removed two unneeded files after Richard backed out these changes.
[Samba.git] / source / nsswitch / pam_winbind.c
blob4d696d7de739453c46c734c86119330f8c1bb6a8
1 /* pam_winbind module
3 Copyright Andrew Tridgell <tridge@samba.org> 2000
4 Copyright Tim Potter <tpot@samba.org> 2000
5 Copyright Andrew Bartlett <abartlet@samba.org> 2002
7 largely based on pam_userdb by Christian Gafton <gafton@redhat.com>
8 also contains large slabs of code from pam_unix by Elliot Lee <sopwith@redhat.com>
9 (see copyright below for full details)
12 #include "pam_winbind.h"
14 /* prototypes from common.c */
15 void init_request(struct winbindd_request *req,int rq_type);
16 int write_sock(void *buffer, int count);
17 int read_reply(struct winbindd_response *response);
19 /* data tokens */
21 #define MAX_PASSWD_TRIES 3
23 /* some syslogging */
24 static void _pam_log(int err, const char *format, ...)
26 va_list args;
28 va_start(args, format);
29 openlog(MODULE_NAME, LOG_CONS|LOG_PID, LOG_AUTH);
30 vsyslog(err, format, args);
31 va_end(args);
32 closelog();
35 static int _pam_parse(int argc, const char **argv)
37 int ctrl;
38 /* step through arguments */
39 for (ctrl = 0; argc-- > 0; ++argv) {
41 /* generic options */
43 if (!strcmp(*argv,"debug"))
44 ctrl |= WINBIND_DEBUG_ARG;
45 else if (!strcasecmp(*argv, "use_authtok"))
46 ctrl |= WINBIND_USE_AUTHTOK_ARG;
47 else if (!strcasecmp(*argv, "use_first_pass"))
48 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
49 else if (!strcasecmp(*argv, "try_first_pass"))
50 ctrl |= WINBIND_USE_FIRST_PASS_ARG;
51 else if (!strcasecmp(*argv, "unknown_ok"))
52 ctrl |= WINBIND_UNKNOWN_OK_ARG;
53 else {
54 _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv);
58 return ctrl;
61 /* --- authentication management functions --- */
63 /* Attempt a conversation */
65 static int converse(pam_handle_t *pamh, int nargs,
66 struct pam_message **message,
67 struct pam_response **response)
69 int retval;
70 struct pam_conv *conv;
72 retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv ) ;
73 if (retval == PAM_SUCCESS) {
74 retval = conv->conv(nargs, (const struct pam_message **)message,
75 response, conv->appdata_ptr);
78 return retval; /* propagate error status */
82 int _make_remark(pam_handle_t * pamh, int type, const char *text)
84 int retval = PAM_SUCCESS;
86 struct pam_message *pmsg[1], msg[1];
87 struct pam_response *resp;
89 pmsg[0] = &msg[0];
90 msg[0].msg = text;
91 msg[0].msg_style = type;
93 resp = NULL;
94 retval = converse(pamh, 1, pmsg, &resp);
96 if (resp) {
97 _pam_drop_reply(resp, 1);
99 return retval;
102 static int winbind_request(enum winbindd_cmd req_type,
103 struct winbindd_request *request,
104 struct winbindd_response *response)
106 /* Fill in request and send down pipe */
107 init_request(request, req_type);
109 if (write_sock(request, sizeof(*request)) == -1) {
110 _pam_log(LOG_ERR, "write to socket failed!");
111 return PAM_SERVICE_ERR;
114 /* Wait for reply */
115 if (read_reply(response) == -1) {
116 _pam_log(LOG_ERR, "read from socket failed!");
117 return PAM_SERVICE_ERR;
120 /* Copy reply data from socket */
121 if (response->result != WINBINDD_OK) {
122 if (response->data.auth.pam_error != PAM_SUCCESS) {
123 _pam_log(LOG_ERR, "request failed, PAM error was %d, NT error was %s",
124 response->data.auth.pam_error,
125 response->data.auth.nt_status_string);
126 return response->data.auth.pam_error;
127 } else {
128 _pam_log(LOG_ERR, "request failed, but PAM error 0!");
129 return PAM_SERVICE_ERR;
133 return PAM_SUCCESS;
136 /* talk to winbindd */
137 static int winbind_auth_request(const char *user, const char *pass, int ctrl)
139 struct winbindd_request request;
140 struct winbindd_response response;
141 int retval;
143 ZERO_STRUCT(request);
145 strncpy(request.data.auth.user, user,
146 sizeof(request.data.auth.user)-1);
148 strncpy(request.data.auth.pass, pass,
149 sizeof(request.data.auth.pass)-1);
151 retval = winbind_request(WINBINDD_PAM_AUTH, &request, &response);
153 switch (retval) {
154 case PAM_AUTH_ERR:
155 /* incorrect password */
156 _pam_log(LOG_WARNING, "user `%s' denied access (incorrect password)", user);
157 return retval;
158 case PAM_USER_UNKNOWN:
159 /* the user does not exist */
160 if (ctrl & WINBIND_DEBUG_ARG)
161 _pam_log(LOG_NOTICE, "user `%s' not found",
162 user);
163 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
164 return PAM_IGNORE;
166 return retval;
167 case PAM_SUCCESS:
168 /* Otherwise, the authentication looked good */
169 _pam_log(LOG_NOTICE, "user '%s' granted acces", user);
170 return retval;
171 default:
172 /* we don't know anything about this return value */
173 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s'",
174 retval, user);
175 return retval;
177 /* should not be reached */
180 /* talk to winbindd */
181 static int winbind_chauthtok_request(const char *user, const char *oldpass,
182 const char *newpass)
184 struct winbindd_request request;
185 struct winbindd_response response;
187 ZERO_STRUCT(request);
189 if (request.data.chauthtok.user == NULL) return -2;
191 strncpy(request.data.chauthtok.user, user,
192 sizeof(request.data.chauthtok.user) - 1);
194 if (oldpass != NULL) {
195 strncpy(request.data.chauthtok.oldpass, oldpass,
196 sizeof(request.data.chauthtok.oldpass) - 1);
197 } else {
198 request.data.chauthtok.oldpass[0] = '\0';
201 if (newpass != NULL) {
202 strncpy(request.data.chauthtok.newpass, newpass,
203 sizeof(request.data.chauthtok.newpass) - 1);
204 } else {
205 request.data.chauthtok.newpass[0] = '\0';
208 return winbind_request(WINBINDD_PAM_CHAUTHTOK, &request, &response);
212 * Checks if a user has an account
214 * return values:
215 * 1 = User not found
216 * 0 = OK
217 * -1 = System error
219 static int valid_user(const char *user)
221 if (getpwnam(user)) return 0;
222 return 1;
225 static char *_pam_delete(register char *xx)
227 _pam_overwrite(xx);
228 _pam_drop(xx);
229 return NULL;
233 * obtain a password from the user
236 int _winbind_read_password(pam_handle_t * pamh
237 ,unsigned int ctrl
238 ,const char *comment
239 ,const char *prompt1
240 ,const char *prompt2
241 ,const char **pass)
243 int authtok_flag;
244 int retval;
245 const char *item;
246 char *token;
249 * make sure nothing inappropriate gets returned
252 *pass = token = NULL;
255 * which authentication token are we getting?
258 authtok_flag = on(WINBIND__OLD_PASSWORD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
261 * should we obtain the password from a PAM item ?
264 if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) || on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
265 retval = pam_get_item(pamh, authtok_flag, (const void **) &item);
266 if (retval != PAM_SUCCESS) {
267 /* very strange. */
268 _pam_log(LOG_ALERT,
269 "pam_get_item returned error to unix-read-password"
271 return retval;
272 } else if (item != NULL) { /* we have a password! */
273 *pass = item;
274 item = NULL;
275 return PAM_SUCCESS;
276 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
277 return PAM_AUTHTOK_RECOVER_ERR; /* didn't work */
278 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
279 && off(WINBIND__OLD_PASSWORD, ctrl)) {
280 return PAM_AUTHTOK_RECOVER_ERR;
284 * getting here implies we will have to get the password from the
285 * user directly.
289 struct pam_message msg[3], *pmsg[3];
290 struct pam_response *resp;
291 int i, replies;
293 /* prepare to converse */
295 if (comment != NULL) {
296 pmsg[0] = &msg[0];
297 msg[0].msg_style = PAM_TEXT_INFO;
298 msg[0].msg = comment;
299 i = 1;
300 } else {
301 i = 0;
304 pmsg[i] = &msg[i];
305 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
306 msg[i++].msg = prompt1;
307 replies = 1;
309 if (prompt2 != NULL) {
310 pmsg[i] = &msg[i];
311 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
312 msg[i++].msg = prompt2;
313 ++replies;
315 /* so call the conversation expecting i responses */
316 resp = NULL;
317 retval = converse(pamh, i, pmsg, &resp);
319 if (resp != NULL) {
321 /* interpret the response */
323 if (retval == PAM_SUCCESS) { /* a good conversation */
325 token = x_strdup(resp[i - replies].resp);
326 if (token != NULL) {
327 if (replies == 2) {
329 /* verify that password entered correctly */
330 if (!resp[i - 1].resp
331 || strcmp(token, resp[i - 1].resp)) {
332 _pam_delete(token); /* mistyped */
333 retval = PAM_AUTHTOK_RECOVER_ERR;
334 _make_remark(pamh ,PAM_ERROR_MSG, MISTYPED_PASS);
337 } else {
338 _pam_log(LOG_NOTICE
339 ,"could not recover authentication token");
344 * tidy up the conversation (resp_retcode) is ignored
345 * -- what is it for anyway? AGM
348 _pam_drop_reply(resp, i);
350 } else {
351 retval = (retval == PAM_SUCCESS)
352 ? PAM_AUTHTOK_RECOVER_ERR : retval;
356 if (retval != PAM_SUCCESS) {
357 if (on(WINBIND_DEBUG_ARG, ctrl))
358 _pam_log(LOG_DEBUG,
359 "unable to obtain a password");
360 return retval;
362 /* 'token' is the entered password */
364 /* we store this password as an item */
366 retval = pam_set_item(pamh, authtok_flag, token);
367 _pam_delete(token); /* clean it up */
368 if (retval != PAM_SUCCESS
369 || (retval = pam_get_item(pamh, authtok_flag
370 ,(const void **) &item))
371 != PAM_SUCCESS) {
373 _pam_log(LOG_CRIT, "error manipulating password");
374 return retval;
378 *pass = item;
379 item = NULL; /* break link to password */
381 return PAM_SUCCESS;
384 PAM_EXTERN
385 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
386 int argc, const char **argv)
388 const char *username;
389 const char *password;
390 int retval = PAM_AUTH_ERR;
392 /* parse arguments */
393 int ctrl = _pam_parse(argc, argv);
395 /* Get the username */
396 retval = pam_get_user(pamh, &username, NULL);
397 if ((retval != PAM_SUCCESS) || (!username)) {
398 if (ctrl & WINBIND_DEBUG_ARG)
399 _pam_log(LOG_DEBUG,"can not get the username");
400 return PAM_SERVICE_ERR;
403 retval = _winbind_read_password(pamh, ctrl, NULL,
404 "Password: ", NULL,
405 &password);
407 if (retval != PAM_SUCCESS) {
408 _pam_log(LOG_ERR, "Could not retrive user's password");
409 return PAM_AUTHTOK_ERR;
412 if (ctrl & WINBIND_DEBUG_ARG) {
414 /* Let's not give too much away in the log file */
416 #ifdef DEBUG_PASSWORD
417 _pam_log(LOG_INFO, "Verify user `%s' with password `%s'",
418 username, password);
419 #else
420 _pam_log(LOG_INFO, "Verify user `%s'", username);
421 #endif
424 /* Now use the username to look up password */
425 return winbind_auth_request(username, password, ctrl);
428 PAM_EXTERN
429 int pam_sm_setcred(pam_handle_t *pamh, int flags,
430 int argc, const char **argv)
432 return PAM_SUCCESS;
436 * Account management. We want to verify that the account exists
437 * before returning PAM_SUCCESS
439 PAM_EXTERN
440 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
441 int argc, const char **argv)
443 const char *username;
444 int retval = PAM_USER_UNKNOWN;
446 /* parse arguments */
447 int ctrl = _pam_parse(argc, argv);
449 /* Get the username */
450 retval = pam_get_user(pamh, &username, NULL);
451 if ((retval != PAM_SUCCESS) || (!username)) {
452 if (ctrl & WINBIND_DEBUG_ARG)
453 _pam_log(LOG_DEBUG,"can not get the username");
454 return PAM_SERVICE_ERR;
457 /* Verify the username */
458 retval = valid_user(username);
459 switch (retval) {
460 case -1:
461 /* some sort of system error. The log was already printed */
462 return PAM_SERVICE_ERR;
463 case 1:
464 /* the user does not exist */
465 if (ctrl & WINBIND_DEBUG_ARG)
466 _pam_log(LOG_NOTICE, "user `%s' not found",
467 username);
468 if (ctrl & WINBIND_UNKNOWN_OK_ARG)
469 return PAM_IGNORE;
470 return PAM_USER_UNKNOWN;
471 case 0:
472 /* Otherwise, the authentication looked good */
473 _pam_log(LOG_NOTICE, "user '%s' granted acces", username);
474 return PAM_SUCCESS;
475 default:
476 /* we don't know anything about this return value */
477 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s'",
478 retval, username);
479 return PAM_SERVICE_ERR;
482 /* should not be reached */
483 return PAM_IGNORE;
486 PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
487 int argc, const char **argv)
489 /* parse arguments */
490 int ctrl = _pam_parse(argc, argv);
491 if (ctrl & WINBIND_DEBUG_ARG)
492 _pam_log(LOG_DEBUG,"libpam_winbind:pam_sm_open_session handler");
493 return PAM_SUCCESS;
496 PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags,
497 int argc, const char **argv)
499 /* parse arguments */
500 int ctrl = _pam_parse(argc, argv);
501 if (ctrl & WINBIND_DEBUG_ARG)
502 _pam_log(LOG_DEBUG,"libpam_winbind:pam_sm_close_session handler");
503 return PAM_SUCCESS;
506 PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
507 int argc, const char **argv)
509 unsigned int lctrl;
510 int retval;
511 unsigned int ctrl = _pam_parse(argc, argv);
513 /* <DO NOT free() THESE> */
514 const char *user;
515 char *pass_old, *pass_new;
516 /* </DO NOT free() THESE> */
518 char *Announce;
520 int retry = 0;
523 * First get the name of a user
525 retval = pam_get_user(pamh, &user, "Username: ");
526 if (retval == PAM_SUCCESS) {
527 if (user == NULL) {
528 _pam_log(LOG_ERR, "username was NULL!");
529 return PAM_USER_UNKNOWN;
531 if (retval == PAM_SUCCESS && on(WINBIND_DEBUG_ARG, ctrl))
532 _pam_log(LOG_DEBUG, "username [%s] obtained",
533 user);
534 } else {
535 if (on(WINBIND_DEBUG_ARG, ctrl))
536 _pam_log(LOG_DEBUG,
537 "password - could not identify user");
538 return retval;
542 * obtain and verify the current password (OLDAUTHTOK) for
543 * the user.
546 if (flags & PAM_PRELIM_CHECK) {
548 /* instruct user what is happening */
549 #define greeting "Changing password for "
550 Announce = (char *) malloc(sizeof(greeting) + strlen(user));
551 if (Announce == NULL) {
552 _pam_log(LOG_CRIT,
553 "password - out of memory");
554 return PAM_BUF_ERR;
556 (void) strcpy(Announce, greeting);
557 (void) strcpy(Announce + sizeof(greeting) - 1, user);
558 #undef greeting
560 lctrl = ctrl | WINBIND__OLD_PASSWORD;
561 retval = _winbind_read_password(pamh, lctrl
562 ,Announce
563 ,"(current) NT password: "
564 ,NULL
565 ,(const char **) &pass_old);
566 free(Announce);
568 if (retval != PAM_SUCCESS) {
569 _pam_log(LOG_NOTICE
570 ,"password - (old) token not obtained");
571 return retval;
573 /* verify that this is the password for this user */
575 retval = winbind_auth_request(user, pass_old, ctrl);
577 if (retval != PAM_ACCT_EXPIRED
578 && retval != PAM_NEW_AUTHTOK_REQD
579 && retval != PAM_SUCCESS) {
580 pass_old = NULL;
581 return retval;
584 retval = pam_set_item(pamh, PAM_OLDAUTHTOK, (const void *) pass_old);
585 pass_old = NULL;
586 if (retval != PAM_SUCCESS) {
587 _pam_log(LOG_CRIT,
588 "failed to set PAM_OLDAUTHTOK");
590 } else if (flags & PAM_UPDATE_AUTHTOK) {
593 * obtain the proposed password
597 * get the old token back.
600 retval = pam_get_item(pamh, PAM_OLDAUTHTOK
601 ,(const void **) &pass_old);
603 if (retval != PAM_SUCCESS) {
604 _pam_log(LOG_NOTICE, "user not authenticated");
605 return retval;
608 lctrl = ctrl;
610 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
611 ctrl = WINBIND_USE_FIRST_PASS_ARG | lctrl;
613 retry = 0;
614 retval = PAM_AUTHTOK_ERR;
615 while ((retval != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
617 * use_authtok is to force the use of a previously entered
618 * password -- needed for pluggable password strength checking
621 retval = _winbind_read_password(pamh, lctrl
622 ,NULL
623 ,"Enter new NT password: "
624 ,"Retype new NT password: "
625 ,(const char **) &pass_new);
627 if (retval != PAM_SUCCESS) {
628 if (on(WINBIND_DEBUG_ARG, ctrl)) {
629 _pam_log(LOG_ALERT
630 ,"password - new password not obtained");
632 pass_old = NULL;/* tidy up */
633 return retval;
637 * At this point we know who the user is and what they
638 * propose as their new password. Verify that the new
639 * password is acceptable.
642 if (pass_new[0] == '\0') {/* "\0" password = NULL */
643 pass_new = NULL;
648 * By reaching here we have approved the passwords and must now
649 * rebuild the password database file.
652 retval = winbind_chauthtok_request(user, pass_old, pass_new);
653 _pam_overwrite(pass_new);
654 _pam_overwrite(pass_old);
655 pass_old = pass_new = NULL;
656 } else {
657 retval = PAM_SERVICE_ERR;
660 return retval;
663 #ifdef PAM_STATIC
665 /* static module data */
667 struct pam_module _pam_winbind_modstruct = {
668 MODULE_NAME,
669 pam_sm_authenticate,
670 pam_sm_setcred,
671 pam_sm_acct_mgmt,
672 NULL,
673 NULL,
674 pam_sm_chauthtok
677 #endif
680 * Copyright (c) Andrew Tridgell <tridge@samba.org> 2000
681 * Copyright (c) Tim Potter <tpot@samba.org> 2000
682 * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
683 * Copyright (c) Jan Rêkorajski 1999.
684 * Copyright (c) Andrew G. Morgan 1996-8.
685 * Copyright (c) Alex O. Yuriev, 1996.
686 * Copyright (c) Cristian Gafton 1996.
687 * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
689 * Redistribution and use in source and binary forms, with or without
690 * modification, are permitted provided that the following conditions
691 * are met:
692 * 1. Redistributions of source code must retain the above copyright
693 * notice, and the entire permission notice in its entirety,
694 * including the disclaimer of warranties.
695 * 2. Redistributions in binary form must reproduce the above copyright
696 * notice, this list of conditions and the following disclaimer in the
697 * documentation and/or other materials provided with the distribution.
698 * 3. The name of the author may not be used to endorse or promote
699 * products derived from this software without specific prior
700 * written permission.
702 * ALTERNATIVELY, this product may be distributed under the terms of
703 * the GNU Public License, in which case the provisions of the GPL are
704 * required INSTEAD OF the above restrictions. (This clause is
705 * necessary due to a potential bad interaction between the GPL and
706 * the restrictions contained in a BSD-style copyright.)
708 * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
709 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
710 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
711 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
712 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
713 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
714 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
715 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
716 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
717 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
718 * OF THE POSSIBILITY OF SUCH DAMAGE.