?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
wafsamba: use additional xml catalog file (bug #9512)
[Samba/bb.git] / source3 / winbindd / winbindd_pam.c
blobb23d421fcda1a2fee1fcd2637f68543946980151
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon - pam auth funcions
5
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_samr_c.h"
29 #include "rpc_client/cli_pipe.h"
30 #include "rpc_client/cli_samr.h"
31 #include "../librpc/gen_ndr/ndr_netlogon.h"
32 #include "rpc_client/cli_netlogon.h"
33 #include "smb_krb5.h"
34 #include "../lib/crypto/arcfour.h"
35 #include "../libcli/security/security.h"
36 #include "ads.h"
37 #include "../librpc/gen_ndr/krb5pac.h"
38 #include "passdb/machine_sid.h"
39 #include "auth.h"
40 #include "../lib/tsocket/tsocket.h"
41 #include "auth/kerberos/pac_utils.h"
42 #include "auth/gensec/gensec.h"
43 #include "librpc/crypto/gse_krb5.h"
44
45 #undef DBGC_CLASS
46 #define DBGC_CLASS DBGC_WINBIND
47
48 #define LOGON_KRB5_FAIL_CLOCK_SKEW 0x02000000
49
50 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
51 struct winbindd_response *resp,
52 struct netr_SamInfo3 *info3)
53 {
54 char *ex;
55 uint32_t i;
56
57 resp->data.auth.info3.logon_time =
58 nt_time_to_unix(info3->base.logon_time);
59 resp->data.auth.info3.logoff_time =
60 nt_time_to_unix(info3->base.logoff_time);
61 resp->data.auth.info3.kickoff_time =
62 nt_time_to_unix(info3->base.kickoff_time);
63 resp->data.auth.info3.pass_last_set_time =
64 nt_time_to_unix(info3->base.last_password_change);
65 resp->data.auth.info3.pass_can_change_time =
66 nt_time_to_unix(info3->base.allow_password_change);
67 resp->data.auth.info3.pass_must_change_time =
68 nt_time_to_unix(info3->base.force_password_change);
69
70 resp->data.auth.info3.logon_count = info3->base.logon_count;
71 resp->data.auth.info3.bad_pw_count = info3->base.bad_password_count;
72
73 resp->data.auth.info3.user_rid = info3->base.rid;
74 resp->data.auth.info3.group_rid = info3->base.primary_gid;
75 sid_to_fstring(resp->data.auth.info3.dom_sid, info3->base.domain_sid);
76
77 resp->data.auth.info3.num_groups = info3->base.groups.count;
78 resp->data.auth.info3.user_flgs = info3->base.user_flags;
79
80 resp->data.auth.info3.acct_flags = info3->base.acct_flags;
81 resp->data.auth.info3.num_other_sids = info3->sidcount;
82
83 fstrcpy(resp->data.auth.info3.user_name,
84 info3->base.account_name.string);
85 fstrcpy(resp->data.auth.info3.full_name,
86 info3->base.full_name.string);
87 fstrcpy(resp->data.auth.info3.logon_script,
88 info3->base.logon_script.string);
89 fstrcpy(resp->data.auth.info3.profile_path,
90 info3->base.profile_path.string);
91 fstrcpy(resp->data.auth.info3.home_dir,
92 info3->base.home_directory.string);
93 fstrcpy(resp->data.auth.info3.dir_drive,
94 info3->base.home_drive.string);
95
96 fstrcpy(resp->data.auth.info3.logon_srv,
97 info3->base.logon_server.string);
98 fstrcpy(resp->data.auth.info3.logon_dom,
99 info3->base.logon_domain.string);
100
101 ex = talloc_strdup(mem_ctx, "");
102 NT_STATUS_HAVE_NO_MEMORY(ex);
103
104 for (i=0; i < info3->base.groups.count; i++) {
105 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
106 info3->base.groups.rids[i].rid,
107 info3->base.groups.rids[i].attributes);
108 NT_STATUS_HAVE_NO_MEMORY(ex);
109 }
110
111 for (i=0; i < info3->sidcount; i++) {
112 char *sid;
113
114 sid = dom_sid_string(mem_ctx, info3->sids[i].sid);
115 NT_STATUS_HAVE_NO_MEMORY(sid);
116
117 ex = talloc_asprintf_append_buffer(ex, "%s:0x%08X\n",
118 sid,
119 info3->sids[i].attributes);
120 NT_STATUS_HAVE_NO_MEMORY(ex);
121
122 talloc_free(sid);
123 }
124
125 resp->extra_data.data = ex;
126 resp->length += talloc_get_size(ex);
127
128 return NT_STATUS_OK;
129 }
130
131 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
132 struct winbindd_response *resp,
133 struct netr_SamInfo3 *info3)
134 {
135 DATA_BLOB blob;
136 enum ndr_err_code ndr_err;
137
138 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
139 (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
140 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
141 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
142 return ndr_map_error2ntstatus(ndr_err);
143 }
144
145 resp->extra_data.data = blob.data;
146 resp->length += blob.length;
147
148 return NT_STATUS_OK;
149 }
150
151 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
152 struct winbindd_response *resp,
153 const struct netr_SamInfo3 *info3,
154 const char *name_domain,
155 const char *name_user)
156 {
157 /* We've been asked to return the unix username, per
158 'winbind use default domain' settings and the like */
159
160 const char *nt_username, *nt_domain;
161
162 nt_domain = talloc_strdup(mem_ctx, info3->base.logon_domain.string);
163 if (!nt_domain) {
164 /* If the server didn't give us one, just use the one
165 * we sent them */
166 nt_domain = name_domain;
167 }
168
169 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
170 if (!nt_username) {
171 /* If the server didn't give us one, just use the one
172 * we sent them */
173 nt_username = name_user;
174 }
175
176 fill_domain_username(resp->data.auth.unix_username,
177 nt_domain, nt_username, true);
178
179 DEBUG(5, ("Setting unix username to [%s]\n",
180 resp->data.auth.unix_username));
181
182 return NT_STATUS_OK;
183 }
184
185 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
186 struct winbindd_response *resp,
187 const struct netr_SamInfo3 *info3,
188 const char *name_domain,
189 const char *name_user)
190 {
191 char *afsname = NULL;
192 char *cell;
193 char *token;
194
195 afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
196 if (afsname == NULL) {
197 return NT_STATUS_NO_MEMORY;
198 }
199
200 afsname = talloc_string_sub(mem_ctx,
201 lp_afs_username_map(),
202 "%D", name_domain);
203 afsname = talloc_string_sub(mem_ctx, afsname,
204 "%u", name_user);
205 afsname = talloc_string_sub(mem_ctx, afsname,
206 "%U", name_user);
207
208 {
209 struct dom_sid user_sid;
210 fstring sidstr;
211
212 sid_compose(&user_sid, info3->base.domain_sid,
213 info3->base.rid);
214 sid_to_fstring(sidstr, &user_sid);
215 afsname = talloc_string_sub(mem_ctx, afsname,
216 "%s", sidstr);
217 }
218
219 if (afsname == NULL) {
220 return NT_STATUS_NO_MEMORY;
221 }
222
223 if (!strlower_m(afsname)) {
224 return NT_STATUS_INVALID_PARAMETER;
225 }
226
227 DEBUG(10, ("Generating token for user %s\n", afsname));
228
229 cell = strchr(afsname, '@');
230
231 if (cell == NULL) {
232 return NT_STATUS_NO_MEMORY;
233 }
234
235 *cell = '\0';
236 cell += 1;
237
238 token = afs_createtoken_str(afsname, cell);
239 if (token == NULL) {
240 return NT_STATUS_OK;
241 }
242 resp->extra_data.data = talloc_strdup(mem_ctx, token);
243 if (resp->extra_data.data == NULL) {
244 return NT_STATUS_NO_MEMORY;
245 }
246 resp->length += strlen((const char *)resp->extra_data.data)+1;
247
248 return NT_STATUS_OK;
249 }
250
251 static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
252 const char *group_sid)
253 /**
254 * Check whether a user belongs to a group or list of groups.
255 *
256 * @param mem_ctx talloc memory context.
257 * @param info3 user information, including group membership info.
258 * @param group_sid One or more groups , separated by commas.
259 *
260 * @return NT_STATUS_OK on success,
261 * NT_STATUS_LOGON_FAILURE if the user does not belong,
262 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
263 */
264 {
265 struct dom_sid *require_membership_of_sid;
266 uint32_t num_require_membership_of_sid;
267 char *req_sid;
268 const char *p;
269 struct dom_sid sid;
270 size_t i;
271 struct security_token *token;
272 TALLOC_CTX *frame = talloc_stackframe();
273 NTSTATUS status;
274
275 /* Parse the 'required group' SID */
276
277 if (!group_sid || !group_sid[0]) {
278 /* NO sid supplied, all users may access */
279 TALLOC_FREE(frame);
280 return NT_STATUS_OK;
281 }
282
283 token = talloc_zero(talloc_tos(), struct security_token);
284 if (token == NULL) {
285 DEBUG(0, ("talloc failed\n"));
286 TALLOC_FREE(frame);
287 return NT_STATUS_NO_MEMORY;
288 }
289
290 num_require_membership_of_sid = 0;
291 require_membership_of_sid = NULL;
292
293 p = group_sid;
294
295 while (next_token_talloc(talloc_tos(), &p, &req_sid, ",")) {
296 if (!string_to_sid(&sid, req_sid)) {
297 DEBUG(0, ("check_info3_in_group: could not parse %s "
298 "as a SID!", req_sid));
299 TALLOC_FREE(frame);
300 return NT_STATUS_INVALID_PARAMETER;
301 }
302
303 status = add_sid_to_array(talloc_tos(), &sid,
304 &require_membership_of_sid,
305 &num_require_membership_of_sid);
306 if (!NT_STATUS_IS_OK(status)) {
307 DEBUG(0, ("add_sid_to_array failed\n"));
308 TALLOC_FREE(frame);
309 return status;
310 }
311 }
312
313 status = sid_array_from_info3(talloc_tos(), info3,
314 &token->sids,
315 &token->num_sids,
316 true);
317 if (!NT_STATUS_IS_OK(status)) {
318 TALLOC_FREE(frame);
319 return status;
320 }
321
322 if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
323 token))
324 || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
325 token))) {
326 DEBUG(3, ("could not add aliases: %s\n",
327 nt_errstr(status)));
328 TALLOC_FREE(frame);
329 return status;
330 }
331
332 security_token_debug(DBGC_CLASS, 10, token);
333
334 for (i=0; i<num_require_membership_of_sid; i++) {
335 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
336 &require_membership_of_sid[i])));
337 if (nt_token_check_sid(&require_membership_of_sid[i],
338 token)) {
339 DEBUG(10, ("Access ok\n"));
340 TALLOC_FREE(frame);
341 return NT_STATUS_OK;
342 }
343 }
344
345 /* Do not distinguish this error from a wrong username/pw */
346
347 TALLOC_FREE(frame);
348 return NT_STATUS_LOGON_FAILURE;
349 }
350
351 struct winbindd_domain *find_auth_domain(uint8_t flags,
352 const char *domain_name)
353 {
354 struct winbindd_domain *domain;
355
356 if (IS_DC) {
357 domain = find_domain_from_name_noinit(domain_name);
358 if (domain == NULL) {
359 DEBUG(3, ("Authentication for domain [%s] refused "
360 "as it is not a trusted domain\n",
361 domain_name));
362 }
363 return domain;
364 }
365
366 if (strequal(domain_name, get_global_sam_name())) {
367 return find_domain_from_name_noinit(domain_name);
368 }
369
370 /* we can auth against trusted domains */
371 if (flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
372 domain = find_domain_from_name_noinit(domain_name);
373 if (domain == NULL) {
374 DEBUG(3, ("Authentication for domain [%s] skipped "
375 "as it is not a trusted domain\n",
376 domain_name));
377 } else {
378 return domain;
379 }
380 }
381
382 return find_our_domain();
383 }
384
385 static void fill_in_password_policy(struct winbindd_response *r,
386 const struct samr_DomInfo1 *p)
387 {
388 r->data.auth.policy.min_length_password =
389 p->min_password_length;
390 r->data.auth.policy.password_history =
391 p->password_history_length;
392 r->data.auth.policy.password_properties =
393 p->password_properties;
394 r->data.auth.policy.expire =
395 nt_time_to_unix_abs((const NTTIME *)&(p->max_password_age));
396 r->data.auth.policy.min_passwordage =
397 nt_time_to_unix_abs((const NTTIME *)&(p->min_password_age));
398 }
399
400 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
401 struct winbindd_response *response)
402 {
403 TALLOC_CTX *frame = talloc_stackframe();
404 struct winbindd_methods *methods;
405 NTSTATUS status;
406 struct samr_DomInfo1 password_policy;
407
408 if ( !winbindd_can_contact_domain( domain ) ) {
409 DEBUG(5,("fillup_password_policy: No inbound trust to "
410 "contact domain %s\n", domain->name));
411 status = NT_STATUS_NOT_SUPPORTED;
412 goto done;
413 }
414
415 methods = domain->methods;
416
417 status = methods->password_policy(domain, talloc_tos(), &password_policy);
418 if (NT_STATUS_IS_ERR(status)) {
419 goto done;
420 }
421
422 fill_in_password_policy(response, &password_policy);
423
424 done:
425 TALLOC_FREE(frame);
426 return NT_STATUS_OK;
427 }
428
429 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
430 TALLOC_CTX *mem_ctx,
431 uint16 *lockout_threshold)
432 {
433 struct winbindd_methods *methods;
434 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
435 struct samr_DomInfo12 lockout_policy;
436
437 *lockout_threshold = 0;
438
439 methods = domain->methods;
440
441 status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
442 if (NT_STATUS_IS_ERR(status)) {
443 return status;
444 }
445
446 *lockout_threshold = lockout_policy.lockout_threshold;
447
448 return NT_STATUS_OK;
449 }
450
451 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
452 TALLOC_CTX *mem_ctx,
453 uint32 *password_properties)
454 {
455 struct winbindd_methods *methods;
456 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
457 struct samr_DomInfo1 password_policy;
458
459 *password_properties = 0;
460
461 methods = domain->methods;
462
463 status = methods->password_policy(domain, mem_ctx, &password_policy);
464 if (NT_STATUS_IS_ERR(status)) {
465 return status;
466 }
467
468 *password_properties = password_policy.password_properties;
469
470 return NT_STATUS_OK;
471 }
472
473 #ifdef HAVE_KRB5
474
475 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
476 const char *type,
477 uid_t uid,
478 const char **user_ccache_file)
479 {
480 /* accept FILE and WRFILE as krb5_cc_type from the client and then
481 * build the full ccname string based on the user's uid here -
482 * Guenther*/
483
484 const char *gen_cc = NULL;
485
486 if (uid != -1) {
487 if (strequal(type, "FILE")) {
488 gen_cc = talloc_asprintf(
489 mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
490 }
491 if (strequal(type, "WRFILE")) {
492 gen_cc = talloc_asprintf(
493 mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
494 }
495 }
496
497 *user_ccache_file = gen_cc;
498
499 if (gen_cc == NULL) {
500 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
501 }
502 if (gen_cc == NULL) {
503 DEBUG(0,("out of memory\n"));
504 return NULL;
505 }
506
507 DEBUG(10, ("using ccache: %s%s\n", gen_cc,
508 (*user_ccache_file == NULL) ? " (internal)":""));
509
510 return gen_cc;
511 }
512
513 #endif
514
515 uid_t get_uid_from_request(struct winbindd_request *request)
516 {
517 uid_t uid;
518
519 uid = request->data.auth.uid;
520
521 if (uid < 0) {
522 DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
523 return -1;
524 }
525 return uid;
526 }
527
528 /**********************************************************************
529 Authenticate a user with a clear text password using Kerberos and fill up
530 ccache if required
531 **********************************************************************/
532
533 static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
534 struct winbindd_domain *domain,
535 const char *user,
536 const char *pass,
537 const char *krb5_cc_type,
538 uid_t uid,
539 struct netr_SamInfo3 **info3,
540 fstring krb5ccname)
541 {
542 #ifdef HAVE_KRB5
543 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
544 krb5_error_code krb5_ret;
545 const char *cc = NULL;
546 const char *principal_s = NULL;
547 const char *service = NULL;
548 char *realm = NULL;
549 fstring name_domain, name_user;
550 time_t ticket_lifetime = 0;
551 time_t renewal_until = 0;
552 ADS_STRUCT *ads;
553 time_t time_offset = 0;
554 const char *user_ccache_file;
555 struct PAC_LOGON_INFO *logon_info = NULL;
556
557 *info3 = NULL;
558
559 /* 1st step:
560 * prepare a krb5_cc_cache string for the user */
561
562 if (uid == -1) {
563 DEBUG(0,("no valid uid\n"));
564 }
565
566 cc = generate_krb5_ccache(mem_ctx,
567 krb5_cc_type,
568 uid,
569 &user_ccache_file);
570 if (cc == NULL) {
571 return NT_STATUS_NO_MEMORY;
572 }
573
574
575 /* 2nd step:
576 * get kerberos properties */
577
578 if (domain->private_data) {
579 ads = (ADS_STRUCT *)domain->private_data;
580 time_offset = ads->auth.time_offset;
581 }
582
583
584 /* 3rd step:
585 * do kerberos auth and setup ccache as the user */
586
587 parse_domain_user(user, name_domain, name_user);
588
589 realm = domain->alt_name;
590 if (!strupper_m(realm)) {
591 return NT_STATUS_INVALID_PARAMETER;
592 }
593
594 principal_s = talloc_asprintf(mem_ctx, "%s@%s", name_user, realm);
595 if (principal_s == NULL) {
596 return NT_STATUS_NO_MEMORY;
597 }
598
599 service = talloc_asprintf(mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
600 if (service == NULL) {
601 return NT_STATUS_NO_MEMORY;
602 }
603
604 /* if this is a user ccache, we need to act as the user to let the krb5
605 * library handle the chown, etc. */
606
607 /************************ ENTERING NON-ROOT **********************/
608
609 if (user_ccache_file != NULL) {
610 set_effective_uid(uid);
611 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
612 }
613
614 result = kerberos_return_pac(mem_ctx,
615 principal_s,
616 pass,
617 time_offset,
618 &ticket_lifetime,
619 &renewal_until,
620 cc,
621 true,
622 true,
623 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
624 NULL,
625 &logon_info);
626 if (user_ccache_file != NULL) {
627 gain_root_privilege();
628 }
629
630 /************************ RETURNED TO ROOT **********************/
631
632 if (!NT_STATUS_IS_OK(result)) {
633 goto failed;
634 }
635
636 *info3 = &logon_info->info3;
637
638 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
639 principal_s));
640
641 /* if we had a user's ccache then return that string for the pam
642 * environment */
643
644 if (user_ccache_file != NULL) {
645
646 fstrcpy(krb5ccname, user_ccache_file);
647
648 result = add_ccache_to_list(principal_s,
649 cc,
650 service,
651 user,
652 pass,
653 realm,
654 uid,
655 time(NULL),
656 ticket_lifetime,
657 renewal_until,
658 false);
659
660 if (!NT_STATUS_IS_OK(result)) {
661 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
662 nt_errstr(result)));
663 }
664 } else {
665
666 /* need to delete the memory cred cache, it is not used anymore */
667
668 krb5_ret = ads_kdestroy(cc);
669 if (krb5_ret) {
670 DEBUG(3,("winbindd_raw_kerberos_login: "
671 "could not destroy krb5 credential cache: "
672 "%s\n", error_message(krb5_ret)));
673 }
674
675 }
676
677 return NT_STATUS_OK;
678
679 failed:
680
681 /* we could have created a new credential cache with a valid tgt in it
682 * but we werent able to get or verify the service ticket for this
683 * local host and therefor didn't get the PAC, we need to remove that
684 * cache entirely now */
685
686 krb5_ret = ads_kdestroy(cc);
687 if (krb5_ret) {
688 DEBUG(3,("winbindd_raw_kerberos_login: "
689 "could not destroy krb5 credential cache: "
690 "%s\n", error_message(krb5_ret)));
691 }
692
693 if (!NT_STATUS_IS_OK(remove_ccache(user))) {
694 DEBUG(3,("winbindd_raw_kerberos_login: "
695 "could not remove ccache for user %s\n",
696 user));
697 }
698
699 return result;
700 #else
701 return NT_STATUS_NOT_SUPPORTED;
702 #endif /* HAVE_KRB5 */
703 }
704
705 /****************************************************************
706 ****************************************************************/
707
708 bool check_request_flags(uint32_t flags)
709 {
710 uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
711 WBFLAG_PAM_INFO3_TEXT |
712 WBFLAG_PAM_INFO3_NDR;
713
714 if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
715 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
716 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
717 !(flags & flags_edata) ) {
718 return true;
719 }
720
721 DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
722 flags));
723
724 return false;
725 }
726
727 /****************************************************************
728 ****************************************************************/
729
730 NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
731 struct winbindd_response *resp,
732 uint32_t request_flags,
733 struct netr_SamInfo3 *info3,
734 const char *name_domain,
735 const char *name_user)
736 {
737 NTSTATUS result;
738
739 if (request_flags & WBFLAG_PAM_USER_SESSION_KEY) {
740 memcpy(resp->data.auth.user_session_key,
741 info3->base.key.key,
742 sizeof(resp->data.auth.user_session_key)
743 /* 16 */);
744 }
745
746 if (request_flags & WBFLAG_PAM_LMKEY) {
747 memcpy(resp->data.auth.first_8_lm_hash,
748 info3->base.LMSessKey.key,
749 sizeof(resp->data.auth.first_8_lm_hash)
750 /* 8 */);
751 }
752
753 if (request_flags & WBFLAG_PAM_UNIX_NAME) {
754 result = append_unix_username(mem_ctx, resp,
755 info3, name_domain, name_user);
756 if (!NT_STATUS_IS_OK(result)) {
757 DEBUG(10,("Failed to append Unix Username: %s\n",
758 nt_errstr(result)));
759 return result;
760 }
761 }
762
763 /* currently, anything from here on potentially overwrites extra_data. */
764
765 if (request_flags & WBFLAG_PAM_INFO3_NDR) {
766 result = append_info3_as_ndr(mem_ctx, resp, info3);
767 if (!NT_STATUS_IS_OK(result)) {
768 DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
769 nt_errstr(result)));
770 return result;
771 }
772 }
773
774 if (request_flags & WBFLAG_PAM_INFO3_TEXT) {
775 result = append_info3_as_txt(mem_ctx, resp, info3);
776 if (!NT_STATUS_IS_OK(result)) {
777 DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
778 nt_errstr(result)));
779 return result;
780 }
781 }
782
783 if (request_flags & WBFLAG_PAM_AFS_TOKEN) {
784 result = append_afs_token(mem_ctx, resp,
785 info3, name_domain, name_user);
786 if (!NT_STATUS_IS_OK(result)) {
787 DEBUG(10,("Failed to append AFS token: %s\n",
788 nt_errstr(result)));
789 return result;
790 }
791 }
792
793 return NT_STATUS_OK;
794 }
795
796 static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
797 struct winbindd_cli_state *state,
798 struct netr_SamInfo3 **info3)
799 {
800 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
801 uint16 max_allowed_bad_attempts;
802 fstring name_domain, name_user;
803 struct dom_sid sid;
804 enum lsa_SidType type;
805 uchar new_nt_pass[NT_HASH_LEN];
806 const uint8 *cached_nt_pass;
807 const uint8 *cached_salt;
808 struct netr_SamInfo3 *my_info3;
809 time_t kickoff_time, must_change_time;
810 bool password_good = false;
811 #ifdef HAVE_KRB5
812 struct winbindd_tdc_domain *tdc_domain = NULL;
813 #endif
814
815 *info3 = NULL;
816
817 ZERO_STRUCTP(info3);
818
819 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
820
821 /* Parse domain and username */
822
823 parse_domain_user(state->request->data.auth.user, name_domain, name_user);
824
825
826 if (!lookup_cached_name(name_domain,
827 name_user,
828 &sid,
829 &type)) {
830 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
831 return NT_STATUS_NO_SUCH_USER;
832 }
833
834 if (type != SID_NAME_USER) {
835 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
836 return NT_STATUS_LOGON_FAILURE;
837 }
838
839 result = winbindd_get_creds(domain,
840 state->mem_ctx,
841 &sid,
842 &my_info3,
843 &cached_nt_pass,
844 &cached_salt);
845 if (!NT_STATUS_IS_OK(result)) {
846 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
847 return result;
848 }
849
850 *info3 = my_info3;
851
852 E_md4hash(state->request->data.auth.pass, new_nt_pass);
853
854 dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
855 dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
856 if (cached_salt) {
857 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
858 }
859
860 if (cached_salt) {
861 /* In this case we didn't store the nt_hash itself,
862 but the MD5 combination of salt + nt_hash. */
863 uchar salted_hash[NT_HASH_LEN];
864 E_md5hash(cached_salt, new_nt_pass, salted_hash);
865
866 password_good = (memcmp(cached_nt_pass, salted_hash,
867 NT_HASH_LEN) == 0);
868 } else {
869 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
870 password_good = (memcmp(cached_nt_pass, new_nt_pass,
871 NT_HASH_LEN) == 0);
872 }
873
874 if (password_good) {
875
876 /* User *DOES* know the password, update logon_time and reset
877 * bad_pw_count */
878
879 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
880
881 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
882 return NT_STATUS_ACCOUNT_LOCKED_OUT;
883 }
884
885 if (my_info3->base.acct_flags & ACB_DISABLED) {
886 return NT_STATUS_ACCOUNT_DISABLED;
887 }
888
889 if (my_info3->base.acct_flags & ACB_WSTRUST) {
890 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
891 }
892
893 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
894 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
895 }
896
897 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
898 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
899 }
900
901 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
902 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
903 my_info3->base.acct_flags));
904 return NT_STATUS_LOGON_FAILURE;
905 }
906
907 kickoff_time = nt_time_to_unix(my_info3->base.kickoff_time);
908 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
909 return NT_STATUS_ACCOUNT_EXPIRED;
910 }
911
912 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
913 if (must_change_time != 0 && must_change_time < time(NULL)) {
914 /* we allow grace logons when the password has expired */
915 my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
916 /* return NT_STATUS_PASSWORD_EXPIRED; */
917 goto success;
918 }
919
920 #ifdef HAVE_KRB5
921 if ((state->request->flags & WBFLAG_PAM_KRB5) &&
922 ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
923 ((tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL) ||
924 /* used to cope with the case winbindd starting without network. */
925 !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
926
927 uid_t uid = -1;
928 const char *cc = NULL;
929 char *realm = NULL;
930 const char *principal_s = NULL;
931 const char *service = NULL;
932 const char *user_ccache_file;
933
934 uid = get_uid_from_request(state->request);
935 if (uid == -1) {
936 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
937 return NT_STATUS_INVALID_PARAMETER;
938 }
939
940 cc = generate_krb5_ccache(state->mem_ctx,
941 state->request->data.auth.krb5_cc_type,
942 state->request->data.auth.uid,
943 &user_ccache_file);
944 if (cc == NULL) {
945 return NT_STATUS_NO_MEMORY;
946 }
947
948 realm = domain->alt_name;
949 if (!strupper_m(realm)) {
950 return NT_STATUS_INVALID_PARAMETER;
951 }
952
953 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
954 if (principal_s == NULL) {
955 return NT_STATUS_NO_MEMORY;
956 }
957
958 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
959 if (service == NULL) {
960 return NT_STATUS_NO_MEMORY;
961 }
962
963 if (user_ccache_file != NULL) {
964
965 fstrcpy(state->response->data.auth.krb5ccname,
966 user_ccache_file);
967
968 result = add_ccache_to_list(principal_s,
969 cc,
970 service,
971 state->request->data.auth.user,
972 state->request->data.auth.pass,
973 domain->alt_name,
974 uid,
975 time(NULL),
976 time(NULL) + lp_winbind_cache_time(),
977 time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
978 true);
979
980 if (!NT_STATUS_IS_OK(result)) {
981 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
982 "to add ccache to list: %s\n",
983 nt_errstr(result)));
984 }
985 }
986 }
987 #endif /* HAVE_KRB5 */
988 success:
989 /* FIXME: we possibly should handle logon hours as well (does xp when
990 * offline?) see auth/auth_sam.c:sam_account_ok for details */
991
992 unix_to_nt_time(&my_info3->base.logon_time, time(NULL));
993 my_info3->base.bad_password_count = 0;
994
995 result = winbindd_update_creds_by_info3(domain,
996 state->request->data.auth.user,
997 state->request->data.auth.pass,
998 my_info3);
999 if (!NT_STATUS_IS_OK(result)) {
1000 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1001 nt_errstr(result)));
1002 return result;
1003 }
1004
1005 return NT_STATUS_OK;
1006
1007 }
1008
1009 /* User does *NOT* know the correct password, modify info3 accordingly, but only if online */
1010 if (domain->online == false) {
1011 goto failed;
1012 }
1013
1014 /* failure of this is not critical */
1015 result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1016 if (!NT_STATUS_IS_OK(result)) {
1017 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1018 "Won't be able to honour account lockout policies\n"));
1019 }
1020
1021 /* increase counter */
1022 my_info3->base.bad_password_count++;
1023
1024 if (max_allowed_bad_attempts == 0) {
1025 goto failed;
1026 }
1027
1028 /* lockout user */
1029 if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1030
1031 uint32 password_properties;
1032
1033 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1034 if (!NT_STATUS_IS_OK(result)) {
1035 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1036 }
1037
1038 if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
1039 (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1040 my_info3->base.acct_flags |= ACB_AUTOLOCK;
1041 }
1042 }
1043
1044 failed:
1045 result = winbindd_update_creds_by_info3(domain,
1046 state->request->data.auth.user,
1047 NULL,
1048 my_info3);
1049
1050 if (!NT_STATUS_IS_OK(result)) {
1051 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1052 nt_errstr(result)));
1053 }
1054
1055 return NT_STATUS_LOGON_FAILURE;
1056 }
1057
1058 static NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1059 struct winbindd_cli_state *state,
1060 struct netr_SamInfo3 **info3)
1061 {
1062 struct winbindd_domain *contact_domain;
1063 fstring name_domain, name_user;
1064 NTSTATUS result;
1065
1066 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1067
1068 /* Parse domain and username */
1069
1070 parse_domain_user(state->request->data.auth.user, name_domain, name_user);
1071
1072 /* what domain should we contact? */
1073
1074 if ( IS_DC ) {
1075 if (!(contact_domain = find_domain_from_name(name_domain))) {
1076 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1077 state->request->data.auth.user, name_domain, name_user, name_domain));
1078 result = NT_STATUS_NO_SUCH_USER;
1079 goto done;
1080 }
1081
1082 } else {
1083 if (is_myname(name_domain)) {
1084 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1085 result = NT_STATUS_NO_SUCH_USER;
1086 goto done;
1087 }
1088
1089 contact_domain = find_domain_from_name(name_domain);
1090 if (contact_domain == NULL) {
1091 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1092 state->request->data.auth.user, name_domain, name_user, name_domain));
1093
1094 result = NT_STATUS_NO_SUCH_USER;
1095 goto done;
1096 }
1097 }
1098
1099 if (contact_domain->initialized &&
1100 contact_domain->active_directory) {
1101 goto try_login;
1102 }
1103
1104 if (!contact_domain->initialized) {
1105 init_dc_connection(contact_domain);
1106 }
1107
1108 if (!contact_domain->active_directory) {
1109 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1110 return NT_STATUS_INVALID_LOGON_TYPE;
1111 }
1112 try_login:
1113 result = winbindd_raw_kerberos_login(
1114 state->mem_ctx, contact_domain,
1115 state->request->data.auth.user,
1116 state->request->data.auth.pass,
1117 state->request->data.auth.krb5_cc_type,
1118 get_uid_from_request(state->request),
1119 info3, state->response->data.auth.krb5ccname);
1120 done:
1121 return result;
1122 }
1123
1124 static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
1125 uint32_t logon_parameters,
1126 const char *domain, const char *user,
1127 const DATA_BLOB *challenge,
1128 const DATA_BLOB *lm_resp,
1129 const DATA_BLOB *nt_resp,
1130 struct netr_SamInfo3 **pinfo3)
1131 {
1132 struct auth_usersupplied_info *user_info = NULL;
1133 struct tsocket_address *local;
1134 NTSTATUS status;
1135 int rc;
1136
1137 rc = tsocket_address_inet_from_strings(mem_ctx,
1138 "ip",
1139 "127.0.0.1",
1140 0,
1141 &local);
1142 if (rc < 0) {
1143 return NT_STATUS_NO_MEMORY;
1144 }
1145 status = make_user_info(&user_info, user, user, domain, domain,
1146 lp_netbios_name(), local, lm_resp, nt_resp, NULL, NULL,
1147 NULL, AUTH_PASSWORD_RESPONSE);
1148 if (!NT_STATUS_IS_OK(status)) {
1149 DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
1150 return status;
1151 }
1152 user_info->logon_parameters = logon_parameters;
1153
1154 /* We don't want any more mapping of the username */
1155 user_info->mapped_state = True;
1156
1157 status = check_sam_security_info3(challenge, talloc_tos(), user_info,
1158 pinfo3);
1159 free_user_info(&user_info);
1160 DEBUG(10, ("Authenticaticating user %s\\%s returned %s\n", domain,
1161 user, nt_errstr(status)));
1162 return status;
1163 }
1164
1165 static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
1166 TALLOC_CTX *mem_ctx,
1167 uint32_t logon_parameters,
1168 const char *server,
1169 const char *username,
1170 const char *domainname,
1171 const char *workstation,
1172 const uint8_t chal[8],
1173 DATA_BLOB lm_response,
1174 DATA_BLOB nt_response,
1175 struct netr_SamInfo3 **info3)
1176 {
1177 int attempts = 0;
1178 int netr_attempts = 0;
1179 bool retry = false;
1180 NTSTATUS result;
1181
1182 do {
1183 struct rpc_pipe_client *netlogon_pipe;
1184 const struct pipe_auth_data *auth;
1185 uint32_t neg_flags = 0;
1186
1187 ZERO_STRUCTP(info3);
1188 retry = false;
1189
1190 result = cm_connect_netlogon(domain, &netlogon_pipe);
1191
1192 if (!NT_STATUS_IS_OK(result)) {
1193 DEBUG(3,("Could not open handle to NETLOGON pipe "
1194 "(error: %s, attempts: %d)\n",
1195 nt_errstr(result), netr_attempts));
1196
1197 /* After the first retry always close the connection */
1198 if (netr_attempts > 0) {
1199 DEBUG(3, ("This is again a problem for this "
1200 "particular call, forcing the close "
1201 "of this connection\n"));
1202 invalidate_cm_connection(&domain->conn);
1203 }
1204
1205 /* After the second retry failover to the next DC */
1206 if (netr_attempts > 1) {
1207 /*
1208 * If the netlogon server is not reachable then
1209 * it is possible that the DC is rebuilding
1210 * sysvol and shutdown netlogon for that time.
1211 * We should failover to the next dc.
1212 */
1213 DEBUG(3, ("This is the third problem for this "
1214 "particular call, adding DC to the "
1215 "negative cache list\n"));
1216 add_failed_connection_entry(domain->name,
1217 domain->dcname,
1218 result);
1219 saf_delete(domain->name);
1220 }
1221
1222 /* Only allow 3 retries */
1223 if (netr_attempts < 3) {
1224 DEBUG(3, ("The connection to netlogon "
1225 "failed, retrying\n"));
1226 netr_attempts++;
1227 retry = true;
1228 continue;
1229 }
1230 return result;
1231 }
1232 netr_attempts = 0;
1233
1234 auth = netlogon_pipe->auth;
1235 if (netlogon_pipe->dc) {
1236 neg_flags = netlogon_pipe->dc->negotiate_flags;
1237 }
1238
1239 /* It is really important to try SamLogonEx here,
1240 * because in a clustered environment, we want to use
1241 * one machine account from multiple physical
1242 * computers.
1243 *
1244 * With a normal SamLogon call, we must keep the
1245 * credentials chain updated and intact between all
1246 * users of the machine account (which would imply
1247 * cross-node communication for every NTLM logon).
1248 *
1249 * (The credentials chain is not per NETLOGON pipe
1250 * connection, but globally on the server/client pair
1251 * by machine name).
1252 *
1253 * When using SamLogonEx, the credentials are not
1254 * supplied, but the session key is implied by the
1255 * wrapping SamLogon context.
1256 *
1257 * -- abartlet 21 April 2008
1258 *
1259 * It's also important to use NetlogonValidationSamInfo4 (6),
1260 * because it relies on the rpc transport encryption
1261 * and avoids using the global netlogon schannel
1262 * session key to en/decrypt secret information
1263 * like the user_session_key for network logons.
1264 *
1265 * [MS-APDS] 3.1.5.2 NTLM Network Logon
1266 * says NETLOGON_NEG_CROSS_FOREST_TRUSTS and
1267 * NETLOGON_NEG_AUTHENTICATED_RPC set together
1268 * are the indication that the server supports
1269 * NetlogonValidationSamInfo4 (6). And it must only
1270 * be used if "SealSecureChannel" is used.
1271 *
1272 * -- metze 4 February 2011
1273 */
1274
1275 if (auth == NULL) {
1276 domain->can_do_validation6 = false;
1277 } else if (auth->auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
1278 domain->can_do_validation6 = false;
1279 } else if (auth->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
1280 domain->can_do_validation6 = false;
1281 } else if (!(neg_flags & NETLOGON_NEG_CROSS_FOREST_TRUSTS)) {
1282 domain->can_do_validation6 = false;
1283 } else if (!(neg_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
1284 domain->can_do_validation6 = false;
1285 }
1286
1287 if (domain->can_do_samlogon_ex && domain->can_do_validation6) {
1288 result = rpccli_netlogon_sam_network_logon_ex(
1289 netlogon_pipe,
1290 mem_ctx,
1291 logon_parameters,
1292 server, /* server name */
1293 username, /* user name */
1294 domainname, /* target domain */
1295 workstation, /* workstation */
1296 chal,
1297 6,
1298 lm_response,
1299 nt_response,
1300 info3);
1301 } else {
1302 result = rpccli_netlogon_sam_network_logon(
1303 netlogon_pipe,
1304 mem_ctx,
1305 logon_parameters,
1306 server, /* server name */
1307 username, /* user name */
1308 domainname, /* target domain */
1309 workstation, /* workstation */
1310 chal,
1311 domain->can_do_validation6 ? 6 : 3,
1312 lm_response,
1313 nt_response,
1314 info3);
1315 }
1316
1317 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1318
1319 /*
1320 * It's likely that the server also does not support
1321 * validation level 6
1322 */
1323 domain->can_do_validation6 = false;
1324
1325 if (domain->can_do_samlogon_ex) {
1326 DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1327 "retrying with NetSamLogon\n"));
1328 domain->can_do_samlogon_ex = false;
1329 retry = true;
1330 continue;
1331 }
1332
1333
1334 /* Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
1335 * (no Ex). This happens against old Samba
1336 * DCs. Drop the connection.
1337 */
1338 invalidate_cm_connection(&domain->conn);
1339 result = NT_STATUS_LOGON_FAILURE;
1340 break;
1341 }
1342
1343 if (domain->can_do_validation6 &&
1344 (NT_STATUS_EQUAL(result, NT_STATUS_INVALID_INFO_CLASS) ||
1345 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_PARAMETER) ||
1346 NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL))) {
1347 DEBUG(3,("Got a DC that can not do validation level 6, "
1348 "retrying with level 3\n"));
1349 domain->can_do_validation6 = false;
1350 retry = true;
1351 continue;
1352 }
1353
1354 /*
1355 * we increment this after the "feature negotiation"
1356 * for can_do_samlogon_ex and can_do_validation6
1357 */
1358 attempts += 1;
1359
1360 /* We have to try a second time as cm_connect_netlogon
1361 might not yet have noticed that the DC has killed
1362 our connection. */
1363
1364 if (!rpccli_is_connected(netlogon_pipe)) {
1365 retry = true;
1366 continue;
1367 }
1368
1369 /* if we get access denied, a possible cause was that we had
1370 and open connection to the DC, but someone changed our
1371 machine account password out from underneath us using 'net
1372 rpc changetrustpw' */
1373
1374 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1375 DEBUG(3,("winbind_samlogon_retry_loop: sam_logon returned "
1376 "ACCESS_DENIED. Maybe the trust account "
1377 "password was changed and we didn't know it. "
1378 "Killing connections to domain %s\n",
1379 domainname));
1380 invalidate_cm_connection(&domain->conn);
1381 retry = true;
1382 }
1383
1384 } while ( (attempts < 2) && retry );
1385
1386 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT)) {
1387 DEBUG(3,("winbind_samlogon_retry_loop: sam_network_logon(ex) "
1388 "returned NT_STATUS_IO_TIMEOUT after the retry."
1389 "Killing connections to domain %s\n",
1390 domainname));
1391 invalidate_cm_connection(&domain->conn);
1392 }
1393 return result;
1394 }
1395
1396 static NTSTATUS winbindd_dual_pam_auth_samlogon(TALLOC_CTX *mem_ctx,
1397 struct winbindd_domain *domain,
1398 const char *user,
1399 const char *pass,
1400 uint32_t request_flags,
1401 struct netr_SamInfo3 **info3)
1402 {
1403
1404 uchar chal[8];
1405 DATA_BLOB lm_resp;
1406 DATA_BLOB nt_resp;
1407 unsigned char local_nt_response[24];
1408 fstring name_domain, name_user;
1409 NTSTATUS result;
1410 struct netr_SamInfo3 *my_info3 = NULL;
1411
1412 *info3 = NULL;
1413
1414 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1415
1416 /* Parse domain and username */
1417
1418 parse_domain_user(user, name_domain, name_user);
1419
1420 /* do password magic */
1421
1422 generate_random_buffer(chal, sizeof(chal));
1423
1424 if (lp_client_ntlmv2_auth()) {
1425 DATA_BLOB server_chal;
1426 DATA_BLOB names_blob;
1427 server_chal = data_blob_const(chal, 8);
1428
1429 /* note that the 'workgroup' here is for the local
1430 machine. The 'server name' must match the
1431 'workstation' passed to the actual SamLogon call.
1432 */
1433 names_blob = NTLMv2_generate_names_blob(
1434 mem_ctx, lp_netbios_name(), lp_workgroup());
1435
1436 if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain,
1437 pass,
1438 &server_chal,
1439 &names_blob,
1440 &lm_resp, &nt_resp, NULL, NULL)) {
1441 data_blob_free(&names_blob);
1442 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1443 result = NT_STATUS_NO_MEMORY;
1444 goto done;
1445 }
1446 data_blob_free(&names_blob);
1447 } else {
1448 lm_resp = data_blob_null;
1449 SMBNTencrypt(pass, chal, local_nt_response);
1450
1451 nt_resp = data_blob_talloc(mem_ctx, local_nt_response,
1452 sizeof(local_nt_response));
1453 }
1454
1455 if (strequal(name_domain, get_global_sam_name())) {
1456 DATA_BLOB chal_blob = data_blob_const(chal, sizeof(chal));
1457
1458 result = winbindd_dual_auth_passdb(
1459 mem_ctx, 0, name_domain, name_user,
1460 &chal_blob, &lm_resp, &nt_resp, info3);
1461 goto done;
1462 }
1463
1464 /* check authentication loop */
1465
1466 result = winbind_samlogon_retry_loop(domain,
1467 mem_ctx,
1468 0,
1469 domain->dcname,
1470 name_user,
1471 name_domain,
1472 lp_netbios_name(),
1473 chal,
1474 lm_resp,
1475 nt_resp,
1476 &my_info3);
1477 if (!NT_STATUS_IS_OK(result)) {
1478 goto done;
1479 }
1480
1481 /* handle the case where a NT4 DC does not fill in the acct_flags in
1482 * the samlogon reply info3. When accurate info3 is required by the
1483 * caller, we look up the account flags ourselve - gd */
1484
1485 if ((request_flags & WBFLAG_PAM_INFO3_TEXT) &&
1486 NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
1487
1488 struct rpc_pipe_client *samr_pipe;
1489 struct policy_handle samr_domain_handle, user_pol;
1490 union samr_UserInfo *info = NULL;
1491 NTSTATUS status_tmp, result_tmp;
1492 uint32 acct_flags;
1493 struct dcerpc_binding_handle *b;
1494
1495 status_tmp = cm_connect_sam(domain, mem_ctx,
1496 &samr_pipe, &samr_domain_handle);
1497
1498 if (!NT_STATUS_IS_OK(status_tmp)) {
1499 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1500 nt_errstr(status_tmp)));
1501 goto done;
1502 }
1503
1504 b = samr_pipe->binding_handle;
1505
1506 status_tmp = dcerpc_samr_OpenUser(b, mem_ctx,
1507 &samr_domain_handle,
1508 MAXIMUM_ALLOWED_ACCESS,
1509 my_info3->base.rid,
1510 &user_pol,
1511 &result_tmp);
1512
1513 if (!NT_STATUS_IS_OK(status_tmp)) {
1514 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1515 nt_errstr(status_tmp)));
1516 goto done;
1517 }
1518 if (!NT_STATUS_IS_OK(result_tmp)) {
1519 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1520 nt_errstr(result_tmp)));
1521 goto done;
1522 }
1523
1524 status_tmp = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1525 &user_pol,
1526 16,
1527 &info,
1528 &result_tmp);
1529
1530 if (!NT_STATUS_IS_OK(status_tmp)) {
1531 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1532 nt_errstr(status_tmp)));
1533 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1534 goto done;
1535 }
1536 if (!NT_STATUS_IS_OK(result_tmp)) {
1537 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1538 nt_errstr(result_tmp)));
1539 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1540 goto done;
1541 }
1542
1543 acct_flags = info->info16.acct_flags;
1544
1545 if (acct_flags == 0) {
1546 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1547 goto done;
1548 }
1549
1550 my_info3->base.acct_flags = acct_flags;
1551
1552 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1553
1554 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1555 }
1556
1557 *info3 = my_info3;
1558 done:
1559 return result;
1560 }
1561
1562 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1563 struct winbindd_cli_state *state)
1564 {
1565 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1566 NTSTATUS krb5_result = NT_STATUS_OK;
1567 fstring name_domain, name_user;
1568 char *mapped_user;
1569 fstring domain_user;
1570 struct netr_SamInfo3 *info3 = NULL;
1571 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
1572
1573 /* Ensure null termination */
1574 state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
1575
1576 /* Ensure null termination */
1577 state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
1578
1579 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1580 state->request->data.auth.user));
1581
1582 /* Parse domain and username */
1583
1584 name_map_status = normalize_name_unmap(state->mem_ctx,
1585 state->request->data.auth.user,
1586 &mapped_user);
1587
1588 /* If the name normalization didnt' actually do anything,
1589 just use the original name */
1590
1591 if (!NT_STATUS_IS_OK(name_map_status) &&
1592 !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
1593 {
1594 mapped_user = state->request->data.auth.user;
1595 }
1596
1597 parse_domain_user(mapped_user, name_domain, name_user);
1598
1599 if ( mapped_user != state->request->data.auth.user ) {
1600 fstr_sprintf( domain_user, "%s%c%s", name_domain,
1601 *lp_winbind_separator(),
1602 name_user );
1603 strlcpy( state->request->data.auth.user, domain_user,
1604 sizeof(state->request->data.auth.user));
1605 }
1606
1607 if (!domain->online) {
1608 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1609 if (domain->startup) {
1610 /* Logons are very important to users. If we're offline and
1611 we get a request within the first 30 seconds of startup,
1612 try very hard to find a DC and go online. */
1613
1614 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1615 "request in startup mode.\n", domain->name ));
1616
1617 winbindd_flush_negative_conn_cache(domain);
1618 result = init_dc_connection(domain);
1619 }
1620 }
1621
1622 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1623
1624 /* Check for Kerberos authentication */
1625 if (domain->online && (state->request->flags & WBFLAG_PAM_KRB5)) {
1626
1627 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1628 /* save for later */
1629 krb5_result = result;
1630
1631
1632 if (NT_STATUS_IS_OK(result)) {
1633 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1634 goto process_result;
1635 } else {
1636 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1637 }
1638
1639 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1640 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1641 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1642 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1643 set_domain_offline( domain );
1644 goto cached_logon;
1645 }
1646
1647 /* there are quite some NT_STATUS errors where there is no
1648 * point in retrying with a samlogon, we explictly have to take
1649 * care not to increase the bad logon counter on the DC */
1650
1651 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1652 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1653 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1654 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1655 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1656 NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1657 NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1658 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1659 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1660 NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1661 goto done;
1662 }
1663
1664 if (state->request->flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1665 DEBUG(3,("falling back to samlogon\n"));
1666 goto sam_logon;
1667 } else {
1668 goto cached_logon;
1669 }
1670 }
1671
1672 sam_logon:
1673 /* Check for Samlogon authentication */
1674 if (domain->online) {
1675 result = winbindd_dual_pam_auth_samlogon(
1676 state->mem_ctx, domain,
1677 state->request->data.auth.user,
1678 state->request->data.auth.pass,
1679 state->request->flags,
1680 &info3);
1681
1682 if (NT_STATUS_IS_OK(result)) {
1683 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1684 /* add the Krb5 err if we have one */
1685 if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1686 info3->base.user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1687 }
1688 goto process_result;
1689 }
1690
1691 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1692 nt_errstr(result)));
1693
1694 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1695 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1696 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1697 {
1698 DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1699 set_domain_offline( domain );
1700 goto cached_logon;
1701 }
1702
1703 if (domain->online) {
1704 /* We're still online - fail. */
1705 goto done;
1706 }
1707 }
1708
1709 cached_logon:
1710 /* Check for Cached logons */
1711 if (!domain->online && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN) &&
1712 lp_winbind_offline_logon()) {
1713
1714 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1715
1716 if (NT_STATUS_IS_OK(result)) {
1717 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1718 goto process_result;
1719 } else {
1720 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1721 goto done;
1722 }
1723 }
1724
1725 process_result:
1726
1727 if (NT_STATUS_IS_OK(result)) {
1728
1729 struct dom_sid user_sid;
1730
1731 /* In all codepaths where result == NT_STATUS_OK info3 must have
1732 been initialized. */
1733 if (!info3) {
1734 result = NT_STATUS_INTERNAL_ERROR;
1735 goto done;
1736 }
1737
1738 sid_compose(&user_sid, info3->base.domain_sid,
1739 info3->base.rid);
1740
1741 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
1742 &user_sid);
1743 netsamlogon_cache_store(name_user, info3);
1744
1745 /* save name_to_sid info as early as possible (only if
1746 this is our primary domain so we don't invalidate
1747 the cache entry by storing the seq_num for the wrong
1748 domain). */
1749 if ( domain->primary ) {
1750 cache_name2sid(domain, name_domain, name_user,
1751 SID_NAME_USER, &user_sid);
1752 }
1753
1754 /* Check if the user is in the right group */
1755
1756 result = check_info3_in_group(
1757 info3,
1758 state->request->data.auth.require_membership_of_sid);
1759 if (!NT_STATUS_IS_OK(result)) {
1760 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1761 state->request->data.auth.user,
1762 state->request->data.auth.require_membership_of_sid));
1763 goto done;
1764 }
1765
1766 result = append_auth_data(state->mem_ctx, state->response,
1767 state->request->flags, info3,
1768 name_domain, name_user);
1769 if (!NT_STATUS_IS_OK(result)) {
1770 goto done;
1771 }
1772
1773 if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
1774 && lp_winbind_offline_logon()) {
1775
1776 result = winbindd_store_creds(domain,
1777 state->request->data.auth.user,
1778 state->request->data.auth.pass,
1779 info3);
1780 }
1781
1782 if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
1783 struct winbindd_domain *our_domain = find_our_domain();
1784
1785 /* This is not entirely correct I believe, but it is
1786 consistent. Only apply the password policy settings
1787 too warn users for our own domain. Cannot obtain these
1788 from trusted DCs all the time so don't do it at all.
1789 -- jerry */
1790
1791 result = NT_STATUS_NOT_SUPPORTED;
1792 if (our_domain == domain ) {
1793 result = fillup_password_policy(
1794 our_domain, state->response);
1795 }
1796
1797 if (!NT_STATUS_IS_OK(result)
1798 && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1799 {
1800 DEBUG(10,("Failed to get password policies for domain %s: %s\n",
1801 domain->name, nt_errstr(result)));
1802 goto done;
1803 }
1804 }
1805
1806 result = NT_STATUS_OK;
1807 }
1808
1809 done:
1810 /* give us a more useful (more correct?) error code */
1811 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1812 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1813 result = NT_STATUS_NO_LOGON_SERVERS;
1814 }
1815
1816 set_auth_errors(state->response, result);
1817
1818 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1819 state->request->data.auth.user,
1820 state->response->data.auth.nt_status_string,
1821 state->response->data.auth.pam_error));
1822
1823 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1824 }
1825
1826 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1827 struct winbindd_cli_state *state)
1828 {
1829 NTSTATUS result;
1830 struct netr_SamInfo3 *info3 = NULL;
1831 const char *name_user = NULL;
1832 const char *name_domain = NULL;
1833 const char *workstation;
1834
1835 DATA_BLOB lm_resp, nt_resp;
1836
1837 /* This is child-only, so no check for privileged access is needed
1838 anymore */
1839
1840 /* Ensure null termination */
1841 state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
1842 state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
1843
1844 name_user = state->request->data.auth_crap.user;
1845 name_domain = state->request->data.auth_crap.domain;
1846 workstation = state->request->data.auth_crap.workstation;
1847
1848 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1849 name_domain, name_user));
1850
1851 if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
1852 || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
1853 if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
1854 state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
1855 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1856 state->request->data.auth_crap.lm_resp_len,
1857 state->request->data.auth_crap.nt_resp_len));
1858 result = NT_STATUS_INVALID_PARAMETER;
1859 goto done;
1860 }
1861 }
1862
1863 lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
1864 state->request->data.auth_crap.lm_resp_len);
1865
1866 if (state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) {
1867 nt_resp = data_blob_talloc(state->mem_ctx,
1868 state->request->extra_data.data,
1869 state->request->data.auth_crap.nt_resp_len);
1870 } else {
1871 nt_resp = data_blob_talloc(state->mem_ctx,
1872 state->request->data.auth_crap.nt_resp,
1873 state->request->data.auth_crap.nt_resp_len);
1874 }
1875
1876 if (strequal(name_domain, get_global_sam_name())) {
1877 DATA_BLOB chal_blob = data_blob_const(
1878 state->request->data.auth_crap.chal,
1879 sizeof(state->request->data.auth_crap.chal));
1880
1881 result = winbindd_dual_auth_passdb(
1882 state->mem_ctx,
1883 state->request->data.auth_crap.logon_parameters,
1884 name_domain, name_user,
1885 &chal_blob, &lm_resp, &nt_resp, &info3);
1886 goto process_result;
1887 }
1888
1889 result = winbind_samlogon_retry_loop(domain,
1890 state->mem_ctx,
1891 state->request->data.auth_crap.logon_parameters,
1892 domain->dcname,
1893 name_user,
1894 name_domain,
1895 /* Bug #3248 - found by Stefan Burkei. */
1896 workstation, /* We carefully set this above so use it... */
1897 state->request->data.auth_crap.chal,
1898 lm_resp,
1899 nt_resp,
1900 &info3);
1901 if (!NT_STATUS_IS_OK(result)) {
1902 goto done;
1903 }
1904
1905 process_result:
1906
1907 if (NT_STATUS_IS_OK(result)) {
1908 struct dom_sid user_sid;
1909
1910 sid_compose(&user_sid, info3->base.domain_sid,
1911 info3->base.rid);
1912 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
1913 &user_sid);
1914 netsamlogon_cache_store(name_user, info3);
1915
1916 /* Check if the user is in the right group */
1917
1918 result = check_info3_in_group(
1919 info3,
1920 state->request->data.auth_crap.require_membership_of_sid);
1921 if (!NT_STATUS_IS_OK(result)) {
1922 DEBUG(3, ("User %s is not in the required group (%s), so "
1923 "crap authentication is rejected\n",
1924 state->request->data.auth_crap.user,
1925 state->request->data.auth_crap.require_membership_of_sid));
1926 goto done;
1927 }
1928
1929 result = append_auth_data(state->mem_ctx, state->response,
1930 state->request->flags, info3,
1931 name_domain, name_user);
1932 if (!NT_STATUS_IS_OK(result)) {
1933 goto done;
1934 }
1935 }
1936
1937 done:
1938
1939 /* give us a more useful (more correct?) error code */
1940 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1941 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1942 result = NT_STATUS_NO_LOGON_SERVERS;
1943 }
1944
1945 if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1946 result = nt_status_squash(result);
1947 }
1948
1949 set_auth_errors(state->response, result);
1950
1951 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1952 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1953 name_domain,
1954 name_user,
1955 state->response->data.auth.nt_status_string,
1956 state->response->data.auth.pam_error));
1957
1958 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1959 }
1960
1961 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1962 struct winbindd_cli_state *state)
1963 {
1964 char *oldpass;
1965 char *newpass = NULL;
1966 struct policy_handle dom_pol;
1967 struct rpc_pipe_client *cli = NULL;
1968 bool got_info = false;
1969 struct samr_DomInfo1 *info = NULL;
1970 struct userPwdChangeFailureInformation *reject = NULL;
1971 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1972 fstring domain, user;
1973 struct dcerpc_binding_handle *b = NULL;
1974
1975 ZERO_STRUCT(dom_pol);
1976
1977 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1978 state->request->data.auth.user));
1979
1980 if (!parse_domain_user(state->request->data.chauthtok.user, domain, user)) {
1981 goto done;
1982 }
1983
1984 /* Change password */
1985
1986 oldpass = state->request->data.chauthtok.oldpass;
1987 newpass = state->request->data.chauthtok.newpass;
1988
1989 /* Initialize reject reason */
1990 state->response->data.auth.reject_reason = Undefined;
1991
1992 /* Get sam handle */
1993
1994 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
1995 &dom_pol);
1996 if (!NT_STATUS_IS_OK(result)) {
1997 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
1998 goto done;
1999 }
2000
2001 b = cli->binding_handle;
2002
2003 result = rpccli_samr_chgpasswd_user3(cli, state->mem_ctx,
2004 user,
2005 newpass,
2006 oldpass,
2007 &info,
2008 &reject);
2009
2010 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2011
2012 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2013
2014 fill_in_password_policy(state->response, info);
2015
2016 state->response->data.auth.reject_reason =
2017 reject->extendedFailureReason;
2018
2019 got_info = true;
2020 }
2021
2022 /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
2023 * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
2024 * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
2025 * short to comply with the samr_ChangePasswordUser3 idl - gd */
2026
2027 /* only fallback when the chgpasswd_user3 call is not supported */
2028 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
2029 NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) ||
2030 NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL) ||
2031 NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
2032
2033 DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
2034 nt_errstr(result)));
2035
2036 result = rpccli_samr_chgpasswd_user2(cli, state->mem_ctx, user, newpass, oldpass);
2037
2038 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2039 Map to the same status code as Windows 2003. */
2040
2041 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2042 result = NT_STATUS_PASSWORD_RESTRICTION;
2043 }
2044 }
2045
2046 done:
2047
2048 if (NT_STATUS_IS_OK(result)
2049 && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
2050 && lp_winbind_offline_logon()) {
2051 result = winbindd_update_creds_by_name(contact_domain, user,
2052 newpass);
2053 /* Again, this happens when we login from gdm or xdm
2054 * and the password expires, *BUT* cached crendentials
2055 * doesn't exist. winbindd_update_creds_by_name()
2056 * returns NT_STATUS_NO_SUCH_USER.
2057 * This is not a failure.
2058 * --- BoYang
2059 * */
2060 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
2061 result = NT_STATUS_OK;
2062 }
2063
2064 if (!NT_STATUS_IS_OK(result)) {
2065 DEBUG(10, ("Failed to store creds: %s\n",
2066 nt_errstr(result)));
2067 goto process_result;
2068 }
2069 }
2070
2071 if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2072
2073 NTSTATUS policy_ret;
2074
2075 policy_ret = fillup_password_policy(
2076 contact_domain, state->response);
2077
2078 /* failure of this is non critical, it will just provide no
2079 * additional information to the client why the change has
2080 * failed - Guenther */
2081
2082 if (!NT_STATUS_IS_OK(policy_ret)) {
2083 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2084 goto process_result;
2085 }
2086 }
2087
2088 process_result:
2089
2090 if (strequal(contact_domain->name, get_global_sam_name())) {
2091 /* FIXME: internal rpc pipe does not cache handles yet */
2092 if (b) {
2093 if (is_valid_policy_hnd(&dom_pol)) {
2094 NTSTATUS _result;
2095 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2096 }
2097 TALLOC_FREE(cli);
2098 }
2099 }
2100
2101 set_auth_errors(state->response, result);
2102
2103 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2104 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2105 domain,
2106 user,
2107 state->response->data.auth.nt_status_string,
2108 state->response->data.auth.pam_error));
2109
2110 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2111 }
2112
2113 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2114 struct winbindd_cli_state *state)
2115 {
2116 NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2117
2118 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2119 state->request->data.logoff.user));
2120
2121 if (!(state->request->flags & WBFLAG_PAM_KRB5)) {
2122 result = NT_STATUS_OK;
2123 goto process_result;
2124 }
2125
2126 if (state->request->data.logoff.krb5ccname[0] == '\0') {
2127 result = NT_STATUS_OK;
2128 goto process_result;
2129 }
2130
2131 #ifdef HAVE_KRB5
2132
2133 if (state->request->data.logoff.uid < 0) {
2134 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2135 goto process_result;
2136 }
2137
2138 /* what we need here is to find the corresponding krb5 ccache name *we*
2139 * created for a given username and destroy it */
2140
2141 if (!ccache_entry_exists(state->request->data.logoff.user)) {
2142 result = NT_STATUS_OK;
2143 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2144 goto process_result;
2145 }
2146
2147 if (!ccache_entry_identical(state->request->data.logoff.user,
2148 state->request->data.logoff.uid,
2149 state->request->data.logoff.krb5ccname)) {
2150 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2151 goto process_result;
2152 }
2153
2154 result = remove_ccache(state->request->data.logoff.user);
2155 if (!NT_STATUS_IS_OK(result)) {
2156 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2157 nt_errstr(result)));
2158 goto process_result;
2159 }
2160
2161 /*
2162 * Remove any mlock'ed memory creds in the child
2163 * we might be using for krb5 ticket renewal.
2164 */
2165
2166 winbindd_delete_memory_creds(state->request->data.logoff.user);
2167
2168 #else
2169 result = NT_STATUS_NOT_SUPPORTED;
2170 #endif
2171
2172 process_result:
2173
2174
2175 set_auth_errors(state->response, result);
2176
2177 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2178 }
2179
2180 /* Change user password with auth crap*/
2181
2182 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2183 {
2184 NTSTATUS result;
2185 DATA_BLOB new_nt_password;
2186 DATA_BLOB old_nt_hash_enc;
2187 DATA_BLOB new_lm_password;
2188 DATA_BLOB old_lm_hash_enc;
2189 fstring domain,user;
2190 struct policy_handle dom_pol;
2191 struct winbindd_domain *contact_domain = domainSt;
2192 struct rpc_pipe_client *cli = NULL;
2193 struct dcerpc_binding_handle *b = NULL;
2194
2195 ZERO_STRUCT(dom_pol);
2196
2197 /* Ensure null termination */
2198 state->request->data.chng_pswd_auth_crap.user[
2199 sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
2200 state->request->data.chng_pswd_auth_crap.domain[
2201 sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
2202 *domain = 0;
2203 *user = 0;
2204
2205 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2206 (unsigned long)state->pid,
2207 state->request->data.chng_pswd_auth_crap.domain,
2208 state->request->data.chng_pswd_auth_crap.user));
2209
2210 if (lp_winbind_offline_logon()) {
2211 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2212 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2213 result = NT_STATUS_ACCESS_DENIED;
2214 goto done;
2215 }
2216
2217 if (*state->request->data.chng_pswd_auth_crap.domain) {
2218 fstrcpy(domain,state->request->data.chng_pswd_auth_crap.domain);
2219 } else {
2220 parse_domain_user(state->request->data.chng_pswd_auth_crap.user,
2221 domain, user);
2222
2223 if(!*domain) {
2224 DEBUG(3,("no domain specified with username (%s) - "
2225 "failing auth\n",
2226 state->request->data.chng_pswd_auth_crap.user));
2227 result = NT_STATUS_NO_SUCH_USER;
2228 goto done;
2229 }
2230 }
2231
2232 if (!*domain && lp_winbind_use_default_domain()) {
2233 fstrcpy(domain,lp_workgroup());
2234 }
2235
2236 if(!*user) {
2237 fstrcpy(user, state->request->data.chng_pswd_auth_crap.user);
2238 }
2239
2240 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2241 (unsigned long)state->pid, domain, user));
2242
2243 /* Change password */
2244 new_nt_password = data_blob_const(
2245 state->request->data.chng_pswd_auth_crap.new_nt_pswd,
2246 state->request->data.chng_pswd_auth_crap.new_nt_pswd_len);
2247
2248 old_nt_hash_enc = data_blob_const(
2249 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
2250 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2251
2252 if(state->request->data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2253 new_lm_password = data_blob_const(
2254 state->request->data.chng_pswd_auth_crap.new_lm_pswd,
2255 state->request->data.chng_pswd_auth_crap.new_lm_pswd_len);
2256
2257 old_lm_hash_enc = data_blob_const(
2258 state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
2259 state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2260 } else {
2261 new_lm_password = data_blob_null;
2262 old_lm_hash_enc = data_blob_null;
2263 }
2264
2265 /* Get sam handle */
2266
2267 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2268 if (!NT_STATUS_IS_OK(result)) {
2269 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2270 goto done;
2271 }
2272
2273 b = cli->binding_handle;
2274
2275 result = rpccli_samr_chng_pswd_auth_crap(
2276 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2277 new_lm_password, old_lm_hash_enc);
2278
2279 done:
2280
2281 if (strequal(contact_domain->name, get_global_sam_name())) {
2282 /* FIXME: internal rpc pipe does not cache handles yet */
2283 if (b) {
2284 if (is_valid_policy_hnd(&dom_pol)) {
2285 NTSTATUS _result;
2286 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2287 }
2288 TALLOC_FREE(cli);
2289 }
2290 }
2291
2292 set_auth_errors(state->response, result);
2293
2294 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2295 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2296 domain, user,
2297 state->response->data.auth.nt_status_string,
2298 state->response->data.auth.pam_error));
2299
2300 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2301 }
2302
2303 #ifdef HAVE_KRB5
2304 static NTSTATUS extract_pac_vrfy_sigs(TALLOC_CTX *mem_ctx, DATA_BLOB pac_blob,
2305 struct PAC_LOGON_INFO **logon_info)
2306 {
2307 krb5_context krbctx = NULL;
2308 krb5_error_code k5ret;
2309 krb5_keytab keytab;
2310 krb5_kt_cursor cursor;
2311 krb5_keytab_entry entry;
2312 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
2313
2314 ZERO_STRUCT(entry);
2315 ZERO_STRUCT(cursor);
2316
2317 k5ret = krb5_init_context(&krbctx);
2318 if (k5ret) {
2319 DEBUG(1, ("Failed to initialize kerberos context: %s\n",
2320 error_message(k5ret)));
2321 status = krb5_to_nt_status(k5ret);
2322 goto out;
2323 }
2324
2325 k5ret = gse_krb5_get_server_keytab(krbctx, &keytab);
2326 if (k5ret) {
2327 DEBUG(1, ("Failed to get keytab: %s\n",
2328 error_message(k5ret)));
2329 status = krb5_to_nt_status(k5ret);
2330 goto out_free;
2331 }
2332
2333 k5ret = krb5_kt_start_seq_get(krbctx, keytab, &cursor);
2334 if (k5ret) {
2335 DEBUG(1, ("Failed to start seq: %s\n",
2336 error_message(k5ret)));
2337 status = krb5_to_nt_status(k5ret);
2338 goto out_keytab;
2339 }
2340
2341 k5ret = krb5_kt_next_entry(krbctx, keytab, &entry, &cursor);
2342 while (k5ret == 0) {
2343 status = kerberos_pac_logon_info(mem_ctx, pac_blob,
2344 krbctx, NULL,
2345 KRB5_KT_KEY(&entry), NULL, 0,
2346 logon_info);
2347 if (NT_STATUS_IS_OK(status)) {
2348 break;
2349 }
2350 k5ret = smb_krb5_kt_free_entry(krbctx, &entry);
2351 k5ret = krb5_kt_next_entry(krbctx, keytab, &entry, &cursor);
2352 }
2353
2354 k5ret = krb5_kt_end_seq_get(krbctx, keytab, &cursor);
2355 if (k5ret) {
2356 DEBUG(1, ("Failed to end seq: %s\n",
2357 error_message(k5ret)));
2358 }
2359 out_keytab:
2360 k5ret = krb5_kt_close(krbctx, keytab);
2361 if (k5ret) {
2362 DEBUG(1, ("Failed to close keytab: %s\n",
2363 error_message(k5ret)));
2364 }
2365 out_free:
2366 krb5_free_context(krbctx);
2367 out:
2368 return status;
2369 }
2370
2371 NTSTATUS winbindd_pam_auth_pac_send(struct winbindd_cli_state *state,
2372 struct netr_SamInfo3 **info3)
2373 {
2374 struct winbindd_request *req = state->request;
2375 DATA_BLOB pac_blob;
2376 struct PAC_LOGON_INFO *logon_info = NULL;
2377 NTSTATUS result;
2378
2379 pac_blob = data_blob_const(req->extra_data.data, req->extra_len);
2380 result = extract_pac_vrfy_sigs(state->mem_ctx, pac_blob, &logon_info);
2381 if (!NT_STATUS_IS_OK(result) &&
2382 !NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
2383 DEBUG(1, ("Error during PAC signature verification: %s\n",
2384 nt_errstr(result)));
2385 return result;
2386 }
2387
2388 if (logon_info) {
2389 /* Signature verification succeeded, trust the PAC */
2390 netsamlogon_cache_store(NULL, &logon_info->info3);
2391
2392 } else {
2393 /* Try without signature verification */
2394 result = kerberos_pac_logon_info(state->mem_ctx, pac_blob, NULL,
2395 NULL, NULL, NULL, 0,
2396 &logon_info);
2397 if (!NT_STATUS_IS_OK(result)) {
2398 DEBUG(10, ("Could not extract PAC: %s\n",
2399 nt_errstr(result)));
2400 return result;
2401 }
2402 }
2403
2404 *info3 = &logon_info->info3;
2405
2406 return NT_STATUS_OK;
2407 }
2408 #else /* HAVE_KRB5 */
2409 NTSTATUS winbindd_pam_auth_pac_send(struct winbindd_cli_state *state,
2410 struct netr_SamInfo3 **info3)
2411 {
2412 return NT_STATUS_NO_SUCH_USER;
2413 }
2414 #endif /* HAVE_KRB5 */