2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "smbd/globals.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
30 #define DBGC_CLASS DBGC_AUTH
32 /****************************************************************************
33 Ensure primary group SID is always at position 0 in a
34 auth_serversupplied_info struct.
35 ****************************************************************************/
37 static void sort_sid_array_for_smbd(struct auth_serversupplied_info
*result
,
38 const struct dom_sid
*pgroup_sid
)
46 if (sid_compare(&result
->sids
[0], pgroup_sid
)==0) {
50 for (i
= 1; i
< result
->num_sids
; i
++) {
51 if (sid_compare(pgroup_sid
,
52 &result
->sids
[i
]) == 0) {
53 sid_copy(&result
->sids
[i
], &result
->sids
[0]);
54 sid_copy(&result
->sids
[0], pgroup_sid
);
60 /****************************************************************************
61 Create a UNIX user on demand.
62 ****************************************************************************/
64 static int _smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
66 TALLOC_CTX
*ctx
= talloc_tos();
70 add_script
= talloc_strdup(ctx
, lp_adduser_script());
71 if (!add_script
|| !*add_script
) {
74 add_script
= talloc_all_string_sub(ctx
,
82 add_script
= talloc_all_string_sub(ctx
,
91 add_script
= talloc_all_string_sub(ctx
,
99 ret
= smbrun(add_script
,NULL
);
102 ("smb_create_user: Running the command `%s' gave %d\n",
107 /****************************************************************************
108 Create an auth_usersupplied_data structure after appropriate mapping.
109 ****************************************************************************/
111 NTSTATUS
make_user_info_map(struct auth_usersupplied_info
**user_info
,
112 const char *smb_name
,
113 const char *client_domain
,
114 const char *wksta_name
,
117 DATA_BLOB
*lm_interactive_pwd
,
118 DATA_BLOB
*nt_interactive_pwd
,
119 DATA_BLOB
*plaintext
,
122 struct smbd_server_connection
*sconn
= smbd_server_conn
;
126 fstring internal_username
;
127 fstrcpy(internal_username
, smb_name
);
128 was_mapped
= map_username(sconn
, internal_username
);
130 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
131 client_domain
, smb_name
, wksta_name
));
133 domain
= client_domain
;
135 /* If you connect to a Windows domain member using a bogus domain name,
136 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
137 * the Windows box is a DC the name will become DOMAIN\user and be
138 * authenticated against AD, if the Windows box is a member server but
139 * not a DC the name will become WORKSTATION\user. A standalone
140 * non-domain member box will also map to WORKSTATION\user.
141 * This also deals with the client passing in a "" domain */
143 if (!is_trusted_domain(domain
) &&
144 !strequal(domain
, my_sam_name()))
146 if (lp_map_untrusted_to_domain())
147 domain
= my_sam_name();
149 domain
= get_global_sam_name();
150 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
151 "workstation [%s]\n",
152 client_domain
, domain
, smb_name
, wksta_name
));
155 /* We know that the given domain is trusted (and we are allowing them),
156 * it is our global SAM name, or for legacy behavior it is our
157 * primary domain name */
159 result
= make_user_info(user_info
, smb_name
, internal_username
,
160 client_domain
, domain
, wksta_name
,
162 lm_interactive_pwd
, nt_interactive_pwd
,
163 plaintext
, encrypted
);
164 if (NT_STATUS_IS_OK(result
)) {
165 (*user_info
)->was_mapped
= was_mapped
;
170 /****************************************************************************
171 Create an auth_usersupplied_data, making the DATA_BLOBs here.
172 Decrypt and encrypt the passwords.
173 ****************************************************************************/
175 bool make_user_info_netlogon_network(struct auth_usersupplied_info
**user_info
,
176 const char *smb_name
,
177 const char *client_domain
,
178 const char *wksta_name
,
179 uint32 logon_parameters
,
180 const uchar
*lm_network_pwd
,
182 const uchar
*nt_network_pwd
,
187 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
188 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
190 status
= make_user_info_map(user_info
,
191 smb_name
, client_domain
,
193 lm_pwd_len
? &lm_blob
: NULL
,
194 nt_pwd_len
? &nt_blob
: NULL
,
198 if (NT_STATUS_IS_OK(status
)) {
199 (*user_info
)->logon_parameters
= logon_parameters
;
201 ret
= NT_STATUS_IS_OK(status
) ? True
: False
;
203 data_blob_free(&lm_blob
);
204 data_blob_free(&nt_blob
);
208 /****************************************************************************
209 Create an auth_usersupplied_data, making the DATA_BLOBs here.
210 Decrypt and encrypt the passwords.
211 ****************************************************************************/
213 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info
**user_info
,
214 const char *smb_name
,
215 const char *client_domain
,
216 const char *wksta_name
,
217 uint32 logon_parameters
,
219 const uchar lm_interactive_pwd
[16],
220 const uchar nt_interactive_pwd
[16],
221 const uchar
*dc_sess_key
)
223 unsigned char lm_pwd
[16];
224 unsigned char nt_pwd
[16];
225 unsigned char local_lm_response
[24];
226 unsigned char local_nt_response
[24];
227 unsigned char key
[16];
229 memcpy(key
, dc_sess_key
, 16);
231 if (lm_interactive_pwd
)
232 memcpy(lm_pwd
, lm_interactive_pwd
, sizeof(lm_pwd
));
234 if (nt_interactive_pwd
)
235 memcpy(nt_pwd
, nt_interactive_pwd
, sizeof(nt_pwd
));
237 #ifdef DEBUG_PASSWORD
239 dump_data(100, key
, sizeof(key
));
241 DEBUG(100,("lm owf password:"));
242 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
244 DEBUG(100,("nt owf password:"));
245 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
248 if (lm_interactive_pwd
)
249 arcfour_crypt(lm_pwd
, key
, sizeof(lm_pwd
));
251 if (nt_interactive_pwd
)
252 arcfour_crypt(nt_pwd
, key
, sizeof(nt_pwd
));
254 #ifdef DEBUG_PASSWORD
255 DEBUG(100,("decrypt of lm owf password:"));
256 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
258 DEBUG(100,("decrypt of nt owf password:"));
259 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
262 if (lm_interactive_pwd
)
263 SMBOWFencrypt(lm_pwd
, chal
,
266 if (nt_interactive_pwd
)
267 SMBOWFencrypt(nt_pwd
, chal
,
270 /* Password info paranoia */
276 DATA_BLOB local_lm_blob
;
277 DATA_BLOB local_nt_blob
;
279 DATA_BLOB lm_interactive_blob
;
280 DATA_BLOB nt_interactive_blob
;
282 if (lm_interactive_pwd
) {
283 local_lm_blob
= data_blob(local_lm_response
,
284 sizeof(local_lm_response
));
285 lm_interactive_blob
= data_blob(lm_pwd
,
290 if (nt_interactive_pwd
) {
291 local_nt_blob
= data_blob(local_nt_response
,
292 sizeof(local_nt_response
));
293 nt_interactive_blob
= data_blob(nt_pwd
,
298 nt_status
= make_user_info_map(
300 smb_name
, client_domain
, wksta_name
,
301 lm_interactive_pwd
? &local_lm_blob
: NULL
,
302 nt_interactive_pwd
? &local_nt_blob
: NULL
,
303 lm_interactive_pwd
? &lm_interactive_blob
: NULL
,
304 nt_interactive_pwd
? &nt_interactive_blob
: NULL
,
307 if (NT_STATUS_IS_OK(nt_status
)) {
308 (*user_info
)->logon_parameters
= logon_parameters
;
311 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
312 data_blob_free(&local_lm_blob
);
313 data_blob_free(&local_nt_blob
);
314 data_blob_free(&lm_interactive_blob
);
315 data_blob_free(&nt_interactive_blob
);
321 /****************************************************************************
322 Create an auth_usersupplied_data structure
323 ****************************************************************************/
325 bool make_user_info_for_reply(struct auth_usersupplied_info
**user_info
,
326 const char *smb_name
,
327 const char *client_domain
,
329 DATA_BLOB plaintext_password
)
332 DATA_BLOB local_lm_blob
;
333 DATA_BLOB local_nt_blob
;
334 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
337 * Not encrypted - do so.
340 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
343 if (plaintext_password
.data
&& plaintext_password
.length
) {
344 unsigned char local_lm_response
[24];
346 #ifdef DEBUG_PASSWORD
347 DEBUG(10,("Unencrypted password (len %d):\n",
348 (int)plaintext_password
.length
));
349 dump_data(100, plaintext_password
.data
,
350 plaintext_password
.length
);
353 SMBencrypt( (const char *)plaintext_password
.data
,
354 (const uchar
*)chal
, local_lm_response
);
355 local_lm_blob
= data_blob(local_lm_response
, 24);
357 /* We can't do an NT hash here, as the password needs to be
359 local_nt_blob
= data_blob_null
;
361 local_lm_blob
= data_blob_null
;
362 local_nt_blob
= data_blob_null
;
365 ret
= make_user_info_map(
366 user_info
, smb_name
, client_domain
,
367 get_remote_machine_name(),
368 local_lm_blob
.data
? &local_lm_blob
: NULL
,
369 local_nt_blob
.data
? &local_nt_blob
: NULL
,
371 plaintext_password
.data
&& plaintext_password
.length
? &plaintext_password
: NULL
,
374 data_blob_free(&local_lm_blob
);
375 return NT_STATUS_IS_OK(ret
) ? True
: False
;
378 /****************************************************************************
379 Create an auth_usersupplied_data structure
380 ****************************************************************************/
382 NTSTATUS
make_user_info_for_reply_enc(struct auth_usersupplied_info
**user_info
,
383 const char *smb_name
,
384 const char *client_domain
,
385 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
387 return make_user_info_map(user_info
, smb_name
,
389 get_remote_machine_name(),
390 lm_resp
.data
? &lm_resp
: NULL
,
391 nt_resp
.data
? &nt_resp
: NULL
,
396 /****************************************************************************
397 Create a guest user_info blob, for anonymous authenticaion.
398 ****************************************************************************/
400 bool make_user_info_guest(struct auth_usersupplied_info
**user_info
)
404 nt_status
= make_user_info(user_info
,
413 return NT_STATUS_IS_OK(nt_status
) ? True
: False
;
416 static NTSTATUS
log_nt_token(NT_USER_TOKEN
*token
)
418 TALLOC_CTX
*frame
= talloc_stackframe();
423 if ((lp_log_nt_token_command() == NULL
) ||
424 (strlen(lp_log_nt_token_command()) == 0)) {
429 group_sidstr
= talloc_strdup(frame
, "");
430 for (i
=1; i
<token
->num_sids
; i
++) {
431 group_sidstr
= talloc_asprintf(
432 frame
, "%s %s", group_sidstr
,
433 sid_string_talloc(frame
, &token
->user_sids
[i
]));
436 command
= talloc_string_sub(
437 frame
, lp_log_nt_token_command(),
438 "%s", sid_string_talloc(frame
, &token
->user_sids
[0]));
439 command
= talloc_string_sub(frame
, command
, "%t", group_sidstr
);
441 if (command
== NULL
) {
443 return NT_STATUS_NO_MEMORY
;
446 DEBUG(8, ("running command: [%s]\n", command
));
447 if (smbrun(command
, NULL
) != 0) {
448 DEBUG(0, ("Could not log NT token\n"));
450 return NT_STATUS_ACCESS_DENIED
;
458 * Create the token to use from server_info->sam_account and
459 * server_info->sids (the info3/sam groups). Find the unix gids.
462 NTSTATUS
create_local_token(struct auth_serversupplied_info
*server_info
)
466 struct dom_sid tmp_sid
;
469 * If winbind is not around, we can not make much use of the SIDs the
470 * domain controller provided us with. Likewise if the user name was
471 * mapped to some local unix user.
474 if (((lp_server_role() == ROLE_DOMAIN_MEMBER
) && !winbind_ping()) ||
475 (server_info
->nss_token
)) {
476 status
= create_token_from_username(server_info
,
477 server_info
->unix_name
,
479 &server_info
->utok
.uid
,
480 &server_info
->utok
.gid
,
481 &server_info
->unix_name
,
485 server_info
->ptok
= create_local_nt_token(
487 pdb_get_user_sid(server_info
->sam_account
),
489 server_info
->num_sids
, server_info
->sids
);
490 status
= server_info
->ptok
?
491 NT_STATUS_OK
: NT_STATUS_NO_SUCH_USER
;
494 if (!NT_STATUS_IS_OK(status
)) {
498 /* Convert the SIDs to gids. */
500 server_info
->utok
.ngroups
= 0;
501 server_info
->utok
.groups
= NULL
;
503 /* Start at index 1, where the groups start. */
505 for (i
=1; i
<server_info
->ptok
->num_sids
; i
++) {
507 struct dom_sid
*sid
= &server_info
->ptok
->user_sids
[i
];
509 if (!sid_to_gid(sid
, &gid
)) {
510 DEBUG(10, ("Could not convert SID %s to gid, "
511 "ignoring it\n", sid_string_dbg(sid
)));
514 add_gid_to_array_unique(server_info
, gid
,
515 &server_info
->utok
.groups
,
516 &server_info
->utok
.ngroups
);
520 * Add the "Unix Group" SID for each gid to catch mapped groups
521 * and their Unix equivalent. This is to solve the backwards
522 * compatibility problem of 'valid users = +ntadmin' where
523 * ntadmin has been paired with "Domain Admins" in the group
524 * mapping table. Otherwise smb.conf would need to be changed
525 * to 'valid user = "Domain Admins"'. --jerry
527 * For consistency we also add the "Unix User" SID,
528 * so that the complete unix token is represented within
532 if (!uid_to_unix_users_sid(server_info
->utok
.uid
, &tmp_sid
)) {
533 DEBUG(1,("create_local_token: Failed to create SID "
534 "for uid %u!\n", (unsigned int)server_info
->utok
.uid
));
536 add_sid_to_array_unique(server_info
->ptok
, &tmp_sid
,
537 &server_info
->ptok
->user_sids
,
538 &server_info
->ptok
->num_sids
);
540 for ( i
=0; i
<server_info
->utok
.ngroups
; i
++ ) {
541 if (!gid_to_unix_groups_sid( server_info
->utok
.groups
[i
], &tmp_sid
) ) {
542 DEBUG(1,("create_local_token: Failed to create SID "
543 "for gid %u!\n", (unsigned int)server_info
->utok
.groups
[i
]));
546 add_sid_to_array_unique(server_info
->ptok
, &tmp_sid
,
547 &server_info
->ptok
->user_sids
,
548 &server_info
->ptok
->num_sids
);
551 debug_nt_user_token(DBGC_AUTH
, 10, server_info
->ptok
);
552 debug_unix_user_token(DBGC_AUTH
, 10,
553 server_info
->utok
.uid
,
554 server_info
->utok
.gid
,
555 server_info
->utok
.ngroups
,
556 server_info
->utok
.groups
);
558 status
= log_nt_token(server_info
->ptok
);
562 /***************************************************************************
563 Make (and fill) a server_info struct from a 'struct passwd' by conversion
565 ***************************************************************************/
567 NTSTATUS
make_server_info_pw(struct auth_serversupplied_info
**server_info
,
572 struct samu
*sampass
= NULL
;
574 char *qualified_name
= NULL
;
575 TALLOC_CTX
*mem_ctx
= NULL
;
576 struct dom_sid u_sid
;
577 enum lsa_SidType type
;
578 struct auth_serversupplied_info
*result
;
580 if ( !(sampass
= samu_new( NULL
)) ) {
581 return NT_STATUS_NO_MEMORY
;
584 status
= samu_set_unix( sampass
, pwd
);
585 if (!NT_STATUS_IS_OK(status
)) {
589 result
= make_server_info(NULL
);
590 if (result
== NULL
) {
591 TALLOC_FREE(sampass
);
592 return NT_STATUS_NO_MEMORY
;
595 result
->sam_account
= sampass
;
597 result
->unix_name
= talloc_strdup(result
, unix_username
);
598 result
->sanitized_username
= sanitize_username(result
, unix_username
);
600 if ((result
->unix_name
== NULL
)
601 || (result
->sanitized_username
== NULL
)) {
602 TALLOC_FREE(sampass
);
604 return NT_STATUS_NO_MEMORY
;
607 result
->utok
.uid
= pwd
->pw_uid
;
608 result
->utok
.gid
= pwd
->pw_gid
;
610 status
= pdb_enum_group_memberships(result
, sampass
,
611 &result
->sids
, &gids
,
614 if (!NT_STATUS_IS_OK(status
)) {
615 DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
622 * The SID returned in server_info->sam_account is based
623 * on our SAM sid even though for a pure UNIX account this should
624 * not be the case as it doesn't really exist in the SAM db.
625 * This causes lookups on "[in]valid users" to fail as they
626 * will lookup this name as a "Unix User" SID to check against
627 * the user token. Fix this by adding the "Unix User"\unix_username
628 * SID to the sid array. The correct fix should probably be
629 * changing the server_info->sam_account user SID to be a
630 * S-1-22 Unix SID, but this might break old configs where
631 * plaintext passwords were used with no SAM backend.
634 mem_ctx
= talloc_init("make_server_info_pw_tmp");
637 return NT_STATUS_NO_MEMORY
;
640 qualified_name
= talloc_asprintf(mem_ctx
, "%s\\%s",
641 unix_users_domain_name(),
643 if (!qualified_name
) {
645 TALLOC_FREE(mem_ctx
);
646 return NT_STATUS_NO_MEMORY
;
649 if (!lookup_name(mem_ctx
, qualified_name
, LOOKUP_NAME_ALL
,
653 TALLOC_FREE(mem_ctx
);
654 return NT_STATUS_NO_SUCH_USER
;
657 TALLOC_FREE(mem_ctx
);
659 if (type
!= SID_NAME_USER
) {
661 return NT_STATUS_NO_SUCH_USER
;
664 status
= add_sid_to_array_unique(result
, &u_sid
,
667 if (!NT_STATUS_IS_OK(status
)) {
672 /* For now we throw away the gids and convert via sid_to_gid
673 * later. This needs fixing, but I'd like to get the code straight and
677 *server_info
= result
;
682 /***************************************************************************
683 Make (and fill) a user_info struct for a guest login.
684 This *must* succeed for smbd to start. If there is no mapping entry for
685 the guest gid, then create one.
686 ***************************************************************************/
688 static NTSTATUS
make_new_server_info_guest(struct auth_serversupplied_info
**server_info
)
691 struct samu
*sampass
= NULL
;
692 struct dom_sid guest_sid
;
694 static const char zeros
[16] = {0, };
697 if ( !(sampass
= samu_new( NULL
)) ) {
698 return NT_STATUS_NO_MEMORY
;
701 sid_compose(&guest_sid
, get_global_sam_sid(), DOMAIN_RID_GUEST
);
704 ret
= pdb_getsampwsid(sampass
, &guest_sid
);
708 TALLOC_FREE(sampass
);
709 return NT_STATUS_NO_SUCH_USER
;
712 status
= make_server_info_sam(server_info
, sampass
);
713 if (!NT_STATUS_IS_OK(status
)) {
714 TALLOC_FREE(sampass
);
718 (*server_info
)->guest
= True
;
720 status
= create_local_token(*server_info
);
721 if (!NT_STATUS_IS_OK(status
)) {
722 DEBUG(10, ("create_local_token failed: %s\n",
727 /* annoying, but the Guest really does have a session key, and it is
729 (*server_info
)->user_session_key
= data_blob(zeros
, sizeof(zeros
));
730 (*server_info
)->lm_session_key
= data_blob(zeros
, sizeof(zeros
));
732 alpha_strcpy(tmp
, pdb_get_username(sampass
), ". _-$", sizeof(tmp
));
733 (*server_info
)->sanitized_username
= talloc_strdup(*server_info
, tmp
);
738 /****************************************************************************
739 Fake a auth_serversupplied_info just from a username
740 ****************************************************************************/
742 NTSTATUS
make_serverinfo_from_username(TALLOC_CTX
*mem_ctx
,
743 const char *username
,
745 struct auth_serversupplied_info
**presult
)
747 struct auth_serversupplied_info
*result
;
751 pwd
= getpwnam_alloc(talloc_tos(), username
);
753 return NT_STATUS_NO_SUCH_USER
;
756 status
= make_server_info_pw(&result
, pwd
->pw_name
, pwd
);
760 if (!NT_STATUS_IS_OK(status
)) {
764 result
->nss_token
= true;
765 result
->guest
= is_guest
;
767 status
= create_local_token(result
);
769 if (!NT_STATUS_IS_OK(status
)) {
779 struct auth_serversupplied_info
*copy_serverinfo(TALLOC_CTX
*mem_ctx
,
780 const struct auth_serversupplied_info
*src
)
782 struct auth_serversupplied_info
*dst
;
784 dst
= make_server_info(mem_ctx
);
789 dst
->guest
= src
->guest
;
790 dst
->utok
.uid
= src
->utok
.uid
;
791 dst
->utok
.gid
= src
->utok
.gid
;
792 dst
->utok
.ngroups
= src
->utok
.ngroups
;
793 if (src
->utok
.ngroups
!= 0) {
794 dst
->utok
.groups
= (gid_t
*)TALLOC_MEMDUP(
795 dst
, src
->utok
.groups
,
796 sizeof(gid_t
)*dst
->utok
.ngroups
);
798 dst
->utok
.groups
= NULL
;
802 dst
->ptok
= dup_nt_token(dst
, src
->ptok
);
809 dst
->user_session_key
= data_blob_talloc( dst
, src
->user_session_key
.data
,
810 src
->user_session_key
.length
);
812 dst
->lm_session_key
= data_blob_talloc(dst
, src
->lm_session_key
.data
,
813 src
->lm_session_key
.length
);
815 dst
->sam_account
= samu_new(NULL
);
816 if (!dst
->sam_account
) {
821 if (!pdb_copy_sam_account(dst
->sam_account
, src
->sam_account
)) {
826 dst
->pam_handle
= NULL
;
827 dst
->unix_name
= talloc_strdup(dst
, src
->unix_name
);
828 if (!dst
->unix_name
) {
833 dst
->sanitized_username
= talloc_strdup(dst
, src
->sanitized_username
);
834 if (!dst
->sanitized_username
) {
843 * Set a new session key. Used in the rpc server where we have to override the
844 * SMB level session key with SystemLibraryDTC
847 bool server_info_set_session_key(struct auth_serversupplied_info
*info
,
848 DATA_BLOB session_key
)
850 TALLOC_FREE(info
->user_session_key
.data
);
852 info
->user_session_key
= data_blob_talloc(
853 info
, session_key
.data
, session_key
.length
);
855 return (info
->user_session_key
.data
!= NULL
);
858 static struct auth_serversupplied_info
*guest_info
= NULL
;
860 bool init_guest_info(void)
862 if (guest_info
!= NULL
)
865 return NT_STATUS_IS_OK(make_new_server_info_guest(&guest_info
));
868 NTSTATUS
make_server_info_guest(TALLOC_CTX
*mem_ctx
,
869 struct auth_serversupplied_info
**server_info
)
871 *server_info
= copy_serverinfo(mem_ctx
, guest_info
);
872 return (*server_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
875 bool copy_current_user(struct current_user
*dst
, struct current_user
*src
)
878 NT_USER_TOKEN
*nt_token
;
880 groups
= (gid_t
*)memdup(src
->ut
.groups
,
881 sizeof(gid_t
) * src
->ut
.ngroups
);
882 if ((src
->ut
.ngroups
!= 0) && (groups
== NULL
)) {
886 nt_token
= dup_nt_token(NULL
, src
->nt_user_token
);
887 if (nt_token
== NULL
) {
892 dst
->conn
= src
->conn
;
893 dst
->vuid
= src
->vuid
;
894 dst
->ut
.uid
= src
->ut
.uid
;
895 dst
->ut
.gid
= src
->ut
.gid
;
896 dst
->ut
.ngroups
= src
->ut
.ngroups
;
897 dst
->ut
.groups
= groups
;
898 dst
->nt_user_token
= nt_token
;
902 /***************************************************************************
903 Purely internal function for make_server_info_info3
904 Fill the sam account from getpwnam
905 ***************************************************************************/
906 static NTSTATUS
fill_sam_account(TALLOC_CTX
*mem_ctx
,
908 const char *username
,
909 char **found_username
,
910 uid_t
*uid
, gid_t
*gid
,
911 struct samu
*account
,
912 bool *username_was_mapped
)
914 struct smbd_server_connection
*sconn
= smbd_server_conn
;
916 fstring dom_user
, lower_username
;
917 fstring real_username
;
918 struct passwd
*passwd
;
920 fstrcpy( lower_username
, username
);
921 strlower_m( lower_username
);
923 fstr_sprintf(dom_user
, "%s%c%s", domain
, *lp_winbind_separator(),
926 /* Get the passwd struct. Try to create the account is necessary. */
928 *username_was_mapped
= map_username(sconn
, dom_user
);
930 if ( !(passwd
= smb_getpwnam( NULL
, dom_user
, real_username
, True
)) )
931 return NT_STATUS_NO_SUCH_USER
;
933 *uid
= passwd
->pw_uid
;
934 *gid
= passwd
->pw_gid
;
936 /* This is pointless -- there is no suport for differing
937 unix and windows names. Make sure to always store the
938 one we actually looked up and succeeded. Have I mentioned
939 why I hate the 'winbind use default domain' parameter?
942 *found_username
= talloc_strdup( mem_ctx
, real_username
);
944 DEBUG(5,("fill_sam_account: located username was [%s]\n", *found_username
));
946 nt_status
= samu_set_unix( account
, passwd
);
953 /****************************************************************************
954 Wrapper to allow the getpwnam() call to strip the domain name and
955 try again in case a local UNIX user is already there. Also run through
956 the username if we fallback to the username only.
957 ****************************************************************************/
959 struct passwd
*smb_getpwnam( TALLOC_CTX
*mem_ctx
, char *domuser
,
960 fstring save_username
, bool create
)
962 struct passwd
*pw
= NULL
;
966 /* we only save a copy of the username it has been mangled
967 by winbindd use default domain */
969 save_username
[0] = '\0';
971 /* don't call map_username() here since it has to be done higher
972 up the stack so we don't call it multiple times */
974 fstrcpy( username
, domuser
);
976 p
= strchr_m( username
, *lp_winbind_separator() );
978 /* code for a DOMAIN\user string */
981 fstring strip_username
;
983 pw
= Get_Pwnam_alloc( mem_ctx
, domuser
);
985 /* make sure we get the case of the username correct */
986 /* work around 'winbind use default domain = yes' */
988 if ( !strchr_m( pw
->pw_name
, *lp_winbind_separator() ) ) {
991 /* split the domain and username into 2 strings */
995 fstr_sprintf(save_username
, "%s%c%s", domain
, *lp_winbind_separator(), pw
->pw_name
);
998 fstrcpy( save_username
, pw
->pw_name
);
1004 /* setup for lookup of just the username */
1005 /* remember that p and username are overlapping memory */
1008 fstrcpy( strip_username
, p
);
1009 fstrcpy( username
, strip_username
);
1012 /* just lookup a plain username */
1014 pw
= Get_Pwnam_alloc(mem_ctx
, username
);
1016 /* Create local user if requested but only if winbindd
1017 is not running. We need to protect against cases
1018 where winbindd is failing and then prematurely
1019 creating users in /etc/passwd */
1021 if ( !pw
&& create
&& !winbind_ping() ) {
1022 /* Don't add a machine account. */
1023 if (username
[strlen(username
)-1] == '$')
1026 _smb_create_user(NULL
, username
, NULL
);
1027 pw
= Get_Pwnam_alloc(mem_ctx
, username
);
1030 /* one last check for a valid passwd struct */
1033 fstrcpy( save_username
, pw
->pw_name
);
1038 /***************************************************************************
1039 Make a server_info struct from the info3 returned by a domain logon
1040 ***************************************************************************/
1042 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
1043 const char *sent_nt_username
,
1045 struct auth_serversupplied_info
**server_info
,
1046 struct netr_SamInfo3
*info3
)
1048 static const char zeros
[16] = {0, };
1050 NTSTATUS nt_status
= NT_STATUS_OK
;
1051 char *found_username
= NULL
;
1052 const char *nt_domain
;
1053 const char *nt_username
;
1054 struct samu
*sam_account
= NULL
;
1055 struct dom_sid user_sid
;
1056 struct dom_sid group_sid
;
1057 bool username_was_mapped
;
1059 uid_t uid
= (uid_t
)-1;
1060 gid_t gid
= (gid_t
)-1;
1062 struct auth_serversupplied_info
*result
;
1065 Here is where we should check the list of
1066 trusted domains, and verify that the SID
1070 if (!sid_compose(&user_sid
, info3
->base
.domain_sid
, info3
->base
.rid
)) {
1071 return NT_STATUS_INVALID_PARAMETER
;
1074 if (!sid_compose(&group_sid
, info3
->base
.domain_sid
,
1075 info3
->base
.primary_gid
)) {
1076 return NT_STATUS_INVALID_PARAMETER
;
1079 nt_username
= talloc_strdup(mem_ctx
, info3
->base
.account_name
.string
);
1081 /* If the server didn't give us one, just use the one we sent
1083 nt_username
= sent_nt_username
;
1086 nt_domain
= talloc_strdup(mem_ctx
, info3
->base
.domain
.string
);
1088 /* If the server didn't give us one, just use the one we sent
1093 /* try to fill the SAM account.. If getpwnam() fails, then try the
1094 add user script (2.2.x behavior).
1096 We use the _unmapped_ username here in an attempt to provide
1097 consistent username mapping behavior between kerberos and NTLM[SSP]
1098 authentication in domain mode security. I.E. Username mapping
1099 should be applied to the fully qualified username
1100 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1101 called map_username() unnecessarily in make_user_info_map() but
1102 that is how the current code is designed. Making the change here
1103 is the least disruptive place. -- jerry */
1105 if ( !(sam_account
= samu_new( NULL
)) ) {
1106 return NT_STATUS_NO_MEMORY
;
1109 /* this call will try to create the user if necessary */
1111 nt_status
= fill_sam_account(mem_ctx
, nt_domain
, sent_nt_username
,
1112 &found_username
, &uid
, &gid
, sam_account
,
1113 &username_was_mapped
);
1116 /* if we still don't have a valid unix account check for
1117 'map to guest = bad uid' */
1119 if (!NT_STATUS_IS_OK(nt_status
)) {
1120 TALLOC_FREE( sam_account
);
1121 if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID
) {
1122 make_server_info_guest(NULL
, server_info
);
1123 return NT_STATUS_OK
;
1128 if (!pdb_set_nt_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1129 TALLOC_FREE(sam_account
);
1130 return NT_STATUS_NO_MEMORY
;
1133 if (!pdb_set_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1134 TALLOC_FREE(sam_account
);
1135 return NT_STATUS_NO_MEMORY
;
1138 if (!pdb_set_domain(sam_account
, nt_domain
, PDB_CHANGED
)) {
1139 TALLOC_FREE(sam_account
);
1140 return NT_STATUS_NO_MEMORY
;
1143 if (!pdb_set_user_sid(sam_account
, &user_sid
, PDB_CHANGED
)) {
1144 TALLOC_FREE(sam_account
);
1145 return NT_STATUS_UNSUCCESSFUL
;
1148 if (!pdb_set_group_sid(sam_account
, &group_sid
, PDB_CHANGED
)) {
1149 TALLOC_FREE(sam_account
);
1150 return NT_STATUS_UNSUCCESSFUL
;
1153 if (!pdb_set_fullname(sam_account
,
1154 info3
->base
.full_name
.string
,
1156 TALLOC_FREE(sam_account
);
1157 return NT_STATUS_NO_MEMORY
;
1160 if (!pdb_set_logon_script(sam_account
,
1161 info3
->base
.logon_script
.string
,
1163 TALLOC_FREE(sam_account
);
1164 return NT_STATUS_NO_MEMORY
;
1167 if (!pdb_set_profile_path(sam_account
,
1168 info3
->base
.profile_path
.string
,
1170 TALLOC_FREE(sam_account
);
1171 return NT_STATUS_NO_MEMORY
;
1174 if (!pdb_set_homedir(sam_account
,
1175 info3
->base
.home_directory
.string
,
1177 TALLOC_FREE(sam_account
);
1178 return NT_STATUS_NO_MEMORY
;
1181 if (!pdb_set_dir_drive(sam_account
,
1182 info3
->base
.home_drive
.string
,
1184 TALLOC_FREE(sam_account
);
1185 return NT_STATUS_NO_MEMORY
;
1188 if (!pdb_set_acct_ctrl(sam_account
, info3
->base
.acct_flags
, PDB_CHANGED
)) {
1189 TALLOC_FREE(sam_account
);
1190 return NT_STATUS_NO_MEMORY
;
1193 if (!pdb_set_pass_last_set_time(
1195 nt_time_to_unix(info3
->base
.last_password_change
),
1197 TALLOC_FREE(sam_account
);
1198 return NT_STATUS_NO_MEMORY
;
1201 if (!pdb_set_pass_can_change_time(
1203 nt_time_to_unix(info3
->base
.allow_password_change
),
1205 TALLOC_FREE(sam_account
);
1206 return NT_STATUS_NO_MEMORY
;
1209 if (!pdb_set_pass_must_change_time(
1211 nt_time_to_unix(info3
->base
.force_password_change
),
1213 TALLOC_FREE(sam_account
);
1214 return NT_STATUS_NO_MEMORY
;
1217 result
= make_server_info(NULL
);
1218 if (result
== NULL
) {
1219 DEBUG(4, ("make_server_info failed!\n"));
1220 TALLOC_FREE(sam_account
);
1221 return NT_STATUS_NO_MEMORY
;
1224 /* save this here to _net_sam_logon() doesn't fail (it assumes a
1225 valid struct samu) */
1227 result
->sam_account
= sam_account
;
1228 result
->unix_name
= talloc_strdup(result
, found_username
);
1230 result
->sanitized_username
= sanitize_username(result
,
1232 if (result
->sanitized_username
== NULL
) {
1233 TALLOC_FREE(result
);
1234 return NT_STATUS_NO_MEMORY
;
1237 /* Fill in the unix info we found on the way */
1239 result
->utok
.uid
= uid
;
1240 result
->utok
.gid
= gid
;
1242 /* Create a 'combined' list of all SIDs we might want in the SD */
1244 result
->num_sids
= 0;
1245 result
->sids
= NULL
;
1247 nt_status
= sid_array_from_info3(result
, info3
,
1251 if (!NT_STATUS_IS_OK(nt_status
)) {
1252 TALLOC_FREE(result
);
1256 /* Ensure the primary group sid is at position 0. */
1257 sort_sid_array_for_smbd(result
, &group_sid
);
1259 result
->login_server
= talloc_strdup(result
,
1260 info3
->base
.logon_server
.string
);
1262 /* ensure we are never given NULL session keys */
1264 if (memcmp(info3
->base
.key
.key
, zeros
, sizeof(zeros
)) == 0) {
1265 result
->user_session_key
= data_blob_null
;
1267 result
->user_session_key
= data_blob_talloc(
1268 result
, info3
->base
.key
.key
,
1269 sizeof(info3
->base
.key
.key
));
1272 if (memcmp(info3
->base
.LMSessKey
.key
, zeros
, 8) == 0) {
1273 result
->lm_session_key
= data_blob_null
;
1275 result
->lm_session_key
= data_blob_talloc(
1276 result
, info3
->base
.LMSessKey
.key
,
1277 sizeof(info3
->base
.LMSessKey
.key
));
1280 result
->nss_token
|= username_was_mapped
;
1282 *server_info
= result
;
1284 return NT_STATUS_OK
;
1287 /*****************************************************************************
1288 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1289 ******************************************************************************/
1291 NTSTATUS
make_server_info_wbcAuthUserInfo(TALLOC_CTX
*mem_ctx
,
1292 const char *sent_nt_username
,
1294 const struct wbcAuthUserInfo
*info
,
1295 struct auth_serversupplied_info
**server_info
)
1297 static const char zeros
[16] = {0, };
1299 NTSTATUS nt_status
= NT_STATUS_OK
;
1300 char *found_username
= NULL
;
1301 const char *nt_domain
;
1302 const char *nt_username
;
1303 struct samu
*sam_account
= NULL
;
1304 struct dom_sid user_sid
;
1305 struct dom_sid group_sid
;
1306 bool username_was_mapped
;
1309 uid_t uid
= (uid_t
)-1;
1310 gid_t gid
= (gid_t
)-1;
1312 struct auth_serversupplied_info
*result
;
1314 result
= make_server_info(NULL
);
1315 if (result
== NULL
) {
1316 DEBUG(4, ("make_server_info failed!\n"));
1317 return NT_STATUS_NO_MEMORY
;
1321 Here is where we should check the list of
1322 trusted domains, and verify that the SID
1326 memcpy(&user_sid
, &info
->sids
[0].sid
, sizeof(user_sid
));
1327 memcpy(&group_sid
, &info
->sids
[1].sid
, sizeof(group_sid
));
1329 if (info
->account_name
) {
1330 nt_username
= talloc_strdup(result
, info
->account_name
);
1332 /* If the server didn't give us one, just use the one we sent
1334 nt_username
= talloc_strdup(result
, sent_nt_username
);
1337 TALLOC_FREE(result
);
1338 return NT_STATUS_NO_MEMORY
;
1341 if (info
->domain_name
) {
1342 nt_domain
= talloc_strdup(result
, info
->domain_name
);
1344 /* If the server didn't give us one, just use the one we sent
1346 nt_domain
= talloc_strdup(result
, domain
);
1349 TALLOC_FREE(result
);
1350 return NT_STATUS_NO_MEMORY
;
1353 /* try to fill the SAM account.. If getpwnam() fails, then try the
1354 add user script (2.2.x behavior).
1356 We use the _unmapped_ username here in an attempt to provide
1357 consistent username mapping behavior between kerberos and NTLM[SSP]
1358 authentication in domain mode security. I.E. Username mapping
1359 should be applied to the fully qualified username
1360 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1361 called map_username() unnecessarily in make_user_info_map() but
1362 that is how the current code is designed. Making the change here
1363 is the least disruptive place. -- jerry */
1365 if ( !(sam_account
= samu_new( result
)) ) {
1366 TALLOC_FREE(result
);
1367 return NT_STATUS_NO_MEMORY
;
1370 /* this call will try to create the user if necessary */
1372 nt_status
= fill_sam_account(result
, nt_domain
, sent_nt_username
,
1373 &found_username
, &uid
, &gid
, sam_account
,
1374 &username_was_mapped
);
1376 /* if we still don't have a valid unix account check for
1377 'map to guest = bad uid' */
1379 if (!NT_STATUS_IS_OK(nt_status
)) {
1380 TALLOC_FREE( result
);
1381 if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID
) {
1382 make_server_info_guest(NULL
, server_info
);
1383 return NT_STATUS_OK
;
1388 if (!pdb_set_nt_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1389 TALLOC_FREE(result
);
1390 return NT_STATUS_NO_MEMORY
;
1393 if (!pdb_set_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1394 TALLOC_FREE(result
);
1395 return NT_STATUS_NO_MEMORY
;
1398 if (!pdb_set_domain(sam_account
, nt_domain
, PDB_CHANGED
)) {
1399 TALLOC_FREE(result
);
1400 return NT_STATUS_NO_MEMORY
;
1403 if (!pdb_set_user_sid(sam_account
, &user_sid
, PDB_CHANGED
)) {
1404 TALLOC_FREE(result
);
1405 return NT_STATUS_UNSUCCESSFUL
;
1408 if (!pdb_set_group_sid(sam_account
, &group_sid
, PDB_CHANGED
)) {
1409 TALLOC_FREE(result
);
1410 return NT_STATUS_UNSUCCESSFUL
;
1413 if (!pdb_set_fullname(sam_account
, info
->full_name
, PDB_CHANGED
)) {
1414 TALLOC_FREE(result
);
1415 return NT_STATUS_NO_MEMORY
;
1418 if (!pdb_set_logon_script(sam_account
, info
->logon_script
, PDB_CHANGED
)) {
1419 TALLOC_FREE(result
);
1420 return NT_STATUS_NO_MEMORY
;
1423 if (!pdb_set_profile_path(sam_account
, info
->profile_path
, PDB_CHANGED
)) {
1424 TALLOC_FREE(result
);
1425 return NT_STATUS_NO_MEMORY
;
1428 if (!pdb_set_homedir(sam_account
, info
->home_directory
, PDB_CHANGED
)) {
1429 TALLOC_FREE(result
);
1430 return NT_STATUS_NO_MEMORY
;
1433 if (!pdb_set_dir_drive(sam_account
, info
->home_drive
, PDB_CHANGED
)) {
1434 TALLOC_FREE(result
);
1435 return NT_STATUS_NO_MEMORY
;
1438 if (!pdb_set_acct_ctrl(sam_account
, info
->acct_flags
, PDB_CHANGED
)) {
1439 TALLOC_FREE(result
);
1440 return NT_STATUS_NO_MEMORY
;
1443 if (!pdb_set_pass_last_set_time(
1445 nt_time_to_unix(info
->pass_last_set_time
),
1447 TALLOC_FREE(result
);
1448 return NT_STATUS_NO_MEMORY
;
1451 if (!pdb_set_pass_can_change_time(
1453 nt_time_to_unix(info
->pass_can_change_time
),
1455 TALLOC_FREE(result
);
1456 return NT_STATUS_NO_MEMORY
;
1459 if (!pdb_set_pass_must_change_time(
1461 nt_time_to_unix(info
->pass_must_change_time
),
1463 TALLOC_FREE(result
);
1464 return NT_STATUS_NO_MEMORY
;
1467 /* save this here to _net_sam_logon() doesn't fail (it assumes a
1468 valid struct samu) */
1470 result
->sam_account
= sam_account
;
1471 result
->unix_name
= talloc_strdup(result
, found_username
);
1473 result
->sanitized_username
= sanitize_username(result
,
1475 result
->login_server
= talloc_strdup(result
, info
->logon_server
);
1477 if ((result
->unix_name
== NULL
)
1478 || (result
->sanitized_username
== NULL
)
1479 || (result
->login_server
== NULL
)) {
1480 TALLOC_FREE(result
);
1481 return NT_STATUS_NO_MEMORY
;
1484 /* Fill in the unix info we found on the way */
1486 result
->utok
.uid
= uid
;
1487 result
->utok
.gid
= gid
;
1489 /* Create a 'combined' list of all SIDs we might want in the SD */
1491 result
->num_sids
= info
->num_sids
- 2;
1492 result
->sids
= talloc_array(result
, struct dom_sid
, result
->num_sids
);
1493 if (result
->sids
== NULL
) {
1494 TALLOC_FREE(result
);
1495 return NT_STATUS_NO_MEMORY
;
1498 for (i
=0; i
< result
->num_sids
; i
++) {
1499 memcpy(&result
->sids
[i
], &info
->sids
[i
+2].sid
, sizeof(result
->sids
[i
]));
1502 /* Ensure the primary group sid is at position 0. */
1503 sort_sid_array_for_smbd(result
, &group_sid
);
1505 /* ensure we are never given NULL session keys */
1507 if (memcmp(info
->user_session_key
, zeros
, sizeof(zeros
)) == 0) {
1508 result
->user_session_key
= data_blob_null
;
1510 result
->user_session_key
= data_blob_talloc(
1511 result
, info
->user_session_key
,
1512 sizeof(info
->user_session_key
));
1515 if (memcmp(info
->lm_session_key
, zeros
, 8) == 0) {
1516 result
->lm_session_key
= data_blob_null
;
1518 result
->lm_session_key
= data_blob_talloc(
1519 result
, info
->lm_session_key
,
1520 sizeof(info
->lm_session_key
));
1523 result
->nss_token
|= username_was_mapped
;
1525 *server_info
= result
;
1527 return NT_STATUS_OK
;
1531 * Verify whether or not given domain is trusted.
1533 * @param domain_name name of the domain to be verified
1534 * @return true if domain is one of the trusted ones or
1535 * false if otherwise
1538 bool is_trusted_domain(const char* dom_name
)
1540 struct dom_sid trustdom_sid
;
1543 /* no trusted domains for a standalone server */
1545 if ( lp_server_role() == ROLE_STANDALONE
)
1548 if (dom_name
== NULL
|| dom_name
[0] == '\0') {
1552 if (strequal(dom_name
, get_global_sam_name())) {
1556 /* if we are a DC, then check for a direct trust relationships */
1560 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1561 "[%s]\n", dom_name
));
1562 ret
= pdb_get_trusteddom_pw(dom_name
, NULL
, NULL
, NULL
);
1570 /* If winbind is around, ask it */
1572 result
= wb_is_trusted_domain(dom_name
);
1574 if (result
== WBC_ERR_SUCCESS
) {
1578 if (result
== WBC_ERR_DOMAIN_NOT_FOUND
) {
1579 /* winbind could not find the domain */
1583 /* The only other possible result is that winbind is not up
1584 and running. We need to update the trustdom_cache
1587 update_trustdom_cache();
1590 /* now the trustdom cache should be available a DC could still
1591 * have a transitive trust so fall back to the cache of trusted
1592 * domains (like a domain member would use */
1594 if ( trustdom_cache_fetch(dom_name
, &trustdom_sid
) ) {