2 Unix SMB/CIFS implementation.
4 Winbind daemon - pam auth funcions
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_samr_c.h"
29 #include "rpc_client/cli_pipe.h"
30 #include "rpc_client/cli_samr.h"
31 #include "../librpc/gen_ndr/ndr_netlogon.h"
32 #include "rpc_client/cli_netlogon.h"
34 #include "../lib/crypto/arcfour.h"
35 #include "../libcli/security/security.h"
37 #include "../librpc/gen_ndr/krb5pac.h"
38 #include "passdb/machine_sid.h"
42 #define DBGC_CLASS DBGC_WINBIND
44 #define LOGON_KRB5_FAIL_CLOCK_SKEW 0x02000000
46 static NTSTATUS
append_info3_as_txt(TALLOC_CTX
*mem_ctx
,
47 struct winbindd_response
*resp
,
48 struct netr_SamInfo3
*info3
)
53 resp
->data
.auth
.info3
.logon_time
=
54 nt_time_to_unix(info3
->base
.last_logon
);
55 resp
->data
.auth
.info3
.logoff_time
=
56 nt_time_to_unix(info3
->base
.last_logoff
);
57 resp
->data
.auth
.info3
.kickoff_time
=
58 nt_time_to_unix(info3
->base
.acct_expiry
);
59 resp
->data
.auth
.info3
.pass_last_set_time
=
60 nt_time_to_unix(info3
->base
.last_password_change
);
61 resp
->data
.auth
.info3
.pass_can_change_time
=
62 nt_time_to_unix(info3
->base
.allow_password_change
);
63 resp
->data
.auth
.info3
.pass_must_change_time
=
64 nt_time_to_unix(info3
->base
.force_password_change
);
66 resp
->data
.auth
.info3
.logon_count
= info3
->base
.logon_count
;
67 resp
->data
.auth
.info3
.bad_pw_count
= info3
->base
.bad_password_count
;
69 resp
->data
.auth
.info3
.user_rid
= info3
->base
.rid
;
70 resp
->data
.auth
.info3
.group_rid
= info3
->base
.primary_gid
;
71 sid_to_fstring(resp
->data
.auth
.info3
.dom_sid
, info3
->base
.domain_sid
);
73 resp
->data
.auth
.info3
.num_groups
= info3
->base
.groups
.count
;
74 resp
->data
.auth
.info3
.user_flgs
= info3
->base
.user_flags
;
76 resp
->data
.auth
.info3
.acct_flags
= info3
->base
.acct_flags
;
77 resp
->data
.auth
.info3
.num_other_sids
= info3
->sidcount
;
79 fstrcpy(resp
->data
.auth
.info3
.user_name
,
80 info3
->base
.account_name
.string
);
81 fstrcpy(resp
->data
.auth
.info3
.full_name
,
82 info3
->base
.full_name
.string
);
83 fstrcpy(resp
->data
.auth
.info3
.logon_script
,
84 info3
->base
.logon_script
.string
);
85 fstrcpy(resp
->data
.auth
.info3
.profile_path
,
86 info3
->base
.profile_path
.string
);
87 fstrcpy(resp
->data
.auth
.info3
.home_dir
,
88 info3
->base
.home_directory
.string
);
89 fstrcpy(resp
->data
.auth
.info3
.dir_drive
,
90 info3
->base
.home_drive
.string
);
92 fstrcpy(resp
->data
.auth
.info3
.logon_srv
,
93 info3
->base
.logon_server
.string
);
94 fstrcpy(resp
->data
.auth
.info3
.logon_dom
,
95 info3
->base
.domain
.string
);
97 ex
= talloc_strdup(mem_ctx
, "");
98 NT_STATUS_HAVE_NO_MEMORY(ex
);
100 for (i
=0; i
< info3
->base
.groups
.count
; i
++) {
101 ex
= talloc_asprintf_append_buffer(ex
, "0x%08X:0x%08X\n",
102 info3
->base
.groups
.rids
[i
].rid
,
103 info3
->base
.groups
.rids
[i
].attributes
);
104 NT_STATUS_HAVE_NO_MEMORY(ex
);
107 for (i
=0; i
< info3
->sidcount
; i
++) {
110 sid
= dom_sid_string(mem_ctx
, info3
->sids
[i
].sid
);
111 NT_STATUS_HAVE_NO_MEMORY(sid
);
113 ex
= talloc_asprintf_append_buffer(ex
, "%s:0x%08X\n",
115 info3
->sids
[i
].attributes
);
116 NT_STATUS_HAVE_NO_MEMORY(ex
);
121 resp
->extra_data
.data
= ex
;
122 resp
->length
+= talloc_get_size(ex
);
127 static NTSTATUS
append_info3_as_ndr(TALLOC_CTX
*mem_ctx
,
128 struct winbindd_response
*resp
,
129 struct netr_SamInfo3
*info3
)
132 enum ndr_err_code ndr_err
;
134 ndr_err
= ndr_push_struct_blob(&blob
, mem_ctx
, info3
,
135 (ndr_push_flags_fn_t
)ndr_push_netr_SamInfo3
);
136 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
137 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
138 return ndr_map_error2ntstatus(ndr_err
);
141 resp
->extra_data
.data
= blob
.data
;
142 resp
->length
+= blob
.length
;
147 static NTSTATUS
append_unix_username(TALLOC_CTX
*mem_ctx
,
148 struct winbindd_response
*resp
,
149 const struct netr_SamInfo3
*info3
,
150 const char *name_domain
,
151 const char *name_user
)
153 /* We've been asked to return the unix username, per
154 'winbind use default domain' settings and the like */
156 const char *nt_username
, *nt_domain
;
158 nt_domain
= talloc_strdup(mem_ctx
, info3
->base
.domain
.string
);
160 /* If the server didn't give us one, just use the one
162 nt_domain
= name_domain
;
165 nt_username
= talloc_strdup(mem_ctx
, info3
->base
.account_name
.string
);
167 /* If the server didn't give us one, just use the one
169 nt_username
= name_user
;
172 fill_domain_username(resp
->data
.auth
.unix_username
,
173 nt_domain
, nt_username
, true);
175 DEBUG(5, ("Setting unix username to [%s]\n",
176 resp
->data
.auth
.unix_username
));
181 static NTSTATUS
append_afs_token(TALLOC_CTX
*mem_ctx
,
182 struct winbindd_response
*resp
,
183 const struct netr_SamInfo3
*info3
,
184 const char *name_domain
,
185 const char *name_user
)
187 char *afsname
= NULL
;
191 afsname
= talloc_strdup(mem_ctx
, lp_afs_username_map());
192 if (afsname
== NULL
) {
193 return NT_STATUS_NO_MEMORY
;
196 afsname
= talloc_string_sub(mem_ctx
,
197 lp_afs_username_map(),
199 afsname
= talloc_string_sub(mem_ctx
, afsname
,
201 afsname
= talloc_string_sub(mem_ctx
, afsname
,
205 struct dom_sid user_sid
;
208 sid_compose(&user_sid
, info3
->base
.domain_sid
,
210 sid_to_fstring(sidstr
, &user_sid
);
211 afsname
= talloc_string_sub(mem_ctx
, afsname
,
215 if (afsname
== NULL
) {
216 return NT_STATUS_NO_MEMORY
;
221 DEBUG(10, ("Generating token for user %s\n", afsname
));
223 cell
= strchr(afsname
, '@');
226 return NT_STATUS_NO_MEMORY
;
232 token
= afs_createtoken_str(afsname
, cell
);
236 resp
->extra_data
.data
= talloc_strdup(mem_ctx
, token
);
237 if (resp
->extra_data
.data
== NULL
) {
238 return NT_STATUS_NO_MEMORY
;
240 resp
->length
+= strlen((const char *)resp
->extra_data
.data
)+1;
245 static NTSTATUS
check_info3_in_group(struct netr_SamInfo3
*info3
,
246 const char *group_sid
)
248 * Check whether a user belongs to a group or list of groups.
250 * @param mem_ctx talloc memory context.
251 * @param info3 user information, including group membership info.
252 * @param group_sid One or more groups , separated by commas.
254 * @return NT_STATUS_OK on success,
255 * NT_STATUS_LOGON_FAILURE if the user does not belong,
256 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
259 struct dom_sid
*require_membership_of_sid
;
260 uint32_t num_require_membership_of_sid
;
265 struct security_token
*token
;
266 TALLOC_CTX
*frame
= talloc_stackframe();
269 /* Parse the 'required group' SID */
271 if (!group_sid
|| !group_sid
[0]) {
272 /* NO sid supplied, all users may access */
276 token
= talloc_zero(talloc_tos(), struct security_token
);
278 DEBUG(0, ("talloc failed\n"));
280 return NT_STATUS_NO_MEMORY
;
283 num_require_membership_of_sid
= 0;
284 require_membership_of_sid
= NULL
;
288 while (next_token_talloc(talloc_tos(), &p
, &req_sid
, ",")) {
289 if (!string_to_sid(&sid
, req_sid
)) {
290 DEBUG(0, ("check_info3_in_group: could not parse %s "
291 "as a SID!", req_sid
));
293 return NT_STATUS_INVALID_PARAMETER
;
296 status
= add_sid_to_array(talloc_tos(), &sid
,
297 &require_membership_of_sid
,
298 &num_require_membership_of_sid
);
299 if (!NT_STATUS_IS_OK(status
)) {
300 DEBUG(0, ("add_sid_to_array failed\n"));
306 status
= sid_array_from_info3(talloc_tos(), info3
,
310 if (!NT_STATUS_IS_OK(status
)) {
315 if (!NT_STATUS_IS_OK(status
= add_aliases(get_global_sam_sid(),
317 || !NT_STATUS_IS_OK(status
= add_aliases(&global_sid_Builtin
,
319 DEBUG(3, ("could not add aliases: %s\n",
325 security_token_debug(DBGC_CLASS
, 10, token
);
327 for (i
=0; i
<num_require_membership_of_sid
; i
++) {
328 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
329 &require_membership_of_sid
[i
])));
330 if (nt_token_check_sid(&require_membership_of_sid
[i
],
332 DEBUG(10, ("Access ok\n"));
338 /* Do not distinguish this error from a wrong username/pw */
341 return NT_STATUS_LOGON_FAILURE
;
344 struct winbindd_domain
*find_auth_domain(uint8_t flags
,
345 const char *domain_name
)
347 struct winbindd_domain
*domain
;
350 domain
= find_domain_from_name_noinit(domain_name
);
351 if (domain
== NULL
) {
352 DEBUG(3, ("Authentication for domain [%s] refused "
353 "as it is not a trusted domain\n",
359 if (strequal(domain_name
, get_global_sam_name())) {
360 return find_domain_from_name_noinit(domain_name
);
363 /* we can auth against trusted domains */
364 if (flags
& WBFLAG_PAM_CONTACT_TRUSTDOM
) {
365 domain
= find_domain_from_name_noinit(domain_name
);
366 if (domain
== NULL
) {
367 DEBUG(3, ("Authentication for domain [%s] skipped "
368 "as it is not a trusted domain\n",
375 return find_our_domain();
378 static void fill_in_password_policy(struct winbindd_response
*r
,
379 const struct samr_DomInfo1
*p
)
381 r
->data
.auth
.policy
.min_length_password
=
382 p
->min_password_length
;
383 r
->data
.auth
.policy
.password_history
=
384 p
->password_history_length
;
385 r
->data
.auth
.policy
.password_properties
=
386 p
->password_properties
;
387 r
->data
.auth
.policy
.expire
=
388 nt_time_to_unix_abs((NTTIME
*)&(p
->max_password_age
));
389 r
->data
.auth
.policy
.min_passwordage
=
390 nt_time_to_unix_abs((NTTIME
*)&(p
->min_password_age
));
393 static NTSTATUS
fillup_password_policy(struct winbindd_domain
*domain
,
394 struct winbindd_response
*response
)
396 TALLOC_CTX
*frame
= talloc_stackframe();
397 struct winbindd_methods
*methods
;
399 struct samr_DomInfo1 password_policy
;
401 if ( !winbindd_can_contact_domain( domain
) ) {
402 DEBUG(5,("fillup_password_policy: No inbound trust to "
403 "contact domain %s\n", domain
->name
));
404 status
= NT_STATUS_NOT_SUPPORTED
;
408 methods
= domain
->methods
;
410 status
= methods
->password_policy(domain
, talloc_tos(), &password_policy
);
411 if (NT_STATUS_IS_ERR(status
)) {
415 fill_in_password_policy(response
, &password_policy
);
422 static NTSTATUS
get_max_bad_attempts_from_lockout_policy(struct winbindd_domain
*domain
,
424 uint16
*lockout_threshold
)
426 struct winbindd_methods
*methods
;
427 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
428 struct samr_DomInfo12 lockout_policy
;
430 *lockout_threshold
= 0;
432 methods
= domain
->methods
;
434 status
= methods
->lockout_policy(domain
, mem_ctx
, &lockout_policy
);
435 if (NT_STATUS_IS_ERR(status
)) {
439 *lockout_threshold
= lockout_policy
.lockout_threshold
;
444 static NTSTATUS
get_pwd_properties(struct winbindd_domain
*domain
,
446 uint32
*password_properties
)
448 struct winbindd_methods
*methods
;
449 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
450 struct samr_DomInfo1 password_policy
;
452 *password_properties
= 0;
454 methods
= domain
->methods
;
456 status
= methods
->password_policy(domain
, mem_ctx
, &password_policy
);
457 if (NT_STATUS_IS_ERR(status
)) {
461 *password_properties
= password_policy
.password_properties
;
468 static const char *generate_krb5_ccache(TALLOC_CTX
*mem_ctx
,
471 const char **user_ccache_file
)
473 /* accept FILE and WRFILE as krb5_cc_type from the client and then
474 * build the full ccname string based on the user's uid here -
477 const char *gen_cc
= NULL
;
480 if (strequal(type
, "FILE")) {
481 gen_cc
= talloc_asprintf(
482 mem_ctx
, "FILE:/tmp/krb5cc_%d", uid
);
484 if (strequal(type
, "WRFILE")) {
485 gen_cc
= talloc_asprintf(
486 mem_ctx
, "WRFILE:/tmp/krb5cc_%d", uid
);
490 *user_ccache_file
= gen_cc
;
492 if (gen_cc
== NULL
) {
493 gen_cc
= talloc_strdup(mem_ctx
, "MEMORY:winbindd_pam_ccache");
495 if (gen_cc
== NULL
) {
496 DEBUG(0,("out of memory\n"));
500 DEBUG(10, ("using ccache: %s%s\n", gen_cc
,
501 (*user_ccache_file
== NULL
) ? " (internal)":""));
508 uid_t
get_uid_from_request(struct winbindd_request
*request
)
512 uid
= request
->data
.auth
.uid
;
515 DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid
));
521 /**********************************************************************
522 Authenticate a user with a clear text password using Kerberos and fill up
524 **********************************************************************/
526 static NTSTATUS
winbindd_raw_kerberos_login(TALLOC_CTX
*mem_ctx
,
527 struct winbindd_domain
*domain
,
530 const char *krb5_cc_type
,
532 struct netr_SamInfo3
**info3
,
536 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
537 krb5_error_code krb5_ret
;
538 const char *cc
= NULL
;
539 const char *principal_s
= NULL
;
540 const char *service
= NULL
;
542 fstring name_domain
, name_user
;
543 time_t ticket_lifetime
= 0;
544 time_t renewal_until
= 0;
546 time_t time_offset
= 0;
547 const char *user_ccache_file
;
548 struct PAC_LOGON_INFO
*logon_info
= NULL
;
553 * prepare a krb5_cc_cache string for the user */
556 DEBUG(0,("no valid uid\n"));
559 cc
= generate_krb5_ccache(mem_ctx
,
564 return NT_STATUS_NO_MEMORY
;
569 * get kerberos properties */
571 if (domain
->private_data
) {
572 ads
= (ADS_STRUCT
*)domain
->private_data
;
573 time_offset
= ads
->auth
.time_offset
;
578 * do kerberos auth and setup ccache as the user */
580 parse_domain_user(user
, name_domain
, name_user
);
582 realm
= domain
->alt_name
;
585 principal_s
= talloc_asprintf(mem_ctx
, "%s@%s", name_user
, realm
);
586 if (principal_s
== NULL
) {
587 return NT_STATUS_NO_MEMORY
;
590 service
= talloc_asprintf(mem_ctx
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
);
591 if (service
== NULL
) {
592 return NT_STATUS_NO_MEMORY
;
595 /* if this is a user ccache, we need to act as the user to let the krb5
596 * library handle the chown, etc. */
598 /************************ ENTERING NON-ROOT **********************/
600 if (user_ccache_file
!= NULL
) {
601 set_effective_uid(uid
);
602 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid
));
605 result
= kerberos_return_pac(mem_ctx
,
614 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
617 if (user_ccache_file
!= NULL
) {
618 gain_root_privilege();
621 /************************ RETURNED TO ROOT **********************/
623 if (!NT_STATUS_IS_OK(result
)) {
627 *info3
= &logon_info
->info3
;
629 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
632 /* if we had a user's ccache then return that string for the pam
635 if (user_ccache_file
!= NULL
) {
637 fstrcpy(krb5ccname
, user_ccache_file
);
639 result
= add_ccache_to_list(principal_s
,
651 if (!NT_STATUS_IS_OK(result
)) {
652 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
657 /* need to delete the memory cred cache, it is not used anymore */
659 krb5_ret
= ads_kdestroy(cc
);
661 DEBUG(3,("winbindd_raw_kerberos_login: "
662 "could not destroy krb5 credential cache: "
663 "%s\n", error_message(krb5_ret
)));
672 * Do not delete an existing valid credential cache, if the user
673 * e.g. enters a wrong password
675 if ((strequal(krb5_cc_type
, "FILE") || strequal(krb5_cc_type
, "WRFILE"))
676 && user_ccache_file
!= NULL
) {
680 /* we could have created a new credential cache with a valid tgt in it
681 * but we werent able to get or verify the service ticket for this
682 * local host and therefor didn't get the PAC, we need to remove that
683 * cache entirely now */
685 krb5_ret
= ads_kdestroy(cc
);
687 DEBUG(3,("winbindd_raw_kerberos_login: "
688 "could not destroy krb5 credential cache: "
689 "%s\n", error_message(krb5_ret
)));
692 if (!NT_STATUS_IS_OK(remove_ccache(user
))) {
693 DEBUG(3,("winbindd_raw_kerberos_login: "
694 "could not remove ccache for user %s\n",
700 return NT_STATUS_NOT_SUPPORTED
;
701 #endif /* HAVE_KRB5 */
704 /****************************************************************
705 ****************************************************************/
707 bool check_request_flags(uint32_t flags
)
709 uint32_t flags_edata
= WBFLAG_PAM_AFS_TOKEN
|
710 WBFLAG_PAM_INFO3_TEXT
|
711 WBFLAG_PAM_INFO3_NDR
;
713 if ( ( (flags
& flags_edata
) == WBFLAG_PAM_AFS_TOKEN
) ||
714 ( (flags
& flags_edata
) == WBFLAG_PAM_INFO3_NDR
) ||
715 ( (flags
& flags_edata
) == WBFLAG_PAM_INFO3_TEXT
)||
716 !(flags
& flags_edata
) ) {
720 DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
726 /****************************************************************
727 ****************************************************************/
729 static NTSTATUS
append_auth_data(TALLOC_CTX
*mem_ctx
,
730 struct winbindd_response
*resp
,
731 uint32_t request_flags
,
732 struct netr_SamInfo3
*info3
,
733 const char *name_domain
,
734 const char *name_user
)
738 if (request_flags
& WBFLAG_PAM_USER_SESSION_KEY
) {
739 memcpy(resp
->data
.auth
.user_session_key
,
741 sizeof(resp
->data
.auth
.user_session_key
)
745 if (request_flags
& WBFLAG_PAM_LMKEY
) {
746 memcpy(resp
->data
.auth
.first_8_lm_hash
,
747 info3
->base
.LMSessKey
.key
,
748 sizeof(resp
->data
.auth
.first_8_lm_hash
)
752 if (request_flags
& WBFLAG_PAM_UNIX_NAME
) {
753 result
= append_unix_username(mem_ctx
, resp
,
754 info3
, name_domain
, name_user
);
755 if (!NT_STATUS_IS_OK(result
)) {
756 DEBUG(10,("Failed to append Unix Username: %s\n",
762 /* currently, anything from here on potentially overwrites extra_data. */
764 if (request_flags
& WBFLAG_PAM_INFO3_NDR
) {
765 result
= append_info3_as_ndr(mem_ctx
, resp
, info3
);
766 if (!NT_STATUS_IS_OK(result
)) {
767 DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
773 if (request_flags
& WBFLAG_PAM_INFO3_TEXT
) {
774 result
= append_info3_as_txt(mem_ctx
, resp
, info3
);
775 if (!NT_STATUS_IS_OK(result
)) {
776 DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
782 if (request_flags
& WBFLAG_PAM_AFS_TOKEN
) {
783 result
= append_afs_token(mem_ctx
, resp
,
784 info3
, name_domain
, name_user
);
785 if (!NT_STATUS_IS_OK(result
)) {
786 DEBUG(10,("Failed to append AFS token: %s\n",
795 static NTSTATUS
winbindd_dual_pam_auth_cached(struct winbindd_domain
*domain
,
796 struct winbindd_cli_state
*state
,
797 struct netr_SamInfo3
**info3
)
799 NTSTATUS result
= NT_STATUS_LOGON_FAILURE
;
800 uint16 max_allowed_bad_attempts
;
801 fstring name_domain
, name_user
;
803 enum lsa_SidType type
;
804 uchar new_nt_pass
[NT_HASH_LEN
];
805 const uint8
*cached_nt_pass
;
806 const uint8
*cached_salt
;
807 struct netr_SamInfo3
*my_info3
;
808 time_t kickoff_time
, must_change_time
;
809 bool password_good
= false;
811 struct winbindd_tdc_domain
*tdc_domain
= NULL
;
818 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
820 /* Parse domain and username */
822 parse_domain_user(state
->request
->data
.auth
.user
, name_domain
, name_user
);
825 if (!lookup_cached_name(name_domain
,
829 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
830 return NT_STATUS_NO_SUCH_USER
;
833 if (type
!= SID_NAME_USER
) {
834 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type
)));
835 return NT_STATUS_LOGON_FAILURE
;
838 result
= winbindd_get_creds(domain
,
844 if (!NT_STATUS_IS_OK(result
)) {
845 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result
)));
851 E_md4hash(state
->request
->data
.auth
.pass
, new_nt_pass
);
853 dump_data_pw("new_nt_pass", new_nt_pass
, NT_HASH_LEN
);
854 dump_data_pw("cached_nt_pass", cached_nt_pass
, NT_HASH_LEN
);
856 dump_data_pw("cached_salt", cached_salt
, NT_HASH_LEN
);
860 /* In this case we didn't store the nt_hash itself,
861 but the MD5 combination of salt + nt_hash. */
862 uchar salted_hash
[NT_HASH_LEN
];
863 E_md5hash(cached_salt
, new_nt_pass
, salted_hash
);
865 password_good
= (memcmp(cached_nt_pass
, salted_hash
,
868 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
869 password_good
= (memcmp(cached_nt_pass
, new_nt_pass
,
875 /* User *DOES* know the password, update logon_time and reset
878 my_info3
->base
.user_flags
|= NETLOGON_CACHED_ACCOUNT
;
880 if (my_info3
->base
.acct_flags
& ACB_AUTOLOCK
) {
881 return NT_STATUS_ACCOUNT_LOCKED_OUT
;
884 if (my_info3
->base
.acct_flags
& ACB_DISABLED
) {
885 return NT_STATUS_ACCOUNT_DISABLED
;
888 if (my_info3
->base
.acct_flags
& ACB_WSTRUST
) {
889 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
;
892 if (my_info3
->base
.acct_flags
& ACB_SVRTRUST
) {
893 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT
;
896 if (my_info3
->base
.acct_flags
& ACB_DOMTRUST
) {
897 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
;
900 if (!(my_info3
->base
.acct_flags
& ACB_NORMAL
)) {
901 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
902 my_info3
->base
.acct_flags
));
903 return NT_STATUS_LOGON_FAILURE
;
906 kickoff_time
= nt_time_to_unix(my_info3
->base
.acct_expiry
);
907 if (kickoff_time
!= 0 && time(NULL
) > kickoff_time
) {
908 return NT_STATUS_ACCOUNT_EXPIRED
;
911 must_change_time
= nt_time_to_unix(my_info3
->base
.force_password_change
);
912 if (must_change_time
!= 0 && must_change_time
< time(NULL
)) {
913 /* we allow grace logons when the password has expired */
914 my_info3
->base
.user_flags
|= NETLOGON_GRACE_LOGON
;
915 /* return NT_STATUS_PASSWORD_EXPIRED; */
920 if ((state
->request
->flags
& WBFLAG_PAM_KRB5
) &&
921 ((tdc_domain
= wcache_tdc_fetch_domain(state
->mem_ctx
, name_domain
)) != NULL
) &&
922 ((tdc_domain
->trust_type
& NETR_TRUST_TYPE_UPLEVEL
) ||
923 /* used to cope with the case winbindd starting without network. */
924 !strequal(tdc_domain
->domain_name
, tdc_domain
->dns_name
))) {
927 const char *cc
= NULL
;
929 const char *principal_s
= NULL
;
930 const char *service
= NULL
;
931 const char *user_ccache_file
;
933 uid
= get_uid_from_request(state
->request
);
935 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
936 return NT_STATUS_INVALID_PARAMETER
;
939 cc
= generate_krb5_ccache(state
->mem_ctx
,
940 state
->request
->data
.auth
.krb5_cc_type
,
941 state
->request
->data
.auth
.uid
,
944 return NT_STATUS_NO_MEMORY
;
947 realm
= domain
->alt_name
;
950 principal_s
= talloc_asprintf(state
->mem_ctx
, "%s@%s", name_user
, realm
);
951 if (principal_s
== NULL
) {
952 return NT_STATUS_NO_MEMORY
;
955 service
= talloc_asprintf(state
->mem_ctx
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
);
956 if (service
== NULL
) {
957 return NT_STATUS_NO_MEMORY
;
960 if (user_ccache_file
!= NULL
) {
962 fstrcpy(state
->response
->data
.auth
.krb5ccname
,
965 result
= add_ccache_to_list(principal_s
,
968 state
->request
->data
.auth
.user
,
969 state
->request
->data
.auth
.pass
,
973 time(NULL
) + lp_winbind_cache_time(),
974 time(NULL
) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
977 if (!NT_STATUS_IS_OK(result
)) {
978 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
979 "to add ccache to list: %s\n",
984 #endif /* HAVE_KRB5 */
986 /* FIXME: we possibly should handle logon hours as well (does xp when
987 * offline?) see auth/auth_sam.c:sam_account_ok for details */
989 unix_to_nt_time(&my_info3
->base
.last_logon
, time(NULL
));
990 my_info3
->base
.bad_password_count
= 0;
992 result
= winbindd_update_creds_by_info3(domain
,
993 state
->request
->data
.auth
.user
,
994 state
->request
->data
.auth
.pass
,
996 if (!NT_STATUS_IS_OK(result
)) {
997 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1002 return NT_STATUS_OK
;
1006 /* User does *NOT* know the correct password, modify info3 accordingly, but only if online */
1007 if (domain
->online
== false) {
1011 /* failure of this is not critical */
1012 result
= get_max_bad_attempts_from_lockout_policy(domain
, state
->mem_ctx
, &max_allowed_bad_attempts
);
1013 if (!NT_STATUS_IS_OK(result
)) {
1014 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1015 "Won't be able to honour account lockout policies\n"));
1018 /* increase counter */
1019 my_info3
->base
.bad_password_count
++;
1021 if (max_allowed_bad_attempts
== 0) {
1026 if (my_info3
->base
.bad_password_count
>= max_allowed_bad_attempts
) {
1028 uint32 password_properties
;
1030 result
= get_pwd_properties(domain
, state
->mem_ctx
, &password_properties
);
1031 if (!NT_STATUS_IS_OK(result
)) {
1032 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1035 if ((my_info3
->base
.rid
!= DOMAIN_RID_ADMINISTRATOR
) ||
1036 (password_properties
& DOMAIN_PASSWORD_LOCKOUT_ADMINS
)) {
1037 my_info3
->base
.acct_flags
|= ACB_AUTOLOCK
;
1042 result
= winbindd_update_creds_by_info3(domain
,
1043 state
->request
->data
.auth
.user
,
1047 if (!NT_STATUS_IS_OK(result
)) {
1048 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1049 nt_errstr(result
)));
1052 return NT_STATUS_LOGON_FAILURE
;
1055 static NTSTATUS
winbindd_dual_pam_auth_kerberos(struct winbindd_domain
*domain
,
1056 struct winbindd_cli_state
*state
,
1057 struct netr_SamInfo3
**info3
)
1059 struct winbindd_domain
*contact_domain
;
1060 fstring name_domain
, name_user
;
1063 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1065 /* Parse domain and username */
1067 parse_domain_user(state
->request
->data
.auth
.user
, name_domain
, name_user
);
1069 /* what domain should we contact? */
1072 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1073 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1074 state
->request
->data
.auth
.user
, name_domain
, name_user
, name_domain
));
1075 result
= NT_STATUS_NO_SUCH_USER
;
1080 if (is_myname(name_domain
)) {
1081 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1082 result
= NT_STATUS_NO_SUCH_USER
;
1086 contact_domain
= find_domain_from_name(name_domain
);
1087 if (contact_domain
== NULL
) {
1088 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1089 state
->request
->data
.auth
.user
, name_domain
, name_user
, name_domain
));
1091 result
= NT_STATUS_NO_SUCH_USER
;
1096 if (contact_domain
->initialized
&&
1097 contact_domain
->active_directory
) {
1101 if (!contact_domain
->initialized
) {
1102 init_dc_connection(contact_domain
);
1105 if (!contact_domain
->active_directory
) {
1106 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1107 return NT_STATUS_INVALID_LOGON_TYPE
;
1110 result
= winbindd_raw_kerberos_login(
1111 state
->mem_ctx
, contact_domain
,
1112 state
->request
->data
.auth
.user
,
1113 state
->request
->data
.auth
.pass
,
1114 state
->request
->data
.auth
.krb5_cc_type
,
1115 get_uid_from_request(state
->request
),
1116 info3
, state
->response
->data
.auth
.krb5ccname
);
1121 static NTSTATUS
winbindd_dual_auth_passdb(TALLOC_CTX
*mem_ctx
,
1122 const char *domain
, const char *user
,
1123 const DATA_BLOB
*challenge
,
1124 const DATA_BLOB
*lm_resp
,
1125 const DATA_BLOB
*nt_resp
,
1126 struct netr_SamInfo3
**pinfo3
)
1128 struct auth_usersupplied_info
*user_info
= NULL
;
1131 status
= make_user_info(&user_info
, user
, user
, domain
, domain
,
1132 global_myname(), lm_resp
, nt_resp
, NULL
, NULL
,
1133 NULL
, AUTH_PASSWORD_RESPONSE
);
1134 if (!NT_STATUS_IS_OK(status
)) {
1135 DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status
)));
1139 /* We don't want any more mapping of the username */
1140 user_info
->mapped_state
= True
;
1142 status
= check_sam_security_info3(challenge
, talloc_tos(), user_info
,
1144 free_user_info(&user_info
);
1145 DEBUG(10, ("Authenticaticating user %s\\%s returned %s\n", domain
,
1146 user
, nt_errstr(status
)));
1150 static NTSTATUS
winbind_samlogon_retry_loop(struct winbindd_domain
*domain
,
1151 TALLOC_CTX
*mem_ctx
,
1152 uint32_t logon_parameters
,
1154 const char *username
,
1155 const char *domainname
,
1156 const char *workstation
,
1157 const uint8_t chal
[8],
1158 DATA_BLOB lm_response
,
1159 DATA_BLOB nt_response
,
1160 struct netr_SamInfo3
**info3
)
1163 int netr_attempts
= 0;
1168 struct rpc_pipe_client
*netlogon_pipe
;
1169 const struct pipe_auth_data
*auth
;
1170 uint32_t neg_flags
= 0;
1172 ZERO_STRUCTP(info3
);
1175 result
= cm_connect_netlogon(domain
, &netlogon_pipe
);
1177 if (!NT_STATUS_IS_OK(result
)) {
1178 DEBUG(3,("Could not open handle to NETLOGON pipe "
1179 "(error: %s, attempts: %d)\n",
1180 nt_errstr(result
), netr_attempts
));
1182 /* After the first retry always close the connection */
1183 if (netr_attempts
> 0) {
1184 DEBUG(3, ("This is again a problem for this "
1185 "particular call, forcing the close "
1186 "of this connection\n"));
1187 invalidate_cm_connection(&domain
->conn
);
1190 /* After the second retry failover to the next DC */
1191 if (netr_attempts
> 1) {
1193 * If the netlogon server is not reachable then
1194 * it is possible that the DC is rebuilding
1195 * sysvol and shutdown netlogon for that time.
1196 * We should failover to the next dc.
1198 DEBUG(3, ("This is the third problem for this "
1199 "particular call, adding DC to the "
1200 "negative cache list\n"));
1201 add_failed_connection_entry(domain
->name
,
1204 saf_delete(domain
->name
);
1207 /* Only allow 3 retries */
1208 if (netr_attempts
< 3) {
1209 DEBUG(3, ("The connection to netlogon "
1210 "failed, retrying\n"));
1219 auth
= netlogon_pipe
->auth
;
1220 if (netlogon_pipe
->dc
) {
1221 neg_flags
= netlogon_pipe
->dc
->negotiate_flags
;
1224 /* It is really important to try SamLogonEx here,
1225 * because in a clustered environment, we want to use
1226 * one machine account from multiple physical
1229 * With a normal SamLogon call, we must keep the
1230 * credentials chain updated and intact between all
1231 * users of the machine account (which would imply
1232 * cross-node communication for every NTLM logon).
1234 * (The credentials chain is not per NETLOGON pipe
1235 * connection, but globally on the server/client pair
1238 * When using SamLogonEx, the credentials are not
1239 * supplied, but the session key is implied by the
1240 * wrapping SamLogon context.
1242 * -- abartlet 21 April 2008
1244 * It's also important to use NetlogonValidationSamInfo4 (6),
1245 * because it relies on the rpc transport encryption
1246 * and avoids using the global netlogon schannel
1247 * session key to en/decrypt secret information
1248 * like the user_session_key for network logons.
1250 * [MS-APDS] 3.1.5.2 NTLM Network Logon
1251 * says NETLOGON_NEG_CROSS_FOREST_TRUSTS and
1252 * NETLOGON_NEG_AUTHENTICATED_RPC set together
1253 * are the indication that the server supports
1254 * NetlogonValidationSamInfo4 (6). And it must only
1255 * be used if "SealSecureChannel" is used.
1257 * -- metze 4 February 2011
1261 domain
->can_do_validation6
= false;
1262 } else if (auth
->auth_type
!= DCERPC_AUTH_TYPE_SCHANNEL
) {
1263 domain
->can_do_validation6
= false;
1264 } else if (auth
->auth_level
!= DCERPC_AUTH_LEVEL_PRIVACY
) {
1265 domain
->can_do_validation6
= false;
1266 } else if (!(neg_flags
& NETLOGON_NEG_CROSS_FOREST_TRUSTS
)) {
1267 domain
->can_do_validation6
= false;
1268 } else if (!(neg_flags
& NETLOGON_NEG_AUTHENTICATED_RPC
)) {
1269 domain
->can_do_validation6
= false;
1272 if (domain
->can_do_samlogon_ex
&& domain
->can_do_validation6
) {
1273 result
= rpccli_netlogon_sam_network_logon_ex(
1277 server
, /* server name */
1278 username
, /* user name */
1279 domainname
, /* target domain */
1280 workstation
, /* workstation */
1287 result
= rpccli_netlogon_sam_network_logon(
1291 server
, /* server name */
1292 username
, /* user name */
1293 domainname
, /* target domain */
1294 workstation
, /* workstation */
1296 domain
->can_do_validation6
? 6 : 3,
1302 if (NT_STATUS_EQUAL(result
, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE
)) {
1305 * It's likely that the server also does not support
1306 * validation level 6
1308 domain
->can_do_validation6
= false;
1310 if (domain
->can_do_samlogon_ex
) {
1311 DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1312 "retrying with NetSamLogon\n"));
1313 domain
->can_do_samlogon_ex
= false;
1319 /* Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
1320 * (no Ex). This happens against old Samba
1321 * DCs. Drop the connection.
1323 invalidate_cm_connection(&domain
->conn
);
1324 result
= NT_STATUS_LOGON_FAILURE
;
1328 if (domain
->can_do_validation6
&&
1329 (NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_INFO_CLASS
) ||
1330 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_PARAMETER
) ||
1331 NT_STATUS_EQUAL(result
, NT_STATUS_BUFFER_TOO_SMALL
))) {
1332 DEBUG(3,("Got a DC that can not do validation level 6, "
1333 "retrying with level 3\n"));
1334 domain
->can_do_validation6
= false;
1340 * we increment this after the "feature negotiation"
1341 * for can_do_samlogon_ex and can_do_validation6
1345 /* We have to try a second time as cm_connect_netlogon
1346 might not yet have noticed that the DC has killed
1349 if (!rpccli_is_connected(netlogon_pipe
)) {
1354 /* if we get access denied, a possible cause was that we had
1355 and open connection to the DC, but someone changed our
1356 machine account password out from underneath us using 'net
1357 rpc changetrustpw' */
1359 if ( NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1360 DEBUG(3,("winbind_samlogon_retry_loop: sam_logon returned "
1361 "ACCESS_DENIED. Maybe the trust account "
1362 "password was changed and we didn't know it. "
1363 "Killing connections to domain %s\n",
1365 invalidate_cm_connection(&domain
->conn
);
1369 } while ( (attempts
< 2) && retry
);
1371 if (NT_STATUS_EQUAL(result
, NT_STATUS_IO_TIMEOUT
)) {
1372 DEBUG(3,("winbind_samlogon_retry_loop: sam_network_logon(ex) "
1373 "returned NT_STATUS_IO_TIMEOUT after the retry."
1374 "Killing connections to domain %s\n",
1376 invalidate_cm_connection(&domain
->conn
);
1381 static NTSTATUS
winbindd_dual_pam_auth_samlogon(TALLOC_CTX
*mem_ctx
,
1382 struct winbindd_domain
*domain
,
1385 uint32_t request_flags
,
1386 struct netr_SamInfo3
**info3
)
1392 unsigned char local_nt_response
[24];
1393 fstring name_domain
, name_user
;
1395 struct netr_SamInfo3
*my_info3
= NULL
;
1399 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1401 /* Parse domain and username */
1403 parse_domain_user(user
, name_domain
, name_user
);
1405 /* do password magic */
1407 generate_random_buffer(chal
, sizeof(chal
));
1409 if (lp_client_ntlmv2_auth()) {
1410 DATA_BLOB server_chal
;
1411 DATA_BLOB names_blob
;
1412 server_chal
= data_blob_const(chal
, 8);
1414 /* note that the 'workgroup' here is for the local
1415 machine. The 'server name' must match the
1416 'workstation' passed to the actual SamLogon call.
1418 names_blob
= NTLMv2_generate_names_blob(
1419 mem_ctx
, global_myname(), lp_workgroup());
1421 if (!SMBNTLMv2encrypt(mem_ctx
, name_user
, name_domain
,
1425 &lm_resp
, &nt_resp
, NULL
, NULL
)) {
1426 data_blob_free(&names_blob
);
1427 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1428 result
= NT_STATUS_NO_MEMORY
;
1431 data_blob_free(&names_blob
);
1433 lm_resp
= data_blob_null
;
1434 SMBNTencrypt(pass
, chal
, local_nt_response
);
1436 nt_resp
= data_blob_talloc(mem_ctx
, local_nt_response
,
1437 sizeof(local_nt_response
));
1440 if (strequal(name_domain
, get_global_sam_name())) {
1441 DATA_BLOB chal_blob
= data_blob_const(chal
, sizeof(chal
));
1443 result
= winbindd_dual_auth_passdb(
1444 mem_ctx
, name_domain
, name_user
,
1445 &chal_blob
, &lm_resp
, &nt_resp
, info3
);
1449 /* check authentication loop */
1451 result
= winbind_samlogon_retry_loop(domain
,
1462 if (!NT_STATUS_IS_OK(result
)) {
1466 /* handle the case where a NT4 DC does not fill in the acct_flags in
1467 * the samlogon reply info3. When accurate info3 is required by the
1468 * caller, we look up the account flags ourselve - gd */
1470 if ((request_flags
& WBFLAG_PAM_INFO3_TEXT
) &&
1471 NT_STATUS_IS_OK(result
) && (my_info3
->base
.acct_flags
== 0)) {
1473 struct rpc_pipe_client
*samr_pipe
;
1474 struct policy_handle samr_domain_handle
, user_pol
;
1475 union samr_UserInfo
*info
= NULL
;
1476 NTSTATUS status_tmp
, result_tmp
;
1478 struct dcerpc_binding_handle
*b
;
1480 status_tmp
= cm_connect_sam(domain
, mem_ctx
,
1481 &samr_pipe
, &samr_domain_handle
);
1483 if (!NT_STATUS_IS_OK(status_tmp
)) {
1484 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1485 nt_errstr(status_tmp
)));
1489 b
= samr_pipe
->binding_handle
;
1491 status_tmp
= dcerpc_samr_OpenUser(b
, mem_ctx
,
1492 &samr_domain_handle
,
1493 MAXIMUM_ALLOWED_ACCESS
,
1498 if (!NT_STATUS_IS_OK(status_tmp
)) {
1499 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1500 nt_errstr(status_tmp
)));
1503 if (!NT_STATUS_IS_OK(result_tmp
)) {
1504 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1505 nt_errstr(result_tmp
)));
1509 status_tmp
= dcerpc_samr_QueryUserInfo(b
, mem_ctx
,
1515 if (!NT_STATUS_IS_OK(status_tmp
)) {
1516 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1517 nt_errstr(status_tmp
)));
1518 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result_tmp
);
1521 if (!NT_STATUS_IS_OK(result_tmp
)) {
1522 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1523 nt_errstr(result_tmp
)));
1524 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result_tmp
);
1528 acct_flags
= info
->info16
.acct_flags
;
1530 if (acct_flags
== 0) {
1531 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result_tmp
);
1535 my_info3
->base
.acct_flags
= acct_flags
;
1537 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags
));
1539 dcerpc_samr_Close(b
, mem_ctx
, &user_pol
, &result_tmp
);
1547 enum winbindd_result
winbindd_dual_pam_auth(struct winbindd_domain
*domain
,
1548 struct winbindd_cli_state
*state
)
1550 NTSTATUS result
= NT_STATUS_LOGON_FAILURE
;
1551 NTSTATUS krb5_result
= NT_STATUS_OK
;
1552 fstring name_domain
, name_user
;
1554 fstring domain_user
;
1555 struct netr_SamInfo3
*info3
= NULL
;
1556 NTSTATUS name_map_status
= NT_STATUS_UNSUCCESSFUL
;
1558 /* Ensure null termination */
1559 state
->request
->data
.auth
.user
[sizeof(state
->request
->data
.auth
.user
)-1]='\0';
1561 /* Ensure null termination */
1562 state
->request
->data
.auth
.pass
[sizeof(state
->request
->data
.auth
.pass
)-1]='\0';
1564 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state
->pid
,
1565 state
->request
->data
.auth
.user
));
1567 /* Parse domain and username */
1569 name_map_status
= normalize_name_unmap(state
->mem_ctx
,
1570 state
->request
->data
.auth
.user
,
1573 /* If the name normalization didnt' actually do anything,
1574 just use the original name */
1576 if (!NT_STATUS_IS_OK(name_map_status
) &&
1577 !NT_STATUS_EQUAL(name_map_status
, NT_STATUS_FILE_RENAMED
))
1579 mapped_user
= state
->request
->data
.auth
.user
;
1582 parse_domain_user(mapped_user
, name_domain
, name_user
);
1584 if ( mapped_user
!= state
->request
->data
.auth
.user
) {
1585 fstr_sprintf( domain_user
, "%s%c%s", name_domain
,
1586 *lp_winbind_separator(),
1588 safe_strcpy( state
->request
->data
.auth
.user
, domain_user
,
1589 sizeof(state
->request
->data
.auth
.user
)-1 );
1592 if (!domain
->online
) {
1593 result
= NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1594 if (domain
->startup
) {
1595 /* Logons are very important to users. If we're offline and
1596 we get a request within the first 30 seconds of startup,
1597 try very hard to find a DC and go online. */
1599 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1600 "request in startup mode.\n", domain
->name
));
1602 winbindd_flush_negative_conn_cache(domain
);
1603 result
= init_dc_connection(domain
);
1607 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain
->name
, domain
->online
? "online":"offline"));
1609 /* Check for Kerberos authentication */
1610 if (domain
->online
&& (state
->request
->flags
& WBFLAG_PAM_KRB5
)) {
1612 result
= winbindd_dual_pam_auth_kerberos(domain
, state
, &info3
);
1613 /* save for later */
1614 krb5_result
= result
;
1617 if (NT_STATUS_IS_OK(result
)) {
1618 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1619 goto process_result
;
1621 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result
)));
1624 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_LOGON_SERVERS
) ||
1625 NT_STATUS_EQUAL(result
, NT_STATUS_IO_TIMEOUT
) ||
1626 NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
1627 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1628 set_domain_offline( domain
);
1632 /* there are quite some NT_STATUS errors where there is no
1633 * point in retrying with a samlogon, we explictly have to take
1634 * care not to increase the bad logon counter on the DC */
1636 if (NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_DISABLED
) ||
1637 NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_EXPIRED
) ||
1638 NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_LOCKED_OUT
) ||
1639 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_LOGON_HOURS
) ||
1640 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_WORKSTATION
) ||
1641 NT_STATUS_EQUAL(result
, NT_STATUS_LOGON_FAILURE
) ||
1642 NT_STATUS_EQUAL(result
, NT_STATUS_NO_SUCH_USER
) ||
1643 NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_EXPIRED
) ||
1644 NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_MUST_CHANGE
) ||
1645 NT_STATUS_EQUAL(result
, NT_STATUS_WRONG_PASSWORD
)) {
1649 if (state
->request
->flags
& WBFLAG_PAM_FALLBACK_AFTER_KRB5
) {
1650 DEBUG(3,("falling back to samlogon\n"));
1658 /* Check for Samlogon authentication */
1659 if (domain
->online
) {
1660 result
= winbindd_dual_pam_auth_samlogon(
1661 state
->mem_ctx
, domain
,
1662 state
->request
->data
.auth
.user
,
1663 state
->request
->data
.auth
.pass
,
1664 state
->request
->flags
,
1667 if (NT_STATUS_IS_OK(result
)) {
1668 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1669 /* add the Krb5 err if we have one */
1670 if ( NT_STATUS_EQUAL(krb5_result
, NT_STATUS_TIME_DIFFERENCE_AT_DC
) ) {
1671 info3
->base
.user_flags
|= LOGON_KRB5_FAIL_CLOCK_SKEW
;
1673 goto process_result
;
1676 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1677 nt_errstr(result
)));
1679 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_LOGON_SERVERS
) ||
1680 NT_STATUS_EQUAL(result
, NT_STATUS_IO_TIMEOUT
) ||
1681 NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
))
1683 DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1684 set_domain_offline( domain
);
1688 if (domain
->online
) {
1689 /* We're still online - fail. */
1695 /* Check for Cached logons */
1696 if (!domain
->online
&& (state
->request
->flags
& WBFLAG_PAM_CACHED_LOGIN
) &&
1697 lp_winbind_offline_logon()) {
1699 result
= winbindd_dual_pam_auth_cached(domain
, state
, &info3
);
1701 if (NT_STATUS_IS_OK(result
)) {
1702 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1703 goto process_result
;
1705 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result
)));
1712 if (NT_STATUS_IS_OK(result
)) {
1714 struct dom_sid user_sid
;
1716 /* In all codepaths where result == NT_STATUS_OK info3 must have
1717 been initialized. */
1719 result
= NT_STATUS_INTERNAL_ERROR
;
1723 sid_compose(&user_sid
, info3
->base
.domain_sid
,
1726 wcache_invalidate_samlogon(find_domain_from_name(name_domain
),
1728 netsamlogon_cache_store(name_user
, info3
);
1730 /* save name_to_sid info as early as possible (only if
1731 this is our primary domain so we don't invalidate
1732 the cache entry by storing the seq_num for the wrong
1734 if ( domain
->primary
) {
1735 cache_name2sid(domain
, name_domain
, name_user
,
1736 SID_NAME_USER
, &user_sid
);
1739 /* Check if the user is in the right group */
1741 result
= check_info3_in_group(
1743 state
->request
->data
.auth
.require_membership_of_sid
);
1744 if (!NT_STATUS_IS_OK(result
)) {
1745 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1746 state
->request
->data
.auth
.user
,
1747 state
->request
->data
.auth
.require_membership_of_sid
));
1751 result
= append_auth_data(state
->mem_ctx
, state
->response
,
1752 state
->request
->flags
, info3
,
1753 name_domain
, name_user
);
1754 if (!NT_STATUS_IS_OK(result
)) {
1758 if ((state
->request
->flags
& WBFLAG_PAM_CACHED_LOGIN
)
1759 && lp_winbind_offline_logon()) {
1761 result
= winbindd_store_creds(domain
,
1762 state
->request
->data
.auth
.user
,
1763 state
->request
->data
.auth
.pass
,
1767 if (state
->request
->flags
& WBFLAG_PAM_GET_PWD_POLICY
) {
1768 struct winbindd_domain
*our_domain
= find_our_domain();
1770 /* This is not entirely correct I believe, but it is
1771 consistent. Only apply the password policy settings
1772 too warn users for our own domain. Cannot obtain these
1773 from trusted DCs all the time so don't do it at all.
1776 result
= NT_STATUS_NOT_SUPPORTED
;
1777 if (our_domain
== domain
) {
1778 result
= fillup_password_policy(
1779 our_domain
, state
->response
);
1782 if (!NT_STATUS_IS_OK(result
)
1783 && !NT_STATUS_EQUAL(result
, NT_STATUS_NOT_SUPPORTED
) )
1785 DEBUG(10,("Failed to get password policies for domain %s: %s\n",
1786 domain
->name
, nt_errstr(result
)));
1791 result
= NT_STATUS_OK
;
1795 /* give us a more useful (more correct?) error code */
1796 if ((NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) ||
1797 (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)))) {
1798 result
= NT_STATUS_NO_LOGON_SERVERS
;
1801 set_auth_errors(state
->response
, result
);
1803 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1804 state
->request
->data
.auth
.user
,
1805 state
->response
->data
.auth
.nt_status_string
,
1806 state
->response
->data
.auth
.pam_error
));
1808 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
1811 enum winbindd_result
winbindd_dual_pam_auth_crap(struct winbindd_domain
*domain
,
1812 struct winbindd_cli_state
*state
)
1815 struct netr_SamInfo3
*info3
= NULL
;
1816 const char *name_user
= NULL
;
1817 const char *name_domain
= NULL
;
1818 const char *workstation
;
1820 DATA_BLOB lm_resp
, nt_resp
;
1822 /* This is child-only, so no check for privileged access is needed
1825 /* Ensure null termination */
1826 state
->request
->data
.auth_crap
.user
[sizeof(state
->request
->data
.auth_crap
.user
)-1]=0;
1827 state
->request
->data
.auth_crap
.domain
[sizeof(state
->request
->data
.auth_crap
.domain
)-1]=0;
1829 name_user
= state
->request
->data
.auth_crap
.user
;
1830 name_domain
= state
->request
->data
.auth_crap
.domain
;
1831 workstation
= state
->request
->data
.auth_crap
.workstation
;
1833 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state
->pid
,
1834 name_domain
, name_user
));
1836 if (state
->request
->data
.auth_crap
.lm_resp_len
> sizeof(state
->request
->data
.auth_crap
.lm_resp
)
1837 || state
->request
->data
.auth_crap
.nt_resp_len
> sizeof(state
->request
->data
.auth_crap
.nt_resp
)) {
1838 if (!(state
->request
->flags
& WBFLAG_BIG_NTLMV2_BLOB
) ||
1839 state
->request
->extra_len
!= state
->request
->data
.auth_crap
.nt_resp_len
) {
1840 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1841 state
->request
->data
.auth_crap
.lm_resp_len
,
1842 state
->request
->data
.auth_crap
.nt_resp_len
));
1843 result
= NT_STATUS_INVALID_PARAMETER
;
1848 lm_resp
= data_blob_talloc(state
->mem_ctx
, state
->request
->data
.auth_crap
.lm_resp
,
1849 state
->request
->data
.auth_crap
.lm_resp_len
);
1851 if (state
->request
->flags
& WBFLAG_BIG_NTLMV2_BLOB
) {
1852 nt_resp
= data_blob_talloc(state
->mem_ctx
,
1853 state
->request
->extra_data
.data
,
1854 state
->request
->data
.auth_crap
.nt_resp_len
);
1856 nt_resp
= data_blob_talloc(state
->mem_ctx
,
1857 state
->request
->data
.auth_crap
.nt_resp
,
1858 state
->request
->data
.auth_crap
.nt_resp_len
);
1861 if (strequal(name_domain
, get_global_sam_name())) {
1862 DATA_BLOB chal_blob
= data_blob_const(
1863 state
->request
->data
.auth_crap
.chal
,
1864 sizeof(state
->request
->data
.auth_crap
.chal
));
1866 result
= winbindd_dual_auth_passdb(
1867 state
->mem_ctx
, name_domain
, name_user
,
1868 &chal_blob
, &lm_resp
, &nt_resp
, &info3
);
1869 goto process_result
;
1872 result
= winbind_samlogon_retry_loop(domain
,
1874 state
->request
->data
.auth_crap
.logon_parameters
,
1878 /* Bug #3248 - found by Stefan Burkei. */
1879 workstation
, /* We carefully set this above so use it... */
1880 state
->request
->data
.auth_crap
.chal
,
1884 if (!NT_STATUS_IS_OK(result
)) {
1890 if (NT_STATUS_IS_OK(result
)) {
1891 struct dom_sid user_sid
;
1893 sid_compose(&user_sid
, info3
->base
.domain_sid
,
1895 wcache_invalidate_samlogon(find_domain_from_name(name_domain
),
1897 netsamlogon_cache_store(name_user
, info3
);
1899 /* Check if the user is in the right group */
1901 result
= check_info3_in_group(
1903 state
->request
->data
.auth_crap
.require_membership_of_sid
);
1904 if (!NT_STATUS_IS_OK(result
)) {
1905 DEBUG(3, ("User %s is not in the required group (%s), so "
1906 "crap authentication is rejected\n",
1907 state
->request
->data
.auth_crap
.user
,
1908 state
->request
->data
.auth_crap
.require_membership_of_sid
));
1912 result
= append_auth_data(state
->mem_ctx
, state
->response
,
1913 state
->request
->flags
, info3
,
1914 name_domain
, name_user
);
1915 if (!NT_STATUS_IS_OK(result
)) {
1922 /* give us a more useful (more correct?) error code */
1923 if ((NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) ||
1924 (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)))) {
1925 result
= NT_STATUS_NO_LOGON_SERVERS
;
1928 if (state
->request
->flags
& WBFLAG_PAM_NT_STATUS_SQUASH
) {
1929 result
= nt_status_squash(result
);
1932 set_auth_errors(state
->response
, result
);
1934 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
1935 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1938 state
->response
->data
.auth
.nt_status_string
,
1939 state
->response
->data
.auth
.pam_error
));
1941 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
1944 enum winbindd_result
winbindd_dual_pam_chauthtok(struct winbindd_domain
*contact_domain
,
1945 struct winbindd_cli_state
*state
)
1948 char *newpass
= NULL
;
1949 struct policy_handle dom_pol
;
1950 struct rpc_pipe_client
*cli
= NULL
;
1951 bool got_info
= false;
1952 struct samr_DomInfo1
*info
= NULL
;
1953 struct userPwdChangeFailureInformation
*reject
= NULL
;
1954 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1955 fstring domain
, user
;
1956 struct dcerpc_binding_handle
*b
= NULL
;
1958 ZERO_STRUCT(dom_pol
);
1960 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state
->pid
,
1961 state
->request
->data
.auth
.user
));
1963 if (!parse_domain_user(state
->request
->data
.chauthtok
.user
, domain
, user
)) {
1967 /* Change password */
1969 oldpass
= state
->request
->data
.chauthtok
.oldpass
;
1970 newpass
= state
->request
->data
.chauthtok
.newpass
;
1972 /* Initialize reject reason */
1973 state
->response
->data
.auth
.reject_reason
= Undefined
;
1975 /* Get sam handle */
1977 result
= cm_connect_sam(contact_domain
, state
->mem_ctx
, &cli
,
1979 if (!NT_STATUS_IS_OK(result
)) {
1980 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain
));
1984 b
= cli
->binding_handle
;
1986 result
= rpccli_samr_chgpasswd_user3(cli
, state
->mem_ctx
,
1993 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
1995 if (NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_RESTRICTION
) ) {
1997 fill_in_password_policy(state
->response
, info
);
1999 state
->response
->data
.auth
.reject_reason
=
2000 reject
->extendedFailureReason
;
2005 /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
2006 * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
2007 * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
2008 * short to comply with the samr_ChangePasswordUser3 idl - gd */
2010 /* only fallback when the chgpasswd_user3 call is not supported */
2011 if (NT_STATUS_EQUAL(result
, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE
) ||
2012 NT_STATUS_EQUAL(result
, NT_STATUS_NOT_SUPPORTED
) ||
2013 NT_STATUS_EQUAL(result
, NT_STATUS_BUFFER_TOO_SMALL
) ||
2014 NT_STATUS_EQUAL(result
, NT_STATUS_NOT_IMPLEMENTED
)) {
2016 DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
2017 nt_errstr(result
)));
2019 result
= rpccli_samr_chgpasswd_user2(cli
, state
->mem_ctx
, user
, newpass
, oldpass
);
2021 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2022 Map to the same status code as Windows 2003. */
2024 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION
, result
) ) {
2025 result
= NT_STATUS_PASSWORD_RESTRICTION
;
2031 if (NT_STATUS_IS_OK(result
)
2032 && (state
->request
->flags
& WBFLAG_PAM_CACHED_LOGIN
)
2033 && lp_winbind_offline_logon()) {
2034 result
= winbindd_update_creds_by_name(contact_domain
, user
,
2036 /* Again, this happens when we login from gdm or xdm
2037 * and the password expires, *BUT* cached crendentials
2038 * doesn't exist. winbindd_update_creds_by_name()
2039 * returns NT_STATUS_NO_SUCH_USER.
2040 * This is not a failure.
2043 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_SUCH_USER
)) {
2044 result
= NT_STATUS_OK
;
2047 if (!NT_STATUS_IS_OK(result
)) {
2048 DEBUG(10, ("Failed to store creds: %s\n",
2049 nt_errstr(result
)));
2050 goto process_result
;
2054 if (!NT_STATUS_IS_OK(result
) && !got_info
&& contact_domain
) {
2056 NTSTATUS policy_ret
;
2058 policy_ret
= fillup_password_policy(
2059 contact_domain
, state
->response
);
2061 /* failure of this is non critical, it will just provide no
2062 * additional information to the client why the change has
2063 * failed - Guenther */
2065 if (!NT_STATUS_IS_OK(policy_ret
)) {
2066 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret
)));
2067 goto process_result
;
2073 if (strequal(contact_domain
->name
, get_global_sam_name())) {
2074 /* FIXME: internal rpc pipe does not cache handles yet */
2076 if (is_valid_policy_hnd(&dom_pol
)) {
2078 dcerpc_samr_Close(b
, state
->mem_ctx
, &dom_pol
, &_result
);
2084 set_auth_errors(state
->response
, result
);
2086 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
2087 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2090 state
->response
->data
.auth
.nt_status_string
,
2091 state
->response
->data
.auth
.pam_error
));
2093 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2096 enum winbindd_result
winbindd_dual_pam_logoff(struct winbindd_domain
*domain
,
2097 struct winbindd_cli_state
*state
)
2099 NTSTATUS result
= NT_STATUS_NOT_SUPPORTED
;
2101 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state
->pid
,
2102 state
->request
->data
.logoff
.user
));
2104 if (!(state
->request
->flags
& WBFLAG_PAM_KRB5
)) {
2105 result
= NT_STATUS_OK
;
2106 goto process_result
;
2109 if (state
->request
->data
.logoff
.krb5ccname
[0] == '\0') {
2110 result
= NT_STATUS_OK
;
2111 goto process_result
;
2116 if (state
->request
->data
.logoff
.uid
< 0) {
2117 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2118 goto process_result
;
2121 /* what we need here is to find the corresponding krb5 ccache name *we*
2122 * created for a given username and destroy it */
2124 if (!ccache_entry_exists(state
->request
->data
.logoff
.user
)) {
2125 result
= NT_STATUS_OK
;
2126 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2127 goto process_result
;
2130 if (!ccache_entry_identical(state
->request
->data
.logoff
.user
,
2131 state
->request
->data
.logoff
.uid
,
2132 state
->request
->data
.logoff
.krb5ccname
)) {
2133 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2134 goto process_result
;
2137 result
= remove_ccache(state
->request
->data
.logoff
.user
);
2138 if (!NT_STATUS_IS_OK(result
)) {
2139 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2140 nt_errstr(result
)));
2141 goto process_result
;
2145 * Remove any mlock'ed memory creds in the child
2146 * we might be using for krb5 ticket renewal.
2149 winbindd_delete_memory_creds(state
->request
->data
.logoff
.user
);
2152 result
= NT_STATUS_NOT_SUPPORTED
;
2158 set_auth_errors(state
->response
, result
);
2160 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2163 /* Change user password with auth crap*/
2165 enum winbindd_result
winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain
*domainSt
, struct winbindd_cli_state
*state
)
2168 DATA_BLOB new_nt_password
;
2169 DATA_BLOB old_nt_hash_enc
;
2170 DATA_BLOB new_lm_password
;
2171 DATA_BLOB old_lm_hash_enc
;
2172 fstring domain
,user
;
2173 struct policy_handle dom_pol
;
2174 struct winbindd_domain
*contact_domain
= domainSt
;
2175 struct rpc_pipe_client
*cli
= NULL
;
2176 struct dcerpc_binding_handle
*b
= NULL
;
2178 ZERO_STRUCT(dom_pol
);
2180 /* Ensure null termination */
2181 state
->request
->data
.chng_pswd_auth_crap
.user
[
2182 sizeof(state
->request
->data
.chng_pswd_auth_crap
.user
)-1]=0;
2183 state
->request
->data
.chng_pswd_auth_crap
.domain
[
2184 sizeof(state
->request
->data
.chng_pswd_auth_crap
.domain
)-1]=0;
2188 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2189 (unsigned long)state
->pid
,
2190 state
->request
->data
.chng_pswd_auth_crap
.domain
,
2191 state
->request
->data
.chng_pswd_auth_crap
.user
));
2193 if (lp_winbind_offline_logon()) {
2194 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2195 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2196 result
= NT_STATUS_ACCESS_DENIED
;
2200 if (*state
->request
->data
.chng_pswd_auth_crap
.domain
) {
2201 fstrcpy(domain
,state
->request
->data
.chng_pswd_auth_crap
.domain
);
2203 parse_domain_user(state
->request
->data
.chng_pswd_auth_crap
.user
,
2207 DEBUG(3,("no domain specified with username (%s) - "
2209 state
->request
->data
.chng_pswd_auth_crap
.user
));
2210 result
= NT_STATUS_NO_SUCH_USER
;
2215 if (!*domain
&& lp_winbind_use_default_domain()) {
2216 fstrcpy(domain
,(char *)lp_workgroup());
2220 fstrcpy(user
, state
->request
->data
.chng_pswd_auth_crap
.user
);
2223 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2224 (unsigned long)state
->pid
, domain
, user
));
2226 /* Change password */
2227 new_nt_password
= data_blob_const(
2228 state
->request
->data
.chng_pswd_auth_crap
.new_nt_pswd
,
2229 state
->request
->data
.chng_pswd_auth_crap
.new_nt_pswd_len
);
2231 old_nt_hash_enc
= data_blob_const(
2232 state
->request
->data
.chng_pswd_auth_crap
.old_nt_hash_enc
,
2233 state
->request
->data
.chng_pswd_auth_crap
.old_nt_hash_enc_len
);
2235 if(state
->request
->data
.chng_pswd_auth_crap
.new_lm_pswd_len
> 0) {
2236 new_lm_password
= data_blob_const(
2237 state
->request
->data
.chng_pswd_auth_crap
.new_lm_pswd
,
2238 state
->request
->data
.chng_pswd_auth_crap
.new_lm_pswd_len
);
2240 old_lm_hash_enc
= data_blob_const(
2241 state
->request
->data
.chng_pswd_auth_crap
.old_lm_hash_enc
,
2242 state
->request
->data
.chng_pswd_auth_crap
.old_lm_hash_enc_len
);
2244 new_lm_password
.length
= 0;
2245 old_lm_hash_enc
.length
= 0;
2248 /* Get sam handle */
2250 result
= cm_connect_sam(contact_domain
, state
->mem_ctx
, &cli
, &dom_pol
);
2251 if (!NT_STATUS_IS_OK(result
)) {
2252 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain
));
2256 b
= cli
->binding_handle
;
2258 result
= rpccli_samr_chng_pswd_auth_crap(
2259 cli
, state
->mem_ctx
, user
, new_nt_password
, old_nt_hash_enc
,
2260 new_lm_password
, old_lm_hash_enc
);
2264 if (strequal(contact_domain
->name
, get_global_sam_name())) {
2265 /* FIXME: internal rpc pipe does not cache handles yet */
2267 if (is_valid_policy_hnd(&dom_pol
)) {
2269 dcerpc_samr_Close(b
, state
->mem_ctx
, &dom_pol
, &_result
);
2275 set_auth_errors(state
->response
, result
);
2277 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
2278 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2280 state
->response
->data
.auth
.nt_status_string
,
2281 state
->response
->data
.auth
.pam_error
));
2283 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;