2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "smbd/globals.h"
26 #include "../libcli/auth/libcli_auth.h"
29 #define DBGC_CLASS DBGC_AUTH
32 /***************************************************************************
33 Is the incoming username our own machine account ?
34 If so, the connection is almost certainly from winbindd.
35 ***************************************************************************/
37 static bool is_our_machine_account(const char *username
)
40 char *truncname
= NULL
;
41 size_t ulen
= strlen(username
);
43 if (ulen
== 0 || username
[ulen
-1] != '$') {
46 truncname
= SMB_STRDUP(username
);
50 truncname
[ulen
-1] = '\0';
51 ret
= strequal(truncname
, global_myname());
56 /***************************************************************************
57 Make (and fill) a user_info struct from a struct samu
58 ***************************************************************************/
60 NTSTATUS
make_server_info_sam(struct auth_serversupplied_info
**server_info
,
65 struct auth_serversupplied_info
*result
;
66 const char *username
= pdb_get_username(sampass
);
69 if ( !(result
= make_server_info(NULL
)) ) {
70 return NT_STATUS_NO_MEMORY
;
73 if ( !(pwd
= getpwnam_alloc(result
, username
)) ) {
74 DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
75 pdb_get_username(sampass
)));
77 return NT_STATUS_NO_SUCH_USER
;
80 result
->sam_account
= sampass
;
81 result
->unix_name
= pwd
->pw_name
;
82 /* Ensure that we keep pwd->pw_name, because we will free pwd below */
83 talloc_steal(result
, pwd
->pw_name
);
84 result
->utok
.gid
= pwd
->pw_gid
;
85 result
->utok
.uid
= pwd
->pw_uid
;
89 result
->sanitized_username
= sanitize_username(result
,
91 if (result
->sanitized_username
== NULL
) {
93 return NT_STATUS_NO_MEMORY
;
96 if (IS_DC
&& is_our_machine_account(username
)) {
98 * Ensure for a connection from our own
99 * machine account (from winbindd on a DC)
100 * there are no supplementary groups.
101 * Prevents loops in calling gid_to_sid().
105 result
->num_sids
= 0;
108 * This is a hack of monstrous proportions.
109 * If we know it's winbindd talking to us,
110 * we know we must never recurse into it,
111 * so turn off contacting winbindd for this
112 * entire process. This will get fixed when
113 * winbindd doesn't need to talk to smbd on
119 DEBUG(10, ("make_server_info_sam: our machine account %s "
120 "setting supplementary group list empty and "
121 "turning off winbindd requests.\n",
124 status
= pdb_enum_group_memberships(result
, sampass
,
125 &result
->sids
, &gids
,
128 if (!NT_STATUS_IS_OK(status
)) {
129 DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
131 result
->sam_account
= NULL
; /* Don't free on error exit. */
137 /* For now we throw away the gids and convert via sid_to_gid
138 * later. This needs fixing, but I'd like to get the code straight and
143 DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
144 pdb_get_username(sampass
), result
->unix_name
));
146 *server_info
= result
;
147 /* Ensure that the sampass will be freed with the result */
148 talloc_steal(result
, sampass
);