?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4-upgradeprovision: split update_present in two functions depending on the method...
[Samba/bb.git] / nsswitch / libwbclient / wbc_pam.c
blob585dfcfaf6ed369f8e5f5660f20e4ebbeee1396b
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind client API
5
6 Copyright (C) Gerald (Jerry) Carter 2007
7 Copyright (C) Guenther Deschner 2008
8 Copyright (C) Volker Lendecke 2009
9
10 This library is free software; you can redistribute it and/or
11 modify it under the terms of the GNU Lesser General Public
12 License as published by the Free Software Foundation; either
13 version 3 of the License, or (at your option) any later version.
14
15 This library is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Library General Public License for more details.
19
20 You should have received a copy of the GNU Lesser General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /* Required Headers */
25
26 #include "replace.h"
27 #include "libwbclient.h"
28 #include "../winbind_client.h"
29
30 /* Authenticate a username/password pair */
31 wbcErr wbcAuthenticateUser(const char *username,
32 const char *password)
33 {
34 wbcErr wbc_status = WBC_ERR_SUCCESS;
35 struct wbcAuthUserParams params;
36
37 ZERO_STRUCT(params);
38
39 params.account_name = username;
40 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
41 params.password.plaintext = password;
42
43 wbc_status = wbcAuthenticateUserEx(&params, NULL, NULL);
44 BAIL_ON_WBC_ERROR(wbc_status);
45
46 done:
47 return wbc_status;
48 }
49
50 static bool sid_attr_compose(struct wbcSidWithAttr *s,
51 const struct wbcDomainSid *d,
52 uint32_t rid, uint32_t attr)
53 {
54 if (d->num_auths >= WBC_MAXSUBAUTHS) {
55 return false;
56 }
57 s->sid = *d;
58 s->sid.sub_auths[s->sid.num_auths++] = rid;
59 s->attributes = attr;
60 return true;
61 }
62
63 static void wbcAuthUserInfoDestructor(void *ptr)
64 {
65 struct wbcAuthUserInfo *i = (struct wbcAuthUserInfo *)ptr;
66 free(i->account_name);
67 free(i->user_principal);
68 free(i->full_name);
69 free(i->domain_name);
70 free(i->dns_domain_name);
71 free(i->logon_server);
72 free(i->logon_script);
73 free(i->profile_path);
74 free(i->home_directory);
75 free(i->home_drive);
76 free(i->sids);
77 }
78
79 static wbcErr wbc_create_auth_info(const struct winbindd_response *resp,
80 struct wbcAuthUserInfo **_i)
81 {
82 wbcErr wbc_status = WBC_ERR_SUCCESS;
83 struct wbcAuthUserInfo *i;
84 struct wbcDomainSid domain_sid;
85 char *p;
86 uint32_t sn = 0;
87 uint32_t j;
88
89 i = (struct wbcAuthUserInfo *)wbcAllocateMemory(
90 1, sizeof(struct wbcAuthUserInfo),
91 wbcAuthUserInfoDestructor);
92 BAIL_ON_PTR_ERROR(i, wbc_status);
93
94 i->user_flags = resp->data.auth.info3.user_flgs;
95
96 i->account_name = strdup(resp->data.auth.info3.user_name);
97 BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
98 i->user_principal= NULL;
99 i->full_name = strdup(resp->data.auth.info3.full_name);
100 BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
101 i->domain_name = strdup(resp->data.auth.info3.logon_dom);
102 BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
103 i->dns_domain_name= NULL;
104
105 i->acct_flags = resp->data.auth.info3.acct_flags;
106 memcpy(i->user_session_key,
107 resp->data.auth.user_session_key,
108 sizeof(i->user_session_key));
109 memcpy(i->lm_session_key,
110 resp->data.auth.first_8_lm_hash,
111 sizeof(i->lm_session_key));
112
113 i->logon_count = resp->data.auth.info3.logon_count;
114 i->bad_password_count = resp->data.auth.info3.bad_pw_count;
115
116 i->logon_time = resp->data.auth.info3.logon_time;
117 i->logoff_time = resp->data.auth.info3.logoff_time;
118 i->kickoff_time = resp->data.auth.info3.kickoff_time;
119 i->pass_last_set_time = resp->data.auth.info3.pass_last_set_time;
120 i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
121 i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
122
123 i->logon_server = strdup(resp->data.auth.info3.logon_srv);
124 BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
125 i->logon_script = strdup(resp->data.auth.info3.logon_script);
126 BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
127 i->profile_path = strdup(resp->data.auth.info3.profile_path);
128 BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
129 i->home_directory= strdup(resp->data.auth.info3.home_dir);
130 BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
131 i->home_drive = strdup(resp->data.auth.info3.dir_drive);
132 BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
133
134 i->num_sids = 2;
135 i->num_sids += resp->data.auth.info3.num_groups;
136 i->num_sids += resp->data.auth.info3.num_other_sids;
137
138 i->sids = (struct wbcSidWithAttr *)calloc(
139 sizeof(struct wbcSidWithAttr), i->num_sids);
140 BAIL_ON_PTR_ERROR(i->sids, wbc_status);
141
142 wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
143 &domain_sid);
144 BAIL_ON_WBC_ERROR(wbc_status);
145
146 sn = 0;
147 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
148 resp->data.auth.info3.user_rid, 0)) {
149 wbc_status = WBC_ERR_INVALID_SID;
150 goto done;
151 }
152 sn++;
153 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
154 resp->data.auth.info3.group_rid, 0)) {
155 wbc_status = WBC_ERR_INVALID_SID;
156 goto done;
157 }
158 sn++;
159
160 p = (char *)resp->extra_data.data;
161 if (!p) {
162 wbc_status = WBC_ERR_INVALID_RESPONSE;
163 BAIL_ON_WBC_ERROR(wbc_status);
164 }
165
166 for (j=0; j < resp->data.auth.info3.num_groups; j++) {
167 uint32_t rid;
168 uint32_t attrs;
169 int ret;
170 char *s = p;
171 char *e = strchr(p, '\n');
172 if (!e) {
173 wbc_status = WBC_ERR_INVALID_RESPONSE;
174 BAIL_ON_WBC_ERROR(wbc_status);
175 }
176 e[0] = '\0';
177 p = &e[1];
178
179 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
180 if (ret != 2) {
181 wbc_status = WBC_ERR_INVALID_RESPONSE;
182 BAIL_ON_WBC_ERROR(wbc_status);
183 }
184
185 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
186 rid, attrs)) {
187 wbc_status = WBC_ERR_INVALID_SID;
188 goto done;
189 }
190 sn++;
191 }
192
193 for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
194 uint32_t attrs;
195 int ret;
196 char *s = p;
197 char *a;
198 char *e = strchr(p, '\n');
199 if (!e) {
200 wbc_status = WBC_ERR_INVALID_RESPONSE;
201 BAIL_ON_WBC_ERROR(wbc_status);
202 }
203 e[0] = '\0';
204 p = &e[1];
205
206 e = strchr(s, ':');
207 if (!e) {
208 wbc_status = WBC_ERR_INVALID_RESPONSE;
209 BAIL_ON_WBC_ERROR(wbc_status);
210 }
211 e[0] = '\0';
212 a = &e[1];
213
214 ret = sscanf(a, "0x%08X",
215 &attrs);
216 if (ret != 1) {
217 wbc_status = WBC_ERR_INVALID_RESPONSE;
218 BAIL_ON_WBC_ERROR(wbc_status);
219 }
220
221 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
222 BAIL_ON_WBC_ERROR(wbc_status);
223
224 i->sids[sn].attributes = attrs;
225 sn++;
226 }
227
228 i->num_sids = sn;
229
230 *_i = i;
231 i = NULL;
232 done:
233 wbcFreeMemory(i);
234 return wbc_status;
235 }
236
237 static void wbcAuthErrorInfoDestructor(void *ptr)
238 {
239 struct wbcAuthErrorInfo *e = (struct wbcAuthErrorInfo *)ptr;
240 free(e->nt_string);
241 free(e->display_string);
242 }
243
244 static wbcErr wbc_create_error_info(const struct winbindd_response *resp,
245 struct wbcAuthErrorInfo **_e)
246 {
247 wbcErr wbc_status = WBC_ERR_SUCCESS;
248 struct wbcAuthErrorInfo *e;
249
250 e = (struct wbcAuthErrorInfo *)wbcAllocateMemory(
251 1, sizeof(struct wbcAuthErrorInfo),
252 wbcAuthErrorInfoDestructor);
253 BAIL_ON_PTR_ERROR(e, wbc_status);
254
255 e->nt_status = resp->data.auth.nt_status;
256 e->pam_error = resp->data.auth.pam_error;
257 e->nt_string = strdup(resp->data.auth.nt_status_string);
258 BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
259
260 e->display_string = strdup(resp->data.auth.error_string);
261 BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
262
263 *_e = e;
264 e = NULL;
265
266 done:
267 wbcFreeMemory(e);
268 return wbc_status;
269 }
270
271 static wbcErr wbc_create_password_policy_info(const struct winbindd_response *resp,
272 struct wbcUserPasswordPolicyInfo **_i)
273 {
274 wbcErr wbc_status = WBC_ERR_SUCCESS;
275 struct wbcUserPasswordPolicyInfo *i;
276
277 i = (struct wbcUserPasswordPolicyInfo *)wbcAllocateMemory(
278 1, sizeof(struct wbcUserPasswordPolicyInfo), NULL);
279 BAIL_ON_PTR_ERROR(i, wbc_status);
280
281 i->min_passwordage = resp->data.auth.policy.min_passwordage;
282 i->min_length_password = resp->data.auth.policy.min_length_password;
283 i->password_history = resp->data.auth.policy.password_history;
284 i->password_properties = resp->data.auth.policy.password_properties;
285 i->expire = resp->data.auth.policy.expire;
286
287 *_i = i;
288 i = NULL;
289
290 done:
291 wbcFreeMemory(i);
292 return wbc_status;
293 }
294
295 static void wbcLogonUserInfoDestructor(void *ptr)
296 {
297 struct wbcLogonUserInfo *i = (struct wbcLogonUserInfo *)ptr;
298 wbcFreeMemory(i->info);
299 wbcFreeMemory(i->blobs);
300 }
301
302 static wbcErr wbc_create_logon_info(struct winbindd_response *resp,
303 struct wbcLogonUserInfo **_i)
304 {
305 wbcErr wbc_status = WBC_ERR_SUCCESS;
306 struct wbcLogonUserInfo *i;
307
308 i = (struct wbcLogonUserInfo *)wbcAllocateMemory(
309 1, sizeof(struct wbcLogonUserInfo),
310 wbcLogonUserInfoDestructor);
311 BAIL_ON_PTR_ERROR(i, wbc_status);
312
313 wbc_status = wbc_create_auth_info(resp, &i->info);
314 BAIL_ON_WBC_ERROR(wbc_status);
315
316 if (resp->data.auth.krb5ccname[0] != '\0') {
317 wbc_status = wbcAddNamedBlob(&i->num_blobs,
318 &i->blobs,
319 "krb5ccname",
320 0,
321 (uint8_t *)resp->data.auth.krb5ccname,
322 strlen(resp->data.auth.krb5ccname)+1);
323 BAIL_ON_WBC_ERROR(wbc_status);
324 }
325
326 if (resp->data.auth.unix_username[0] != '\0') {
327 wbc_status = wbcAddNamedBlob(&i->num_blobs,
328 &i->blobs,
329 "unix_username",
330 0,
331 (uint8_t *)resp->data.auth.unix_username,
332 strlen(resp->data.auth.unix_username)+1);
333 BAIL_ON_WBC_ERROR(wbc_status);
334 }
335
336 *_i = i;
337 i = NULL;
338 done:
339 wbcFreeMemory(i);
340 return wbc_status;
341 }
342
343
344 /* Authenticate with more detailed information */
345 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
346 struct wbcAuthUserInfo **info,
347 struct wbcAuthErrorInfo **error)
348 {
349 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
350 int cmd = 0;
351 struct winbindd_request request;
352 struct winbindd_response response;
353
354 ZERO_STRUCT(request);
355 ZERO_STRUCT(response);
356
357 if (error) {
358 *error = NULL;
359 }
360
361 if (!params) {
362 wbc_status = WBC_ERR_INVALID_PARAM;
363 BAIL_ON_WBC_ERROR(wbc_status);
364 }
365
366 if (!params->account_name) {
367 wbc_status = WBC_ERR_INVALID_PARAM;
368 BAIL_ON_WBC_ERROR(wbc_status);
369 }
370
371 /* Initialize request */
372
373 switch (params->level) {
374 case WBC_AUTH_USER_LEVEL_PLAIN:
375 cmd = WINBINDD_PAM_AUTH;
376 request.flags = WBFLAG_PAM_INFO3_TEXT |
377 WBFLAG_PAM_USER_SESSION_KEY |
378 WBFLAG_PAM_LMKEY;
379
380 if (!params->password.plaintext) {
381 wbc_status = WBC_ERR_INVALID_PARAM;
382 BAIL_ON_WBC_ERROR(wbc_status);
383 }
384
385 if (params->domain_name && params->domain_name[0]) {
386 /* We need to get the winbind separator :-( */
387 struct winbindd_response sep_response;
388
389 ZERO_STRUCT(sep_response);
390
391 wbc_status = wbcRequestResponse(WINBINDD_INFO,
392 NULL, &sep_response);
393 BAIL_ON_WBC_ERROR(wbc_status);
394
395 snprintf(request.data.auth.user,
396 sizeof(request.data.auth.user)-1,
397 "%s%c%s",
398 params->domain_name,
399 sep_response.data.info.winbind_separator,
400 params->account_name);
401 } else {
402 strncpy(request.data.auth.user,
403 params->account_name,
404 sizeof(request.data.auth.user)-1);
405 }
406
407 strncpy(request.data.auth.pass,
408 params->password.plaintext,
409 sizeof(request.data.auth.pass)-1);
410 break;
411
412 case WBC_AUTH_USER_LEVEL_HASH:
413 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
414 BAIL_ON_WBC_ERROR(wbc_status);
415 break;
416
417 case WBC_AUTH_USER_LEVEL_RESPONSE:
418 cmd = WINBINDD_PAM_AUTH_CRAP;
419 request.flags = WBFLAG_PAM_INFO3_TEXT |
420 WBFLAG_PAM_USER_SESSION_KEY |
421 WBFLAG_PAM_LMKEY;
422
423 if (params->password.response.lm_length &&
424 !params->password.response.lm_data) {
425 wbc_status = WBC_ERR_INVALID_PARAM;
426 BAIL_ON_WBC_ERROR(wbc_status);
427 }
428 if (params->password.response.lm_length == 0 &&
429 params->password.response.lm_data) {
430 wbc_status = WBC_ERR_INVALID_PARAM;
431 BAIL_ON_WBC_ERROR(wbc_status);
432 }
433
434 if (params->password.response.nt_length &&
435 !params->password.response.nt_data) {
436 wbc_status = WBC_ERR_INVALID_PARAM;
437 BAIL_ON_WBC_ERROR(wbc_status);
438 }
439 if (params->password.response.nt_length == 0&&
440 params->password.response.nt_data) {
441 wbc_status = WBC_ERR_INVALID_PARAM;
442 BAIL_ON_WBC_ERROR(wbc_status);
443 }
444
445 strncpy(request.data.auth_crap.user,
446 params->account_name,
447 sizeof(request.data.auth_crap.user)-1);
448 if (params->domain_name) {
449 strncpy(request.data.auth_crap.domain,
450 params->domain_name,
451 sizeof(request.data.auth_crap.domain)-1);
452 }
453 if (params->workstation_name) {
454 strncpy(request.data.auth_crap.workstation,
455 params->workstation_name,
456 sizeof(request.data.auth_crap.workstation)-1);
457 }
458
459 request.data.auth_crap.logon_parameters =
460 params->parameter_control;
461
462 memcpy(request.data.auth_crap.chal,
463 params->password.response.challenge,
464 sizeof(request.data.auth_crap.chal));
465
466 request.data.auth_crap.lm_resp_len =
467 MIN(params->password.response.lm_length,
468 sizeof(request.data.auth_crap.lm_resp));
469 if (params->password.response.lm_data) {
470 memcpy(request.data.auth_crap.lm_resp,
471 params->password.response.lm_data,
472 request.data.auth_crap.lm_resp_len);
473 }
474 request.data.auth_crap.nt_resp_len = params->password.response.nt_length;
475 if (params->password.response.nt_length > sizeof(request.data.auth_crap.nt_resp)) {
476 request.flags |= WBFLAG_BIG_NTLMV2_BLOB;
477 request.extra_len = params->password.response.nt_length;
478 request.extra_data.data = (char *)malloc(
479 request.extra_len);
480 if (request.extra_data.data == NULL) {
481 wbc_status = WBC_ERR_NO_MEMORY;
482 BAIL_ON_WBC_ERROR(wbc_status);
483 }
484 memcpy(request.extra_data.data,
485 params->password.response.nt_data,
486 request.data.auth_crap.nt_resp_len);
487 } else if (params->password.response.nt_data) {
488 memcpy(request.data.auth_crap.nt_resp,
489 params->password.response.nt_data,
490 request.data.auth_crap.nt_resp_len);
491 }
492 break;
493 default:
494 break;
495 }
496
497 if (cmd == 0) {
498 wbc_status = WBC_ERR_INVALID_PARAM;
499 BAIL_ON_WBC_ERROR(wbc_status);
500 }
501
502 if (params->flags) {
503 request.flags |= params->flags;
504 }
505
506 if (cmd == WINBINDD_PAM_AUTH_CRAP) {
507 wbc_status = wbcRequestResponsePriv(cmd, &request, &response);
508 } else {
509 wbc_status = wbcRequestResponse(cmd, &request, &response);
510 }
511 if (response.data.auth.nt_status != 0) {
512 if (error) {
513 wbc_status = wbc_create_error_info(&response,
514 error);
515 BAIL_ON_WBC_ERROR(wbc_status);
516 }
517
518 wbc_status = WBC_ERR_AUTH_ERROR;
519 BAIL_ON_WBC_ERROR(wbc_status);
520 }
521 BAIL_ON_WBC_ERROR(wbc_status);
522
523 if (info) {
524 wbc_status = wbc_create_auth_info(&response, info);
525 BAIL_ON_WBC_ERROR(wbc_status);
526 }
527
528 done:
529 winbindd_free_response(&response);
530
531 free(request.extra_data.data);
532
533 return wbc_status;
534 }
535
536 /* Trigger a verification of the trust credentials of a specific domain */
537 wbcErr wbcCheckTrustCredentials(const char *domain,
538 struct wbcAuthErrorInfo **error)
539 {
540 struct winbindd_request request;
541 struct winbindd_response response;
542 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
543
544 ZERO_STRUCT(request);
545 ZERO_STRUCT(response);
546
547 if (domain) {
548 strncpy(request.domain_name, domain,
549 sizeof(request.domain_name)-1);
550 }
551
552 /* Send request */
553
554 wbc_status = wbcRequestResponsePriv(WINBINDD_CHECK_MACHACC,
555 &request, &response);
556 if (response.data.auth.nt_status != 0) {
557 if (error) {
558 wbc_status = wbc_create_error_info(&response,
559 error);
560 BAIL_ON_WBC_ERROR(wbc_status);
561 }
562
563 wbc_status = WBC_ERR_AUTH_ERROR;
564 BAIL_ON_WBC_ERROR(wbc_status);
565 }
566 BAIL_ON_WBC_ERROR(wbc_status);
567
568 done:
569 return wbc_status;
570 }
571
572 /* Trigger a change of the trust credentials for a specific domain */
573 wbcErr wbcChangeTrustCredentials(const char *domain,
574 struct wbcAuthErrorInfo **error)
575 {
576 struct winbindd_request request;
577 struct winbindd_response response;
578 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
579
580 ZERO_STRUCT(request);
581 ZERO_STRUCT(response);
582
583 if (domain) {
584 strncpy(request.domain_name, domain,
585 sizeof(request.domain_name)-1);
586 }
587
588 /* Send request */
589
590 wbc_status = wbcRequestResponsePriv(WINBINDD_CHANGE_MACHACC,
591 &request, &response);
592 if (response.data.auth.nt_status != 0) {
593 if (error) {
594 wbc_status = wbc_create_error_info(&response,
595 error);
596 BAIL_ON_WBC_ERROR(wbc_status);
597 }
598
599 wbc_status = WBC_ERR_AUTH_ERROR;
600 BAIL_ON_WBC_ERROR(wbc_status);
601 }
602 BAIL_ON_WBC_ERROR(wbc_status);
603
604 done:
605 return wbc_status;
606 }
607
608 /*
609 * Trigger a no-op NETLOGON call. Lightweight version of
610 * wbcCheckTrustCredentials
611 */
612 wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
613 {
614 struct winbindd_request request;
615 struct winbindd_response response;
616 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
617
618 if (domain) {
619 /*
620 * the current protocol doesn't support
621 * specifying a domain
622 */
623 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
624 BAIL_ON_WBC_ERROR(wbc_status);
625 }
626
627 ZERO_STRUCT(request);
628 ZERO_STRUCT(response);
629
630 /* Send request */
631
632 wbc_status = wbcRequestResponse(WINBINDD_PING_DC,
633 &request,
634 &response);
635 if (response.data.auth.nt_status != 0) {
636 if (error) {
637 wbc_status = wbc_create_error_info(&response,
638 error);
639 BAIL_ON_WBC_ERROR(wbc_status);
640 }
641
642 wbc_status = WBC_ERR_AUTH_ERROR;
643 BAIL_ON_WBC_ERROR(wbc_status);
644 }
645 BAIL_ON_WBC_ERROR(wbc_status);
646
647 done:
648 return wbc_status;
649 }
650
651 /* Trigger an extended logoff notification to Winbind for a specific user */
652 wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
653 struct wbcAuthErrorInfo **error)
654 {
655 struct winbindd_request request;
656 struct winbindd_response response;
657 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
658 int i;
659
660 /* validate input */
661
662 if (!params || !params->username) {
663 wbc_status = WBC_ERR_INVALID_PARAM;
664 BAIL_ON_WBC_ERROR(wbc_status);
665 }
666
667 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
668 wbc_status = WBC_ERR_INVALID_PARAM;
669 BAIL_ON_WBC_ERROR(wbc_status);
670 }
671 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
672 wbc_status = WBC_ERR_INVALID_PARAM;
673 BAIL_ON_WBC_ERROR(wbc_status);
674 }
675
676 ZERO_STRUCT(request);
677 ZERO_STRUCT(response);
678
679 strncpy(request.data.logoff.user, params->username,
680 sizeof(request.data.logoff.user)-1);
681
682 for (i=0; i<params->num_blobs; i++) {
683
684 if (strcasecmp(params->blobs[i].name, "ccfilename") == 0) {
685 if (params->blobs[i].blob.data) {
686 strncpy(request.data.logoff.krb5ccname,
687 (const char *)params->blobs[i].blob.data,
688 sizeof(request.data.logoff.krb5ccname) - 1);
689 }
690 continue;
691 }
692
693 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
694 if (params->blobs[i].blob.data) {
695 memcpy(&request.data.logoff.uid,
696 params->blobs[i].blob.data,
697 MIN(params->blobs[i].blob.length,
698 sizeof(request.data.logoff.uid)));
699 }
700 continue;
701 }
702
703 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
704 if (params->blobs[i].blob.data) {
705 memcpy(&request.flags,
706 params->blobs[i].blob.data,
707 MIN(params->blobs[i].blob.length,
708 sizeof(request.flags)));
709 }
710 continue;
711 }
712 }
713
714 /* Send request */
715
716 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
717 &request,
718 &response);
719
720 /* Take the response above and return it to the caller */
721 if (response.data.auth.nt_status != 0) {
722 if (error) {
723 wbc_status = wbc_create_error_info(&response,
724 error);
725 BAIL_ON_WBC_ERROR(wbc_status);
726 }
727
728 wbc_status = WBC_ERR_AUTH_ERROR;
729 BAIL_ON_WBC_ERROR(wbc_status);
730 }
731 BAIL_ON_WBC_ERROR(wbc_status);
732
733 done:
734 return wbc_status;
735 }
736
737 /* Trigger a logoff notification to Winbind for a specific user */
738 wbcErr wbcLogoffUser(const char *username,
739 uid_t uid,
740 const char *ccfilename)
741 {
742 struct winbindd_request request;
743 struct winbindd_response response;
744 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
745
746 /* validate input */
747
748 if (!username) {
749 wbc_status = WBC_ERR_INVALID_PARAM;
750 BAIL_ON_WBC_ERROR(wbc_status);
751 }
752
753 ZERO_STRUCT(request);
754 ZERO_STRUCT(response);
755
756 strncpy(request.data.logoff.user, username,
757 sizeof(request.data.logoff.user)-1);
758 request.data.logoff.uid = uid;
759
760 if (ccfilename) {
761 strncpy(request.data.logoff.krb5ccname, ccfilename,
762 sizeof(request.data.logoff.krb5ccname)-1);
763 }
764
765 /* Send request */
766
767 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
768 &request,
769 &response);
770
771 /* Take the response above and return it to the caller */
772
773 done:
774 return wbc_status;
775 }
776
777 /* Change a password for a user with more detailed information upon failure */
778 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
779 struct wbcAuthErrorInfo **error,
780 enum wbcPasswordChangeRejectReason *reject_reason,
781 struct wbcUserPasswordPolicyInfo **policy)
782 {
783 struct winbindd_request request;
784 struct winbindd_response response;
785 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
786 int cmd = 0;
787
788 /* validate input */
789
790 if (!params->account_name) {
791 wbc_status = WBC_ERR_INVALID_PARAM;
792 goto done;
793 }
794
795 if (error) {
796 *error = NULL;
797 }
798
799 if (policy) {
800 *policy = NULL;
801 }
802
803 if (reject_reason) {
804 *reject_reason = -1;
805 }
806
807 ZERO_STRUCT(request);
808 ZERO_STRUCT(response);
809
810 switch (params->level) {
811 case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
812 cmd = WINBINDD_PAM_CHAUTHTOK;
813
814 if (!params->account_name) {
815 wbc_status = WBC_ERR_INVALID_PARAM;
816 goto done;
817 }
818
819 strncpy(request.data.chauthtok.user, params->account_name,
820 sizeof(request.data.chauthtok.user) - 1);
821
822 if (params->old_password.plaintext) {
823 strncpy(request.data.chauthtok.oldpass,
824 params->old_password.plaintext,
825 sizeof(request.data.chauthtok.oldpass) - 1);
826 }
827
828 if (params->new_password.plaintext) {
829 strncpy(request.data.chauthtok.newpass,
830 params->new_password.plaintext,
831 sizeof(request.data.chauthtok.newpass) - 1);
832 }
833 break;
834
835 case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
836 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
837
838 if (!params->account_name || !params->domain_name) {
839 wbc_status = WBC_ERR_INVALID_PARAM;
840 goto done;
841 }
842
843 if (params->old_password.response.old_lm_hash_enc_length &&
844 !params->old_password.response.old_lm_hash_enc_data) {
845 wbc_status = WBC_ERR_INVALID_PARAM;
846 goto done;
847 }
848
849 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
850 params->old_password.response.old_lm_hash_enc_data) {
851 wbc_status = WBC_ERR_INVALID_PARAM;
852 goto done;
853 }
854
855 if (params->old_password.response.old_nt_hash_enc_length &&
856 !params->old_password.response.old_nt_hash_enc_data) {
857 wbc_status = WBC_ERR_INVALID_PARAM;
858 goto done;
859 }
860
861 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
862 params->old_password.response.old_nt_hash_enc_data) {
863 wbc_status = WBC_ERR_INVALID_PARAM;
864 goto done;
865 }
866
867 if (params->new_password.response.lm_length &&
868 !params->new_password.response.lm_data) {
869 wbc_status = WBC_ERR_INVALID_PARAM;
870 goto done;
871 }
872
873 if (params->new_password.response.lm_length == 0 &&
874 params->new_password.response.lm_data) {
875 wbc_status = WBC_ERR_INVALID_PARAM;
876 goto done;
877 }
878
879 if (params->new_password.response.nt_length &&
880 !params->new_password.response.nt_data) {
881 wbc_status = WBC_ERR_INVALID_PARAM;
882 goto done;
883 }
884
885 if (params->new_password.response.nt_length == 0 &&
886 params->new_password.response.nt_data) {
887 wbc_status = WBC_ERR_INVALID_PARAM;
888 goto done;
889 }
890
891 strncpy(request.data.chng_pswd_auth_crap.user,
892 params->account_name,
893 sizeof(request.data.chng_pswd_auth_crap.user) - 1);
894
895 strncpy(request.data.chng_pswd_auth_crap.domain,
896 params->domain_name,
897 sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
898
899 if (params->new_password.response.nt_data) {
900 request.data.chng_pswd_auth_crap.new_nt_pswd_len =
901 params->new_password.response.nt_length;
902 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
903 params->new_password.response.nt_data,
904 request.data.chng_pswd_auth_crap.new_nt_pswd_len);
905 }
906
907 if (params->new_password.response.lm_data) {
908 request.data.chng_pswd_auth_crap.new_lm_pswd_len =
909 params->new_password.response.lm_length;
910 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
911 params->new_password.response.lm_data,
912 request.data.chng_pswd_auth_crap.new_lm_pswd_len);
913 }
914
915 if (params->old_password.response.old_nt_hash_enc_data) {
916 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
917 params->old_password.response.old_nt_hash_enc_length;
918 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
919 params->old_password.response.old_nt_hash_enc_data,
920 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
921 }
922
923 if (params->old_password.response.old_lm_hash_enc_data) {
924 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
925 params->old_password.response.old_lm_hash_enc_length;
926 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
927 params->old_password.response.old_lm_hash_enc_data,
928 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
929 }
930
931 break;
932 default:
933 wbc_status = WBC_ERR_INVALID_PARAM;
934 goto done;
935 break;
936 }
937
938 /* Send request */
939
940 wbc_status = wbcRequestResponse(cmd,
941 &request,
942 &response);
943 if (WBC_ERROR_IS_OK(wbc_status)) {
944 goto done;
945 }
946
947 /* Take the response above and return it to the caller */
948
949 if (response.data.auth.nt_status != 0) {
950 if (error) {
951 wbc_status = wbc_create_error_info(&response,
952 error);
953 BAIL_ON_WBC_ERROR(wbc_status);
954 }
955
956 }
957
958 if (policy) {
959 wbc_status = wbc_create_password_policy_info(&response,
960 policy);
961 BAIL_ON_WBC_ERROR(wbc_status);
962 }
963
964 if (reject_reason) {
965 *reject_reason = response.data.auth.reject_reason;
966 }
967
968 wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
969 BAIL_ON_WBC_ERROR(wbc_status);
970
971 done:
972 return wbc_status;
973 }
974
975 /* Change a password for a user */
976 wbcErr wbcChangeUserPassword(const char *username,
977 const char *old_password,
978 const char *new_password)
979 {
980 wbcErr wbc_status = WBC_ERR_SUCCESS;
981 struct wbcChangePasswordParams params;
982
983 ZERO_STRUCT(params);
984
985 params.account_name = username;
986 params.level = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
987 params.old_password.plaintext = old_password;
988 params.new_password.plaintext = new_password;
989
990 wbc_status = wbcChangeUserPasswordEx(&params,
991 NULL,
992 NULL,
993 NULL);
994 BAIL_ON_WBC_ERROR(wbc_status);
995
996 done:
997 return wbc_status;
998 }
999
1000 /* Logon a User */
1001 wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
1002 struct wbcLogonUserInfo **info,
1003 struct wbcAuthErrorInfo **error,
1004 struct wbcUserPasswordPolicyInfo **policy)
1005 {
1006 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1007 struct winbindd_request request;
1008 struct winbindd_response response;
1009 uint32_t i;
1010
1011 ZERO_STRUCT(request);
1012 ZERO_STRUCT(response);
1013
1014 if (info) {
1015 *info = NULL;
1016 }
1017 if (error) {
1018 *error = NULL;
1019 }
1020 if (policy) {
1021 *policy = NULL;
1022 }
1023
1024 if (!params) {
1025 wbc_status = WBC_ERR_INVALID_PARAM;
1026 BAIL_ON_WBC_ERROR(wbc_status);
1027 }
1028
1029 if (!params->username) {
1030 wbc_status = WBC_ERR_INVALID_PARAM;
1031 BAIL_ON_WBC_ERROR(wbc_status);
1032 }
1033
1034 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
1035 wbc_status = WBC_ERR_INVALID_PARAM;
1036 BAIL_ON_WBC_ERROR(wbc_status);
1037 }
1038 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
1039 wbc_status = WBC_ERR_INVALID_PARAM;
1040 BAIL_ON_WBC_ERROR(wbc_status);
1041 }
1042
1043 /* Initialize request */
1044
1045 request.flags = WBFLAG_PAM_INFO3_TEXT |
1046 WBFLAG_PAM_USER_SESSION_KEY |
1047 WBFLAG_PAM_LMKEY;
1048
1049 if (!params->password) {
1050 wbc_status = WBC_ERR_INVALID_PARAM;
1051 BAIL_ON_WBC_ERROR(wbc_status);
1052 }
1053
1054 strncpy(request.data.auth.user,
1055 params->username,
1056 sizeof(request.data.auth.user)-1);
1057
1058 strncpy(request.data.auth.pass,
1059 params->password,
1060 sizeof(request.data.auth.pass)-1);
1061
1062 for (i=0; i<params->num_blobs; i++) {
1063
1064 if (strcasecmp(params->blobs[i].name, "krb5_cc_type") == 0) {
1065 if (params->blobs[i].blob.data) {
1066 strncpy(request.data.auth.krb5_cc_type,
1067 (const char *)params->blobs[i].blob.data,
1068 sizeof(request.data.auth.krb5_cc_type) - 1);
1069 }
1070 continue;
1071 }
1072
1073 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
1074 if (params->blobs[i].blob.data) {
1075 memcpy(&request.data.auth.uid,
1076 params->blobs[i].blob.data,
1077 MIN(sizeof(request.data.auth.uid),
1078 params->blobs[i].blob.length));
1079 }
1080 continue;
1081 }
1082
1083 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
1084 if (params->blobs[i].blob.data) {
1085 uint32_t flags;
1086 memcpy(&flags,
1087 params->blobs[i].blob.data,
1088 MIN(sizeof(flags),
1089 params->blobs[i].blob.length));
1090 request.flags |= flags;
1091 }
1092 continue;
1093 }
1094
1095 if (strcasecmp(params->blobs[i].name, "membership_of") == 0) {
1096 if (params->blobs[i].blob.data &&
1097 params->blobs[i].blob.data[0] > 0) {
1098 strncpy(request.data.auth.require_membership_of_sid,
1099 (const char *)params->blobs[i].blob.data,
1100 sizeof(request.data.auth.require_membership_of_sid) - 1);
1101 }
1102 continue;
1103 }
1104 }
1105
1106 wbc_status = wbcRequestResponse(WINBINDD_PAM_AUTH,
1107 &request,
1108 &response);
1109
1110 if (response.data.auth.nt_status != 0) {
1111 if (error) {
1112 wbc_status = wbc_create_error_info(&response,
1113 error);
1114 BAIL_ON_WBC_ERROR(wbc_status);
1115 }
1116
1117 wbc_status = WBC_ERR_AUTH_ERROR;
1118 BAIL_ON_WBC_ERROR(wbc_status);
1119 }
1120 BAIL_ON_WBC_ERROR(wbc_status);
1121
1122 if (info) {
1123 wbc_status = wbc_create_logon_info(&response,
1124 info);
1125 BAIL_ON_WBC_ERROR(wbc_status);
1126 }
1127
1128 if (policy) {
1129 wbc_status = wbc_create_password_policy_info(&response,
1130 policy);
1131 BAIL_ON_WBC_ERROR(wbc_status);
1132 }
1133
1134 done:
1135 winbindd_free_response(&response);
1136
1137 return wbc_status;
1138 }
1139
1140 static void wbcCredentialCacheInfoDestructor(void *ptr)
1141 {
1142 struct wbcCredentialCacheInfo *i =
1143 (struct wbcCredentialCacheInfo *)ptr;
1144 wbcFreeMemory(i->blobs);
1145 }
1146
1147 /* Authenticate a user with cached credentials */
1148 wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
1149 struct wbcCredentialCacheInfo **info,
1150 struct wbcAuthErrorInfo **error)
1151 {
1152 wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
1153 struct wbcCredentialCacheInfo *result = NULL;
1154 struct winbindd_request request;
1155 struct winbindd_response response;
1156 struct wbcNamedBlob *initial_blob = NULL;
1157 struct wbcNamedBlob *challenge_blob = NULL;
1158 int i;
1159
1160 ZERO_STRUCT(request);
1161 ZERO_STRUCT(response);
1162
1163 *info = NULL;
1164
1165 if (error != NULL) {
1166 *error = NULL;
1167 }
1168 if ((params == NULL)
1169 || (params->account_name == NULL)
1170 || (params->level != WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP)) {
1171 status = WBC_ERR_INVALID_PARAM;
1172 goto fail;
1173 }
1174
1175 if (params->domain_name != NULL) {
1176 status = wbcRequestResponse(WINBINDD_INFO, NULL, &response);
1177 if (!WBC_ERROR_IS_OK(status)) {
1178 goto fail;
1179 }
1180 snprintf(request.data.ccache_ntlm_auth.user,
1181 sizeof(request.data.ccache_ntlm_auth.user)-1,
1182 "%s%c%s", params->domain_name,
1183 response.data.info.winbind_separator,
1184 params->account_name);
1185 } else {
1186 strncpy(request.data.ccache_ntlm_auth.user,
1187 params->account_name,
1188 sizeof(request.data.ccache_ntlm_auth.user)-1);
1189 }
1190 request.data.ccache_ntlm_auth.uid = getuid();
1191
1192 for (i=0; i<params->num_blobs; i++) {
1193 if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) {
1194 initial_blob = &params->blobs[i];
1195 break;
1196 }
1197 if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
1198 challenge_blob = &params->blobs[i];
1199 break;
1200 }
1201 }
1202
1203 request.data.ccache_ntlm_auth.initial_blob_len = 0;
1204 request.data.ccache_ntlm_auth.challenge_blob_len = 0;
1205 request.extra_len = 0;
1206
1207 if (initial_blob != NULL) {
1208 request.data.ccache_ntlm_auth.initial_blob_len =
1209 initial_blob->blob.length;
1210 request.extra_len += initial_blob->blob.length;
1211 }
1212 if (challenge_blob != NULL) {
1213 request.data.ccache_ntlm_auth.challenge_blob_len =
1214 challenge_blob->blob.length;
1215 request.extra_len += challenge_blob->blob.length;
1216 }
1217
1218 if (request.extra_len != 0) {
1219 request.extra_data.data = (char *)malloc(request.extra_len);
1220 if (request.extra_data.data == NULL) {
1221 status = WBC_ERR_NO_MEMORY;
1222 goto fail;
1223 }
1224 }
1225 if (initial_blob != NULL) {
1226 memcpy(request.extra_data.data,
1227 initial_blob->blob.data, initial_blob->blob.length);
1228 }
1229 if (challenge_blob != NULL) {
1230 memcpy(request.extra_data.data
1231 + request.data.ccache_ntlm_auth.initial_blob_len,
1232 challenge_blob->blob.data,
1233 challenge_blob->blob.length);
1234 }
1235
1236 status = wbcRequestResponse(WINBINDD_CCACHE_NTLMAUTH, &request,
1237 &response);
1238 if (!WBC_ERROR_IS_OK(status)) {
1239 goto fail;
1240 }
1241
1242 result = (struct wbcCredentialCacheInfo *)wbcAllocateMemory(
1243 1, sizeof(struct wbcCredentialCacheInfo),
1244 wbcCredentialCacheInfoDestructor);
1245 if (result == NULL) {
1246 status = WBC_ERR_NO_MEMORY;
1247 goto fail;
1248 }
1249 result->num_blobs = 0;
1250 result->blobs = NULL;
1251 status = wbcAddNamedBlob(&result->num_blobs, &result->blobs,
1252 "auth_blob", 0,
1253 (uint8_t *)response.extra_data.data,
1254 response.data.ccache_ntlm_auth.auth_blob_len);
1255 if (!WBC_ERROR_IS_OK(status)) {
1256 goto fail;
1257 }
1258 status = wbcAddNamedBlob(
1259 &result->num_blobs, &result->blobs, "session_key", 0,
1260 response.data.ccache_ntlm_auth.session_key,
1261 sizeof(response.data.ccache_ntlm_auth.session_key));
1262 if (!WBC_ERROR_IS_OK(status)) {
1263 goto fail;
1264 }
1265
1266 *info = result;
1267 result = NULL;
1268 status = WBC_ERR_SUCCESS;
1269 fail:
1270 free(request.extra_data.data);
1271 winbindd_free_response(&response);
1272 wbcFreeMemory(result);
1273 return status;
1274 }
1275
1276 /* Authenticate a user with cached credentials */
1277 wbcErr wbcCredentialSave(const char *user, const char *password)
1278 {
1279 struct winbindd_request request;
1280 struct winbindd_response response;
1281
1282 ZERO_STRUCT(request);
1283 ZERO_STRUCT(response);
1284
1285 strncpy(request.data.ccache_save.user, user,
1286 sizeof(request.data.ccache_save.user)-1);
1287 strncpy(request.data.ccache_save.pass, password,
1288 sizeof(request.data.ccache_save.pass)-1);
1289 request.data.ccache_save.uid = getuid();
1290
1291 return wbcRequestResponse(WINBINDD_CCACHE_SAVE, &request, &response);
1292 }