2 Unix SMB/CIFS implementation.
4 Samba kpasswd implementation
6 Copyright (c) 2005 Andrew Bartlett <abartlet@samba.org>
7 Copyright (c) 2016 Andreas Schneider <asn@samba.org>
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/kerberos.h"
25 #include "librpc/gen_ndr/samr.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "auth/auth.h"
28 #include "kdc/kpasswd-helper.h"
31 #define DBGC_CLASS DBGC_KERBEROS
33 bool kpasswd_make_error_reply(TALLOC_CTX
*mem_ctx
,
34 krb5_error_code error_code
,
35 const char *error_string
,
36 DATA_BLOB
*error_data
)
42 if (error_code
== 0) {
43 DBG_DEBUG("kpasswd reply - %s\n", error_string
);
45 DBG_INFO("kpasswd reply - %s\n", error_string
);
48 ok
= push_utf8_talloc(mem_ctx
, &s
, error_string
, &slen
);
54 * The string 's' has one terminating nul-byte which is also
55 * reflected by 'slen'. We subtract it from the length.
63 /* Two bytes are added to the length to account for the error code. */
64 if (2 + slen
< slen
) {
68 error_data
->length
= 2 + slen
;
69 error_data
->data
= talloc_size(mem_ctx
, error_data
->length
);
70 if (error_data
->data
== NULL
) {
75 RSSVAL(error_data
->data
, 0, error_code
);
76 memcpy(error_data
->data
+ 2, s
, slen
);
83 bool kpasswd_make_pwchange_reply(TALLOC_CTX
*mem_ctx
,
85 enum samPwdChangeReason reject_reason
,
86 struct samr_DomInfo1
*dominfo
,
87 DATA_BLOB
*error_blob
)
89 const char *reject_string
= NULL
;
91 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)) {
92 return kpasswd_make_error_reply(mem_ctx
,
93 KRB5_KPASSWD_ACCESSDENIED
,
94 "No such user when changing password",
96 } else if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
)) {
97 return kpasswd_make_error_reply(mem_ctx
,
98 KRB5_KPASSWD_ACCESSDENIED
,
99 "Not permitted to change password",
102 if (dominfo
!= NULL
&&
103 NT_STATUS_EQUAL(status
, NT_STATUS_PASSWORD_RESTRICTION
)) {
104 switch (reject_reason
) {
105 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT
:
107 talloc_asprintf(mem_ctx
,
108 "Password too short, password "
109 "must be at least %d characters "
111 dominfo
->min_password_length
);
112 if (reject_string
== NULL
) {
113 reject_string
= "Password too short";
116 case SAM_PWD_CHANGE_NOT_COMPLEX
:
117 reject_string
= "Password does not meet complexity "
120 case SAM_PWD_CHANGE_PWD_IN_HISTORY
:
122 talloc_asprintf(mem_ctx
,
123 "Password is already in password "
124 "history. New password must not "
125 "match any of your %d previous "
127 dominfo
->password_history_length
);
128 if (reject_string
== NULL
) {
129 reject_string
= "Password is already in password "
134 reject_string
= "Password change rejected, password "
135 "changes may not be permitted on this "
136 "account, or the minimum password age "
137 "may not have elapsed.";
141 return kpasswd_make_error_reply(mem_ctx
,
142 KRB5_KPASSWD_SOFTERROR
,
147 if (!NT_STATUS_IS_OK(status
)) {
148 reject_string
= talloc_asprintf(mem_ctx
,
149 "Failed to set password: %s",
151 if (reject_string
== NULL
) {
152 reject_string
= "Failed to set password";
154 return kpasswd_make_error_reply(mem_ctx
,
155 KRB5_KPASSWD_HARDERROR
,
160 return kpasswd_make_error_reply(mem_ctx
,
161 KRB5_KPASSWD_SUCCESS
,
166 NTSTATUS
kpasswd_samdb_set_password(TALLOC_CTX
*mem_ctx
,
167 struct tevent_context
*event_ctx
,
168 struct loadparm_context
*lp_ctx
,
169 struct auth_session_info
*session_info
,
170 bool is_service_principal
,
171 const char *target_principal_name
,
173 enum samPwdChangeReason
*reject_reason
,
174 struct samr_DomInfo1
**dominfo
)
177 struct ldb_context
*samdb
;
178 struct ldb_dn
*target_dn
= NULL
;
181 samdb
= samdb_connect(mem_ctx
,
188 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
191 DBG_INFO("%s\\%s (%s) is changing password of %s\n",
192 session_info
->info
->domain_name
,
193 session_info
->info
->account_name
,
194 dom_sid_string(mem_ctx
,
195 &session_info
->security_token
->sids
[PRIMARY_USER_SID_INDEX
]),
196 target_principal_name
);
198 rc
= ldb_transaction_start(samdb
);
199 if (rc
!= LDB_SUCCESS
) {
200 return NT_STATUS_TRANSACTION_ABORTED
;
203 if (is_service_principal
) {
204 status
= crack_service_principal_name(samdb
,
206 target_principal_name
,
210 status
= crack_user_principal_name(samdb
,
212 target_principal_name
,
216 if (!NT_STATUS_IS_OK(status
)) {
217 ldb_transaction_cancel(samdb
);
221 status
= samdb_set_password(samdb
,
225 NULL
, /* ntNewHash */
229 if (NT_STATUS_IS_OK(status
)) {
230 rc
= ldb_transaction_commit(samdb
);
231 if (rc
!= LDB_SUCCESS
) {
232 DBG_WARNING("Failed to commit transaction to "
233 "set password on %s: %s\n",
234 ldb_dn_get_linearized(target_dn
),
235 ldb_errstring(samdb
));
236 return NT_STATUS_TRANSACTION_ABORTED
;
239 ldb_transaction_cancel(samdb
);
245 krb5_error_code
kpasswd_check_non_tgt(struct auth_session_info
*session_info
,
246 const char **error_string
)
248 switch(session_info
->ticket_type
) {
249 case TICKET_TYPE_TGT
:
250 /* TGTs are disallowed here. */
251 *error_string
= "A TGT may not be used as a ticket to kpasswd";
252 return KRB5_KPASSWD_AUTHERROR
;
253 case TICKET_TYPE_NON_TGT
:
254 /* Non-TGTs are permitted, and expected. */
257 /* In case we forgot to set the type. */
258 *error_string
= "Failed to ascertain that ticket to kpasswd is not a TGT";
259 return KRB5_KPASSWD_HARDERROR
;