?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
fixing typo in the 'map readonly = permissions' explanation reported by Thomas Bork
[Samba.git] / source / nsswitch / winbindd_pam.c
blobe5e55e60f98ad4368076c2690d765fcb74ba3c5d
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon - pam auth funcions
5
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program; if not, write to the Free Software
23 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 */
25
26 #include "includes.h"
27 #include "winbindd.h"
28 #undef DBGC_CLASS
29 #define DBGC_CLASS DBGC_WINBIND
30
31 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
32 struct winbindd_cli_state *state,
33 NET_USER_INFO_3 *info3)
34 {
35 fstring str_sid;
36
37 state->response.data.auth.info3.logon_time =
38 nt_time_to_unix(info3->logon_time);
39 state->response.data.auth.info3.logoff_time =
40 nt_time_to_unix(info3->logoff_time);
41 state->response.data.auth.info3.kickoff_time =
42 nt_time_to_unix(info3->kickoff_time);
43 state->response.data.auth.info3.pass_last_set_time =
44 nt_time_to_unix(info3->pass_last_set_time);
45 state->response.data.auth.info3.pass_can_change_time =
46 nt_time_to_unix(info3->pass_can_change_time);
47 state->response.data.auth.info3.pass_must_change_time =
48 nt_time_to_unix(info3->pass_must_change_time);
49
50 state->response.data.auth.info3.logon_count = info3->logon_count;
51 state->response.data.auth.info3.bad_pw_count = info3->bad_pw_count;
52
53 state->response.data.auth.info3.user_rid = info3->user_rid;
54 state->response.data.auth.info3.group_rid = info3->group_rid;
55 sid_to_string(str_sid, &(info3->dom_sid.sid));
56 fstrcpy(state->response.data.auth.info3.dom_sid, str_sid);
57
58 state->response.data.auth.info3.num_groups = info3->num_groups;
59 state->response.data.auth.info3.user_flgs = info3->user_flgs;
60
61 state->response.data.auth.info3.acct_flags = info3->acct_flags;
62 state->response.data.auth.info3.num_other_sids = info3->num_other_sids;
63
64 unistr2_to_ascii(state->response.data.auth.info3.user_name,
65 &info3->uni_user_name, -1);
66 unistr2_to_ascii(state->response.data.auth.info3.full_name,
67 &info3->uni_full_name, -1);
68 unistr2_to_ascii(state->response.data.auth.info3.logon_script,
69 &info3->uni_logon_script, -1);
70 unistr2_to_ascii(state->response.data.auth.info3.profile_path,
71 &info3->uni_profile_path, -1);
72 unistr2_to_ascii(state->response.data.auth.info3.home_dir,
73 &info3->uni_home_dir, -1);
74 unistr2_to_ascii(state->response.data.auth.info3.dir_drive,
75 &info3->uni_dir_drive, -1);
76
77 unistr2_to_ascii(state->response.data.auth.info3.logon_srv,
78 &info3->uni_logon_srv, -1);
79 unistr2_to_ascii(state->response.data.auth.info3.logon_dom,
80 &info3->uni_logon_dom, -1);
81
82 return NT_STATUS_OK;
83 }
84
85 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
86 struct winbindd_cli_state *state,
87 NET_USER_INFO_3 *info3)
88 {
89 prs_struct ps;
90 uint32 size;
91 if (!prs_init(&ps, 256 /* Random, non-zero number */, mem_ctx, MARSHALL)) {
92 return NT_STATUS_NO_MEMORY;
93 }
94 if (!net_io_user_info3("", info3, &ps, 1, 3, False)) {
95 prs_mem_free(&ps);
96 return NT_STATUS_UNSUCCESSFUL;
97 }
98
99 size = prs_data_size(&ps);
100 SAFE_FREE(state->response.extra_data.data);
101 state->response.extra_data.data = SMB_MALLOC(size);
102 if (!state->response.extra_data.data) {
103 prs_mem_free(&ps);
104 return NT_STATUS_NO_MEMORY;
105 }
106 memset( state->response.extra_data.data, '\0', size );
107 prs_copy_all_data_out((char *)state->response.extra_data.data, &ps);
108 state->response.length += size;
109 prs_mem_free(&ps);
110 return NT_STATUS_OK;
111 }
112
113 static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
114 NET_USER_INFO_3 *info3,
115 const char *group_sid)
116 /**
117 * Check whether a user belongs to a group or list of groups.
118 *
119 * @param mem_ctx talloc memory context.
120 * @param info3 user information, including group membership info.
121 * @param group_sid One or more groups , separated by commas.
122 *
123 * @return NT_STATUS_OK on success,
124 * NT_STATUS_LOGON_FAILURE if the user does not belong,
125 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
126 */
127 {
128 DOM_SID *require_membership_of_sid;
129 size_t num_require_membership_of_sid;
130 DOM_SID *all_sids;
131 size_t num_all_sids = (2 + info3->num_groups2 + info3->num_other_sids);
132 size_t i, j = 0, k;
133 size_t group_sid_length;
134 const char *search_location;
135 char *single_group_sid;
136 const char *comma;
137
138 /* Parse the 'required group' SID */
139
140 if (!group_sid || !group_sid[0]) {
141 /* NO sid supplied, all users may access */
142 return NT_STATUS_OK;
143 }
144
145 num_require_membership_of_sid = 1;
146 group_sid_length = strlen(group_sid);
147 for (i = 0; i < group_sid_length; i++) {
148 if (',' == group_sid[i]) {
149 num_require_membership_of_sid++;
150 }
151 }
152
153 require_membership_of_sid = TALLOC_ARRAY(mem_ctx, DOM_SID, num_require_membership_of_sid);
154 if (!require_membership_of_sid)
155 return NT_STATUS_NO_MEMORY;
156
157 i = 0;
158 search_location = group_sid;
159
160 if (num_require_membership_of_sid > 1) {
161
162 /* Allocate the maximum possible size */
163 single_group_sid = TALLOC(mem_ctx, group_sid_length);
164 if (!single_group_sid)
165 return NT_STATUS_NO_MEMORY;
166
167 while ( (comma = strstr(search_location, ",")) != NULL ) {
168
169 strncpy(single_group_sid, search_location, comma - search_location);
170 single_group_sid[comma - search_location] = 0;
171
172 if (!string_to_sid(&require_membership_of_sid[i++], single_group_sid)) {
173 DEBUG(0, ("check_info3_in_group: could not parse %s as a SID!",
174 single_group_sid));
175
176 return NT_STATUS_INVALID_PARAMETER;
177 }
178
179 search_location = comma + 1;
180 }
181 }
182
183 if (!string_to_sid(&require_membership_of_sid[i++], search_location)) {
184 DEBUG(0, ("check_info3_in_group: could not parse %s as a SID!",
185 search_location));
186
187 return NT_STATUS_INVALID_PARAMETER;
188 }
189
190 all_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, num_all_sids);
191 if (!all_sids)
192 return NT_STATUS_NO_MEMORY;
193
194 /* and create (by appending rids) the 'domain' sids */
195
196 sid_copy(&all_sids[0], &(info3->dom_sid.sid));
197
198 if (!sid_append_rid(&all_sids[0], info3->user_rid)) {
199 DEBUG(3,("could not append user's primary RID 0x%x\n",
200 info3->user_rid));
201
202 return NT_STATUS_INVALID_PARAMETER;
203 }
204 j++;
205
206 sid_copy(&all_sids[1], &(info3->dom_sid.sid));
207
208 if (!sid_append_rid(&all_sids[1], info3->group_rid)) {
209 DEBUG(3,("could not append additional group rid 0x%x\n",
210 info3->group_rid));
211
212 return NT_STATUS_INVALID_PARAMETER;
213 }
214 j++;
215
216 for (i = 0; i < info3->num_groups2; i++) {
217
218 sid_copy(&all_sids[j], &(info3->dom_sid.sid));
219
220 if (!sid_append_rid(&all_sids[j], info3->gids[i].g_rid)) {
221 DEBUG(3,("could not append additional group rid 0x%x\n",
222 info3->gids[i].g_rid));
223
224 return NT_STATUS_INVALID_PARAMETER;
225 }
226 j++;
227 }
228
229 /* Copy 'other' sids. We need to do sid filtering here to
230 prevent possible elevation of privileges. See:
231
232 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
233 */
234
235 for (i = 0; i < info3->num_other_sids; i++) {
236 sid_copy(&all_sids[info3->num_groups2 + i + 2],
237 &info3->other_sids[i].sid);
238 j++;
239 }
240
241 for (i = 0; i < j; i++) {
242 fstring sid1, sid2;
243 DEBUG(10, ("User has SID: %s\n",
244 sid_to_string(sid1, &all_sids[i])));
245 for (k = 0; k < num_require_membership_of_sid; k++) {
246 if (sid_equal(&require_membership_of_sid[k], &all_sids[i])) {
247 DEBUG(10, ("SID %s matches %s - user permitted to authenticate!\n",
248 sid_to_string(sid1, &require_membership_of_sid[k]), sid_to_string(sid2, &all_sids[i])));
249 return NT_STATUS_OK;
250 }
251 }
252 }
253
254 /* Do not distinguish this error from a wrong username/pw */
255
256 return NT_STATUS_LOGON_FAILURE;
257 }
258
259 struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
260 const char *domain_name)
261 {
262 struct winbindd_domain *domain;
263
264 if (IS_DC) {
265 domain = find_domain_from_name_noinit(domain_name);
266 if (domain == NULL) {
267 DEBUG(3, ("Authentication for domain [%s] refused"
268 "as it is not a trusted domain\n",
269 domain_name));
270 }
271 return domain;
272 }
273
274 if (is_myname(domain_name)) {
275 DEBUG(3, ("Authentication for domain %s (local domain "
276 "to this server) not supported at this "
277 "stage\n", domain_name));
278 return NULL;
279 }
280
281 /* we can auth against trusted domains */
282 if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
283 domain = find_domain_from_name_noinit(domain_name);
284 if (domain == NULL) {
285 DEBUG(3, ("Authentication for domain [%s] skipped "
286 "as it is not a trusted domain\n",
287 domain_name));
288 } else {
289 return domain;
290 }
291 }
292
293 return find_our_domain();
294 }
295
296 static void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
297 {
298 resp->data.auth.nt_status = NT_STATUS_V(result);
299 fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result));
300
301 /* we might have given a more useful error above */
302 if (*resp->data.auth.error_string == '\0')
303 fstrcpy(resp->data.auth.error_string,
304 get_friendly_nt_error_msg(result));
305 resp->data.auth.pam_error = nt_status_to_pam(result);
306 }
307
308 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
309 struct winbindd_cli_state *state)
310 {
311 struct winbindd_methods *methods;
312 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
313 SAM_UNK_INFO_1 password_policy;
314
315 methods = domain->methods;
316
317 status = methods->password_policy(domain, state->mem_ctx, &password_policy);
318 if (NT_STATUS_IS_ERR(status)) {
319 return status;
320 }
321
322 state->response.data.auth.policy.min_length_password =
323 password_policy.min_length_password;
324 state->response.data.auth.policy.password_history =
325 password_policy.password_history;
326 state->response.data.auth.policy.password_properties =
327 password_policy.password_properties;
328 state->response.data.auth.policy.expire =
329 nt_time_to_unix_abs(&(password_policy.expire));
330 state->response.data.auth.policy.min_passwordage =
331 nt_time_to_unix_abs(&(password_policy.min_passwordage));
332
333 return NT_STATUS_OK;
334 }
335
336 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
337 TALLOC_CTX *mem_ctx,
338 uint16 *max_allowed_bad_attempts)
339 {
340 struct winbindd_methods *methods;
341 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
342 SAM_UNK_INFO_12 lockout_policy;
343
344 *max_allowed_bad_attempts = 0;
345
346 methods = domain->methods;
347
348 status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
349 if (NT_STATUS_IS_ERR(status)) {
350 return status;
351 }
352
353 *max_allowed_bad_attempts = lockout_policy.bad_attempt_lockout;
354
355 return NT_STATUS_OK;
356 }
357
358 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
359 TALLOC_CTX *mem_ctx,
360 uint32 *password_properties)
361 {
362 struct winbindd_methods *methods;
363 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
364 SAM_UNK_INFO_1 password_policy;
365
366 *password_properties = 0;
367
368 methods = domain->methods;
369
370 status = methods->password_policy(domain, mem_ctx, &password_policy);
371 if (NT_STATUS_IS_ERR(status)) {
372 return status;
373 }
374
375 *password_properties = password_policy.password_properties;
376
377 return NT_STATUS_OK;
378 }
379
380 #ifdef HAVE_KRB5
381
382 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
383 const char *type,
384 uid_t uid,
385 BOOL *internal_ccache)
386 {
387 /* accept FILE and WRFILE as krb5_cc_type from the client and then
388 * build the full ccname string based on the user's uid here -
389 * Guenther*/
390
391 const char *gen_cc = NULL;
392
393 *internal_ccache = True;
394
395 if (uid == -1) {
396 goto memory_ccache;
397 }
398
399 if (!type || type[0] == '\0') {
400 goto memory_ccache;
401 }
402
403 if (strequal(type, "FILE")) {
404 gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
405 } else if (strequal(type, "WRFILE")) {
406 gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
407 } else {
408 DEBUG(10,("we don't allow to set a %s type ccache\n", type));
409 goto memory_ccache;
410 }
411
412 *internal_ccache = False;
413 goto done;
414
415 memory_ccache:
416 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
417
418 done:
419 if (gen_cc == NULL) {
420 DEBUG(0,("out of memory\n"));
421 return NULL;
422 }
423
424 DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
425
426 return gen_cc;
427 }
428
429 static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
430 {
431 const char *type = state->request.data.auth.krb5_cc_type;
432
433 state->response.data.auth.krb5ccname[0] = '\0';
434
435 if (type[0] == '\0') {
436 return;
437 }
438
439 if (!strequal(type, "FILE") &&
440 !strequal(type, "WRFILE")) {
441 DEBUG(10,("won't return krbccname for a %s type ccache\n",
442 type));
443 return;
444 }
445
446 fstrcpy(state->response.data.auth.krb5ccname, cc);
447 }
448
449 #endif
450
451 static uid_t get_uid_from_state(struct winbindd_cli_state *state)
452 {
453 uid_t uid = -1;
454
455 uid = state->request.data.auth.uid;
456
457 if (uid < 0) {
458 DEBUG(1,("invalid uid: '%d'\n", uid));
459 return -1;
460 }
461 return uid;
462 }
463
464 /**********************************************************************
465 Authenticate a user with a clear text password using Kerberos and fill up
466 ccache if required
467 **********************************************************************/
468
469 static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
470 struct winbindd_cli_state *state,
471 NET_USER_INFO_3 **info3)
472 {
473 #ifdef HAVE_KRB5
474 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
475 krb5_error_code krb5_ret;
476 DATA_BLOB tkt, session_key_krb5;
477 DATA_BLOB ap_rep, session_key;
478 PAC_DATA *pac_data = NULL;
479 PAC_LOGON_INFO *logon_info = NULL;
480 char *client_princ = NULL;
481 char *client_princ_out = NULL;
482 char *local_service = NULL;
483 const char *cc = NULL;
484 const char *principal_s = NULL;
485 const char *service = NULL;
486 char *realm = NULL;
487 fstring name_domain, name_user;
488 time_t ticket_lifetime = 0;
489 time_t renewal_until = 0;
490 uid_t uid = -1;
491 ADS_STRUCT *ads;
492 time_t time_offset = 0;
493 BOOL internal_ccache = True;
494
495 ZERO_STRUCT(session_key);
496 ZERO_STRUCT(session_key_krb5);
497 ZERO_STRUCT(tkt);
498 ZERO_STRUCT(ap_rep);
499
500 ZERO_STRUCTP(info3);
501
502 *info3 = NULL;
503
504 /* 1st step:
505 * prepare a krb5_cc_cache string for the user */
506
507 uid = get_uid_from_state(state);
508 if (uid == -1) {
509 DEBUG(0,("no valid uid\n"));
510 }
511
512 cc = generate_krb5_ccache(state->mem_ctx,
513 state->request.data.auth.krb5_cc_type,
514 state->request.data.auth.uid,
515 &internal_ccache);
516 if (cc == NULL) {
517 return NT_STATUS_NO_MEMORY;
518 }
519
520
521 /* 2nd step:
522 * get kerberos properties */
523
524 if (domain->private_data) {
525 ads = (ADS_STRUCT *)domain->private_data;
526 time_offset = ads->auth.time_offset;
527 }
528
529
530 /* 3rd step:
531 * do kerberos auth and setup ccache as the user */
532
533 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
534
535 realm = domain->alt_name;
536 strupper_m(realm);
537
538 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
539 if (principal_s == NULL) {
540 return NT_STATUS_NO_MEMORY;
541 }
542
543 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
544 if (service == NULL) {
545 return NT_STATUS_NO_MEMORY;
546 }
547
548 /* if this is a user ccache, we need to act as the user to let the krb5
549 * library handle the chown, etc. */
550
551 /************************ NON-ROOT **********************/
552
553 if (!internal_ccache) {
554
555 set_effective_uid(uid);
556 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
557 }
558
559 krb5_ret = kerberos_kinit_password_ext(principal_s,
560 state->request.data.auth.pass,
561 time_offset,
562 &ticket_lifetime,
563 &renewal_until,
564 cc,
565 True,
566 True,
567 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
568
569 if (krb5_ret) {
570 DEBUG(1,("winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d)\n",
571 principal_s, error_message(krb5_ret), krb5_ret));
572 result = krb5_to_nt_status(krb5_ret);
573 goto failed;
574 }
575
576 /* does http_timestring use heimdals libroken strftime?? - Guenther */
577 DEBUG(10,("got TGT for %s in %s (valid until: %s (%d), renewable till: %s (%d))\n",
578 principal_s, cc,
579 http_timestring(ticket_lifetime), (int)ticket_lifetime,
580 http_timestring(renewal_until), (int)renewal_until));
581
582 /* we cannot continue with krb5 when UF_DONT_REQUIRE_PREAUTH is set,
583 * in that case fallback to NTLM - gd */
584
585 if ((ticket_lifetime == 0) && (renewal_until == 0)) {
586 result = NT_STATUS_INVALID_LOGON_TYPE;
587 goto failed;
588 }
589
590 client_princ = talloc_strdup(state->mem_ctx, global_myname());
591 if (client_princ == NULL) {
592 result = NT_STATUS_NO_MEMORY;
593 goto failed;
594 }
595 strlower_m(client_princ);
596
597 local_service = talloc_asprintf(state->mem_ctx, "%s$@%s", client_princ, lp_realm());
598 if (local_service == NULL) {
599 DEBUG(0,("winbindd_raw_kerberos_login: out of memory\n"));
600 result = NT_STATUS_NO_MEMORY;
601 goto failed;
602 }
603
604 krb5_ret = cli_krb5_get_ticket(local_service,
605 time_offset,
606 &tkt,
607 &session_key_krb5,
608 0,
609 cc,
610 NULL);
611 if (krb5_ret) {
612 DEBUG(1,("winbindd_raw_kerberos_login: failed to get ticket for %s: %s\n",
613 local_service, error_message(krb5_ret)));
614 result = krb5_to_nt_status(krb5_ret);
615 goto failed;
616 }
617
618 if (!internal_ccache) {
619 gain_root_privilege();
620 }
621
622 /************************ NON-ROOT **********************/
623
624 result = ads_verify_ticket(state->mem_ctx,
625 lp_realm(),
626 time_offset,
627 &tkt,
628 &client_princ_out,
629 &pac_data,
630 &ap_rep,
631 &session_key);
632 if (!NT_STATUS_IS_OK(result)) {
633 DEBUG(0,("winbindd_raw_kerberos_login: ads_verify_ticket failed: %s\n",
634 nt_errstr(result)));
635 goto failed;
636 }
637
638 if (!pac_data) {
639 DEBUG(3,("winbindd_raw_kerberos_login: no pac data\n"));
640 result = NT_STATUS_INVALID_PARAMETER;
641 goto failed;
642 }
643
644 logon_info = get_logon_info_from_pac(pac_data);
645 if (logon_info == NULL) {
646 DEBUG(1,("winbindd_raw_kerberos_login: no logon info\n"));
647 result = NT_STATUS_INVALID_PARAMETER;
648 goto failed;
649 }
650
651 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
652 local_service));
653
654
655 /* last step:
656 * put results together */
657
658 *info3 = &logon_info->info3;
659
660 /* if we had a user's ccache then return that string for the pam
661 * environment */
662
663 if (!internal_ccache) {
664
665 setup_return_cc_name(state, cc);
666
667 result = add_ccache_to_list(principal_s,
668 cc,
669 service,
670 state->request.data.auth.user,
671 realm,
672 uid,
673 time(NULL),
674 ticket_lifetime,
675 renewal_until,
676 False);
677
678 if (!NT_STATUS_IS_OK(result)) {
679 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
680 nt_errstr(result)));
681 }
682 } else {
683
684 /* need to delete the memory cred cache, it is not used anymore */
685
686 krb5_ret = ads_kdestroy(cc);
687 if (krb5_ret) {
688 DEBUG(3,("winbindd_raw_kerberos_login: "
689 "could not destroy krb5 credential cache: "
690 "%s\n", error_message(krb5_ret)));
691 }
692
693 }
694
695 result = NT_STATUS_OK;
696
697 goto done;
698
699 failed:
700
701 /* we could have created a new credential cache with a valid tgt in it
702 * but we werent able to get or verify the service ticket for this
703 * local host and therefor didn't get the PAC, we need to remove that
704 * cache entirely now */
705
706 krb5_ret = ads_kdestroy(cc);
707 if (krb5_ret) {
708 DEBUG(3,("winbindd_raw_kerberos_login: "
709 "could not destroy krb5 credential cache: "
710 "%s\n", error_message(krb5_ret)));
711 }
712
713 if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
714 DEBUG(3,("winbindd_raw_kerberos_login: "
715 "could not remove ccache for user %s\n",
716 state->request.data.auth.user));
717 }
718
719 done:
720 data_blob_free(&session_key);
721 data_blob_free(&session_key_krb5);
722 data_blob_free(&ap_rep);
723 data_blob_free(&tkt);
724
725 SAFE_FREE(client_princ_out);
726
727 if (!internal_ccache) {
728 gain_root_privilege();
729 }
730
731 return result;
732 #else
733 return NT_STATUS_NOT_SUPPORTED;
734 #endif /* HAVE_KRB5 */
735 }
736
737 void winbindd_pam_auth(struct winbindd_cli_state *state)
738 {
739 struct winbindd_domain *domain;
740 fstring name_domain, name_user;
741
742 /* Ensure null termination */
743 state->request.data.auth.user
744 [sizeof(state->request.data.auth.user)-1]='\0';
745
746 /* Ensure null termination */
747 state->request.data.auth.pass
748 [sizeof(state->request.data.auth.pass)-1]='\0';
749
750 DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
751 state->request.data.auth.user));
752
753 /* Parse domain and username */
754
755 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
756
757 if (!canonicalize_username(state->request.data.auth.user,
758 name_domain, name_user)) {
759 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
760 DEBUG(5, ("Plain text authentication for %s returned %s "
761 "(PAM: %d)\n",
762 state->request.data.auth.user,
763 state->response.data.auth.nt_status_string,
764 state->response.data.auth.pam_error));
765 request_error(state);
766 return;
767 }
768
769 domain = find_auth_domain(state, name_domain);
770
771 if (domain == NULL) {
772 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
773 DEBUG(5, ("Plain text authentication for %s returned %s "
774 "(PAM: %d)\n",
775 state->request.data.auth.user,
776 state->response.data.auth.nt_status_string,
777 state->response.data.auth.pam_error));
778 request_error(state);
779 return;
780 }
781
782 sendto_domain(state, domain);
783 }
784
785 NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
786 struct winbindd_cli_state *state,
787 NET_USER_INFO_3 **info3)
788 {
789 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
790 uint16 max_allowed_bad_attempts;
791 fstring name_domain, name_user;
792 DOM_SID sid;
793 enum lsa_SidType type;
794 uchar new_nt_pass[NT_HASH_LEN];
795 const uint8 *cached_nt_pass;
796 const uint8 *cached_salt;
797 NET_USER_INFO_3 *my_info3;
798 time_t kickoff_time, must_change_time;
799 BOOL password_good = False;
800
801 *info3 = NULL;
802
803 ZERO_STRUCTP(info3);
804
805 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
806
807 /* Parse domain and username */
808
809 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
810
811
812 if (!lookup_cached_name(state->mem_ctx,
813 name_domain,
814 name_user,
815 &sid,
816 &type)) {
817 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
818 return NT_STATUS_NO_SUCH_USER;
819 }
820
821 if (type != SID_NAME_USER) {
822 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
823 return NT_STATUS_LOGON_FAILURE;
824 }
825
826 result = winbindd_get_creds(domain,
827 state->mem_ctx,
828 &sid,
829 &my_info3,
830 &cached_nt_pass,
831 &cached_salt);
832 if (!NT_STATUS_IS_OK(result)) {
833 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
834 return result;
835 }
836
837 *info3 = my_info3;
838
839 E_md4hash(state->request.data.auth.pass, new_nt_pass);
840
841 #if DEBUG_PASSWORD
842 dump_data(100, (const char *)new_nt_pass, NT_HASH_LEN);
843 dump_data(100, (const char *)cached_nt_pass, NT_HASH_LEN);
844 if (cached_salt) {
845 dump_data(100, (const char *)cached_salt, NT_HASH_LEN);
846 }
847 #endif
848
849 if (cached_salt) {
850 /* In this case we didn't store the nt_hash itself,
851 but the MD5 combination of salt + nt_hash. */
852 uchar salted_hash[NT_HASH_LEN];
853 E_md5hash(cached_salt, new_nt_pass, salted_hash);
854
855 password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
856 True : False;
857 } else {
858 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
859 password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
860 True : False;
861 }
862
863 if (password_good) {
864
865 /* User *DOES* know the password, update logon_time and reset
866 * bad_pw_count */
867
868 my_info3->user_flgs |= LOGON_CACHED_ACCOUNT;
869
870 if (my_info3->acct_flags & ACB_AUTOLOCK) {
871 return NT_STATUS_ACCOUNT_LOCKED_OUT;
872 }
873
874 if (my_info3->acct_flags & ACB_DISABLED) {
875 return NT_STATUS_ACCOUNT_DISABLED;
876 }
877
878 if (my_info3->acct_flags & ACB_WSTRUST) {
879 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
880 }
881
882 if (my_info3->acct_flags & ACB_SVRTRUST) {
883 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
884 }
885
886 if (my_info3->acct_flags & ACB_DOMTRUST) {
887 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
888 }
889
890 if (!(my_info3->acct_flags & ACB_NORMAL)) {
891 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
892 my_info3->acct_flags));
893 return NT_STATUS_LOGON_FAILURE;
894 }
895
896 kickoff_time = nt_time_to_unix(my_info3->kickoff_time);
897 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
898 return NT_STATUS_ACCOUNT_EXPIRED;
899 }
900
901 must_change_time = nt_time_to_unix(my_info3->pass_must_change_time);
902 if (must_change_time != 0 && must_change_time < time(NULL)) {
903 /* we allow grace logons when the password has expired */
904 my_info3->user_flgs |= LOGON_GRACE_LOGON;
905 /* return NT_STATUS_PASSWORD_EXPIRED; */
906 goto success;
907 }
908
909 #ifdef HAVE_KRB5
910 /* FIXME: what else points out that the remote domain is AD ? */
911 if (!strequal(domain->name, domain->alt_name) &&
912 (state->request.flags & WBFLAG_PAM_KRB5)) {
913
914 uid_t uid = -1;
915 const char *cc = NULL;
916 char *realm = NULL;
917 const char *principal_s = NULL;
918 const char *service = NULL;
919 BOOL internal_ccache = False;
920
921 uid = get_uid_from_state(state);
922 if (uid == -1) {
923 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
924 return NT_STATUS_INVALID_PARAMETER;
925 }
926
927 cc = generate_krb5_ccache(state->mem_ctx,
928 state->request.data.auth.krb5_cc_type,
929 state->request.data.auth.uid,
930 &internal_ccache);
931 if (cc == NULL) {
932 return NT_STATUS_NO_MEMORY;
933 }
934
935 realm = domain->alt_name;
936 strupper_m(realm);
937
938 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
939 if (principal_s == NULL) {
940 return NT_STATUS_NO_MEMORY;
941 }
942
943 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
944 if (service == NULL) {
945 return NT_STATUS_NO_MEMORY;
946 }
947
948 if (!internal_ccache) {
949
950 setup_return_cc_name(state, cc);
951
952 result = add_ccache_to_list(principal_s,
953 cc,
954 service,
955 state->request.data.auth.user,
956 domain->alt_name,
957 uid,
958 time(NULL),
959 time(NULL) + lp_winbind_cache_time(),
960 time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
961 True);
962
963 if (!NT_STATUS_IS_OK(result)) {
964 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
965 "to add ccache to list: %s\n",
966 nt_errstr(result)));
967 }
968 }
969 }
970 #endif /* HAVE_KRB5 */
971 success:
972 /* FIXME: we possibly should handle logon hours as well (does xp when
973 * offline?) see auth/auth_sam.c:sam_account_ok for details */
974
975 unix_to_nt_time(&my_info3->logon_time, time(NULL));
976 my_info3->bad_pw_count = 0;
977
978 result = winbindd_update_creds_by_info3(domain,
979 state->mem_ctx,
980 state->request.data.auth.user,
981 state->request.data.auth.pass,
982 my_info3);
983 if (!NT_STATUS_IS_OK(result)) {
984 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
985 nt_errstr(result)));
986 return result;
987 }
988
989 return NT_STATUS_OK;
990
991 }
992
993 /* User does *NOT* know the correct password, modify info3 accordingly */
994
995 /* failure of this is not critical */
996 result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
997 if (!NT_STATUS_IS_OK(result)) {
998 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
999 "Won't be able to honour account lockout policies\n"));
1000 }
1001
1002 /* increase counter */
1003 my_info3->bad_pw_count++;
1004
1005 if (max_allowed_bad_attempts == 0) {
1006 goto failed;
1007 }
1008
1009 /* lockout user */
1010 if (my_info3->bad_pw_count >= max_allowed_bad_attempts) {
1011
1012 uint32 password_properties;
1013
1014 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1015 if (!NT_STATUS_IS_OK(result)) {
1016 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1017 }
1018
1019 if ((my_info3->user_rid != DOMAIN_USER_RID_ADMIN) ||
1020 (password_properties & DOMAIN_LOCKOUT_ADMINS)) {
1021 my_info3->acct_flags |= ACB_AUTOLOCK;
1022 }
1023 }
1024
1025 failed:
1026 result = winbindd_update_creds_by_info3(domain,
1027 state->mem_ctx,
1028 state->request.data.auth.user,
1029 NULL,
1030 my_info3);
1031
1032 if (!NT_STATUS_IS_OK(result)) {
1033 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1034 nt_errstr(result)));
1035 }
1036
1037 return NT_STATUS_LOGON_FAILURE;
1038 }
1039
1040 NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1041 struct winbindd_cli_state *state,
1042 NET_USER_INFO_3 **info3)
1043 {
1044 struct winbindd_domain *contact_domain;
1045 fstring name_domain, name_user;
1046 NTSTATUS result;
1047
1048 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1049
1050 /* Parse domain and username */
1051
1052 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1053
1054 /* what domain should we contact? */
1055
1056 if ( IS_DC ) {
1057 if (!(contact_domain = find_domain_from_name(name_domain))) {
1058 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1059 state->request.data.auth.user, name_domain, name_user, name_domain));
1060 result = NT_STATUS_NO_SUCH_USER;
1061 goto done;
1062 }
1063
1064 } else {
1065 if (is_myname(name_domain)) {
1066 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1067 result = NT_STATUS_NO_SUCH_USER;
1068 goto done;
1069 }
1070
1071 contact_domain = find_domain_from_name(name_domain);
1072 if (contact_domain == NULL) {
1073 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1074 state->request.data.auth.user, name_domain, name_user, name_domain));
1075
1076 contact_domain = find_our_domain();
1077 }
1078 }
1079
1080 if (contact_domain->initialized &&
1081 contact_domain->active_directory) {
1082 goto try_login;
1083 }
1084
1085 if (!contact_domain->initialized) {
1086 init_dc_connection(contact_domain);
1087 }
1088
1089 if (!contact_domain->active_directory) {
1090 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1091 return NT_STATUS_INVALID_LOGON_TYPE;
1092 }
1093 try_login:
1094 result = winbindd_raw_kerberos_login(contact_domain, state, info3);
1095 done:
1096 return result;
1097 }
1098
1099 NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
1100 struct winbindd_cli_state *state,
1101 NET_USER_INFO_3 **info3)
1102 {
1103
1104 struct rpc_pipe_client *netlogon_pipe;
1105 uchar chal[8];
1106 DATA_BLOB lm_resp;
1107 DATA_BLOB nt_resp;
1108 int attempts = 0;
1109 unsigned char local_lm_response[24];
1110 unsigned char local_nt_response[24];
1111 struct winbindd_domain *contact_domain;
1112 fstring name_domain, name_user;
1113 BOOL retry;
1114 NTSTATUS result;
1115 NET_USER_INFO_3 *my_info3;
1116
1117 ZERO_STRUCTP(info3);
1118
1119 *info3 = NULL;
1120
1121 my_info3 = TALLOC_ZERO_P(state->mem_ctx, NET_USER_INFO_3);
1122 if (my_info3 == NULL) {
1123 return NT_STATUS_NO_MEMORY;
1124 }
1125
1126
1127 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1128
1129 /* Parse domain and username */
1130
1131 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1132
1133 /* do password magic */
1134
1135
1136 generate_random_buffer(chal, 8);
1137 if (lp_client_ntlmv2_auth()) {
1138 DATA_BLOB server_chal;
1139 DATA_BLOB names_blob;
1140 DATA_BLOB nt_response;
1141 DATA_BLOB lm_response;
1142 server_chal = data_blob_talloc(state->mem_ctx, chal, 8);
1143
1144 /* note that the 'workgroup' here is a best guess - we don't know
1145 the server's domain at this point. The 'server name' is also
1146 dodgy...
1147 */
1148 names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1149
1150 if (!SMBNTLMv2encrypt(name_user, name_domain,
1151 state->request.data.auth.pass,
1152 &server_chal,
1153 &names_blob,
1154 &lm_response, &nt_response, NULL)) {
1155 data_blob_free(&names_blob);
1156 data_blob_free(&server_chal);
1157 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1158 result = NT_STATUS_NO_MEMORY;
1159 goto done;
1160 }
1161 data_blob_free(&names_blob);
1162 data_blob_free(&server_chal);
1163 lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data,
1164 lm_response.length);
1165 nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data,
1166 nt_response.length);
1167 data_blob_free(&lm_response);
1168 data_blob_free(&nt_response);
1169
1170 } else {
1171 if (lp_client_lanman_auth()
1172 && SMBencrypt(state->request.data.auth.pass,
1173 chal,
1174 local_lm_response)) {
1175 lm_resp = data_blob_talloc(state->mem_ctx,
1176 local_lm_response,
1177 sizeof(local_lm_response));
1178 } else {
1179 lm_resp = data_blob(NULL, 0);
1180 }
1181 SMBNTencrypt(state->request.data.auth.pass,
1182 chal,
1183 local_nt_response);
1184
1185 nt_resp = data_blob_talloc(state->mem_ctx,
1186 local_nt_response,
1187 sizeof(local_nt_response));
1188 }
1189
1190 /* what domain should we contact? */
1191
1192 if ( IS_DC ) {
1193 if (!(contact_domain = find_domain_from_name(name_domain))) {
1194 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1195 state->request.data.auth.user, name_domain, name_user, name_domain));
1196 result = NT_STATUS_NO_SUCH_USER;
1197 goto done;
1198 }
1199
1200 } else {
1201 if (is_myname(name_domain)) {
1202 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1203 result = NT_STATUS_NO_SUCH_USER;
1204 goto done;
1205 }
1206
1207 contact_domain = find_our_domain();
1208 }
1209
1210 /* check authentication loop */
1211
1212 do {
1213
1214 ZERO_STRUCTP(my_info3);
1215 retry = False;
1216
1217 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1218
1219 if (!NT_STATUS_IS_OK(result)) {
1220 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1221 goto done;
1222 }
1223
1224 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1225 state->mem_ctx,
1226 0,
1227 contact_domain->dcname, /* server name */
1228 name_user, /* user name */
1229 name_domain, /* target domain */
1230 global_myname(), /* workstation */
1231 chal,
1232 lm_resp,
1233 nt_resp,
1234 my_info3);
1235 attempts += 1;
1236
1237 /* We have to try a second time as cm_connect_netlogon
1238 might not yet have noticed that the DC has killed
1239 our connection. */
1240
1241 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1242 retry = True;
1243 continue;
1244 }
1245
1246 /* if we get access denied, a possible cause was that we had
1247 and open connection to the DC, but someone changed our
1248 machine account password out from underneath us using 'net
1249 rpc changetrustpw' */
1250
1251 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1252 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1253 "ACCESS_DENIED. Maybe the trust account "
1254 "password was changed and we didn't know it. "
1255 "Killing connections to domain %s\n",
1256 name_domain));
1257 invalidate_cm_connection(&contact_domain->conn);
1258 retry = True;
1259 }
1260
1261 } while ( (attempts < 2) && retry );
1262
1263 /* handle the case where a NT4 DC does not fill in the acct_flags in
1264 * the samlogon reply info3. When accurate info3 is required by the
1265 * caller, we look up the account flags ourselve - gd */
1266
1267 if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
1268 (my_info3->acct_flags == 0) && NT_STATUS_IS_OK(result)) {
1269
1270 struct rpc_pipe_client *samr_pipe;
1271 POLICY_HND samr_domain_handle, user_pol;
1272 SAM_USERINFO_CTR *user_ctr;
1273 NTSTATUS status_tmp;
1274 uint32 acct_flags;
1275
1276 ZERO_STRUCT(user_ctr);
1277
1278 status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
1279 &samr_pipe, &samr_domain_handle);
1280
1281 if (!NT_STATUS_IS_OK(status_tmp)) {
1282 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1283 nt_errstr(status_tmp)));
1284 goto done;
1285 }
1286
1287 status_tmp = rpccli_samr_open_user(samr_pipe, state->mem_ctx,
1288 &samr_domain_handle,
1289 MAXIMUM_ALLOWED_ACCESS,
1290 my_info3->user_rid, &user_pol);
1291
1292 if (!NT_STATUS_IS_OK(status_tmp)) {
1293 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1294 nt_errstr(status_tmp)));
1295 goto done;
1296 }
1297
1298 status_tmp = rpccli_samr_query_userinfo(samr_pipe, state->mem_ctx,
1299 &user_pol, 16, &user_ctr);
1300
1301 if (!NT_STATUS_IS_OK(status_tmp)) {
1302 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1303 nt_errstr(status_tmp)));
1304 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1305 goto done;
1306 }
1307
1308 acct_flags = user_ctr->info.id16->acb_info;
1309
1310 if (acct_flags == 0) {
1311 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1312 goto done;
1313 }
1314
1315 my_info3->acct_flags = acct_flags;
1316
1317 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1318
1319 rpccli_samr_close(samr_pipe, state->mem_ctx, &user_pol);
1320 }
1321
1322 *info3 = my_info3;
1323 done:
1324 return result;
1325 }
1326
1327 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1328 struct winbindd_cli_state *state)
1329 {
1330 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1331 fstring name_domain, name_user;
1332 NET_USER_INFO_3 *info3 = NULL;
1333
1334 /* Ensure null termination */
1335 state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
1336
1337 /* Ensure null termination */
1338 state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
1339
1340 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1341 state->request.data.auth.user));
1342
1343 /* Parse domain and username */
1344
1345 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1346
1347 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1348
1349 if (domain->online == False) {
1350 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1351 if (domain->startup) {
1352 /* Logons are very important to users. If we're offline and
1353 we get a request within the first 30 seconds of startup,
1354 try very hard to find a DC and go online. */
1355
1356 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1357 "request in startup mode.\n", domain->name ));
1358
1359 winbindd_flush_negative_conn_cache(domain);
1360 result = init_dc_connection(domain);
1361 }
1362 }
1363
1364 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1365
1366 /* Check for Kerberos authentication */
1367 if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
1368
1369 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1370
1371 if (NT_STATUS_IS_OK(result)) {
1372 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1373 goto process_result;
1374 } else {
1375 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1376 }
1377
1378 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1379 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1380 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1381 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1382 domain->online = False;
1383 }
1384
1385 /* there are quite some NT_STATUS errors where there is no
1386 * point in retrying with a samlogon, we explictly have to take
1387 * care not to increase the bad logon counter on the DC */
1388
1389 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1390 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1391 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1392 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1393 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1394 NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1395 NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1396 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1397 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1398 NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1399 goto process_result;
1400 }
1401
1402 if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1403 DEBUG(3,("falling back to samlogon\n"));
1404 goto sam_logon;
1405 } else {
1406 goto cached_logon;
1407 }
1408 }
1409
1410 sam_logon:
1411 /* Check for Samlogon authentication */
1412 if (domain->online) {
1413 result = winbindd_dual_pam_auth_samlogon(domain, state, &info3);
1414
1415 if (NT_STATUS_IS_OK(result)) {
1416 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1417 goto process_result;
1418 } else {
1419 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n", nt_errstr(result)));
1420 if (domain->online) {
1421 /* We're still online - fail. */
1422 goto done;
1423 }
1424 /* Else drop through and see if we can check offline.... */
1425 }
1426 }
1427
1428 cached_logon:
1429 /* Check for Cached logons */
1430 if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
1431 lp_winbind_offline_logon()) {
1432
1433 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1434
1435 if (NT_STATUS_IS_OK(result)) {
1436 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1437 goto process_result;
1438 } else {
1439 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1440 goto done;
1441 }
1442 }
1443
1444 process_result:
1445
1446 if (NT_STATUS_IS_OK(result)) {
1447
1448 DOM_SID user_sid;
1449
1450 /* In all codepaths where result == NT_STATUS_OK info3 must have
1451 been initialized. */
1452 if (!info3) {
1453 result = NT_STATUS_INTERNAL_ERROR;
1454 goto done;
1455 }
1456
1457 netsamlogon_cache_store(name_user, info3);
1458 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1459
1460 /* save name_to_sid info as early as possible */
1461 sid_compose(&user_sid, &info3->dom_sid.sid, info3->user_rid);
1462 cache_name2sid(domain, name_domain, name_user, SID_NAME_USER, &user_sid);
1463
1464 /* Check if the user is in the right group */
1465
1466 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1467 state->request.data.auth.require_membership_of_sid))) {
1468 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1469 state->request.data.auth.user,
1470 state->request.data.auth.require_membership_of_sid));
1471 goto done;
1472 }
1473
1474 if (state->request.flags & WBFLAG_PAM_INFO3_NDR) {
1475 result = append_info3_as_ndr(state->mem_ctx, state, info3);
1476 if (!NT_STATUS_IS_OK(result)) {
1477 DEBUG(10,("Failed to append INFO3 (NDR): %s\n", nt_errstr(result)));
1478 goto done;
1479 }
1480 }
1481
1482 if (state->request.flags & WBFLAG_PAM_INFO3_TEXT) {
1483 result = append_info3_as_txt(state->mem_ctx, state, info3);
1484 if (!NT_STATUS_IS_OK(result)) {
1485 DEBUG(10,("Failed to append INFO3 (TXT): %s\n", nt_errstr(result)));
1486 goto done;
1487 }
1488
1489 }
1490
1491 if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
1492
1493 /* Store in-memory creds for single-signon using ntlm_auth. */
1494 result = winbindd_add_memory_creds(state->request.data.auth.user,
1495 get_uid_from_state(state),
1496 state->request.data.auth.pass);
1497
1498 if (!NT_STATUS_IS_OK(result)) {
1499 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
1500 goto done;
1501 }
1502
1503 if (lp_winbind_offline_logon()) {
1504 result = winbindd_store_creds(domain,
1505 state->mem_ctx,
1506 state->request.data.auth.user,
1507 state->request.data.auth.pass,
1508 info3, NULL);
1509 if (!NT_STATUS_IS_OK(result)) {
1510
1511 /* Release refcount. */
1512 winbindd_delete_memory_creds(state->request.data.auth.user);
1513
1514 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
1515 goto done;
1516 }
1517 }
1518 }
1519
1520 if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
1521 result = fillup_password_policy(domain, state);
1522
1523 if (!NT_STATUS_IS_OK(result)) {
1524 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
1525 goto done;
1526 }
1527 }
1528
1529 if (state->request.flags & WBFLAG_PAM_UNIX_NAME) {
1530 /* We've been asked to return the unix username, per
1531 'winbind use default domain' settings and the like */
1532
1533 fstring username_out;
1534 const char *nt_username, *nt_domain;
1535
1536 if (!(nt_username = unistr2_tdup(state->mem_ctx, &info3->uni_user_name))) {
1537 /* If the server didn't give us one, just use the one we sent them */
1538 nt_username = name_user;
1539 }
1540
1541 if (!(nt_domain = unistr2_tdup(state->mem_ctx, &info3->uni_logon_dom))) {
1542 /* If the server didn't give us one, just use the one we sent them */
1543 nt_domain = name_domain;
1544 }
1545
1546 fill_domain_username(username_out, nt_domain, nt_username, True);
1547
1548 DEBUG(5, ("Setting unix username to [%s]\n", username_out));
1549
1550 SAFE_FREE(state->response.extra_data.data);
1551 state->response.extra_data.data = SMB_STRDUP(username_out);
1552 if (!state->response.extra_data.data) {
1553 result = NT_STATUS_NO_MEMORY;
1554 goto done;
1555 }
1556 state->response.length +=
1557 strlen((const char *)state->response.extra_data.data)+1;
1558 }
1559 }
1560
1561
1562 done:
1563 /* give us a more useful (more correct?) error code */
1564 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1565 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1566 result = NT_STATUS_NO_LOGON_SERVERS;
1567 }
1568
1569 state->response.data.auth.nt_status = NT_STATUS_V(result);
1570 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1571
1572 /* we might have given a more useful error above */
1573 if (!*state->response.data.auth.error_string)
1574 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1575 state->response.data.auth.pam_error = nt_status_to_pam(result);
1576
1577 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1578 state->request.data.auth.user,
1579 state->response.data.auth.nt_status_string,
1580 state->response.data.auth.pam_error));
1581
1582 if ( NT_STATUS_IS_OK(result) && info3 &&
1583 (state->request.flags & WBFLAG_PAM_AFS_TOKEN) ) {
1584
1585 char *afsname = talloc_strdup(state->mem_ctx,
1586 lp_afs_username_map());
1587 char *cell;
1588
1589 if (afsname == NULL) {
1590 goto no_token;
1591 }
1592
1593 afsname = talloc_string_sub(state->mem_ctx,
1594 lp_afs_username_map(),
1595 "%D", name_domain);
1596 afsname = talloc_string_sub(state->mem_ctx, afsname,
1597 "%u", name_user);
1598 afsname = talloc_string_sub(state->mem_ctx, afsname,
1599 "%U", name_user);
1600
1601 {
1602 DOM_SID user_sid;
1603 fstring sidstr;
1604
1605 sid_copy(&user_sid, &info3->dom_sid.sid);
1606 sid_append_rid(&user_sid, info3->user_rid);
1607 sid_to_string(sidstr, &user_sid);
1608 afsname = talloc_string_sub(state->mem_ctx, afsname,
1609 "%s", sidstr);
1610 }
1611
1612 if (afsname == NULL) {
1613 goto no_token;
1614 }
1615
1616 strlower_m(afsname);
1617
1618 DEBUG(10, ("Generating token for user %s\n", afsname));
1619
1620 cell = strchr(afsname, '@');
1621
1622 if (cell == NULL) {
1623 goto no_token;
1624 }
1625
1626 *cell = '\0';
1627 cell += 1;
1628
1629 /* Append an AFS token string */
1630 SAFE_FREE(state->response.extra_data.data);
1631 state->response.extra_data.data =
1632 afs_createtoken_str(afsname, cell);
1633
1634 if (state->response.extra_data.data != NULL) {
1635 state->response.length +=
1636 strlen((const char *)state->response.extra_data.data)+1;
1637 }
1638
1639 no_token:
1640 TALLOC_FREE(afsname);
1641 }
1642
1643 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1644 }
1645
1646
1647 /**********************************************************************
1648 Challenge Response Authentication Protocol
1649 **********************************************************************/
1650
1651 void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
1652 {
1653 struct winbindd_domain *domain = NULL;
1654 const char *domain_name = NULL;
1655 NTSTATUS result;
1656
1657 if (!state->privileged) {
1658 char *error_string = NULL;
1659 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1660 "denied. !\n"));
1661 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1662 "on %s are set correctly.\n",
1663 get_winbind_priv_pipe_dir()));
1664 /* send a better message than ACCESS_DENIED */
1665 error_string = talloc_asprintf(state->mem_ctx,
1666 "winbind client not authorized "
1667 "to use winbindd_pam_auth_crap."
1668 " Ensure permissions on %s "
1669 "are set correctly.",
1670 get_winbind_priv_pipe_dir());
1671 fstrcpy(state->response.data.auth.error_string, error_string);
1672 result = NT_STATUS_ACCESS_DENIED;
1673 goto done;
1674 }
1675
1676 /* Ensure null termination */
1677 state->request.data.auth_crap.user
1678 [sizeof(state->request.data.auth_crap.user)-1]=0;
1679 state->request.data.auth_crap.domain
1680 [sizeof(state->request.data.auth_crap.domain)-1]=0;
1681
1682 DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1683 (unsigned long)state->pid,
1684 state->request.data.auth_crap.domain,
1685 state->request.data.auth_crap.user));
1686
1687 if (*state->request.data.auth_crap.domain != '\0') {
1688 domain_name = state->request.data.auth_crap.domain;
1689 } else if (lp_winbind_use_default_domain()) {
1690 domain_name = lp_workgroup();
1691 }
1692
1693 if (domain_name != NULL)
1694 domain = find_auth_domain(state, domain_name);
1695
1696 if (domain != NULL) {
1697 sendto_domain(state, domain);
1698 return;
1699 }
1700
1701 result = NT_STATUS_NO_SUCH_USER;
1702
1703 done:
1704 set_auth_errors(&state->response, result);
1705 DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1706 state->request.data.auth_crap.domain,
1707 state->request.data.auth_crap.user,
1708 state->response.data.auth.nt_status_string,
1709 state->response.data.auth.pam_error));
1710 request_error(state);
1711 return;
1712 }
1713
1714
1715 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1716 struct winbindd_cli_state *state)
1717 {
1718 NTSTATUS result;
1719 NET_USER_INFO_3 info3;
1720 struct rpc_pipe_client *netlogon_pipe;
1721 const char *name_user = NULL;
1722 const char *name_domain = NULL;
1723 const char *workstation;
1724 struct winbindd_domain *contact_domain;
1725 int attempts = 0;
1726 BOOL retry;
1727
1728 DATA_BLOB lm_resp, nt_resp;
1729
1730 /* This is child-only, so no check for privileged access is needed
1731 anymore */
1732
1733 /* Ensure null termination */
1734 state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
1735 state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
1736
1737 name_user = state->request.data.auth_crap.user;
1738
1739 if (*state->request.data.auth_crap.domain) {
1740 name_domain = state->request.data.auth_crap.domain;
1741 } else if (lp_winbind_use_default_domain()) {
1742 name_domain = lp_workgroup();
1743 } else {
1744 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1745 name_user));
1746 result = NT_STATUS_NO_SUCH_USER;
1747 goto done;
1748 }
1749
1750 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1751 name_domain, name_user));
1752
1753 if (*state->request.data.auth_crap.workstation) {
1754 workstation = state->request.data.auth_crap.workstation;
1755 } else {
1756 workstation = global_myname();
1757 }
1758
1759 if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
1760 || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
1761 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1762 state->request.data.auth_crap.lm_resp_len,
1763 state->request.data.auth_crap.nt_resp_len));
1764 result = NT_STATUS_INVALID_PARAMETER;
1765 goto done;
1766 }
1767
1768 lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
1769 state->request.data.auth_crap.lm_resp_len);
1770 nt_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.nt_resp,
1771 state->request.data.auth_crap.nt_resp_len);
1772
1773 /* what domain should we contact? */
1774
1775 if ( IS_DC ) {
1776 if (!(contact_domain = find_domain_from_name(name_domain))) {
1777 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1778 state->request.data.auth_crap.user, name_domain, name_user, name_domain));
1779 result = NT_STATUS_NO_SUCH_USER;
1780 goto done;
1781 }
1782 } else {
1783 if (is_myname(name_domain)) {
1784 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1785 result = NT_STATUS_NO_SUCH_USER;
1786 goto done;
1787 }
1788 contact_domain = find_our_domain();
1789 }
1790
1791 do {
1792 ZERO_STRUCT(info3);
1793 retry = False;
1794
1795 netlogon_pipe = NULL;
1796 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1797
1798 if (!NT_STATUS_IS_OK(result)) {
1799 DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1800 nt_errstr(result)));
1801 goto done;
1802 }
1803
1804 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1805 state->mem_ctx,
1806 state->request.data.auth_crap.logon_parameters,
1807 contact_domain->dcname,
1808 name_user,
1809 name_domain,
1810 /* Bug #3248 - found by Stefan Burkei. */
1811 workstation, /* We carefully set this above so use it... */
1812 state->request.data.auth_crap.chal,
1813 lm_resp,
1814 nt_resp,
1815 &info3);
1816
1817 attempts += 1;
1818
1819 /* We have to try a second time as cm_connect_netlogon
1820 might not yet have noticed that the DC has killed
1821 our connection. */
1822
1823 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1824 retry = True;
1825 continue;
1826 }
1827
1828 /* if we get access denied, a possible cause was that we had and open
1829 connection to the DC, but someone changed our machine account password
1830 out from underneath us using 'net rpc changetrustpw' */
1831
1832 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1833 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1834 "ACCESS_DENIED. Maybe the trust account "
1835 "password was changed and we didn't know it. "
1836 "Killing connections to domain %s\n",
1837 name_domain));
1838 invalidate_cm_connection(&contact_domain->conn);
1839 retry = True;
1840 }
1841
1842 } while ( (attempts < 2) && retry );
1843
1844 if (NT_STATUS_IS_OK(result)) {
1845
1846 netsamlogon_cache_store(name_user, &info3);
1847 wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3);
1848
1849 /* Check if the user is in the right group */
1850
1851 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3,
1852 state->request.data.auth_crap.require_membership_of_sid))) {
1853 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1854 state->request.data.auth_crap.user,
1855 state->request.data.auth_crap.require_membership_of_sid));
1856 goto done;
1857 }
1858
1859 if (state->request.flags & WBFLAG_PAM_INFO3_NDR) {
1860 result = append_info3_as_ndr(state->mem_ctx, state, &info3);
1861 } else if (state->request.flags & WBFLAG_PAM_UNIX_NAME) {
1862 /* ntlm_auth should return the unix username, per
1863 'winbind use default domain' settings and the like */
1864
1865 fstring username_out;
1866 const char *nt_username, *nt_domain;
1867 if (!(nt_username = unistr2_tdup(state->mem_ctx, &(info3.uni_user_name)))) {
1868 /* If the server didn't give us one, just use the one we sent them */
1869 nt_username = name_user;
1870 }
1871
1872 if (!(nt_domain = unistr2_tdup(state->mem_ctx, &(info3.uni_logon_dom)))) {
1873 /* If the server didn't give us one, just use the one we sent them */
1874 nt_domain = name_domain;
1875 }
1876
1877 fill_domain_username(username_out, nt_domain, nt_username, True);
1878
1879 DEBUG(5, ("Setting unix username to [%s]\n", username_out));
1880
1881 SAFE_FREE(state->response.extra_data.data);
1882 state->response.extra_data.data = SMB_STRDUP(username_out);
1883 if (!state->response.extra_data.data) {
1884 result = NT_STATUS_NO_MEMORY;
1885 goto done;
1886 }
1887 state->response.length +=
1888 strlen((const char *)state->response.extra_data.data)+1;
1889 }
1890
1891 if (state->request.flags & WBFLAG_PAM_USER_SESSION_KEY) {
1892 memcpy(state->response.data.auth.user_session_key, info3.user_sess_key,
1893 sizeof(state->response.data.auth.user_session_key) /* 16 */);
1894 }
1895 if (state->request.flags & WBFLAG_PAM_LMKEY) {
1896 memcpy(state->response.data.auth.first_8_lm_hash, info3.lm_sess_key,
1897 sizeof(state->response.data.auth.first_8_lm_hash) /* 8 */);
1898 }
1899 }
1900
1901 done:
1902
1903 /* give us a more useful (more correct?) error code */
1904 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1905 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1906 result = NT_STATUS_NO_LOGON_SERVERS;
1907 }
1908
1909 if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1910 result = nt_status_squash(result);
1911 }
1912
1913 state->response.data.auth.nt_status = NT_STATUS_V(result);
1914 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1915
1916 /* we might have given a more useful error above */
1917 if (!*state->response.data.auth.error_string) {
1918 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1919 }
1920 state->response.data.auth.pam_error = nt_status_to_pam(result);
1921
1922 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1923 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1924 name_domain,
1925 name_user,
1926 state->response.data.auth.nt_status_string,
1927 state->response.data.auth.pam_error));
1928
1929 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1930 }
1931
1932 /* Change a user password */
1933
1934 void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
1935 {
1936 fstring domain, user;
1937 struct winbindd_domain *contact_domain;
1938
1939 DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
1940 state->request.data.chauthtok.user));
1941
1942 /* Setup crap */
1943
1944 if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
1945 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1946 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
1947 "(PAM: %d)\n",
1948 state->request.data.auth.user,
1949 state->response.data.auth.nt_status_string,
1950 state->response.data.auth.pam_error));
1951 request_error(state);
1952 return;
1953 }
1954
1955 contact_domain = find_domain_from_name(domain);
1956 if (!contact_domain) {
1957 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1958 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
1959 state->request.data.chauthtok.user, domain, user, domain));
1960 request_error(state);
1961 return;
1962 }
1963
1964 sendto_domain(state, contact_domain);
1965 }
1966
1967 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1968 struct winbindd_cli_state *state)
1969 {
1970 char *oldpass;
1971 char *newpass = NULL;
1972 POLICY_HND dom_pol;
1973 struct rpc_pipe_client *cli;
1974 BOOL got_info = False;
1975 SAM_UNK_INFO_1 info;
1976 SAMR_CHANGE_REJECT reject;
1977 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1978 fstring domain, user;
1979
1980 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1981 state->request.data.auth.user));
1982
1983 if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
1984 goto done;
1985 }
1986
1987 /* Change password */
1988
1989 oldpass = state->request.data.chauthtok.oldpass;
1990 newpass = state->request.data.chauthtok.newpass;
1991
1992 /* Initialize reject reason */
1993 state->response.data.auth.reject_reason = Undefined;
1994
1995 /* Get sam handle */
1996
1997 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
1998 &dom_pol);
1999 if (!NT_STATUS_IS_OK(result)) {
2000 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2001 goto done;
2002 }
2003
2004 result = rpccli_samr_chgpasswd3(cli, state->mem_ctx, user, newpass, oldpass, &info, &reject);
2005
2006 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2007
2008 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2009 state->response.data.auth.policy.min_length_password =
2010 info.min_length_password;
2011 state->response.data.auth.policy.password_history =
2012 info.password_history;
2013 state->response.data.auth.policy.password_properties =
2014 info.password_properties;
2015 state->response.data.auth.policy.expire =
2016 nt_time_to_unix_abs(&info.expire);
2017 state->response.data.auth.policy.min_passwordage =
2018 nt_time_to_unix_abs(&info.min_passwordage);
2019
2020 state->response.data.auth.reject_reason =
2021 reject.reject_reason;
2022
2023 got_info = True;
2024 }
2025
2026 /* only fallback when the chgpasswd3 call is not supported */
2027 if ((NT_STATUS_EQUAL(result, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR))) ||
2028 (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) ||
2029 (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED))) {
2030
2031 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
2032 nt_errstr(result)));
2033
2034 result = rpccli_samr_chgpasswd_user(cli, state->mem_ctx, user, newpass, oldpass);
2035
2036 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2037 Map to the same status code as Windows 2003. */
2038
2039 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2040 result = NT_STATUS_PASSWORD_RESTRICTION;
2041 }
2042 }
2043
2044 done:
2045
2046 if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
2047
2048 /* Update the single sign-on memory creds. */
2049 result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
2050 newpass);
2051
2052 if (!NT_STATUS_IS_OK(result)) {
2053 DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
2054 goto process_result;
2055 }
2056
2057 if (lp_winbind_offline_logon()) {
2058 result = winbindd_update_creds_by_name(contact_domain,
2059 state->mem_ctx, user,
2060 newpass);
2061 if (!NT_STATUS_IS_OK(result)) {
2062 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
2063 goto process_result;
2064 }
2065 }
2066 }
2067
2068 if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2069
2070 NTSTATUS policy_ret;
2071
2072 policy_ret = fillup_password_policy(contact_domain, state);
2073
2074 /* failure of this is non critical, it will just provide no
2075 * additional information to the client why the change has
2076 * failed - Guenther */
2077
2078 if (!NT_STATUS_IS_OK(policy_ret)) {
2079 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2080 goto process_result;
2081 }
2082 }
2083
2084 process_result:
2085
2086 state->response.data.auth.nt_status = NT_STATUS_V(result);
2087 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2088 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2089 state->response.data.auth.pam_error = nt_status_to_pam(result);
2090
2091 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2092 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2093 domain,
2094 user,
2095 state->response.data.auth.nt_status_string,
2096 state->response.data.auth.pam_error));
2097
2098 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2099 }
2100
2101 void winbindd_pam_logoff(struct winbindd_cli_state *state)
2102 {
2103 struct winbindd_domain *domain;
2104 fstring name_domain, user;
2105 uid_t caller_uid = (uid_t)-1;
2106 uid_t request_uid = state->request.data.logoff.uid;
2107
2108 DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
2109 state->request.data.logoff.user));
2110
2111 /* Ensure null termination */
2112 state->request.data.logoff.user
2113 [sizeof(state->request.data.logoff.user)-1]='\0';
2114
2115 state->request.data.logoff.krb5ccname
2116 [sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
2117
2118 if (request_uid == (gid_t)-1) {
2119 goto failed;
2120 }
2121
2122 if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
2123 goto failed;
2124 }
2125
2126 if ((domain = find_auth_domain(state, name_domain)) == NULL) {
2127 goto failed;
2128 }
2129
2130 if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
2131 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2132 strerror(errno)));
2133 goto failed;
2134 }
2135
2136 switch (caller_uid) {
2137 case -1:
2138 goto failed;
2139 case 0:
2140 /* root must be able to logoff any user - gd */
2141 state->request.data.logoff.uid = request_uid;
2142 break;
2143 default:
2144 if (caller_uid != request_uid) {
2145 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2146 goto failed;
2147 }
2148 state->request.data.logoff.uid = caller_uid;
2149 break;
2150 }
2151
2152 sendto_domain(state, domain);
2153 return;
2154
2155 failed:
2156 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2157 DEBUG(5, ("Pam Logoff for %s returned %s "
2158 "(PAM: %d)\n",
2159 state->request.data.logoff.user,
2160 state->response.data.auth.nt_status_string,
2161 state->response.data.auth.pam_error));
2162 request_error(state);
2163 return;
2164 }
2165
2166 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2167 struct winbindd_cli_state *state)
2168 {
2169 NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2170
2171 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2172 state->request.data.logoff.user));
2173
2174 if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
2175 result = NT_STATUS_OK;
2176 goto process_result;
2177 }
2178
2179 if (state->request.data.logoff.krb5ccname[0] == '\0') {
2180 result = NT_STATUS_OK;
2181 goto process_result;
2182 }
2183
2184 #ifdef HAVE_KRB5
2185
2186 if (state->request.data.logoff.uid < 0) {
2187 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2188 goto process_result;
2189 }
2190
2191 /* what we need here is to find the corresponding krb5 ccache name *we*
2192 * created for a given username and destroy it */
2193
2194 if (!ccache_entry_exists(state->request.data.logoff.user)) {
2195 result = NT_STATUS_OK;
2196 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2197 goto process_result;
2198 }
2199
2200 if (!ccache_entry_identical(state->request.data.logoff.user,
2201 state->request.data.logoff.uid,
2202 state->request.data.logoff.krb5ccname)) {
2203 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2204 goto process_result;
2205 }
2206
2207 result = remove_ccache(state->request.data.logoff.user);
2208 if (!NT_STATUS_IS_OK(result)) {
2209 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2210 nt_errstr(result)));
2211 goto process_result;
2212 }
2213
2214 #else
2215 result = NT_STATUS_NOT_SUPPORTED;
2216 #endif
2217
2218 process_result:
2219
2220 winbindd_delete_memory_creds(state->request.data.logoff.user);
2221
2222 state->response.data.auth.nt_status = NT_STATUS_V(result);
2223 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2224 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2225 state->response.data.auth.pam_error = nt_status_to_pam(result);
2226
2227 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2228 }
2229
2230 /* Change user password with auth crap*/
2231
2232 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
2233 {
2234 struct winbindd_domain *domain = NULL;
2235 const char *domain_name = NULL;
2236
2237 /* Ensure null termination */
2238 state->request.data.chng_pswd_auth_crap.user[
2239 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2240 state->request.data.chng_pswd_auth_crap.domain[
2241 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2242
2243 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2244 (unsigned long)state->pid,
2245 state->request.data.chng_pswd_auth_crap.domain,
2246 state->request.data.chng_pswd_auth_crap.user));
2247
2248 if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
2249 domain_name = state->request.data.chng_pswd_auth_crap.domain;
2250 } else if (lp_winbind_use_default_domain()) {
2251 domain_name = lp_workgroup();
2252 }
2253
2254 if (domain_name != NULL)
2255 domain = find_domain_from_name(domain_name);
2256
2257 if (domain != NULL) {
2258 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2259 "%s\n", (unsigned long)state->pid,domain->name));
2260 sendto_domain(state, domain);
2261 return;
2262 }
2263
2264 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2265 DEBUG(5, ("CRAP change password for %s\\%s returned %s (PAM: %d)\n",
2266 state->request.data.chng_pswd_auth_crap.domain,
2267 state->request.data.chng_pswd_auth_crap.user,
2268 state->response.data.auth.nt_status_string,
2269 state->response.data.auth.pam_error));
2270 request_error(state);
2271 return;
2272 }
2273
2274 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2275 {
2276 NTSTATUS result;
2277 DATA_BLOB new_nt_password;
2278 DATA_BLOB old_nt_hash_enc;
2279 DATA_BLOB new_lm_password;
2280 DATA_BLOB old_lm_hash_enc;
2281 fstring domain,user;
2282 POLICY_HND dom_pol;
2283 struct winbindd_domain *contact_domain = domainSt;
2284 struct rpc_pipe_client *cli;
2285
2286 /* Ensure null termination */
2287 state->request.data.chng_pswd_auth_crap.user[
2288 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2289 state->request.data.chng_pswd_auth_crap.domain[
2290 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2291 *domain = 0;
2292 *user = 0;
2293
2294 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2295 (unsigned long)state->pid,
2296 state->request.data.chng_pswd_auth_crap.domain,
2297 state->request.data.chng_pswd_auth_crap.user));
2298
2299 if (lp_winbind_offline_logon()) {
2300 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2301 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2302 result = NT_STATUS_ACCESS_DENIED;
2303 goto done;
2304 }
2305
2306 if (*state->request.data.chng_pswd_auth_crap.domain) {
2307 fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
2308 } else {
2309 parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
2310 domain, user);
2311
2312 if(!*domain) {
2313 DEBUG(3,("no domain specified with username (%s) - "
2314 "failing auth\n",
2315 state->request.data.chng_pswd_auth_crap.user));
2316 result = NT_STATUS_NO_SUCH_USER;
2317 goto done;
2318 }
2319 }
2320
2321 if (!*domain && lp_winbind_use_default_domain()) {
2322 fstrcpy(domain,(char *)lp_workgroup());
2323 }
2324
2325 if(!*user) {
2326 fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
2327 }
2328
2329 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2330 (unsigned long)state->pid, domain, user));
2331
2332 /* Change password */
2333 new_nt_password = data_blob_talloc(
2334 state->mem_ctx,
2335 state->request.data.chng_pswd_auth_crap.new_nt_pswd,
2336 state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
2337
2338 old_nt_hash_enc = data_blob_talloc(
2339 state->mem_ctx,
2340 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
2341 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2342
2343 if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2344 new_lm_password = data_blob_talloc(
2345 state->mem_ctx,
2346 state->request.data.chng_pswd_auth_crap.new_lm_pswd,
2347 state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
2348
2349 old_lm_hash_enc = data_blob_talloc(
2350 state->mem_ctx,
2351 state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
2352 state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2353 } else {
2354 new_lm_password.length = 0;
2355 old_lm_hash_enc.length = 0;
2356 }
2357
2358 /* Get sam handle */
2359
2360 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2361 if (!NT_STATUS_IS_OK(result)) {
2362 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2363 goto done;
2364 }
2365
2366 result = rpccli_samr_chng_pswd_auth_crap(
2367 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2368 new_lm_password, old_lm_hash_enc);
2369
2370 done:
2371 state->response.data.auth.nt_status = NT_STATUS_V(result);
2372 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2373 fstrcpy(state->response.data.auth.error_string,
2374 get_friendly_nt_error_msg(result));
2375 state->response.data.auth.pam_error = nt_status_to_pam(result);
2376
2377 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2378 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2379 domain, user,
2380 state->response.data.auth.nt_status_string,
2381 state->response.data.auth.pam_error));
2382
2383 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2384 }
Samba GIT mirror