 case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
848 cmd = WINBINDD_PAM_CHAUTHTOK;
849
850 if (!params->account_name) {
851 wbc_status = WBC_ERR_INVALID_PARAM;
852 goto done;
853 }
854
855 strncpy(request.data.chauthtok.user, params->account_name,
856 sizeof(request.data.chauthtok.user) - 1);
857
858 if (params->old_password.plaintext) {
859 strncpy(request.data.chauthtok.oldpass,
860 params->old_password.plaintext,
861 sizeof(request.data.chauthtok.oldpass) - 1);
862 }
863
864 if (params->new_password.plaintext) {
865 strncpy(request.data.chauthtok.newpass,
866 params->new_password.plaintext,
867 sizeof(request.data.chauthtok.newpass) - 1);
868 }
869 break;
870
871 case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
872 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
873
874 if (!params->account_name || !params->domain_name) {
875 wbc_status = WBC_ERR_INVALID_PARAM;
876 goto done;
877 }
878
879 if (params->old_password.response.old_lm_hash_enc_length &&
880 !params->old_password.response.old_lm_hash_enc_data) {
881 wbc_status = WBC_ERR_INVALID_PARAM;
882 goto done;
883 }
884
885 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
886 params->old_password.response.old_lm_hash_enc_data) {
887 wbc_status = WBC_ERR_INVALID_PARAM;
888 goto done;
889 }
890
891 if (params->old_password.response.old_nt_hash_enc_length &&
892 !params->old_password.response.old_nt_hash_enc_data) {
893 wbc_status = WBC_ERR_INVALID_PARAM;
894 goto done;
895 }
896
897 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
898 params->old_password.response.old_nt_hash_enc_data) {
899 wbc_status = WBC_ERR_INVALID_PARAM;
900 goto done;
901 }
902
903 if (params->new_password.response.lm_length &&
904 !params->new_password.response.lm_data) {
905 wbc_status = WBC_ERR_INVALID_PARAM;
906 goto done;
907 }
908
909 if (params->new_password.response.lm_length == 0 &&
910 params->new_password.response.lm_data) {
911 wbc_status = WBC_ERR_INVALID_PARAM;
912 goto done;
913 }
914
915 if (params->new_password.response.nt_length &&
916 !params->new_password.response.nt_data) {
917 wbc_status = WBC_ERR_INVALID_PARAM;
918 goto done;
919 }
920
921 if (params->new_password.response.nt_length == 0 &&
922 params->new_password.response.nt_data) {
923 wbc_status = WBC_ERR_INVALID_PARAM;
924 goto done;
925 }
926
927 strncpy(request.data.chng_pswd_auth_crap.user,
928 params->account_name,
929 sizeof(request.data.chng_pswd_auth_crap.user) - 1);
930
931 strncpy(request.data.chng_pswd_auth_crap.domain,
932 params->domain_name,
933 sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
934
935 if (params->new_password.response.nt_data) {
936 request.data.chng_pswd_auth_crap.new_nt_pswd_len =
937 params->new_password.response.nt_length;
938 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
939 params->new_password.response.nt_data,
940 request.data.chng_pswd_auth_crap.new_nt_pswd_len);
941 }
942
943 if (params->new_password.response.lm_data) {
944 request.data.chng_pswd_auth_crap.new_lm_pswd_len =
945 params->new_password.response.lm_length;
946 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
947 params->new_password.response.lm_data,
948 request.data.chng_pswd_auth_crap.new_lm_pswd_len);
949 }
950
951 if (params->old_password.response.old_nt_hash_enc_data) {
952 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
953 params->old_password.response.old_nt_hash_enc_length;
954 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
955 params->old_password.response.old_nt_hash_enc_data,
956 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
957 }
958
959 if (params->old_password.response.old_lm_hash_enc_data) {
960 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
961 params->old_password.response.old_lm_hash_enc_length;
962 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
963 params->old_password.response.old_lm_hash_enc_data,
964 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
965 }
966
967 break;
968 default:
969 wbc_status = WBC_ERR_INVALID_PARAM;
970 goto done;
971 break;
972 }
973
974 /* Send request */
975
976 wbc_status = wbcRequestResponse(cmd,
977 &request,
978 &response);
979 if (WBC_ERROR_IS_OK(wbc_status)) {
980 goto done;
981 }
982
983 /* Take the response above and return it to the caller */
984
985 if (response.data.auth.nt_status != 0) {
986 if (error) {
987 wbc_status = wbc_create_error_info(&response,
988 error);
989 BAIL_ON_WBC_ERROR(wbc_status);
990 }
991
992 }
993
994 if (policy) {
995 wbc_status = wbc_create_password_policy_info(&response,
996 policy);
997 BAIL_ON_WBC_ERROR(wbc_status);
998 }
999
1000 if (reject_reason) {
1001 *reject_reason = response.data.auth.reject_reason;
1002 }
1003
1004 wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
1005 BAIL_ON_WBC_ERROR(wbc_status);
1006
1007 done:
1008 return wbc_status;
1009 }
1010
1011 /* Change a password for a user */
1012 wbcErr wbcChangeUserPassword(const char *username,
1013 const char *old_password,
1014 const char *new_password)
1015 {
1016 wbcErr wbc_status = WBC_ERR_SUCCESS;
1017 struct wbcChangePasswordParams params;
1018
1019 ZERO_STRUCT(params);
1020
1021 params.account_name = username;
1022 params.level = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
1023 params.old_password.plaintext = old_password;
1024 params.new_password.plaintext = new_password;
1025
1026 wbc_status = wbcChangeUserPasswordEx(&params,
1027 NULL,
1028 NULL,
1029 NULL);
1030 BAIL_ON_WBC_ERROR(wbc_status);
1031
1032 done:
1033 return wbc_status;
1034 }
1035
1036 /* Logon a User */
1037 wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
1038 struct wbcLogonUserInfo **info,
1039 struct wbcAuthErrorInfo **error,
1040 struct wbcUserPasswordPolicyInfo **policy)
1041 {
1042 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1043 struct winbindd_request request;
1044 struct winbindd_response response;
1045 uint32_t i;
1046
1047 ZERO_STRUCT(request);
1048 ZERO_STRUCT(response);
1049
1050 if (info) {
1051 *info = NULL;
1052 }
1053 if (error) {
1054 *error = NULL;
1055 }
1056 if (policy) {
1057 *policy = NULL;
1058 }
1059
1060 if (!params) {
1061 wbc_status = WBC_ERR_INVALID_PARAM;
1062 BAIL_ON_WBC_ERROR(wbc_status);
1063 }
1064
1065 if (!params->username) {
1066 wbc_status = WBC_ERR_INVALID_PARAM;
1067 BAIL_ON_WBC_ERROR(wbc_status);
1068 }
1069
1070 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
1071 wbc_status = WBC_ERR_INVALID_PARAM;
1072 BAIL_ON_WBC_ERROR(wbc_status);
1073 }
1074 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
1075 wbc_status = WBC_ERR_INVALID_PARAM;
1076 BAIL_ON_WBC_ERROR(wbc_status);
1077 }
1078
1079 /* Initialize request */
1080
1081 request.flags = WBFLAG_PAM_INFO3_TEXT |
1082 WBFLAG_PAM_USER_SESSION_KEY |
1083 WBFLAG_PAM_LMKEY;
1084
1085 if (!params->password) {
1086 wbc_status = WBC_ERR_INVALID_PARAM;
1087 BAIL_ON_WBC_ERROR(wbc_status);
1088 }
1089
1090 strncpy(request.data.auth.user,
1091 params->username,
1092 sizeof(request.data.auth.user)-1);
1093
1094 strncpy(request.data.auth.pass,
1095 params->password,
1096 sizeof(request.data.auth.pass)-1);
1097
1098 for (i=0; i<params->num_blobs; i++) {
1099
1100 if (strcasecmp(params->blobs[i].name, "krb5_cc_type") == 0) {
1101 if (params->blobs[i].blob.data) {
1102 strncpy(request.data.auth.krb5_cc_type,
1103 (const char *)params->blobs[i].blob.data,
1104 sizeof(request.data.auth.krb5_cc_type) - 1);
1105 }
1106 continue;
1107 }
1108
1109 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
1110 if (params->blobs[i].blob.data) {
1111 memcpy(&request.data.auth.uid,
1112 params->blobs[i].blob.data,
1113 MIN(sizeof(request.data.auth.uid),
1114 params->blobs[i].blob.length));
1115 }
1116 continue;
1117 }
1118
1119 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
1120 if (params->blobs[i].blob.data) {
1121 uint32_t flags;
1122 memcpy(&flags,
1123 params->blobs[i].blob.data,
1124 MIN(sizeof(flags),
1125 params->blobs[i].blob.length));
1126 request.flags |= flags;
1127 }
1128 continue;
1129 }
1130
1131 if (strcasecmp(params->blobs[i].name, "membership_of") == 0) {
1132 if (params->blobs[i].blob.data &&
1133 params->blobs[i].blob.data[0] > 0) {
1134 strncpy(request.data.auth.require_membership_of_sid,
1135 (const char *)params->blobs[i].blob.data,
1136 sizeof(request.data.auth.require_membership_of_sid) - 1);
1137 }
1138 continue;
1139 }
1140 }
1141
1142 wbc_status = wbcRequestResponse(WINBINDD_PAM_AUTH,
1143 &request,
1144 &response);
1145
1146 if (response.data.auth.nt_status != 0) {
1147 if (error) {
1148 wbc_status = wbc_create_error_info(&response,
1149 error);
1150 BAIL_ON_WBC_ERROR(wbc_status);
1151 }
1152
1153 wbc_status = WBC_ERR_AUTH_ERROR;
1154 BAIL_ON_WBC_ERROR(wbc_status);
1155 }
1156 BAIL_ON_WBC_ERROR(wbc_status);
1157
1158 if (info) {
1159 wbc_status = wbc_create_logon_info(&response,
1160 info);
1161 BAIL_ON_WBC_ERROR(wbc_status);
1162 }
1163
1164 if (policy) {
1165 wbc_status = wbc_create_password_policy_info(&response,
1166 policy);
1167 BAIL_ON_WBC_ERROR(wbc_status);
1168 }
1169
1170 done:
1171 winbindd_free_response(&response);
1172
1173 return wbc_status;
1174 }
1175
1176 static void wbcCredentialCacheInfoDestructor(void *ptr)
1177 {
1178 struct wbcCredentialCacheInfo *i =
1179 (struct wbcCredentialCacheInfo *)ptr;
1180 wbcFreeMemory(i->blobs);
1181 }
1182
1183 /* Authenticate a user with cached credentials */
1184 wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
1185 struct wbcCredentialCacheInfo **info,
1186 struct wbcAuthErrorInfo **error)
1187 {
1188 wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
1189 struct wbcCredentialCacheInfo *result = NULL;
1190 struct winbindd_request request;
1191 struct winbindd_response response;
1192 struct wbcNamedBlob *initial_blob = NULL;
1193 struct wbcNamedBlob *challenge_blob = NULL;
1194 int i;
1195
1196 ZERO_STRUCT(request);
1197 ZERO_STRUCT(response);
1198
1199 *info = NULL;
1200
1201 if (error != NULL) {
1202 *error = NULL;
1203 }
1204 if ((params == NULL)
1205 || (params->account_name == NULL)
1206 || (params->level != WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP)) {
1207 status = WBC_ERR_INVALID_PARAM;
1208 goto fail;
1209 }
1210
1211 if (params->domain_name != NULL) {
1212 status = wbcRequestResponse(WINBINDD_INFO, NULL, &response);
1213 if (!WBC_ERROR_IS_OK(status)) {
1214 goto fail;
1215 }
1216 snprintf(request.data.ccache_ntlm_auth.user,
1217 sizeof(request.data.ccache_ntlm_auth.user)-1,
1218 "%s%c%s", params->domain_name,
1219 response.data.info.winbind_separator,
1220 params->account_name);
1221 } else {
1222 strncpy(request.data.ccache_ntlm_auth.user,
1223 params->account_name,
1224 sizeof(request.data.ccache_ntlm_auth.user)-1);
1225 }
1226 request.data.ccache_ntlm_auth.uid = getuid();
1227
1228 for (i=0; i<params->num_blobs; i++) {
1229 if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) {
1230 initial_blob = &params->blobs[i];
1231 break;
1232 }
1233 if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
1234 challenge_blob = &params->blobs[i];
1235 break;
1236 }
1237 }
1238
1239 request.data.ccache_ntlm_auth.initial_blob_len = 0;
1240 request.data.ccache_ntlm_auth.challenge_blob_len = 0;
1241 request.extra_len = 0;
1242
1243 if (initial_blob != NULL) {
1244 request.data.ccache_ntlm_auth.initial_blob_len =
1245 initial_blob->blob.length;
1246 request.extra_len += initial_blob->blob.length;
1247 }
1248 if (challenge_blob != NULL) {
1249 request.data.ccache_ntlm_auth.challenge_blob_len =
1250 challenge_blob->blob.length;
1251 request.extra_len += challenge_blob->blob.length;
1252 }
1253
1254 if (request.extra_len != 0) {
1255 request.extra_data.data = (char *)malloc(request.extra_len);
1256 if (request.extra_data.data == NULL) {
1257 status = WBC_ERR_NO_MEMORY;
1258 goto fail;
1259 }
1260 }
1261 if (initial_blob != NULL) {
1262 memcpy(request.extra_data.data,
1263 initial_blob->blob.data, initial_blob->blob.length);
1264 }
1265 if (challenge_blob != NULL) {
1266 memcpy(request.extra_data.data
1267 + request.data.ccache_ntlm_auth.initial_blob_len,
1268 challenge_blob->blob.data,
1269 challenge_blob->blob.length);
1270 }
1271
1272 status = wbcRequestResponse(WINBINDD_CCACHE_NTLMAUTH, &request,
1273 &response);
1274 if (!WBC_ERROR_IS_OK(status)) {
1275 goto fail;
1276 }
1277
1278 result = (struct wbcCredentialCacheInfo *)wbcAllocateMemory(
1279 1, sizeof(struct wbcCredentialCacheInfo),
1280 wbcCredentialCacheInfoDestructor);
1281 if (result == NULL) {
1282 status = WBC_ERR_NO_MEMORY;
1283 goto fail;
1284 }
1285 result->num_blobs = 0;
1286 result->blobs = NULL;
1287 status = wbcAddNamedBlob(&result->num_blobs, &result->blobs,
1288 "auth_blob", 0,
1289 (uint8_t *)response.extra_data.data,
1290 response.data.ccache_ntlm_auth.auth_blob_len);
1291 if (!WBC_ERROR_IS_OK(status)) {
1292 goto fail;
1293 }
1294 status = wbcAddNamedBlob(
1295 &result->num_blobs, &result->blobs, "session_key", 0,
1296 response.data.ccache_ntlm_auth.session_key,
1297 sizeof(response.data.ccache_ntlm_auth.session_key));
1298 if (!WBC_ERROR_IS_OK(status)) {
1299 goto fail;
1300 }
1301
1302 *info = result;
1303 result = NULL;
1304 status = WBC_ERR_SUCCESS;
1305 fail:
1306 free(request.extra_data.data);
1307 winbindd_free_response(&response);
1308 wbcFreeMemory(result);
1309 return status;
1310 }
1311
1312 /* Authenticate a user with cached credentials */
1313 wbcErr wbcCredentialSave(const char *user, const char *password)
1314 {
1315 struct winbindd_request request;
1316 struct winbindd_response response;
1317
1318 ZERO_STRUCT(request);
1319 ZERO_STRUCT(response);
1320
1321 strncpy(request.data.ccache_save.user, user,
1322 sizeof(request.data.ccache_save.user)-1);
1323 strncpy(request.data.ccache_save.pass, password,
1324 sizeof(request.data.ccache_save.pass)-1);
1325 request.data.ccache_save.uid = getuid();
1326
1327 return wbcRequestResponse(WINBINDD_CCACHE_SAVE, &request, &response);
1328 }
Samba GIT mirror