2 Unix SMB/CIFS implementation.
4 Winbind daemon - pam auth funcions
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #define DBGC_CLASS DBGC_WINBIND
30 static NTSTATUS
append_info3_as_txt(TALLOC_CTX
*mem_ctx
,
31 struct winbindd_cli_state
*state
,
32 NET_USER_INFO_3
*info3
)
36 state
->response
.data
.auth
.info3
.logon_time
=
37 nt_time_to_unix(info3
->logon_time
);
38 state
->response
.data
.auth
.info3
.logoff_time
=
39 nt_time_to_unix(info3
->logoff_time
);
40 state
->response
.data
.auth
.info3
.kickoff_time
=
41 nt_time_to_unix(info3
->kickoff_time
);
42 state
->response
.data
.auth
.info3
.pass_last_set_time
=
43 nt_time_to_unix(info3
->pass_last_set_time
);
44 state
->response
.data
.auth
.info3
.pass_can_change_time
=
45 nt_time_to_unix(info3
->pass_can_change_time
);
46 state
->response
.data
.auth
.info3
.pass_must_change_time
=
47 nt_time_to_unix(info3
->pass_must_change_time
);
49 state
->response
.data
.auth
.info3
.logon_count
= info3
->logon_count
;
50 state
->response
.data
.auth
.info3
.bad_pw_count
= info3
->bad_pw_count
;
52 state
->response
.data
.auth
.info3
.user_rid
= info3
->user_rid
;
53 state
->response
.data
.auth
.info3
.group_rid
= info3
->group_rid
;
54 sid_to_string(str_sid
, &(info3
->dom_sid
.sid
));
55 fstrcpy(state
->response
.data
.auth
.info3
.dom_sid
, str_sid
);
57 state
->response
.data
.auth
.info3
.num_groups
= info3
->num_groups
;
58 state
->response
.data
.auth
.info3
.user_flgs
= info3
->user_flgs
;
60 state
->response
.data
.auth
.info3
.acct_flags
= info3
->acct_flags
;
61 state
->response
.data
.auth
.info3
.num_other_sids
= info3
->num_other_sids
;
63 unistr2_to_ascii(state
->response
.data
.auth
.info3
.user_name
,
64 &info3
->uni_user_name
, -1);
65 unistr2_to_ascii(state
->response
.data
.auth
.info3
.full_name
,
66 &info3
->uni_full_name
, -1);
67 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_script
,
68 &info3
->uni_logon_script
, -1);
69 unistr2_to_ascii(state
->response
.data
.auth
.info3
.profile_path
,
70 &info3
->uni_profile_path
, -1);
71 unistr2_to_ascii(state
->response
.data
.auth
.info3
.home_dir
,
72 &info3
->uni_home_dir
, -1);
73 unistr2_to_ascii(state
->response
.data
.auth
.info3
.dir_drive
,
74 &info3
->uni_dir_drive
, -1);
76 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_srv
,
77 &info3
->uni_logon_srv
, -1);
78 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_dom
,
79 &info3
->uni_logon_dom
, -1);
84 static NTSTATUS
append_info3_as_ndr(TALLOC_CTX
*mem_ctx
,
85 struct winbindd_cli_state
*state
,
86 NET_USER_INFO_3
*info3
)
90 if (!prs_init(&ps
, 256 /* Random, non-zero number */, mem_ctx
, MARSHALL
)) {
91 return NT_STATUS_NO_MEMORY
;
93 if (!net_io_user_info3("", info3
, &ps
, 1, 3, False
)) {
95 return NT_STATUS_UNSUCCESSFUL
;
98 size
= prs_data_size(&ps
);
99 SAFE_FREE(state
->response
.extra_data
.data
);
100 state
->response
.extra_data
.data
= SMB_MALLOC(size
);
101 if (!state
->response
.extra_data
.data
) {
103 return NT_STATUS_NO_MEMORY
;
105 memset( state
->response
.extra_data
.data
, '\0', size
);
106 prs_copy_all_data_out((char *)state
->response
.extra_data
.data
, &ps
);
107 state
->response
.length
+= size
;
112 static NTSTATUS
check_info3_in_group(TALLOC_CTX
*mem_ctx
,
113 NET_USER_INFO_3
*info3
,
114 const char *group_sid
)
116 * Check whether a user belongs to a group or list of groups.
118 * @param mem_ctx talloc memory context.
119 * @param info3 user information, including group membership info.
120 * @param group_sid One or more groups , separated by commas.
122 * @return NT_STATUS_OK on success,
123 * NT_STATUS_LOGON_FAILURE if the user does not belong,
124 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
127 DOM_SID
*require_membership_of_sid
;
128 size_t num_require_membership_of_sid
;
133 struct nt_user_token
*token
;
136 /* Parse the 'required group' SID */
138 if (!group_sid
|| !group_sid
[0]) {
139 /* NO sid supplied, all users may access */
143 if (!(token
= TALLOC_ZERO_P(mem_ctx
, struct nt_user_token
))) {
144 DEBUG(0, ("talloc failed\n"));
145 return NT_STATUS_NO_MEMORY
;
148 num_require_membership_of_sid
= 0;
149 require_membership_of_sid
= NULL
;
153 while (next_token(&p
, req_sid
, ",", sizeof(req_sid
))) {
154 if (!string_to_sid(&sid
, req_sid
)) {
155 DEBUG(0, ("check_info3_in_group: could not parse %s "
156 "as a SID!", req_sid
));
157 return NT_STATUS_INVALID_PARAMETER
;
160 if (!add_sid_to_array(mem_ctx
, &sid
,
161 &require_membership_of_sid
,
162 &num_require_membership_of_sid
)) {
163 DEBUG(0, ("add_sid_to_array failed\n"));
164 return NT_STATUS_NO_MEMORY
;
168 if (!sid_compose(&sid
, &(info3
->dom_sid
.sid
),
170 || !add_sid_to_array(mem_ctx
, &sid
,
171 &token
->user_sids
, &token
->num_sids
)) {
172 DEBUG(3,("could not add user SID from rid 0x%x\n",
174 return NT_STATUS_INVALID_PARAMETER
;
177 if (!sid_compose(&sid
, &(info3
->dom_sid
.sid
),
179 || !add_sid_to_array(mem_ctx
, &sid
,
180 &token
->user_sids
, &token
->num_sids
)) {
181 DEBUG(3,("could not append additional group rid 0x%x\n",
184 return NT_STATUS_INVALID_PARAMETER
;
187 for (i
= 0; i
< info3
->num_groups2
; i
++) {
188 if (!sid_compose(&sid
, &(info3
->dom_sid
.sid
),
189 info3
->gids
[i
].g_rid
)
190 || !add_sid_to_array(mem_ctx
, &sid
,
191 &token
->user_sids
, &token
->num_sids
)) {
192 DEBUG(3,("could not append additional group rid 0x%x\n",
193 info3
->gids
[i
].g_rid
));
194 return NT_STATUS_INVALID_PARAMETER
;
198 /* Copy 'other' sids. We need to do sid filtering here to
199 prevent possible elevation of privileges. See:
201 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
204 for (i
= 0; i
< info3
->num_other_sids
; i
++) {
205 if (!add_sid_to_array(mem_ctx
, &info3
->other_sids
[i
].sid
,
206 &token
->user_sids
, &token
->num_sids
)) {
207 DEBUG(3, ("could not add SID to array: %s\n",
208 sid_string_static(&info3
->other_sids
[i
].sid
)));
209 return NT_STATUS_NO_MEMORY
;
213 if (!NT_STATUS_IS_OK(status
= add_aliases(get_global_sam_sid(),
215 || !NT_STATUS_IS_OK(status
= add_aliases(&global_sid_Builtin
,
217 DEBUG(3, ("could not add aliases: %s\n",
222 debug_nt_user_token(DBGC_CLASS
, 10, token
);
224 for (i
=0; i
<num_require_membership_of_sid
; i
++) {
225 DEBUG(10, ("Checking SID %s\n", sid_string_static(
226 &require_membership_of_sid
[i
])));
227 if (nt_token_check_sid(&require_membership_of_sid
[i
],
229 DEBUG(10, ("Access ok\n"));
234 /* Do not distinguish this error from a wrong username/pw */
236 return NT_STATUS_LOGON_FAILURE
;
239 struct winbindd_domain
*find_auth_domain(struct winbindd_cli_state
*state
,
240 const char *domain_name
)
242 struct winbindd_domain
*domain
;
245 domain
= find_domain_from_name_noinit(domain_name
);
246 if (domain
== NULL
) {
247 DEBUG(3, ("Authentication for domain [%s] refused"
248 "as it is not a trusted domain\n",
254 if (is_myname(domain_name
)) {
255 DEBUG(3, ("Authentication for domain %s (local domain "
256 "to this server) not supported at this "
257 "stage\n", domain_name
));
261 /* we can auth against trusted domains */
262 if (state
->request
.flags
& WBFLAG_PAM_CONTACT_TRUSTDOM
) {
263 domain
= find_domain_from_name_noinit(domain_name
);
264 if (domain
== NULL
) {
265 DEBUG(3, ("Authentication for domain [%s] skipped "
266 "as it is not a trusted domain\n",
273 return find_our_domain();
276 static void set_auth_errors(struct winbindd_response
*resp
, NTSTATUS result
)
278 resp
->data
.auth
.nt_status
= NT_STATUS_V(result
);
279 fstrcpy(resp
->data
.auth
.nt_status_string
, nt_errstr(result
));
281 /* we might have given a more useful error above */
282 if (*resp
->data
.auth
.error_string
== '\0')
283 fstrcpy(resp
->data
.auth
.error_string
,
284 get_friendly_nt_error_msg(result
));
285 resp
->data
.auth
.pam_error
= nt_status_to_pam(result
);
288 static NTSTATUS
fillup_password_policy(struct winbindd_domain
*domain
,
289 struct winbindd_cli_state
*state
)
291 struct winbindd_methods
*methods
;
292 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
293 SAM_UNK_INFO_1 password_policy
;
295 if ( !winbindd_can_contact_domain( domain
) ) {
296 DEBUG(5,("fillup_password_policy: No inbound trust to "
297 "contact domain %s\n", domain
->name
));
298 return NT_STATUS_NOT_SUPPORTED
;
301 methods
= domain
->methods
;
303 status
= methods
->password_policy(domain
, state
->mem_ctx
, &password_policy
);
304 if (NT_STATUS_IS_ERR(status
)) {
308 state
->response
.data
.auth
.policy
.min_length_password
=
309 password_policy
.min_length_password
;
310 state
->response
.data
.auth
.policy
.password_history
=
311 password_policy
.password_history
;
312 state
->response
.data
.auth
.policy
.password_properties
=
313 password_policy
.password_properties
;
314 state
->response
.data
.auth
.policy
.expire
=
315 nt_time_to_unix_abs(&(password_policy
.expire
));
316 state
->response
.data
.auth
.policy
.min_passwordage
=
317 nt_time_to_unix_abs(&(password_policy
.min_passwordage
));
322 static NTSTATUS
get_max_bad_attempts_from_lockout_policy(struct winbindd_domain
*domain
,
324 uint16
*max_allowed_bad_attempts
)
326 struct winbindd_methods
*methods
;
327 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
328 SAM_UNK_INFO_12 lockout_policy
;
330 *max_allowed_bad_attempts
= 0;
332 methods
= domain
->methods
;
334 status
= methods
->lockout_policy(domain
, mem_ctx
, &lockout_policy
);
335 if (NT_STATUS_IS_ERR(status
)) {
339 *max_allowed_bad_attempts
= lockout_policy
.bad_attempt_lockout
;
344 static NTSTATUS
get_pwd_properties(struct winbindd_domain
*domain
,
346 uint32
*password_properties
)
348 struct winbindd_methods
*methods
;
349 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
350 SAM_UNK_INFO_1 password_policy
;
352 *password_properties
= 0;
354 methods
= domain
->methods
;
356 status
= methods
->password_policy(domain
, mem_ctx
, &password_policy
);
357 if (NT_STATUS_IS_ERR(status
)) {
361 *password_properties
= password_policy
.password_properties
;
368 static const char *generate_krb5_ccache(TALLOC_CTX
*mem_ctx
,
371 BOOL
*internal_ccache
)
373 /* accept FILE and WRFILE as krb5_cc_type from the client and then
374 * build the full ccname string based on the user's uid here -
377 const char *gen_cc
= NULL
;
379 *internal_ccache
= True
;
385 if (!type
|| type
[0] == '\0') {
389 if (strequal(type
, "FILE")) {
390 gen_cc
= talloc_asprintf(mem_ctx
, "FILE:/tmp/krb5cc_%d", uid
);
391 } else if (strequal(type
, "WRFILE")) {
392 gen_cc
= talloc_asprintf(mem_ctx
, "WRFILE:/tmp/krb5cc_%d", uid
);
394 DEBUG(10,("we don't allow to set a %s type ccache\n", type
));
398 *internal_ccache
= False
;
402 gen_cc
= talloc_strdup(mem_ctx
, "MEMORY:winbindd_pam_ccache");
405 if (gen_cc
== NULL
) {
406 DEBUG(0,("out of memory\n"));
410 DEBUG(10,("using ccache: %s %s\n", gen_cc
, *internal_ccache
? "(internal)":""));
415 static void setup_return_cc_name(struct winbindd_cli_state
*state
, const char *cc
)
417 const char *type
= state
->request
.data
.auth
.krb5_cc_type
;
419 state
->response
.data
.auth
.krb5ccname
[0] = '\0';
421 if (type
[0] == '\0') {
425 if (!strequal(type
, "FILE") &&
426 !strequal(type
, "WRFILE")) {
427 DEBUG(10,("won't return krbccname for a %s type ccache\n",
432 fstrcpy(state
->response
.data
.auth
.krb5ccname
, cc
);
437 static uid_t
get_uid_from_state(struct winbindd_cli_state
*state
)
441 uid
= state
->request
.data
.auth
.uid
;
444 DEBUG(1,("invalid uid: '%d'\n", uid
));
450 /**********************************************************************
451 Authenticate a user with a clear text password using Kerberos and fill up
453 **********************************************************************/
455 static NTSTATUS
winbindd_raw_kerberos_login(struct winbindd_domain
*domain
,
456 struct winbindd_cli_state
*state
,
457 NET_USER_INFO_3
**info3
)
460 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
461 krb5_error_code krb5_ret
;
462 DATA_BLOB tkt
, session_key_krb5
;
463 DATA_BLOB ap_rep
, session_key
;
464 PAC_DATA
*pac_data
= NULL
;
465 PAC_LOGON_INFO
*logon_info
= NULL
;
466 char *client_princ
= NULL
;
467 char *client_princ_out
= NULL
;
468 char *local_service
= NULL
;
469 const char *cc
= NULL
;
470 const char *principal_s
= NULL
;
471 const char *service
= NULL
;
473 fstring name_domain
, name_user
;
474 time_t ticket_lifetime
= 0;
475 time_t renewal_until
= 0;
478 time_t time_offset
= 0;
479 BOOL internal_ccache
= True
;
481 ZERO_STRUCT(session_key
);
482 ZERO_STRUCT(session_key_krb5
);
491 * prepare a krb5_cc_cache string for the user */
493 uid
= get_uid_from_state(state
);
495 DEBUG(0,("no valid uid\n"));
498 cc
= generate_krb5_ccache(state
->mem_ctx
,
499 state
->request
.data
.auth
.krb5_cc_type
,
500 state
->request
.data
.auth
.uid
,
503 return NT_STATUS_NO_MEMORY
;
508 * get kerberos properties */
510 if (domain
->private_data
) {
511 ads
= (ADS_STRUCT
*)domain
->private_data
;
512 time_offset
= ads
->auth
.time_offset
;
517 * do kerberos auth and setup ccache as the user */
519 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
521 realm
= domain
->alt_name
;
524 principal_s
= talloc_asprintf(state
->mem_ctx
, "%s@%s", name_user
, realm
);
525 if (principal_s
== NULL
) {
526 return NT_STATUS_NO_MEMORY
;
529 service
= talloc_asprintf(state
->mem_ctx
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
);
530 if (service
== NULL
) {
531 return NT_STATUS_NO_MEMORY
;
534 /* if this is a user ccache, we need to act as the user to let the krb5
535 * library handle the chown, etc. */
537 /************************ NON-ROOT **********************/
539 if (!internal_ccache
) {
541 set_effective_uid(uid
);
542 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid
));
545 krb5_ret
= kerberos_kinit_password_ext(principal_s
,
546 state
->request
.data
.auth
.pass
,
553 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
557 DEBUG(1,("winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d)\n",
558 principal_s
, error_message(krb5_ret
), krb5_ret
));
562 /* does http_timestring use heimdals libroken strftime?? - Guenther */
563 DEBUG(10,("got TGT for %s in %s (valid until: %s (%d), renewable till: %s (%d))\n",
565 http_timestring(ticket_lifetime
), (int)ticket_lifetime
,
566 http_timestring(renewal_until
), (int)renewal_until
));
568 /* we cannot continue with krb5 when UF_DONT_REQUIRE_PREAUTH is set,
569 * in that case fallback to NTLM - gd */
571 if ((ticket_lifetime
== 0) && (renewal_until
== 0)) {
572 result
= NT_STATUS_INVALID_LOGON_TYPE
;
576 client_princ
= talloc_strdup(state
->mem_ctx
, global_myname());
577 if (client_princ
== NULL
) {
578 result
= NT_STATUS_NO_MEMORY
;
581 strlower_m(client_princ
);
583 local_service
= talloc_asprintf(state
->mem_ctx
, "%s$@%s", client_princ
, lp_realm());
584 if (local_service
== NULL
) {
585 DEBUG(0,("winbindd_raw_kerberos_login: out of memory\n"));
586 result
= NT_STATUS_NO_MEMORY
;
590 krb5_ret
= cli_krb5_get_ticket(local_service
,
598 DEBUG(1,("winbindd_raw_kerberos_login: failed to get ticket for %s: %s\n",
599 local_service
, error_message(krb5_ret
)));
600 result
= krb5_to_nt_status(krb5_ret
);
604 if (!internal_ccache
) {
605 gain_root_privilege();
608 /************************ NON-ROOT **********************/
610 result
= ads_verify_ticket(state
->mem_ctx
,
617 &session_key
, False
);
618 if (!NT_STATUS_IS_OK(result
)) {
619 DEBUG(0,("winbindd_raw_kerberos_login: ads_verify_ticket failed: %s\n",
625 DEBUG(3,("winbindd_raw_kerberos_login: no pac data\n"));
626 result
= NT_STATUS_INVALID_PARAMETER
;
630 logon_info
= get_logon_info_from_pac(pac_data
);
631 if (logon_info
== NULL
) {
632 DEBUG(1,("winbindd_raw_kerberos_login: no logon info\n"));
633 result
= NT_STATUS_INVALID_PARAMETER
;
637 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
642 * put results together */
644 *info3
= &logon_info
->info3
;
646 /* if we had a user's ccache then return that string for the pam
649 if (!internal_ccache
) {
651 setup_return_cc_name(state
, cc
);
653 result
= add_ccache_to_list(principal_s
,
656 state
->request
.data
.auth
.user
,
664 if (!NT_STATUS_IS_OK(result
)) {
665 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
670 /* need to delete the memory cred cache, it is not used anymore */
672 krb5_ret
= ads_kdestroy(cc
);
674 DEBUG(3,("winbindd_raw_kerberos_login: "
675 "could not destroy krb5 credential cache: "
676 "%s\n", error_message(krb5_ret
)));
681 result
= NT_STATUS_OK
;
687 /* we could have created a new credential cache with a valid tgt in it
688 * but we werent able to get or verify the service ticket for this
689 * local host and therefor didn't get the PAC, we need to remove that
690 * cache entirely now */
692 krb5_ret
= ads_kdestroy(cc
);
694 DEBUG(3,("winbindd_raw_kerberos_login: "
695 "could not destroy krb5 credential cache: "
696 "%s\n", error_message(krb5_ret
)));
699 if (!NT_STATUS_IS_OK(remove_ccache(state
->request
.data
.auth
.user
))) {
700 DEBUG(3,("winbindd_raw_kerberos_login: "
701 "could not remove ccache for user %s\n",
702 state
->request
.data
.auth
.user
));
706 data_blob_free(&session_key
);
707 data_blob_free(&session_key_krb5
);
708 data_blob_free(&ap_rep
);
709 data_blob_free(&tkt
);
711 SAFE_FREE(client_princ_out
);
713 if (!internal_ccache
) {
714 gain_root_privilege();
719 return NT_STATUS_NOT_SUPPORTED
;
720 #endif /* HAVE_KRB5 */
723 void winbindd_pam_auth(struct winbindd_cli_state
*state
)
725 struct winbindd_domain
*domain
;
726 fstring name_domain
, name_user
;
728 /* Ensure null termination */
729 state
->request
.data
.auth
.user
730 [sizeof(state
->request
.data
.auth
.user
)-1]='\0';
732 /* Ensure null termination */
733 state
->request
.data
.auth
.pass
734 [sizeof(state
->request
.data
.auth
.pass
)-1]='\0';
736 DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state
->pid
,
737 state
->request
.data
.auth
.user
));
739 /* Parse domain and username */
741 ws_name_return( state
->request
.data
.auth
.user
, WB_REPLACE_CHAR
);
743 if (!canonicalize_username(state
->request
.data
.auth
.user
,
744 name_domain
, name_user
)) {
745 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
746 DEBUG(5, ("Plain text authentication for %s returned %s "
748 state
->request
.data
.auth
.user
,
749 state
->response
.data
.auth
.nt_status_string
,
750 state
->response
.data
.auth
.pam_error
));
751 request_error(state
);
755 domain
= find_auth_domain(state
, name_domain
);
757 if (domain
== NULL
) {
758 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
759 DEBUG(5, ("Plain text authentication for %s returned %s "
761 state
->request
.data
.auth
.user
,
762 state
->response
.data
.auth
.nt_status_string
,
763 state
->response
.data
.auth
.pam_error
));
764 request_error(state
);
768 sendto_domain(state
, domain
);
771 NTSTATUS
winbindd_dual_pam_auth_cached(struct winbindd_domain
*domain
,
772 struct winbindd_cli_state
*state
,
773 NET_USER_INFO_3
**info3
)
775 NTSTATUS result
= NT_STATUS_LOGON_FAILURE
;
776 uint16 max_allowed_bad_attempts
;
777 fstring name_domain
, name_user
;
779 enum lsa_SidType type
;
780 uchar new_nt_pass
[NT_HASH_LEN
];
781 const uint8
*cached_nt_pass
;
782 const uint8
*cached_salt
;
783 NET_USER_INFO_3
*my_info3
;
784 time_t kickoff_time
, must_change_time
;
785 BOOL password_good
= False
;
787 struct winbindd_tdc_domain
*tdc_domain
= NULL
;
794 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
796 /* Parse domain and username */
798 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
801 if (!lookup_cached_name(state
->mem_ctx
,
806 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
807 return NT_STATUS_NO_SUCH_USER
;
810 if (type
!= SID_NAME_USER
) {
811 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type
)));
812 return NT_STATUS_LOGON_FAILURE
;
815 result
= winbindd_get_creds(domain
,
821 if (!NT_STATUS_IS_OK(result
)) {
822 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result
)));
828 E_md4hash(state
->request
.data
.auth
.pass
, new_nt_pass
);
831 dump_data(100, new_nt_pass
, NT_HASH_LEN
);
832 dump_data(100, cached_nt_pass
, NT_HASH_LEN
);
834 dump_data(100, cached_salt
, NT_HASH_LEN
);
839 /* In this case we didn't store the nt_hash itself,
840 but the MD5 combination of salt + nt_hash. */
841 uchar salted_hash
[NT_HASH_LEN
];
842 E_md5hash(cached_salt
, new_nt_pass
, salted_hash
);
844 password_good
= (memcmp(cached_nt_pass
, salted_hash
, NT_HASH_LEN
) == 0) ?
847 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
848 password_good
= (memcmp(cached_nt_pass
, new_nt_pass
, NT_HASH_LEN
) == 0) ?
854 /* User *DOES* know the password, update logon_time and reset
857 my_info3
->user_flgs
|= LOGON_CACHED_ACCOUNT
;
859 if (my_info3
->acct_flags
& ACB_AUTOLOCK
) {
860 return NT_STATUS_ACCOUNT_LOCKED_OUT
;
863 if (my_info3
->acct_flags
& ACB_DISABLED
) {
864 return NT_STATUS_ACCOUNT_DISABLED
;
867 if (my_info3
->acct_flags
& ACB_WSTRUST
) {
868 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
;
871 if (my_info3
->acct_flags
& ACB_SVRTRUST
) {
872 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT
;
875 if (my_info3
->acct_flags
& ACB_DOMTRUST
) {
876 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
;
879 if (!(my_info3
->acct_flags
& ACB_NORMAL
)) {
880 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
881 my_info3
->acct_flags
));
882 return NT_STATUS_LOGON_FAILURE
;
885 kickoff_time
= nt_time_to_unix(my_info3
->kickoff_time
);
886 if (kickoff_time
!= 0 && time(NULL
) > kickoff_time
) {
887 return NT_STATUS_ACCOUNT_EXPIRED
;
890 must_change_time
= nt_time_to_unix(my_info3
->pass_must_change_time
);
891 if (must_change_time
!= 0 && must_change_time
< time(NULL
)) {
892 /* we allow grace logons when the password has expired */
893 my_info3
->user_flgs
|= LOGON_GRACE_LOGON
;
894 /* return NT_STATUS_PASSWORD_EXPIRED; */
899 if ((state
->request
.flags
& WBFLAG_PAM_KRB5
) &&
900 ((tdc_domain
= wcache_tdc_fetch_domain(state
->mem_ctx
, name_domain
)) != NULL
) &&
901 (tdc_domain
->trust_type
& DS_DOMAIN_TRUST_TYPE_UPLEVEL
)) {
904 const char *cc
= NULL
;
906 const char *principal_s
= NULL
;
907 const char *service
= NULL
;
908 BOOL internal_ccache
= False
;
910 uid
= get_uid_from_state(state
);
912 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
913 return NT_STATUS_INVALID_PARAMETER
;
916 cc
= generate_krb5_ccache(state
->mem_ctx
,
917 state
->request
.data
.auth
.krb5_cc_type
,
918 state
->request
.data
.auth
.uid
,
921 return NT_STATUS_NO_MEMORY
;
924 realm
= domain
->alt_name
;
927 principal_s
= talloc_asprintf(state
->mem_ctx
, "%s@%s", name_user
, realm
);
928 if (principal_s
== NULL
) {
929 return NT_STATUS_NO_MEMORY
;
932 service
= talloc_asprintf(state
->mem_ctx
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
);
933 if (service
== NULL
) {
934 return NT_STATUS_NO_MEMORY
;
937 if (!internal_ccache
) {
939 setup_return_cc_name(state
, cc
);
941 result
= add_ccache_to_list(principal_s
,
944 state
->request
.data
.auth
.user
,
948 time(NULL
) + lp_winbind_cache_time(),
949 time(NULL
) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
952 if (!NT_STATUS_IS_OK(result
)) {
953 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
954 "to add ccache to list: %s\n",
959 #endif /* HAVE_KRB5 */
961 /* FIXME: we possibly should handle logon hours as well (does xp when
962 * offline?) see auth/auth_sam.c:sam_account_ok for details */
964 unix_to_nt_time(&my_info3
->logon_time
, time(NULL
));
965 my_info3
->bad_pw_count
= 0;
967 result
= winbindd_update_creds_by_info3(domain
,
969 state
->request
.data
.auth
.user
,
970 state
->request
.data
.auth
.pass
,
972 if (!NT_STATUS_IS_OK(result
)) {
973 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
982 /* User does *NOT* know the correct password, modify info3 accordingly */
984 /* failure of this is not critical */
985 result
= get_max_bad_attempts_from_lockout_policy(domain
, state
->mem_ctx
, &max_allowed_bad_attempts
);
986 if (!NT_STATUS_IS_OK(result
)) {
987 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
988 "Won't be able to honour account lockout policies\n"));
991 /* increase counter */
992 my_info3
->bad_pw_count
++;
994 if (max_allowed_bad_attempts
== 0) {
999 if (my_info3
->bad_pw_count
>= max_allowed_bad_attempts
) {
1001 uint32 password_properties
;
1003 result
= get_pwd_properties(domain
, state
->mem_ctx
, &password_properties
);
1004 if (!NT_STATUS_IS_OK(result
)) {
1005 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1008 if ((my_info3
->user_rid
!= DOMAIN_USER_RID_ADMIN
) ||
1009 (password_properties
& DOMAIN_LOCKOUT_ADMINS
)) {
1010 my_info3
->acct_flags
|= ACB_AUTOLOCK
;
1015 result
= winbindd_update_creds_by_info3(domain
,
1017 state
->request
.data
.auth
.user
,
1021 if (!NT_STATUS_IS_OK(result
)) {
1022 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1023 nt_errstr(result
)));
1026 return NT_STATUS_LOGON_FAILURE
;
1029 NTSTATUS
winbindd_dual_pam_auth_kerberos(struct winbindd_domain
*domain
,
1030 struct winbindd_cli_state
*state
,
1031 NET_USER_INFO_3
**info3
)
1033 struct winbindd_domain
*contact_domain
;
1034 fstring name_domain
, name_user
;
1037 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1039 /* Parse domain and username */
1041 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1043 /* what domain should we contact? */
1046 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1047 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1048 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1049 result
= NT_STATUS_NO_SUCH_USER
;
1054 if (is_myname(name_domain
)) {
1055 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1056 result
= NT_STATUS_NO_SUCH_USER
;
1060 contact_domain
= find_domain_from_name(name_domain
);
1061 if (contact_domain
== NULL
) {
1062 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1063 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1065 contact_domain
= find_our_domain();
1069 if (contact_domain
->initialized
&&
1070 contact_domain
->active_directory
) {
1074 if (!contact_domain
->initialized
) {
1075 init_dc_connection(contact_domain
);
1078 if (!contact_domain
->active_directory
) {
1079 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1080 return NT_STATUS_INVALID_LOGON_TYPE
;
1083 result
= winbindd_raw_kerberos_login(contact_domain
, state
, info3
);
1088 NTSTATUS
winbindd_dual_pam_auth_samlogon(struct winbindd_domain
*domain
,
1089 struct winbindd_cli_state
*state
,
1090 NET_USER_INFO_3
**info3
)
1093 struct rpc_pipe_client
*netlogon_pipe
;
1098 unsigned char local_lm_response
[24];
1099 unsigned char local_nt_response
[24];
1100 struct winbindd_domain
*contact_domain
;
1101 fstring name_domain
, name_user
;
1104 NET_USER_INFO_3
*my_info3
;
1106 ZERO_STRUCTP(info3
);
1110 my_info3
= TALLOC_ZERO_P(state
->mem_ctx
, NET_USER_INFO_3
);
1111 if (my_info3
== NULL
) {
1112 return NT_STATUS_NO_MEMORY
;
1116 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1118 /* Parse domain and username */
1120 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1122 /* do password magic */
1125 generate_random_buffer(chal
, 8);
1126 if (lp_client_ntlmv2_auth()) {
1127 DATA_BLOB server_chal
;
1128 DATA_BLOB names_blob
;
1129 DATA_BLOB nt_response
;
1130 DATA_BLOB lm_response
;
1131 server_chal
= data_blob_talloc(state
->mem_ctx
, chal
, 8);
1133 /* note that the 'workgroup' here is a best guess - we don't know
1134 the server's domain at this point. The 'server name' is also
1137 names_blob
= NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1139 if (!SMBNTLMv2encrypt(name_user
, name_domain
,
1140 state
->request
.data
.auth
.pass
,
1143 &lm_response
, &nt_response
, NULL
)) {
1144 data_blob_free(&names_blob
);
1145 data_blob_free(&server_chal
);
1146 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1147 result
= NT_STATUS_NO_MEMORY
;
1150 data_blob_free(&names_blob
);
1151 data_blob_free(&server_chal
);
1152 lm_resp
= data_blob_talloc(state
->mem_ctx
, lm_response
.data
,
1153 lm_response
.length
);
1154 nt_resp
= data_blob_talloc(state
->mem_ctx
, nt_response
.data
,
1155 nt_response
.length
);
1156 data_blob_free(&lm_response
);
1157 data_blob_free(&nt_response
);
1160 if (lp_client_lanman_auth()
1161 && SMBencrypt(state
->request
.data
.auth
.pass
,
1163 local_lm_response
)) {
1164 lm_resp
= data_blob_talloc(state
->mem_ctx
,
1166 sizeof(local_lm_response
));
1168 lm_resp
= data_blob_null
;
1170 SMBNTencrypt(state
->request
.data
.auth
.pass
,
1174 nt_resp
= data_blob_talloc(state
->mem_ctx
,
1176 sizeof(local_nt_response
));
1179 /* what domain should we contact? */
1182 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1183 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1184 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1185 result
= NT_STATUS_NO_SUCH_USER
;
1190 if (is_myname(name_domain
)) {
1191 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1192 result
= NT_STATUS_NO_SUCH_USER
;
1196 contact_domain
= find_our_domain();
1199 /* check authentication loop */
1202 NTSTATUS (*logon_fn
)(struct rpc_pipe_client
1203 *cli
, TALLOC_CTX
*mem_ctx
,
1204 uint32 logon_parameters
,
1206 const char *username
,
1208 const char *workstation
,
1209 const uint8 chal
[8],
1210 DATA_BLOB lm_response
,
1211 DATA_BLOB nt_response
,
1212 NET_USER_INFO_3
*info3
);
1214 ZERO_STRUCTP(my_info3
);
1217 result
= cm_connect_netlogon(contact_domain
, &netlogon_pipe
);
1219 if (!NT_STATUS_IS_OK(result
)) {
1220 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1224 logon_fn
= contact_domain
->can_do_samlogon_ex
1225 ? rpccli_netlogon_sam_network_logon_ex
1226 : rpccli_netlogon_sam_network_logon
;
1228 result
= logon_fn(netlogon_pipe
,
1231 contact_domain
->dcname
, /* server name */
1232 name_user
, /* user name */
1233 name_domain
, /* target domain */
1234 global_myname(), /* workstation */
1240 if ((NT_STATUS_V(result
) == DCERPC_FAULT_OP_RNG_ERROR
)
1241 && contact_domain
->can_do_samlogon_ex
) {
1242 DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1243 "retrying with NetSamLogon\n"));
1244 contact_domain
->can_do_samlogon_ex
= False
;
1251 /* We have to try a second time as cm_connect_netlogon
1252 might not yet have noticed that the DC has killed
1255 if (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)) {
1260 /* if we get access denied, a possible cause was that we had
1261 and open connection to the DC, but someone changed our
1262 machine account password out from underneath us using 'net
1263 rpc changetrustpw' */
1265 if ( NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1266 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1267 "ACCESS_DENIED. Maybe the trust account "
1268 "password was changed and we didn't know it. "
1269 "Killing connections to domain %s\n",
1271 invalidate_cm_connection(&contact_domain
->conn
);
1275 } while ( (attempts
< 2) && retry
);
1277 /* handle the case where a NT4 DC does not fill in the acct_flags in
1278 * the samlogon reply info3. When accurate info3 is required by the
1279 * caller, we look up the account flags ourselve - gd */
1281 if ((state
->request
.flags
& WBFLAG_PAM_INFO3_TEXT
) &&
1282 (my_info3
->acct_flags
== 0) && NT_STATUS_IS_OK(result
)) {
1284 struct rpc_pipe_client
*samr_pipe
;
1285 POLICY_HND samr_domain_handle
, user_pol
;
1286 SAM_USERINFO_CTR
*user_ctr
;
1287 NTSTATUS status_tmp
;
1290 ZERO_STRUCT(user_ctr
);
1292 status_tmp
= cm_connect_sam(contact_domain
, state
->mem_ctx
,
1293 &samr_pipe
, &samr_domain_handle
);
1295 if (!NT_STATUS_IS_OK(status_tmp
)) {
1296 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1297 nt_errstr(status_tmp
)));
1301 status_tmp
= rpccli_samr_open_user(samr_pipe
, state
->mem_ctx
,
1302 &samr_domain_handle
,
1303 MAXIMUM_ALLOWED_ACCESS
,
1304 my_info3
->user_rid
, &user_pol
);
1306 if (!NT_STATUS_IS_OK(status_tmp
)) {
1307 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1308 nt_errstr(status_tmp
)));
1312 status_tmp
= rpccli_samr_query_userinfo(samr_pipe
, state
->mem_ctx
,
1313 &user_pol
, 16, &user_ctr
);
1315 if (!NT_STATUS_IS_OK(status_tmp
)) {
1316 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1317 nt_errstr(status_tmp
)));
1318 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1322 acct_flags
= user_ctr
->info
.id16
->acb_info
;
1324 if (acct_flags
== 0) {
1325 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1329 my_info3
->acct_flags
= acct_flags
;
1331 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags
));
1333 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1341 enum winbindd_result
winbindd_dual_pam_auth(struct winbindd_domain
*domain
,
1342 struct winbindd_cli_state
*state
)
1344 NTSTATUS result
= NT_STATUS_LOGON_FAILURE
;
1345 NTSTATUS krb5_result
= NT_STATUS_OK
;
1346 fstring name_domain
, name_user
;
1347 NET_USER_INFO_3
*info3
= NULL
;
1349 /* Ensure null termination */
1350 state
->request
.data
.auth
.user
[sizeof(state
->request
.data
.auth
.user
)-1]='\0';
1352 /* Ensure null termination */
1353 state
->request
.data
.auth
.pass
[sizeof(state
->request
.data
.auth
.pass
)-1]='\0';
1355 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state
->pid
,
1356 state
->request
.data
.auth
.user
));
1358 /* Parse domain and username */
1360 ws_name_return( state
->request
.data
.auth
.user
, WB_REPLACE_CHAR
);
1362 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1364 if (domain
->online
== False
) {
1365 result
= NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1366 if (domain
->startup
) {
1367 /* Logons are very important to users. If we're offline and
1368 we get a request within the first 30 seconds of startup,
1369 try very hard to find a DC and go online. */
1371 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1372 "request in startup mode.\n", domain
->name
));
1374 winbindd_flush_negative_conn_cache(domain
);
1375 result
= init_dc_connection(domain
);
1379 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain
->name
, domain
->online
? "online":"offline"));
1381 /* Check for Kerberos authentication */
1382 if (domain
->online
&& (state
->request
.flags
& WBFLAG_PAM_KRB5
)) {
1384 result
= winbindd_dual_pam_auth_kerberos(domain
, state
, &info3
);
1385 /* save for later */
1386 krb5_result
= result
;
1389 if (NT_STATUS_IS_OK(result
)) {
1390 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1391 goto process_result
;
1393 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result
)));
1396 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_LOGON_SERVERS
) ||
1397 NT_STATUS_EQUAL(result
, NT_STATUS_IO_TIMEOUT
) ||
1398 NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
1399 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1400 set_domain_offline( domain
);
1404 /* there are quite some NT_STATUS errors where there is no
1405 * point in retrying with a samlogon, we explictly have to take
1406 * care not to increase the bad logon counter on the DC */
1408 if (NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_DISABLED
) ||
1409 NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_EXPIRED
) ||
1410 NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_LOCKED_OUT
) ||
1411 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_LOGON_HOURS
) ||
1412 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_WORKSTATION
) ||
1413 NT_STATUS_EQUAL(result
, NT_STATUS_LOGON_FAILURE
) ||
1414 NT_STATUS_EQUAL(result
, NT_STATUS_NO_SUCH_USER
) ||
1415 NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_EXPIRED
) ||
1416 NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_MUST_CHANGE
) ||
1417 NT_STATUS_EQUAL(result
, NT_STATUS_WRONG_PASSWORD
)) {
1418 goto process_result
;
1421 if (state
->request
.flags
& WBFLAG_PAM_FALLBACK_AFTER_KRB5
) {
1422 DEBUG(3,("falling back to samlogon\n"));
1430 /* Check for Samlogon authentication */
1431 if (domain
->online
) {
1432 result
= winbindd_dual_pam_auth_samlogon(domain
, state
, &info3
);
1434 if (NT_STATUS_IS_OK(result
)) {
1435 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1436 /* add the Krb5 err if we have one */
1437 if ( NT_STATUS_EQUAL(krb5_result
, NT_STATUS_TIME_DIFFERENCE_AT_DC
) ) {
1438 info3
->user_flgs
|= LOGON_KRB5_FAIL_CLOCK_SKEW
;
1440 goto process_result
;
1443 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1444 nt_errstr(result
)));
1446 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_LOGON_SERVERS
) ||
1447 NT_STATUS_EQUAL(result
, NT_STATUS_IO_TIMEOUT
) ||
1448 NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
))
1450 DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1451 set_domain_offline( domain
);
1455 if (domain
->online
) {
1456 /* We're still online - fail. */
1462 /* Check for Cached logons */
1463 if (!domain
->online
&& (state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
) &&
1464 lp_winbind_offline_logon()) {
1466 result
= winbindd_dual_pam_auth_cached(domain
, state
, &info3
);
1468 if (NT_STATUS_IS_OK(result
)) {
1469 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1470 goto process_result
;
1472 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result
)));
1479 if (NT_STATUS_IS_OK(result
)) {
1483 /* In all codepaths where result == NT_STATUS_OK info3 must have
1484 been initialized. */
1486 result
= NT_STATUS_INTERNAL_ERROR
;
1490 netsamlogon_cache_store(name_user
, info3
);
1491 wcache_invalidate_samlogon(find_domain_from_name(name_domain
), info3
);
1493 /* save name_to_sid info as early as possible (only if
1494 this is our primary domain so we don't invalidate
1495 the cache entry by storing the seq_num for the wrong
1497 if ( domain
->primary
) {
1498 sid_compose(&user_sid
, &info3
->dom_sid
.sid
,
1500 cache_name2sid(domain
, name_domain
, name_user
,
1501 SID_NAME_USER
, &user_sid
);
1504 /* Check if the user is in the right group */
1506 if (!NT_STATUS_IS_OK(result
= check_info3_in_group(state
->mem_ctx
, info3
,
1507 state
->request
.data
.auth
.require_membership_of_sid
))) {
1508 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1509 state
->request
.data
.auth
.user
,
1510 state
->request
.data
.auth
.require_membership_of_sid
));
1514 if (state
->request
.flags
& WBFLAG_PAM_INFO3_NDR
) {
1515 result
= append_info3_as_ndr(state
->mem_ctx
, state
, info3
);
1516 if (!NT_STATUS_IS_OK(result
)) {
1517 DEBUG(10,("Failed to append INFO3 (NDR): %s\n", nt_errstr(result
)));
1522 if (state
->request
.flags
& WBFLAG_PAM_INFO3_TEXT
) {
1523 result
= append_info3_as_txt(state
->mem_ctx
, state
, info3
);
1524 if (!NT_STATUS_IS_OK(result
)) {
1525 DEBUG(10,("Failed to append INFO3 (TXT): %s\n", nt_errstr(result
)));
1531 if ((state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
)) {
1533 /* Store in-memory creds for single-signon using ntlm_auth. */
1534 result
= winbindd_add_memory_creds(state
->request
.data
.auth
.user
,
1535 get_uid_from_state(state
),
1536 state
->request
.data
.auth
.pass
);
1538 if (!NT_STATUS_IS_OK(result
)) {
1539 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result
)));
1543 if (lp_winbind_offline_logon()) {
1544 result
= winbindd_store_creds(domain
,
1546 state
->request
.data
.auth
.user
,
1547 state
->request
.data
.auth
.pass
,
1549 if (!NT_STATUS_IS_OK(result
)) {
1551 /* Release refcount. */
1552 winbindd_delete_memory_creds(state
->request
.data
.auth
.user
);
1554 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result
)));
1560 result
= fillup_password_policy(domain
, state
);
1562 if (!NT_STATUS_IS_OK(result
)
1563 && !NT_STATUS_EQUAL(result
, NT_STATUS_NOT_SUPPORTED
) )
1565 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result
)));
1569 result
= NT_STATUS_OK
;
1571 if (state
->request
.flags
& WBFLAG_PAM_UNIX_NAME
) {
1572 /* We've been asked to return the unix username, per
1573 'winbind use default domain' settings and the like */
1575 fstring username_out
;
1576 const char *nt_username
, *nt_domain
;
1578 if (!(nt_username
= unistr2_tdup(state
->mem_ctx
, &info3
->uni_user_name
))) {
1579 /* If the server didn't give us one, just use the one we sent them */
1580 nt_username
= name_user
;
1583 if (!(nt_domain
= unistr2_tdup(state
->mem_ctx
, &info3
->uni_logon_dom
))) {
1584 /* If the server didn't give us one, just use the one we sent them */
1585 nt_domain
= name_domain
;
1588 fill_domain_username(username_out
, nt_domain
, nt_username
, True
);
1590 DEBUG(5, ("Setting unix username to [%s]\n", username_out
));
1592 SAFE_FREE(state
->response
.extra_data
.data
);
1593 state
->response
.extra_data
.data
= SMB_STRDUP(username_out
);
1594 if (!state
->response
.extra_data
.data
) {
1595 result
= NT_STATUS_NO_MEMORY
;
1598 state
->response
.length
+=
1599 strlen((const char *)state
->response
.extra_data
.data
)+1;
1605 /* give us a more useful (more correct?) error code */
1606 if ((NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) ||
1607 (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)))) {
1608 result
= NT_STATUS_NO_LOGON_SERVERS
;
1611 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
1612 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
1614 /* we might have given a more useful error above */
1615 if (!*state
->response
.data
.auth
.error_string
)
1616 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
1617 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
1619 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1620 state
->request
.data
.auth
.user
,
1621 state
->response
.data
.auth
.nt_status_string
,
1622 state
->response
.data
.auth
.pam_error
));
1624 if ( NT_STATUS_IS_OK(result
) && info3
&&
1625 (state
->request
.flags
& WBFLAG_PAM_AFS_TOKEN
) ) {
1627 char *afsname
= talloc_strdup(state
->mem_ctx
,
1628 lp_afs_username_map());
1631 if (afsname
== NULL
) {
1635 afsname
= talloc_string_sub(state
->mem_ctx
,
1636 lp_afs_username_map(),
1638 afsname
= talloc_string_sub(state
->mem_ctx
, afsname
,
1640 afsname
= talloc_string_sub(state
->mem_ctx
, afsname
,
1647 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
1648 sid_append_rid(&user_sid
, info3
->user_rid
);
1649 sid_to_string(sidstr
, &user_sid
);
1650 afsname
= talloc_string_sub(state
->mem_ctx
, afsname
,
1654 if (afsname
== NULL
) {
1658 strlower_m(afsname
);
1660 DEBUG(10, ("Generating token for user %s\n", afsname
));
1662 cell
= strchr(afsname
, '@');
1671 /* Append an AFS token string */
1672 SAFE_FREE(state
->response
.extra_data
.data
);
1673 state
->response
.extra_data
.data
=
1674 afs_createtoken_str(afsname
, cell
);
1676 if (state
->response
.extra_data
.data
!= NULL
) {
1677 state
->response
.length
+=
1678 strlen((const char *)state
->response
.extra_data
.data
)+1;
1682 TALLOC_FREE(afsname
);
1685 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
1689 /**********************************************************************
1690 Challenge Response Authentication Protocol
1691 **********************************************************************/
1693 void winbindd_pam_auth_crap(struct winbindd_cli_state
*state
)
1695 struct winbindd_domain
*domain
= NULL
;
1696 const char *domain_name
= NULL
;
1699 if (!state
->privileged
) {
1700 char *error_string
= NULL
;
1701 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1703 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1704 "on %s are set correctly.\n",
1705 get_winbind_priv_pipe_dir()));
1706 /* send a better message than ACCESS_DENIED */
1707 error_string
= talloc_asprintf(state
->mem_ctx
,
1708 "winbind client not authorized "
1709 "to use winbindd_pam_auth_crap."
1710 " Ensure permissions on %s "
1711 "are set correctly.",
1712 get_winbind_priv_pipe_dir());
1713 fstrcpy(state
->response
.data
.auth
.error_string
, error_string
);
1714 result
= NT_STATUS_ACCESS_DENIED
;
1718 /* Ensure null termination */
1719 state
->request
.data
.auth_crap
.user
1720 [sizeof(state
->request
.data
.auth_crap
.user
)-1]=0;
1721 state
->request
.data
.auth_crap
.domain
1722 [sizeof(state
->request
.data
.auth_crap
.domain
)-1]=0;
1724 DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1725 (unsigned long)state
->pid
,
1726 state
->request
.data
.auth_crap
.domain
,
1727 state
->request
.data
.auth_crap
.user
));
1729 if (*state
->request
.data
.auth_crap
.domain
!= '\0') {
1730 domain_name
= state
->request
.data
.auth_crap
.domain
;
1731 } else if (lp_winbind_use_default_domain()) {
1732 domain_name
= lp_workgroup();
1735 if (domain_name
!= NULL
)
1736 domain
= find_auth_domain(state
, domain_name
);
1738 if (domain
!= NULL
) {
1739 sendto_domain(state
, domain
);
1743 result
= NT_STATUS_NO_SUCH_USER
;
1746 set_auth_errors(&state
->response
, result
);
1747 DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1748 state
->request
.data
.auth_crap
.domain
,
1749 state
->request
.data
.auth_crap
.user
,
1750 state
->response
.data
.auth
.nt_status_string
,
1751 state
->response
.data
.auth
.pam_error
));
1752 request_error(state
);
1757 enum winbindd_result
winbindd_dual_pam_auth_crap(struct winbindd_domain
*domain
,
1758 struct winbindd_cli_state
*state
)
1761 NET_USER_INFO_3 info3
;
1762 struct rpc_pipe_client
*netlogon_pipe
;
1763 const char *name_user
= NULL
;
1764 const char *name_domain
= NULL
;
1765 const char *workstation
;
1766 struct winbindd_domain
*contact_domain
;
1770 DATA_BLOB lm_resp
, nt_resp
;
1772 /* This is child-only, so no check for privileged access is needed
1775 /* Ensure null termination */
1776 state
->request
.data
.auth_crap
.user
[sizeof(state
->request
.data
.auth_crap
.user
)-1]=0;
1777 state
->request
.data
.auth_crap
.domain
[sizeof(state
->request
.data
.auth_crap
.domain
)-1]=0;
1779 name_user
= state
->request
.data
.auth_crap
.user
;
1781 if (*state
->request
.data
.auth_crap
.domain
) {
1782 name_domain
= state
->request
.data
.auth_crap
.domain
;
1783 } else if (lp_winbind_use_default_domain()) {
1784 name_domain
= lp_workgroup();
1786 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1788 result
= NT_STATUS_NO_SUCH_USER
;
1792 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state
->pid
,
1793 name_domain
, name_user
));
1795 if (*state
->request
.data
.auth_crap
.workstation
) {
1796 workstation
= state
->request
.data
.auth_crap
.workstation
;
1798 workstation
= global_myname();
1801 if (state
->request
.data
.auth_crap
.lm_resp_len
> sizeof(state
->request
.data
.auth_crap
.lm_resp
)
1802 || state
->request
.data
.auth_crap
.nt_resp_len
> sizeof(state
->request
.data
.auth_crap
.nt_resp
)) {
1803 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1804 state
->request
.data
.auth_crap
.lm_resp_len
,
1805 state
->request
.data
.auth_crap
.nt_resp_len
));
1806 result
= NT_STATUS_INVALID_PARAMETER
;
1810 lm_resp
= data_blob_talloc(state
->mem_ctx
, state
->request
.data
.auth_crap
.lm_resp
,
1811 state
->request
.data
.auth_crap
.lm_resp_len
);
1812 nt_resp
= data_blob_talloc(state
->mem_ctx
, state
->request
.data
.auth_crap
.nt_resp
,
1813 state
->request
.data
.auth_crap
.nt_resp_len
);
1815 /* what domain should we contact? */
1818 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1819 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1820 state
->request
.data
.auth_crap
.user
, name_domain
, name_user
, name_domain
));
1821 result
= NT_STATUS_NO_SUCH_USER
;
1825 if (is_myname(name_domain
)) {
1826 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1827 result
= NT_STATUS_NO_SUCH_USER
;
1830 contact_domain
= find_our_domain();
1834 NTSTATUS (*logon_fn
)(struct rpc_pipe_client
1835 *cli
, TALLOC_CTX
*mem_ctx
,
1836 uint32 logon_parameters
,
1838 const char *username
,
1840 const char *workstation
,
1841 const uint8 chal
[8],
1842 DATA_BLOB lm_response
,
1843 DATA_BLOB nt_response
,
1844 NET_USER_INFO_3
*info3
);
1849 netlogon_pipe
= NULL
;
1850 result
= cm_connect_netlogon(contact_domain
, &netlogon_pipe
);
1852 if (!NT_STATUS_IS_OK(result
)) {
1853 DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1854 nt_errstr(result
)));
1858 logon_fn
= contact_domain
->can_do_samlogon_ex
1859 ? rpccli_netlogon_sam_network_logon_ex
1860 : rpccli_netlogon_sam_network_logon
;
1862 result
= logon_fn(netlogon_pipe
,
1864 state
->request
.data
.auth_crap
.logon_parameters
,
1865 contact_domain
->dcname
,
1868 /* Bug #3248 - found by Stefan Burkei. */
1869 workstation
, /* We carefully set this above so use it... */
1870 state
->request
.data
.auth_crap
.chal
,
1875 if ((NT_STATUS_V(result
) == DCERPC_FAULT_OP_RNG_ERROR
)
1876 && contact_domain
->can_do_samlogon_ex
) {
1877 DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1878 "retrying with NetSamLogon\n"));
1879 contact_domain
->can_do_samlogon_ex
= False
;
1886 /* We have to try a second time as cm_connect_netlogon
1887 might not yet have noticed that the DC has killed
1890 if (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)) {
1895 /* if we get access denied, a possible cause was that we had and open
1896 connection to the DC, but someone changed our machine account password
1897 out from underneath us using 'net rpc changetrustpw' */
1899 if ( NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1900 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1901 "ACCESS_DENIED. Maybe the trust account "
1902 "password was changed and we didn't know it. "
1903 "Killing connections to domain %s\n",
1905 invalidate_cm_connection(&contact_domain
->conn
);
1909 } while ( (attempts
< 2) && retry
);
1911 if (NT_STATUS_IS_OK(result
)) {
1913 netsamlogon_cache_store(name_user
, &info3
);
1914 wcache_invalidate_samlogon(find_domain_from_name(name_domain
), &info3
);
1916 /* Check if the user is in the right group */
1918 if (!NT_STATUS_IS_OK(result
= check_info3_in_group(state
->mem_ctx
, &info3
,
1919 state
->request
.data
.auth_crap
.require_membership_of_sid
))) {
1920 DEBUG(3, ("User %s is not in the required group (%s), so "
1921 "crap authentication is rejected\n",
1922 state
->request
.data
.auth_crap
.user
,
1923 state
->request
.data
.auth_crap
.require_membership_of_sid
));
1927 if (state
->request
.flags
& WBFLAG_PAM_INFO3_NDR
) {
1928 result
= append_info3_as_ndr(state
->mem_ctx
, state
, &info3
);
1929 } else if (state
->request
.flags
& WBFLAG_PAM_UNIX_NAME
) {
1930 /* ntlm_auth should return the unix username, per
1931 'winbind use default domain' settings and the like */
1933 fstring username_out
;
1934 const char *nt_username
, *nt_domain
;
1935 if (!(nt_username
= unistr2_tdup(state
->mem_ctx
, &(info3
.uni_user_name
)))) {
1936 /* If the server didn't give us one, just use the one we sent them */
1937 nt_username
= name_user
;
1940 if (!(nt_domain
= unistr2_tdup(state
->mem_ctx
, &(info3
.uni_logon_dom
)))) {
1941 /* If the server didn't give us one, just use the one we sent them */
1942 nt_domain
= name_domain
;
1945 fill_domain_username(username_out
, nt_domain
, nt_username
, True
);
1947 DEBUG(5, ("Setting unix username to [%s]\n", username_out
));
1949 SAFE_FREE(state
->response
.extra_data
.data
);
1950 state
->response
.extra_data
.data
= SMB_STRDUP(username_out
);
1951 if (!state
->response
.extra_data
.data
) {
1952 result
= NT_STATUS_NO_MEMORY
;
1955 state
->response
.length
+=
1956 strlen((const char *)state
->response
.extra_data
.data
)+1;
1959 if (state
->request
.flags
& WBFLAG_PAM_USER_SESSION_KEY
) {
1960 memcpy(state
->response
.data
.auth
.user_session_key
, info3
.user_sess_key
,
1961 sizeof(state
->response
.data
.auth
.user_session_key
) /* 16 */);
1963 if (state
->request
.flags
& WBFLAG_PAM_LMKEY
) {
1964 memcpy(state
->response
.data
.auth
.first_8_lm_hash
, info3
.lm_sess_key
,
1965 sizeof(state
->response
.data
.auth
.first_8_lm_hash
) /* 8 */);
1971 /* give us a more useful (more correct?) error code */
1972 if ((NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) ||
1973 (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)))) {
1974 result
= NT_STATUS_NO_LOGON_SERVERS
;
1977 if (state
->request
.flags
& WBFLAG_PAM_NT_STATUS_SQUASH
) {
1978 result
= nt_status_squash(result
);
1981 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
1982 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
1984 /* we might have given a more useful error above */
1985 if (!*state
->response
.data
.auth
.error_string
) {
1986 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
1988 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
1990 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
1991 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1994 state
->response
.data
.auth
.nt_status_string
,
1995 state
->response
.data
.auth
.pam_error
));
1997 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2000 /* Change a user password */
2002 void winbindd_pam_chauthtok(struct winbindd_cli_state
*state
)
2004 fstring domain
, user
;
2005 struct winbindd_domain
*contact_domain
;
2007 DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state
->pid
,
2008 state
->request
.data
.chauthtok
.user
));
2012 ws_name_return( state
->request
.data
.auth
.user
, WB_REPLACE_CHAR
);
2014 if (!canonicalize_username(state
->request
.data
.chauthtok
.user
, domain
, user
)) {
2015 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
2016 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
2018 state
->request
.data
.auth
.user
,
2019 state
->response
.data
.auth
.nt_status_string
,
2020 state
->response
.data
.auth
.pam_error
));
2021 request_error(state
);
2025 contact_domain
= find_domain_from_name(domain
);
2026 if (!contact_domain
) {
2027 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
2028 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
2029 state
->request
.data
.chauthtok
.user
, domain
, user
, domain
));
2030 request_error(state
);
2034 sendto_domain(state
, contact_domain
);
2037 enum winbindd_result
winbindd_dual_pam_chauthtok(struct winbindd_domain
*contact_domain
,
2038 struct winbindd_cli_state
*state
)
2041 char *newpass
= NULL
;
2043 struct rpc_pipe_client
*cli
;
2044 BOOL got_info
= False
;
2045 SAM_UNK_INFO_1 info
;
2046 SAMR_CHANGE_REJECT reject
;
2047 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2048 fstring domain
, user
;
2050 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state
->pid
,
2051 state
->request
.data
.auth
.user
));
2053 if (!parse_domain_user(state
->request
.data
.chauthtok
.user
, domain
, user
)) {
2057 /* Change password */
2059 oldpass
= state
->request
.data
.chauthtok
.oldpass
;
2060 newpass
= state
->request
.data
.chauthtok
.newpass
;
2062 /* Initialize reject reason */
2063 state
->response
.data
.auth
.reject_reason
= Undefined
;
2065 /* Get sam handle */
2067 result
= cm_connect_sam(contact_domain
, state
->mem_ctx
, &cli
,
2069 if (!NT_STATUS_IS_OK(result
)) {
2070 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain
));
2074 result
= rpccli_samr_chgpasswd3(cli
, state
->mem_ctx
, user
, newpass
, oldpass
, &info
, &reject
);
2076 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2078 if (NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_RESTRICTION
) ) {
2079 state
->response
.data
.auth
.policy
.min_length_password
=
2080 info
.min_length_password
;
2081 state
->response
.data
.auth
.policy
.password_history
=
2082 info
.password_history
;
2083 state
->response
.data
.auth
.policy
.password_properties
=
2084 info
.password_properties
;
2085 state
->response
.data
.auth
.policy
.expire
=
2086 nt_time_to_unix_abs(&info
.expire
);
2087 state
->response
.data
.auth
.policy
.min_passwordage
=
2088 nt_time_to_unix_abs(&info
.min_passwordage
);
2090 state
->response
.data
.auth
.reject_reason
=
2091 reject
.reject_reason
;
2096 /* only fallback when the chgpasswd3 call is not supported */
2097 if ((NT_STATUS_EQUAL(result
, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR
))) ||
2098 (NT_STATUS_EQUAL(result
, NT_STATUS_NOT_SUPPORTED
)) ||
2099 (NT_STATUS_EQUAL(result
, NT_STATUS_NOT_IMPLEMENTED
))) {
2101 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
2102 nt_errstr(result
)));
2104 result
= rpccli_samr_chgpasswd_user(cli
, state
->mem_ctx
, user
, newpass
, oldpass
);
2106 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2107 Map to the same status code as Windows 2003. */
2109 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION
, result
) ) {
2110 result
= NT_STATUS_PASSWORD_RESTRICTION
;
2116 if (NT_STATUS_IS_OK(result
) && (state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
)) {
2118 /* Update the single sign-on memory creds. */
2119 result
= winbindd_replace_memory_creds(state
->request
.data
.chauthtok
.user
,
2122 if (!NT_STATUS_IS_OK(result
)) {
2123 DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result
)));
2124 goto process_result
;
2127 if (lp_winbind_offline_logon()) {
2128 result
= winbindd_update_creds_by_name(contact_domain
,
2129 state
->mem_ctx
, user
,
2131 if (!NT_STATUS_IS_OK(result
)) {
2132 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result
)));
2133 goto process_result
;
2138 if (!NT_STATUS_IS_OK(result
) && !got_info
&& contact_domain
) {
2140 NTSTATUS policy_ret
;
2142 policy_ret
= fillup_password_policy(contact_domain
, state
);
2144 /* failure of this is non critical, it will just provide no
2145 * additional information to the client why the change has
2146 * failed - Guenther */
2148 if (!NT_STATUS_IS_OK(policy_ret
)) {
2149 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret
)));
2150 goto process_result
;
2156 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2157 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2158 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
2159 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2161 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
2162 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2165 state
->response
.data
.auth
.nt_status_string
,
2166 state
->response
.data
.auth
.pam_error
));
2168 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2171 void winbindd_pam_logoff(struct winbindd_cli_state
*state
)
2173 struct winbindd_domain
*domain
;
2174 fstring name_domain
, user
;
2175 uid_t caller_uid
= (uid_t
)-1;
2176 uid_t request_uid
= state
->request
.data
.logoff
.uid
;
2178 DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state
->pid
,
2179 state
->request
.data
.logoff
.user
));
2181 /* Ensure null termination */
2182 state
->request
.data
.logoff
.user
2183 [sizeof(state
->request
.data
.logoff
.user
)-1]='\0';
2185 state
->request
.data
.logoff
.krb5ccname
2186 [sizeof(state
->request
.data
.logoff
.krb5ccname
)-1]='\0';
2188 if (request_uid
== (gid_t
)-1) {
2192 if (!canonicalize_username(state
->request
.data
.logoff
.user
, name_domain
, user
)) {
2196 if ((domain
= find_auth_domain(state
, name_domain
)) == NULL
) {
2200 if ((sys_getpeereid(state
->sock
, &caller_uid
)) != 0) {
2201 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2206 switch (caller_uid
) {
2210 /* root must be able to logoff any user - gd */
2211 state
->request
.data
.logoff
.uid
= request_uid
;
2214 if (caller_uid
!= request_uid
) {
2215 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2218 state
->request
.data
.logoff
.uid
= caller_uid
;
2222 sendto_domain(state
, domain
);
2226 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
2227 DEBUG(5, ("Pam Logoff for %s returned %s "
2229 state
->request
.data
.logoff
.user
,
2230 state
->response
.data
.auth
.nt_status_string
,
2231 state
->response
.data
.auth
.pam_error
));
2232 request_error(state
);
2236 enum winbindd_result
winbindd_dual_pam_logoff(struct winbindd_domain
*domain
,
2237 struct winbindd_cli_state
*state
)
2239 NTSTATUS result
= NT_STATUS_NOT_SUPPORTED
;
2241 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state
->pid
,
2242 state
->request
.data
.logoff
.user
));
2244 if (!(state
->request
.flags
& WBFLAG_PAM_KRB5
)) {
2245 result
= NT_STATUS_OK
;
2246 goto process_result
;
2249 if (state
->request
.data
.logoff
.krb5ccname
[0] == '\0') {
2250 result
= NT_STATUS_OK
;
2251 goto process_result
;
2256 if (state
->request
.data
.logoff
.uid
< 0) {
2257 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2258 goto process_result
;
2261 /* what we need here is to find the corresponding krb5 ccache name *we*
2262 * created for a given username and destroy it */
2264 if (!ccache_entry_exists(state
->request
.data
.logoff
.user
)) {
2265 result
= NT_STATUS_OK
;
2266 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2267 goto process_result
;
2270 if (!ccache_entry_identical(state
->request
.data
.logoff
.user
,
2271 state
->request
.data
.logoff
.uid
,
2272 state
->request
.data
.logoff
.krb5ccname
)) {
2273 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2274 goto process_result
;
2277 result
= remove_ccache(state
->request
.data
.logoff
.user
);
2278 if (!NT_STATUS_IS_OK(result
)) {
2279 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2280 nt_errstr(result
)));
2281 goto process_result
;
2285 result
= NT_STATUS_NOT_SUPPORTED
;
2290 winbindd_delete_memory_creds(state
->request
.data
.logoff
.user
);
2292 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2293 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2294 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
2295 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2297 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2300 /* Change user password with auth crap*/
2302 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state
*state
)
2304 struct winbindd_domain
*domain
= NULL
;
2305 const char *domain_name
= NULL
;
2307 /* Ensure null termination */
2308 state
->request
.data
.chng_pswd_auth_crap
.user
[
2309 sizeof(state
->request
.data
.chng_pswd_auth_crap
.user
)-1]=0;
2310 state
->request
.data
.chng_pswd_auth_crap
.domain
[
2311 sizeof(state
->request
.data
.chng_pswd_auth_crap
.domain
)-1]=0;
2313 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2314 (unsigned long)state
->pid
,
2315 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2316 state
->request
.data
.chng_pswd_auth_crap
.user
));
2318 if (*state
->request
.data
.chng_pswd_auth_crap
.domain
!= '\0') {
2319 domain_name
= state
->request
.data
.chng_pswd_auth_crap
.domain
;
2320 } else if (lp_winbind_use_default_domain()) {
2321 domain_name
= lp_workgroup();
2324 if (domain_name
!= NULL
)
2325 domain
= find_domain_from_name(domain_name
);
2327 if (domain
!= NULL
) {
2328 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2329 "%s\n", (unsigned long)state
->pid
,domain
->name
));
2330 sendto_domain(state
, domain
);
2334 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
2335 DEBUG(5, ("CRAP change password for %s\\%s returned %s (PAM: %d)\n",
2336 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2337 state
->request
.data
.chng_pswd_auth_crap
.user
,
2338 state
->response
.data
.auth
.nt_status_string
,
2339 state
->response
.data
.auth
.pam_error
));
2340 request_error(state
);
2344 enum winbindd_result
winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain
*domainSt
, struct winbindd_cli_state
*state
)
2347 DATA_BLOB new_nt_password
;
2348 DATA_BLOB old_nt_hash_enc
;
2349 DATA_BLOB new_lm_password
;
2350 DATA_BLOB old_lm_hash_enc
;
2351 fstring domain
,user
;
2353 struct winbindd_domain
*contact_domain
= domainSt
;
2354 struct rpc_pipe_client
*cli
;
2356 /* Ensure null termination */
2357 state
->request
.data
.chng_pswd_auth_crap
.user
[
2358 sizeof(state
->request
.data
.chng_pswd_auth_crap
.user
)-1]=0;
2359 state
->request
.data
.chng_pswd_auth_crap
.domain
[
2360 sizeof(state
->request
.data
.chng_pswd_auth_crap
.domain
)-1]=0;
2364 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2365 (unsigned long)state
->pid
,
2366 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2367 state
->request
.data
.chng_pswd_auth_crap
.user
));
2369 if (lp_winbind_offline_logon()) {
2370 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2371 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2372 result
= NT_STATUS_ACCESS_DENIED
;
2376 if (*state
->request
.data
.chng_pswd_auth_crap
.domain
) {
2377 fstrcpy(domain
,state
->request
.data
.chng_pswd_auth_crap
.domain
);
2379 parse_domain_user(state
->request
.data
.chng_pswd_auth_crap
.user
,
2383 DEBUG(3,("no domain specified with username (%s) - "
2385 state
->request
.data
.chng_pswd_auth_crap
.user
));
2386 result
= NT_STATUS_NO_SUCH_USER
;
2391 if (!*domain
&& lp_winbind_use_default_domain()) {
2392 fstrcpy(domain
,(char *)lp_workgroup());
2396 fstrcpy(user
, state
->request
.data
.chng_pswd_auth_crap
.user
);
2399 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2400 (unsigned long)state
->pid
, domain
, user
));
2402 /* Change password */
2403 new_nt_password
= data_blob_talloc(
2405 state
->request
.data
.chng_pswd_auth_crap
.new_nt_pswd
,
2406 state
->request
.data
.chng_pswd_auth_crap
.new_nt_pswd_len
);
2408 old_nt_hash_enc
= data_blob_talloc(
2410 state
->request
.data
.chng_pswd_auth_crap
.old_nt_hash_enc
,
2411 state
->request
.data
.chng_pswd_auth_crap
.old_nt_hash_enc_len
);
2413 if(state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd_len
> 0) {
2414 new_lm_password
= data_blob_talloc(
2416 state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd
,
2417 state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd_len
);
2419 old_lm_hash_enc
= data_blob_talloc(
2421 state
->request
.data
.chng_pswd_auth_crap
.old_lm_hash_enc
,
2422 state
->request
.data
.chng_pswd_auth_crap
.old_lm_hash_enc_len
);
2424 new_lm_password
.length
= 0;
2425 old_lm_hash_enc
.length
= 0;
2428 /* Get sam handle */
2430 result
= cm_connect_sam(contact_domain
, state
->mem_ctx
, &cli
, &dom_pol
);
2431 if (!NT_STATUS_IS_OK(result
)) {
2432 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain
));
2436 result
= rpccli_samr_chng_pswd_auth_crap(
2437 cli
, state
->mem_ctx
, user
, new_nt_password
, old_nt_hash_enc
,
2438 new_lm_password
, old_lm_hash_enc
);
2441 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2442 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2443 fstrcpy(state
->response
.data
.auth
.error_string
,
2444 get_friendly_nt_error_msg(result
));
2445 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2447 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
2448 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2450 state
->response
.data
.auth
.nt_status_string
,
2451 state
->response
.data
.auth
.pam_error
));
2453 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;