?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
docs: Rename manpages-3 -> manpages.
[Samba/gbeck.git] / source3 / winbindd / winbindd_pam.c
blob6ad0baf1964258e9e1c31fff33b5fcec29c3dd7b
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind daemon - pam auth funcions
5
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27 #include "../libcli/auth/libcli_auth.h"
28 #include "../librpc/gen_ndr/ndr_samr_c.h"
29 #include "rpc_client/cli_pipe.h"
30 #include "rpc_client/cli_samr.h"
31 #include "../librpc/gen_ndr/ndr_netlogon.h"
32 #include "rpc_client/cli_netlogon.h"
33 #include "smb_krb5.h"
34 #include "../lib/crypto/arcfour.h"
35 #include "../libcli/security/security.h"
36 #include "ads.h"
37 #include "../librpc/gen_ndr/krb5pac.h"
38 #include "passdb/machine_sid.h"
39 #include "auth.h"
40 #include "../lib/tsocket/tsocket.h"
41
42 #undef DBGC_CLASS
43 #define DBGC_CLASS DBGC_WINBIND
44
45 #define LOGON_KRB5_FAIL_CLOCK_SKEW 0x02000000
46
47 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
48 struct winbindd_response *resp,
49 struct netr_SamInfo3 *info3)
50 {
51 char *ex;
52 uint32_t i;
53
54 resp->data.auth.info3.logon_time =
55 nt_time_to_unix(info3->base.logon_time);
56 resp->data.auth.info3.logoff_time =
57 nt_time_to_unix(info3->base.logoff_time);
58 resp->data.auth.info3.kickoff_time =
59 nt_time_to_unix(info3->base.kickoff_time);
60 resp->data.auth.info3.pass_last_set_time =
61 nt_time_to_unix(info3->base.last_password_change);
62 resp->data.auth.info3.pass_can_change_time =
63 nt_time_to_unix(info3->base.allow_password_change);
64 resp->data.auth.info3.pass_must_change_time =
65 nt_time_to_unix(info3->base.force_password_change);
66
67 resp->data.auth.info3.logon_count = info3->base.logon_count;
68 resp->data.auth.info3.bad_pw_count = info3->base.bad_password_count;
69
70 resp->data.auth.info3.user_rid = info3->base.rid;
71 resp->data.auth.info3.group_rid = info3->base.primary_gid;
72 sid_to_fstring(resp->data.auth.info3.dom_sid, info3->base.domain_sid);
73
74 resp->data.auth.info3.num_groups = info3->base.groups.count;
75 resp->data.auth.info3.user_flgs = info3->base.user_flags;
76
77 resp->data.auth.info3.acct_flags = info3->base.acct_flags;
78 resp->data.auth.info3.num_other_sids = info3->sidcount;
79
80 fstrcpy(resp->data.auth.info3.user_name,
81 info3->base.account_name.string);
82 fstrcpy(resp->data.auth.info3.full_name,
83 info3->base.full_name.string);
84 fstrcpy(resp->data.auth.info3.logon_script,
85 info3->base.logon_script.string);
86 fstrcpy(resp->data.auth.info3.profile_path,
87 info3->base.profile_path.string);
88 fstrcpy(resp->data.auth.info3.home_dir,
89 info3->base.home_directory.string);
90 fstrcpy(resp->data.auth.info3.dir_drive,
91 info3->base.home_drive.string);
92
93 fstrcpy(resp->data.auth.info3.logon_srv,
94 info3->base.logon_server.string);
95 fstrcpy(resp->data.auth.info3.logon_dom,
96 info3->base.logon_domain.string);
97
98 ex = talloc_strdup(mem_ctx, "");
99 NT_STATUS_HAVE_NO_MEMORY(ex);
100
101 for (i=0; i < info3->base.groups.count; i++) {
102 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
103 info3->base.groups.rids[i].rid,
104 info3->base.groups.rids[i].attributes);
105 NT_STATUS_HAVE_NO_MEMORY(ex);
106 }
107
108 for (i=0; i < info3->sidcount; i++) {
109 char *sid;
110
111 sid = dom_sid_string(mem_ctx, info3->sids[i].sid);
112 NT_STATUS_HAVE_NO_MEMORY(sid);
113
114 ex = talloc_asprintf_append_buffer(ex, "%s:0x%08X\n",
115 sid,
116 info3->sids[i].attributes);
117 NT_STATUS_HAVE_NO_MEMORY(ex);
118
119 talloc_free(sid);
120 }
121
122 resp->extra_data.data = ex;
123 resp->length += talloc_get_size(ex);
124
125 return NT_STATUS_OK;
126 }
127
128 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
129 struct winbindd_response *resp,
130 struct netr_SamInfo3 *info3)
131 {
132 DATA_BLOB blob;
133 enum ndr_err_code ndr_err;
134
135 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
136 (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
137 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
138 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
139 return ndr_map_error2ntstatus(ndr_err);
140 }
141
142 resp->extra_data.data = blob.data;
143 resp->length += blob.length;
144
145 return NT_STATUS_OK;
146 }
147
148 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
149 struct winbindd_response *resp,
150 const struct netr_SamInfo3 *info3,
151 const char *name_domain,
152 const char *name_user)
153 {
154 /* We've been asked to return the unix username, per
155 'winbind use default domain' settings and the like */
156
157 const char *nt_username, *nt_domain;
158
159 nt_domain = talloc_strdup(mem_ctx, info3->base.logon_domain.string);
160 if (!nt_domain) {
161 /* If the server didn't give us one, just use the one
162 * we sent them */
163 nt_domain = name_domain;
164 }
165
166 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
167 if (!nt_username) {
168 /* If the server didn't give us one, just use the one
169 * we sent them */
170 nt_username = name_user;
171 }
172
173 fill_domain_username(resp->data.auth.unix_username,
174 nt_domain, nt_username, true);
175
176 DEBUG(5, ("Setting unix username to [%s]\n",
177 resp->data.auth.unix_username));
178
179 return NT_STATUS_OK;
180 }
181
182 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
183 struct winbindd_response *resp,
184 const struct netr_SamInfo3 *info3,
185 const char *name_domain,
186 const char *name_user)
187 {
188 char *afsname = NULL;
189 char *cell;
190 char *token;
191
192 afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
193 if (afsname == NULL) {
194 return NT_STATUS_NO_MEMORY;
195 }
196
197 afsname = talloc_string_sub(mem_ctx,
198 lp_afs_username_map(),
199 "%D", name_domain);
200 afsname = talloc_string_sub(mem_ctx, afsname,
201 "%u", name_user);
202 afsname = talloc_string_sub(mem_ctx, afsname,
203 "%U", name_user);
204
205 {
206 struct dom_sid user_sid;
207 fstring sidstr;
208
209 sid_compose(&user_sid, info3->base.domain_sid,
210 info3->base.rid);
211 sid_to_fstring(sidstr, &user_sid);
212 afsname = talloc_string_sub(mem_ctx, afsname,
213 "%s", sidstr);
214 }
215
216 if (afsname == NULL) {
217 return NT_STATUS_NO_MEMORY;
218 }
219
220 if (!strlower_m(afsname)) {
221 return NT_STATUS_INVALID_PARAMETER;
222 }
223
224 DEBUG(10, ("Generating token for user %s\n", afsname));
225
226 cell = strchr(afsname, '@');
227
228 if (cell == NULL) {
229 return NT_STATUS_NO_MEMORY;
230 }
231
232 *cell = '\0';
233 cell += 1;
234
235 token = afs_createtoken_str(afsname, cell);
236 if (token == NULL) {
237 return NT_STATUS_OK;
238 }
239 resp->extra_data.data = talloc_strdup(mem_ctx, token);
240 if (resp->extra_data.data == NULL) {
241 return NT_STATUS_NO_MEMORY;
242 }
243 resp->length += strlen((const char *)resp->extra_data.data)+1;
244
245 return NT_STATUS_OK;
246 }
247
248 static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
249 const char *group_sid)
250 /**
251 * Check whether a user belongs to a group or list of groups.
252 *
253 * @param mem_ctx talloc memory context.
254 * @param info3 user information, including group membership info.
255 * @param group_sid One or more groups , separated by commas.
256 *
257 * @return NT_STATUS_OK on success,
258 * NT_STATUS_LOGON_FAILURE if the user does not belong,
259 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
260 */
261 {
262 struct dom_sid *require_membership_of_sid;
263 uint32_t num_require_membership_of_sid;
264 char *req_sid;
265 const char *p;
266 struct dom_sid sid;
267 size_t i;
268 struct security_token *token;
269 TALLOC_CTX *frame = talloc_stackframe();
270 NTSTATUS status;
271
272 /* Parse the 'required group' SID */
273
274 if (!group_sid || !group_sid[0]) {
275 /* NO sid supplied, all users may access */
276 TALLOC_FREE(frame);
277 return NT_STATUS_OK;
278 }
279
280 token = talloc_zero(talloc_tos(), struct security_token);
281 if (token == NULL) {
282 DEBUG(0, ("talloc failed\n"));
283 TALLOC_FREE(frame);
284 return NT_STATUS_NO_MEMORY;
285 }
286
287 num_require_membership_of_sid = 0;
288 require_membership_of_sid = NULL;
289
290 p = group_sid;
291
292 while (next_token_talloc(talloc_tos(), &p, &req_sid, ",")) {
293 if (!string_to_sid(&sid, req_sid)) {
294 DEBUG(0, ("check_info3_in_group: could not parse %s "
295 "as a SID!", req_sid));
296 TALLOC_FREE(frame);
297 return NT_STATUS_INVALID_PARAMETER;
298 }
299
300 status = add_sid_to_array(talloc_tos(), &sid,
301 &require_membership_of_sid,
302 &num_require_membership_of_sid);
303 if (!NT_STATUS_IS_OK(status)) {
304 DEBUG(0, ("add_sid_to_array failed\n"));
305 TALLOC_FREE(frame);
306 return status;
307 }
308 }
309
310 status = sid_array_from_info3(talloc_tos(), info3,
311 &token->sids,
312 &token->num_sids,
313 true);
314 if (!NT_STATUS_IS_OK(status)) {
315 TALLOC_FREE(frame);
316 return status;
317 }
318
319 if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
320 token))
321 || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
322 token))) {
323 DEBUG(3, ("could not add aliases: %s\n",
324 nt_errstr(status)));
325 TALLOC_FREE(frame);
326 return status;
327 }
328
329 security_token_debug(DBGC_CLASS, 10, token);
330
331 for (i=0; i<num_require_membership_of_sid; i++) {
332 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
333 &require_membership_of_sid[i])));
334 if (nt_token_check_sid(&require_membership_of_sid[i],
335 token)) {
336 DEBUG(10, ("Access ok\n"));
337 TALLOC_FREE(frame);
338 return NT_STATUS_OK;
339 }
340 }
341
342 /* Do not distinguish this error from a wrong username/pw */
343
344 TALLOC_FREE(frame);
345 return NT_STATUS_LOGON_FAILURE;
346 }
347
348 struct winbindd_domain *find_auth_domain(uint8_t flags,
349 const char *domain_name)
350 {
351 struct winbindd_domain *domain;
352
353 if (IS_DC) {
354 domain = find_domain_from_name_noinit(domain_name);
355 if (domain == NULL) {
356 DEBUG(3, ("Authentication for domain [%s] refused "
357 "as it is not a trusted domain\n",
358 domain_name));
359 }
360 return domain;
361 }
362
363 if (strequal(domain_name, get_global_sam_name())) {
364 return find_domain_from_name_noinit(domain_name);
365 }
366
367 /* we can auth against trusted domains */
368 if (flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
369 domain = find_domain_from_name_noinit(domain_name);
370 if (domain == NULL) {
371 DEBUG(3, ("Authentication for domain [%s] skipped "
372 "as it is not a trusted domain\n",
373 domain_name));
374 } else {
375 return domain;
376 }
377 }
378
379 return find_our_domain();
380 }
381
382 static void fill_in_password_policy(struct winbindd_response *r,
383 const struct samr_DomInfo1 *p)
384 {
385 r->data.auth.policy.min_length_password =
386 p->min_password_length;
387 r->data.auth.policy.password_history =
388 p->password_history_length;
389 r->data.auth.policy.password_properties =
390 p->password_properties;
391 r->data.auth.policy.expire =
392 nt_time_to_unix_abs((const NTTIME *)&(p->max_password_age));
393 r->data.auth.policy.min_passwordage =
394 nt_time_to_unix_abs((const NTTIME *)&(p->min_password_age));
395 }
396
397 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
398 struct winbindd_response *response)
399 {
400 TALLOC_CTX *frame = talloc_stackframe();
401 struct winbindd_methods *methods;
402 NTSTATUS status;
403 struct samr_DomInfo1 password_policy;
404
405 if ( !winbindd_can_contact_domain( domain ) ) {
406 DEBUG(5,("fillup_password_policy: No inbound trust to "
407 "contact domain %s\n", domain->name));
408 status = NT_STATUS_NOT_SUPPORTED;
409 goto done;
410 }
411
412 methods = domain->methods;
413
414 status = methods->password_policy(domain, talloc_tos(), &password_policy);
415 if (NT_STATUS_IS_ERR(status)) {
416 goto done;
417 }
418
419 fill_in_password_policy(response, &password_policy);
420
421 done:
422 TALLOC_FREE(frame);
423 return NT_STATUS_OK;
424 }
425
426 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
427 TALLOC_CTX *mem_ctx,
428 uint16 *lockout_threshold)
429 {
430 struct winbindd_methods *methods;
431 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
432 struct samr_DomInfo12 lockout_policy;
433
434 *lockout_threshold = 0;
435
436 methods = domain->methods;
437
438 status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
439 if (NT_STATUS_IS_ERR(status)) {
440 return status;
441 }
442
443 *lockout_threshold = lockout_policy.lockout_threshold;
444
445 return NT_STATUS_OK;
446 }
447
448 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
449 TALLOC_CTX *mem_ctx,
450 uint32 *password_properties)
451 {
452 struct winbindd_methods *methods;
453 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
454 struct samr_DomInfo1 password_policy;
455
456 *password_properties = 0;
457
458 methods = domain->methods;
459
460 status = methods->password_policy(domain, mem_ctx, &password_policy);
461 if (NT_STATUS_IS_ERR(status)) {
462 return status;
463 }
464
465 *password_properties = password_policy.password_properties;
466
467 return NT_STATUS_OK;
468 }
469
470 #ifdef HAVE_KRB5
471
472 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
473 const char *type,
474 uid_t uid,
475 const char **user_ccache_file)
476 {
477 /* accept FILE and WRFILE as krb5_cc_type from the client and then
478 * build the full ccname string based on the user's uid here -
479 * Guenther*/
480
481 const char *gen_cc = NULL;
482
483 if (uid != -1) {
484 if (strequal(type, "FILE")) {
485 gen_cc = talloc_asprintf(
486 mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
487 }
488 if (strequal(type, "WRFILE")) {
489 gen_cc = talloc_asprintf(
490 mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
491 }
492 }
493
494 *user_ccache_file = gen_cc;
495
496 if (gen_cc == NULL) {
497 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
498 }
499 if (gen_cc == NULL) {
500 DEBUG(0,("out of memory\n"));
501 return NULL;
502 }
503
504 DEBUG(10, ("using ccache: %s%s\n", gen_cc,
505 (*user_ccache_file == NULL) ? " (internal)":""));
506
507 return gen_cc;
508 }
509
510 #endif
511
512 uid_t get_uid_from_request(struct winbindd_request *request)
513 {
514 uid_t uid;
515
516 uid = request->data.auth.uid;
517
518 if (uid < 0) {
519 DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
520 return -1;
521 }
522 return uid;
523 }
524
525 /**********************************************************************
526 Authenticate a user with a clear text password using Kerberos and fill up
527 ccache if required
528 **********************************************************************/
529
530 static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
531 struct winbindd_domain *domain,
532 const char *user,
533 const char *pass,
534 const char *krb5_cc_type,
535 uid_t uid,
536 struct netr_SamInfo3 **info3,
537 fstring krb5ccname)
538 {
539 #ifdef HAVE_KRB5
540 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
541 krb5_error_code krb5_ret;
542 const char *cc = NULL;
543 const char *principal_s = NULL;
544 const char *service = NULL;
545 char *realm = NULL;
546 fstring name_domain, name_user;
547 time_t ticket_lifetime = 0;
548 time_t renewal_until = 0;
549 ADS_STRUCT *ads;
550 time_t time_offset = 0;
551 const char *user_ccache_file;
552 struct PAC_LOGON_INFO *logon_info = NULL;
553
554 *info3 = NULL;
555
556 /* 1st step:
557 * prepare a krb5_cc_cache string for the user */
558
559 if (uid == -1) {
560 DEBUG(0,("no valid uid\n"));
561 }
562
563 cc = generate_krb5_ccache(mem_ctx,
564 krb5_cc_type,
565 uid,
566 &user_ccache_file);
567 if (cc == NULL) {
568 return NT_STATUS_NO_MEMORY;
569 }
570
571
572 /* 2nd step:
573 * get kerberos properties */
574
575 if (domain->private_data) {
576 ads = (ADS_STRUCT *)domain->private_data;
577 time_offset = ads->auth.time_offset;
578 }
579
580
581 /* 3rd step:
582 * do kerberos auth and setup ccache as the user */
583
584 parse_domain_user(user, name_domain, name_user);
585
586 realm = domain->alt_name;
587 if (!strupper_m(realm)) {
588 return NT_STATUS_INVALID_PARAMETER;
589 }
590
591 principal_s = talloc_asprintf(mem_ctx, "%s@%s", name_user, realm);
592 if (principal_s == NULL) {
593 return NT_STATUS_NO_MEMORY;
594 }
595
596 service = talloc_asprintf(mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
597 if (service == NULL) {
598 return NT_STATUS_NO_MEMORY;
599 }
600
601 /* if this is a user ccache, we need to act as the user to let the krb5
602 * library handle the chown, etc. */
603
604 /************************ ENTERING NON-ROOT **********************/
605
606 if (user_ccache_file != NULL) {
607 set_effective_uid(uid);
608 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
609 }
610
611 result = kerberos_return_pac(mem_ctx,
612 principal_s,
613 pass,
614 time_offset,
615 &ticket_lifetime,
616 &renewal_until,
617 cc,
618 true,
619 true,
620 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
621 NULL,
622 &logon_info);
623 if (user_ccache_file != NULL) {
624 gain_root_privilege();
625 }
626
627 /************************ RETURNED TO ROOT **********************/
628
629 if (!NT_STATUS_IS_OK(result)) {
630 goto failed;
631 }
632
633 *info3 = &logon_info->info3;
634
635 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
636 principal_s));
637
638 /* if we had a user's ccache then return that string for the pam
639 * environment */
640
641 if (user_ccache_file != NULL) {
642
643 fstrcpy(krb5ccname, user_ccache_file);
644
645 result = add_ccache_to_list(principal_s,
646 cc,
647 service,
648 user,
649 pass,
650 realm,
651 uid,
652 time(NULL),
653 ticket_lifetime,
654 renewal_until,
655 false);
656
657 if (!NT_STATUS_IS_OK(result)) {
658 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
659 nt_errstr(result)));
660 }
661 } else {
662
663 /* need to delete the memory cred cache, it is not used anymore */
664
665 krb5_ret = ads_kdestroy(cc);
666 if (krb5_ret) {
667 DEBUG(3,("winbindd_raw_kerberos_login: "
668 "could not destroy krb5 credential cache: "
669 "%s\n", error_message(krb5_ret)));
670 }
671
672 }
673
674 return NT_STATUS_OK;
675
676 failed:
677
678 /* we could have created a new credential cache with a valid tgt in it
679 * but we werent able to get or verify the service ticket for this
680 * local host and therefor didn't get the PAC, we need to remove that
681 * cache entirely now */
682
683 krb5_ret = ads_kdestroy(cc);
684 if (krb5_ret) {
685 DEBUG(3,("winbindd_raw_kerberos_login: "
686 "could not destroy krb5 credential cache: "
687 "%s\n", error_message(krb5_ret)));
688 }
689
690 if (!NT_STATUS_IS_OK(remove_ccache(user))) {
691 DEBUG(3,("winbindd_raw_kerberos_login: "
692 "could not remove ccache for user %s\n",
693 user));
694 }
695
696 return result;
697 #else
698 return NT_STATUS_NOT_SUPPORTED;
699 #endif /* HAVE_KRB5 */
700 }
701
702 /****************************************************************
703 ****************************************************************/
704
705 bool check_request_flags(uint32_t flags)
706 {
707 uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
708 WBFLAG_PAM_INFO3_TEXT |
709 WBFLAG_PAM_INFO3_NDR;
710
711 if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
712 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
713 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
714 !(flags & flags_edata) ) {
715 return true;
716 }
717
718 DEBUG(1, ("check_request_flags: invalid request flags[0x%08X]\n",
719 flags));
720
721 return false;
722 }
723
724 /****************************************************************
725 ****************************************************************/
726
727 static NTSTATUS append_auth_data(TALLOC_CTX *mem_ctx,
728 struct winbindd_response *resp,
729 uint32_t request_flags,
730 struct netr_SamInfo3 *info3,
731 const char *name_domain,
732 const char *name_user)
733 {
734 NTSTATUS result;
735
736 if (request_flags & WBFLAG_PAM_USER_SESSION_KEY) {
737 memcpy(resp->data.auth.user_session_key,
738 info3->base.key.key,
739 sizeof(resp->data.auth.user_session_key)
740 /* 16 */);
741 }
742
743 if (request_flags & WBFLAG_PAM_LMKEY) {
744 memcpy(resp->data.auth.first_8_lm_hash,
745 info3->base.LMSessKey.key,
746 sizeof(resp->data.auth.first_8_lm_hash)
747 /* 8 */);
748 }
749
750 if (request_flags & WBFLAG_PAM_UNIX_NAME) {
751 result = append_unix_username(mem_ctx, resp,
752 info3, name_domain, name_user);
753 if (!NT_STATUS_IS_OK(result)) {
754 DEBUG(10,("Failed to append Unix Username: %s\n",
755 nt_errstr(result)));
756 return result;
757 }
758 }
759
760 /* currently, anything from here on potentially overwrites extra_data. */
761
762 if (request_flags & WBFLAG_PAM_INFO3_NDR) {
763 result = append_info3_as_ndr(mem_ctx, resp, info3);
764 if (!NT_STATUS_IS_OK(result)) {
765 DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
766 nt_errstr(result)));
767 return result;
768 }
769 }
770
771 if (request_flags & WBFLAG_PAM_INFO3_TEXT) {
772 result = append_info3_as_txt(mem_ctx, resp, info3);
773 if (!NT_STATUS_IS_OK(result)) {
774 DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
775 nt_errstr(result)));
776 return result;
777 }
778 }
779
780 if (request_flags & WBFLAG_PAM_AFS_TOKEN) {
781 result = append_afs_token(mem_ctx, resp,
782 info3, name_domain, name_user);
783 if (!NT_STATUS_IS_OK(result)) {
784 DEBUG(10,("Failed to append AFS token: %s\n",
785 nt_errstr(result)));
786 return result;
787 }
788 }
789
790 return NT_STATUS_OK;
791 }
792
793 static NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
794 struct winbindd_cli_state *state,
795 struct netr_SamInfo3 **info3)
796 {
797 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
798 uint16 max_allowed_bad_attempts;
799 fstring name_domain, name_user;
800 struct dom_sid sid;
801 enum lsa_SidType type;
802 uchar new_nt_pass[NT_HASH_LEN];
803 const uint8 *cached_nt_pass;
804 const uint8 *cached_salt;
805 struct netr_SamInfo3 *my_info3;
806 time_t kickoff_time, must_change_time;
807 bool password_good = false;
808 #ifdef HAVE_KRB5
809 struct winbindd_tdc_domain *tdc_domain = NULL;
810 #endif
811
812 *info3 = NULL;
813
814 ZERO_STRUCTP(info3);
815
816 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
817
818 /* Parse domain and username */
819
820 parse_domain_user(state->request->data.auth.user, name_domain, name_user);
821
822
823 if (!lookup_cached_name(name_domain,
824 name_user,
825 &sid,
826 &type)) {
827 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
828 return NT_STATUS_NO_SUCH_USER;
829 }
830
831 if (type != SID_NAME_USER) {
832 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
833 return NT_STATUS_LOGON_FAILURE;
834 }
835
836 result = winbindd_get_creds(domain,
837 state->mem_ctx,
838 &sid,
839 &my_info3,
840 &cached_nt_pass,
841 &cached_salt);
842 if (!NT_STATUS_IS_OK(result)) {
843 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
844 return result;
845 }
846
847 *info3 = my_info3;
848
849 E_md4hash(state->request->data.auth.pass, new_nt_pass);
850
851 dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
852 dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
853 if (cached_salt) {
854 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
855 }
856
857 if (cached_salt) {
858 /* In this case we didn't store the nt_hash itself,
859 but the MD5 combination of salt + nt_hash. */
860 uchar salted_hash[NT_HASH_LEN];
861 E_md5hash(cached_salt, new_nt_pass, salted_hash);
862
863 password_good = (memcmp(cached_nt_pass, salted_hash,
864 NT_HASH_LEN) == 0);
865 } else {
866 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
867 password_good = (memcmp(cached_nt_pass, new_nt_pass,
868 NT_HASH_LEN) == 0);
869 }
870
871 if (password_good) {
872
873 /* User *DOES* know the password, update logon_time and reset
874 * bad_pw_count */
875
876 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
877
878 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
879 return NT_STATUS_ACCOUNT_LOCKED_OUT;
880 }
881
882 if (my_info3->base.acct_flags & ACB_DISABLED) {
883 return NT_STATUS_ACCOUNT_DISABLED;
884 }
885
886 if (my_info3->base.acct_flags & ACB_WSTRUST) {
887 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
888 }
889
890 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
891 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
892 }
893
894 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
895 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
896 }
897
898 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
899 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
900 my_info3->base.acct_flags));
901 return NT_STATUS_LOGON_FAILURE;
902 }
903
904 kickoff_time = nt_time_to_unix(my_info3->base.kickoff_time);
905 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
906 return NT_STATUS_ACCOUNT_EXPIRED;
907 }
908
909 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
910 if (must_change_time != 0 && must_change_time < time(NULL)) {
911 /* we allow grace logons when the password has expired */
912 my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
913 /* return NT_STATUS_PASSWORD_EXPIRED; */
914 goto success;
915 }
916
917 #ifdef HAVE_KRB5
918 if ((state->request->flags & WBFLAG_PAM_KRB5) &&
919 ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
920 ((tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL) ||
921 /* used to cope with the case winbindd starting without network. */
922 !strequal(tdc_domain->domain_name, tdc_domain->dns_name))) {
923
924 uid_t uid = -1;
925 const char *cc = NULL;
926 char *realm = NULL;
927 const char *principal_s = NULL;
928 const char *service = NULL;
929 const char *user_ccache_file;
930
931 uid = get_uid_from_request(state->request);
932 if (uid == -1) {
933 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
934 return NT_STATUS_INVALID_PARAMETER;
935 }
936
937 cc = generate_krb5_ccache(state->mem_ctx,
938 state->request->data.auth.krb5_cc_type,
939 state->request->data.auth.uid,
940 &user_ccache_file);
941 if (cc == NULL) {
942 return NT_STATUS_NO_MEMORY;
943 }
944
945 realm = domain->alt_name;
946 if (!strupper_m(realm)) {
947 return NT_STATUS_INVALID_PARAMETER;
948 }
949
950 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
951 if (principal_s == NULL) {
952 return NT_STATUS_NO_MEMORY;
953 }
954
955 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
956 if (service == NULL) {
957 return NT_STATUS_NO_MEMORY;
958 }
959
960 if (user_ccache_file != NULL) {
961
962 fstrcpy(state->response->data.auth.krb5ccname,
963 user_ccache_file);
964
965 result = add_ccache_to_list(principal_s,
966 cc,
967 service,
968 state->request->data.auth.user,
969 state->request->data.auth.pass,
970 domain->alt_name,
971 uid,
972 time(NULL),
973 time(NULL) + lp_winbind_cache_time(),
974 time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
975 true);
976
977 if (!NT_STATUS_IS_OK(result)) {
978 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
979 "to add ccache to list: %s\n",
980 nt_errstr(result)));
981 }
982 }
983 }
984 #endif /* HAVE_KRB5 */
985 success:
986 /* FIXME: we possibly should handle logon hours as well (does xp when
987 * offline?) see auth/auth_sam.c:sam_account_ok for details */
988
989 unix_to_nt_time(&my_info3->base.logon_time, time(NULL));
990 my_info3->base.bad_password_count = 0;
991
992 result = winbindd_update_creds_by_info3(domain,
993 state->request->data.auth.user,
994 state->request->data.auth.pass,
995 my_info3);
996 if (!NT_STATUS_IS_OK(result)) {
997 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
998 nt_errstr(result)));
999 return result;
1000 }
1001
1002 return NT_STATUS_OK;
1003
1004 }
1005
1006 /* User does *NOT* know the correct password, modify info3 accordingly, but only if online */
1007 if (domain->online == false) {
1008 goto failed;
1009 }
1010
1011 /* failure of this is not critical */
1012 result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1013 if (!NT_STATUS_IS_OK(result)) {
1014 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1015 "Won't be able to honour account lockout policies\n"));
1016 }
1017
1018 /* increase counter */
1019 my_info3->base.bad_password_count++;
1020
1021 if (max_allowed_bad_attempts == 0) {
1022 goto failed;
1023 }
1024
1025 /* lockout user */
1026 if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1027
1028 uint32 password_properties;
1029
1030 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1031 if (!NT_STATUS_IS_OK(result)) {
1032 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1033 }
1034
1035 if ((my_info3->base.rid != DOMAIN_RID_ADMINISTRATOR) ||
1036 (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1037 my_info3->base.acct_flags |= ACB_AUTOLOCK;
1038 }
1039 }
1040
1041 failed:
1042 result = winbindd_update_creds_by_info3(domain,
1043 state->request->data.auth.user,
1044 NULL,
1045 my_info3);
1046
1047 if (!NT_STATUS_IS_OK(result)) {
1048 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1049 nt_errstr(result)));
1050 }
1051
1052 return NT_STATUS_LOGON_FAILURE;
1053 }
1054
1055 static NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1056 struct winbindd_cli_state *state,
1057 struct netr_SamInfo3 **info3)
1058 {
1059 struct winbindd_domain *contact_domain;
1060 fstring name_domain, name_user;
1061 NTSTATUS result;
1062
1063 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1064
1065 /* Parse domain and username */
1066
1067 parse_domain_user(state->request->data.auth.user, name_domain, name_user);
1068
1069 /* what domain should we contact? */
1070
1071 if ( IS_DC ) {
1072 if (!(contact_domain = find_domain_from_name(name_domain))) {
1073 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1074 state->request->data.auth.user, name_domain, name_user, name_domain));
1075 result = NT_STATUS_NO_SUCH_USER;
1076 goto done;
1077 }
1078
1079 } else {
1080 if (is_myname(name_domain)) {
1081 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1082 result = NT_STATUS_NO_SUCH_USER;
1083 goto done;
1084 }
1085
1086 contact_domain = find_domain_from_name(name_domain);
1087 if (contact_domain == NULL) {
1088 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1089 state->request->data.auth.user, name_domain, name_user, name_domain));
1090
1091 result = NT_STATUS_NO_SUCH_USER;
1092 goto done;
1093 }
1094 }
1095
1096 if (contact_domain->initialized &&
1097 contact_domain->active_directory) {
1098 goto try_login;
1099 }
1100
1101 if (!contact_domain->initialized) {
1102 init_dc_connection(contact_domain);
1103 }
1104
1105 if (!contact_domain->active_directory) {
1106 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1107 return NT_STATUS_INVALID_LOGON_TYPE;
1108 }
1109 try_login:
1110 result = winbindd_raw_kerberos_login(
1111 state->mem_ctx, contact_domain,
1112 state->request->data.auth.user,
1113 state->request->data.auth.pass,
1114 state->request->data.auth.krb5_cc_type,
1115 get_uid_from_request(state->request),
1116 info3, state->response->data.auth.krb5ccname);
1117 done:
1118 return result;
1119 }
1120
1121 static NTSTATUS winbindd_dual_auth_passdb(TALLOC_CTX *mem_ctx,
1122 uint32_t logon_parameters,
1123 const char *domain, const char *user,
1124 const DATA_BLOB *challenge,
1125 const DATA_BLOB *lm_resp,
1126 const DATA_BLOB *nt_resp,
1127 struct netr_SamInfo3 **pinfo3)
1128 {
1129 struct auth_usersupplied_info *user_info = NULL;
1130 struct tsocket_address *local;
1131 NTSTATUS status;
1132 int rc;
1133
1134 rc = tsocket_address_inet_from_strings(mem_ctx,
1135 "ip",
1136 "127.0.0.1",
1137 0,
1138 &local);
1139 if (rc < 0) {
1140 return NT_STATUS_NO_MEMORY;
1141 }
1142 status = make_user_info(&user_info, user, user, domain, domain,
1143 lp_netbios_name(), local, lm_resp, nt_resp, NULL, NULL,
1144 NULL, AUTH_PASSWORD_RESPONSE);
1145 if (!NT_STATUS_IS_OK(status)) {
1146 DEBUG(10, ("make_user_info failed: %s\n", nt_errstr(status)));
1147 return status;
1148 }
1149 user_info->logon_parameters = logon_parameters;
1150
1151 /* We don't want any more mapping of the username */
1152 user_info->mapped_state = True;
1153
1154 status = check_sam_security_info3(challenge, talloc_tos(), user_info,
1155 pinfo3);
1156 free_user_info(&user_info);
1157 DEBUG(10, ("Authenticaticating user %s\\%s returned %s\n", domain,
1158 user, nt_errstr(status)));
1159 return status;
1160 }
1161
1162 static NTSTATUS winbind_samlogon_retry_loop(struct winbindd_domain *domain,
1163 TALLOC_CTX *mem_ctx,
1164 uint32_t logon_parameters,
1165 const char *server,
1166 const char *username,
1167 const char *domainname,
1168 const char *workstation,
1169 const uint8_t chal[8],
1170 DATA_BLOB lm_response,
1171 DATA_BLOB nt_response,
1172 struct netr_SamInfo3 **info3)
1173 {
1174 int attempts = 0;
1175 bool retry = false;
1176 NTSTATUS result;
1177
1178 do {
1179 struct rpc_pipe_client *netlogon_pipe;
1180 const struct pipe_auth_data *auth;
1181 uint32_t neg_flags = 0;
1182
1183 ZERO_STRUCTP(info3);
1184 retry = false;
1185
1186 result = cm_connect_netlogon(domain, &netlogon_pipe);
1187
1188 if (!NT_STATUS_IS_OK(result)) {
1189 DEBUG(3,("could not open handle to NETLOGON pipe (error: %s)\n",
1190 nt_errstr(result)));
1191 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT)) {
1192 if (attempts > 0) {
1193 DEBUG(3, ("This is the second problem for this "
1194 "particular call, forcing the close of "
1195 "this connection\n"));
1196 invalidate_cm_connection(&domain->conn);
1197 } else {
1198 DEBUG(3, ("First call to cm_connect_netlogon "
1199 "has timed out, retrying\n"));
1200 continue;
1201 }
1202 }
1203 return result;
1204 }
1205 auth = netlogon_pipe->auth;
1206 if (netlogon_pipe->dc) {
1207 neg_flags = netlogon_pipe->dc->negotiate_flags;
1208 }
1209
1210 /* It is really important to try SamLogonEx here,
1211 * because in a clustered environment, we want to use
1212 * one machine account from multiple physical
1213 * computers.
1214 *
1215 * With a normal SamLogon call, we must keep the
1216 * credentials chain updated and intact between all
1217 * users of the machine account (which would imply
1218 * cross-node communication for every NTLM logon).
1219 *
1220 * (The credentials chain is not per NETLOGON pipe
1221 * connection, but globally on the server/client pair
1222 * by machine name).
1223 *
1224 * When using SamLogonEx, the credentials are not
1225 * supplied, but the session key is implied by the
1226 * wrapping SamLogon context.
1227 *
1228 * -- abartlet 21 April 2008
1229 *
1230 * It's also important to use NetlogonValidationSamInfo4 (6),
1231 * because it relies on the rpc transport encryption
1232 * and avoids using the global netlogon schannel
1233 * session key to en/decrypt secret information
1234 * like the user_session_key for network logons.
1235 *
1236 * [MS-APDS] 3.1.5.2 NTLM Network Logon
1237 * says NETLOGON_NEG_CROSS_FOREST_TRUSTS and
1238 * NETLOGON_NEG_AUTHENTICATED_RPC set together
1239 * are the indication that the server supports
1240 * NetlogonValidationSamInfo4 (6). And it must only
1241 * be used if "SealSecureChannel" is used.
1242 *
1243 * -- metze 4 February 2011
1244 */
1245
1246 if (auth == NULL) {
1247 domain->can_do_validation6 = false;
1248 } else if (auth->auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
1249 domain->can_do_validation6 = false;
1250 } else if (auth->auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
1251 domain->can_do_validation6 = false;
1252 } else if (!(neg_flags & NETLOGON_NEG_CROSS_FOREST_TRUSTS)) {
1253 domain->can_do_validation6 = false;
1254 } else if (!(neg_flags & NETLOGON_NEG_AUTHENTICATED_RPC)) {
1255 domain->can_do_validation6 = false;
1256 }
1257
1258 if (domain->can_do_samlogon_ex && domain->can_do_validation6) {
1259 result = rpccli_netlogon_sam_network_logon_ex(
1260 netlogon_pipe,
1261 mem_ctx,
1262 logon_parameters,
1263 server, /* server name */
1264 username, /* user name */
1265 domainname, /* target domain */
1266 workstation, /* workstation */
1267 chal,
1268 6,
1269 lm_response,
1270 nt_response,
1271 info3);
1272 } else {
1273 result = rpccli_netlogon_sam_network_logon(
1274 netlogon_pipe,
1275 mem_ctx,
1276 logon_parameters,
1277 server, /* server name */
1278 username, /* user name */
1279 domainname, /* target domain */
1280 workstation, /* workstation */
1281 chal,
1282 domain->can_do_validation6 ? 6 : 3,
1283 lm_response,
1284 nt_response,
1285 info3);
1286 }
1287
1288 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1289
1290 /*
1291 * It's likely that the server also does not support
1292 * validation level 6
1293 */
1294 domain->can_do_validation6 = false;
1295
1296 if (domain->can_do_samlogon_ex) {
1297 DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1298 "retrying with NetSamLogon\n"));
1299 domain->can_do_samlogon_ex = false;
1300 retry = true;
1301 continue;
1302 }
1303
1304
1305 /* Got DCERPC_FAULT_OP_RNG_ERROR for SamLogon
1306 * (no Ex). This happens against old Samba
1307 * DCs. Drop the connection.
1308 */
1309 invalidate_cm_connection(&domain->conn);
1310 result = NT_STATUS_LOGON_FAILURE;
1311 break;
1312 }
1313
1314 if (domain->can_do_validation6 &&
1315 (NT_STATUS_EQUAL(result, NT_STATUS_INVALID_INFO_CLASS) ||
1316 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_PARAMETER) ||
1317 NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL))) {
1318 DEBUG(3,("Got a DC that can not do validation level 6, "
1319 "retrying with level 3\n"));
1320 domain->can_do_validation6 = false;
1321 retry = true;
1322 continue;
1323 }
1324
1325 /*
1326 * we increment this after the "feature negotiation"
1327 * for can_do_samlogon_ex and can_do_validation6
1328 */
1329 attempts += 1;
1330
1331 /* We have to try a second time as cm_connect_netlogon
1332 might not yet have noticed that the DC has killed
1333 our connection. */
1334
1335 if (!rpccli_is_connected(netlogon_pipe)) {
1336 retry = true;
1337 continue;
1338 }
1339
1340 /* if we get access denied, a possible cause was that we had
1341 and open connection to the DC, but someone changed our
1342 machine account password out from underneath us using 'net
1343 rpc changetrustpw' */
1344
1345 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1346 DEBUG(3,("winbind_samlogon_retry_loop: sam_logon returned "
1347 "ACCESS_DENIED. Maybe the trust account "
1348 "password was changed and we didn't know it. "
1349 "Killing connections to domain %s\n",
1350 domainname));
1351 invalidate_cm_connection(&domain->conn);
1352 retry = true;
1353 }
1354
1355 } while ( (attempts < 2) && retry );
1356
1357 if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT)) {
1358 DEBUG(3,("winbind_samlogon_retry_loop: sam_network_logon(ex) "
1359 "returned NT_STATUS_IO_TIMEOUT after the retry."
1360 "Killing connections to domain %s\n",
1361 domainname));
1362 invalidate_cm_connection(&domain->conn);
1363 }
1364 return result;
1365 }
1366
1367 static NTSTATUS winbindd_dual_pam_auth_samlogon(TALLOC_CTX *mem_ctx,
1368 struct winbindd_domain *domain,
1369 const char *user,
1370 const char *pass,
1371 uint32_t request_flags,
1372 struct netr_SamInfo3 **info3)
1373 {
1374
1375 uchar chal[8];
1376 DATA_BLOB lm_resp;
1377 DATA_BLOB nt_resp;
1378 unsigned char local_nt_response[24];
1379 fstring name_domain, name_user;
1380 NTSTATUS result;
1381 struct netr_SamInfo3 *my_info3 = NULL;
1382
1383 *info3 = NULL;
1384
1385 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1386
1387 /* Parse domain and username */
1388
1389 parse_domain_user(user, name_domain, name_user);
1390
1391 /* do password magic */
1392
1393 generate_random_buffer(chal, sizeof(chal));
1394
1395 if (lp_client_ntlmv2_auth()) {
1396 DATA_BLOB server_chal;
1397 DATA_BLOB names_blob;
1398 server_chal = data_blob_const(chal, 8);
1399
1400 /* note that the 'workgroup' here is for the local
1401 machine. The 'server name' must match the
1402 'workstation' passed to the actual SamLogon call.
1403 */
1404 names_blob = NTLMv2_generate_names_blob(
1405 mem_ctx, lp_netbios_name(), lp_workgroup());
1406
1407 if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain,
1408 pass,
1409 &server_chal,
1410 &names_blob,
1411 &lm_resp, &nt_resp, NULL, NULL)) {
1412 data_blob_free(&names_blob);
1413 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1414 result = NT_STATUS_NO_MEMORY;
1415 goto done;
1416 }
1417 data_blob_free(&names_blob);
1418 } else {
1419 lm_resp = data_blob_null;
1420 SMBNTencrypt(pass, chal, local_nt_response);
1421
1422 nt_resp = data_blob_talloc(mem_ctx, local_nt_response,
1423 sizeof(local_nt_response));
1424 }
1425
1426 if (strequal(name_domain, get_global_sam_name())) {
1427 DATA_BLOB chal_blob = data_blob_const(chal, sizeof(chal));
1428
1429 result = winbindd_dual_auth_passdb(
1430 mem_ctx, 0, name_domain, name_user,
1431 &chal_blob, &lm_resp, &nt_resp, info3);
1432 goto done;
1433 }
1434
1435 /* check authentication loop */
1436
1437 result = winbind_samlogon_retry_loop(domain,
1438 mem_ctx,
1439 0,
1440 domain->dcname,
1441 name_user,
1442 name_domain,
1443 lp_netbios_name(),
1444 chal,
1445 lm_resp,
1446 nt_resp,
1447 &my_info3);
1448 if (!NT_STATUS_IS_OK(result)) {
1449 goto done;
1450 }
1451
1452 /* handle the case where a NT4 DC does not fill in the acct_flags in
1453 * the samlogon reply info3. When accurate info3 is required by the
1454 * caller, we look up the account flags ourselve - gd */
1455
1456 if ((request_flags & WBFLAG_PAM_INFO3_TEXT) &&
1457 NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
1458
1459 struct rpc_pipe_client *samr_pipe;
1460 struct policy_handle samr_domain_handle, user_pol;
1461 union samr_UserInfo *info = NULL;
1462 NTSTATUS status_tmp, result_tmp;
1463 uint32 acct_flags;
1464 struct dcerpc_binding_handle *b;
1465
1466 status_tmp = cm_connect_sam(domain, mem_ctx,
1467 &samr_pipe, &samr_domain_handle);
1468
1469 if (!NT_STATUS_IS_OK(status_tmp)) {
1470 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1471 nt_errstr(status_tmp)));
1472 goto done;
1473 }
1474
1475 b = samr_pipe->binding_handle;
1476
1477 status_tmp = dcerpc_samr_OpenUser(b, mem_ctx,
1478 &samr_domain_handle,
1479 MAXIMUM_ALLOWED_ACCESS,
1480 my_info3->base.rid,
1481 &user_pol,
1482 &result_tmp);
1483
1484 if (!NT_STATUS_IS_OK(status_tmp)) {
1485 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1486 nt_errstr(status_tmp)));
1487 goto done;
1488 }
1489 if (!NT_STATUS_IS_OK(result_tmp)) {
1490 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1491 nt_errstr(result_tmp)));
1492 goto done;
1493 }
1494
1495 status_tmp = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1496 &user_pol,
1497 16,
1498 &info,
1499 &result_tmp);
1500
1501 if (!NT_STATUS_IS_OK(status_tmp)) {
1502 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1503 nt_errstr(status_tmp)));
1504 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1505 goto done;
1506 }
1507 if (!NT_STATUS_IS_OK(result_tmp)) {
1508 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1509 nt_errstr(result_tmp)));
1510 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1511 goto done;
1512 }
1513
1514 acct_flags = info->info16.acct_flags;
1515
1516 if (acct_flags == 0) {
1517 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1518 goto done;
1519 }
1520
1521 my_info3->base.acct_flags = acct_flags;
1522
1523 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1524
1525 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result_tmp);
1526 }
1527
1528 *info3 = my_info3;
1529 done:
1530 return result;
1531 }
1532
1533 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1534 struct winbindd_cli_state *state)
1535 {
1536 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1537 NTSTATUS krb5_result = NT_STATUS_OK;
1538 fstring name_domain, name_user;
1539 char *mapped_user;
1540 fstring domain_user;
1541 struct netr_SamInfo3 *info3 = NULL;
1542 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
1543
1544 /* Ensure null termination */
1545 state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
1546
1547 /* Ensure null termination */
1548 state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
1549
1550 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1551 state->request->data.auth.user));
1552
1553 /* Parse domain and username */
1554
1555 name_map_status = normalize_name_unmap(state->mem_ctx,
1556 state->request->data.auth.user,
1557 &mapped_user);
1558
1559 /* If the name normalization didnt' actually do anything,
1560 just use the original name */
1561
1562 if (!NT_STATUS_IS_OK(name_map_status) &&
1563 !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
1564 {
1565 mapped_user = state->request->data.auth.user;
1566 }
1567
1568 parse_domain_user(mapped_user, name_domain, name_user);
1569
1570 if ( mapped_user != state->request->data.auth.user ) {
1571 fstr_sprintf( domain_user, "%s%c%s", name_domain,
1572 *lp_winbind_separator(),
1573 name_user );
1574 strlcpy( state->request->data.auth.user, domain_user,
1575 sizeof(state->request->data.auth.user));
1576 }
1577
1578 if (!domain->online) {
1579 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1580 if (domain->startup) {
1581 /* Logons are very important to users. If we're offline and
1582 we get a request within the first 30 seconds of startup,
1583 try very hard to find a DC and go online. */
1584
1585 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1586 "request in startup mode.\n", domain->name ));
1587
1588 winbindd_flush_negative_conn_cache(domain);
1589 result = init_dc_connection(domain);
1590 }
1591 }
1592
1593 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1594
1595 /* Check for Kerberos authentication */
1596 if (domain->online && (state->request->flags & WBFLAG_PAM_KRB5)) {
1597
1598 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1599 /* save for later */
1600 krb5_result = result;
1601
1602
1603 if (NT_STATUS_IS_OK(result)) {
1604 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1605 goto process_result;
1606 } else {
1607 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1608 }
1609
1610 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1611 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1612 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1613 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1614 set_domain_offline( domain );
1615 goto cached_logon;
1616 }
1617
1618 /* there are quite some NT_STATUS errors where there is no
1619 * point in retrying with a samlogon, we explictly have to take
1620 * care not to increase the bad logon counter on the DC */
1621
1622 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1623 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1624 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1625 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1626 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1627 NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1628 NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1629 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1630 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1631 NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1632 goto done;
1633 }
1634
1635 if (state->request->flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1636 DEBUG(3,("falling back to samlogon\n"));
1637 goto sam_logon;
1638 } else {
1639 goto cached_logon;
1640 }
1641 }
1642
1643 sam_logon:
1644 /* Check for Samlogon authentication */
1645 if (domain->online) {
1646 result = winbindd_dual_pam_auth_samlogon(
1647 state->mem_ctx, domain,
1648 state->request->data.auth.user,
1649 state->request->data.auth.pass,
1650 state->request->flags,
1651 &info3);
1652
1653 if (NT_STATUS_IS_OK(result)) {
1654 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1655 /* add the Krb5 err if we have one */
1656 if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1657 info3->base.user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1658 }
1659 goto process_result;
1660 }
1661
1662 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1663 nt_errstr(result)));
1664
1665 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1666 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1667 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1668 {
1669 DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1670 set_domain_offline( domain );
1671 goto cached_logon;
1672 }
1673
1674 if (domain->online) {
1675 /* We're still online - fail. */
1676 goto done;
1677 }
1678 }
1679
1680 cached_logon:
1681 /* Check for Cached logons */
1682 if (!domain->online && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN) &&
1683 lp_winbind_offline_logon()) {
1684
1685 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1686
1687 if (NT_STATUS_IS_OK(result)) {
1688 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1689 goto process_result;
1690 } else {
1691 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1692 goto done;
1693 }
1694 }
1695
1696 process_result:
1697
1698 if (NT_STATUS_IS_OK(result)) {
1699
1700 struct dom_sid user_sid;
1701
1702 /* In all codepaths where result == NT_STATUS_OK info3 must have
1703 been initialized. */
1704 if (!info3) {
1705 result = NT_STATUS_INTERNAL_ERROR;
1706 goto done;
1707 }
1708
1709 sid_compose(&user_sid, info3->base.domain_sid,
1710 info3->base.rid);
1711
1712 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
1713 &user_sid);
1714 netsamlogon_cache_store(name_user, info3);
1715
1716 /* save name_to_sid info as early as possible (only if
1717 this is our primary domain so we don't invalidate
1718 the cache entry by storing the seq_num for the wrong
1719 domain). */
1720 if ( domain->primary ) {
1721 cache_name2sid(domain, name_domain, name_user,
1722 SID_NAME_USER, &user_sid);
1723 }
1724
1725 /* Check if the user is in the right group */
1726
1727 result = check_info3_in_group(
1728 info3,
1729 state->request->data.auth.require_membership_of_sid);
1730 if (!NT_STATUS_IS_OK(result)) {
1731 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1732 state->request->data.auth.user,
1733 state->request->data.auth.require_membership_of_sid));
1734 goto done;
1735 }
1736
1737 result = append_auth_data(state->mem_ctx, state->response,
1738 state->request->flags, info3,
1739 name_domain, name_user);
1740 if (!NT_STATUS_IS_OK(result)) {
1741 goto done;
1742 }
1743
1744 if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
1745 && lp_winbind_offline_logon()) {
1746
1747 result = winbindd_store_creds(domain,
1748 state->request->data.auth.user,
1749 state->request->data.auth.pass,
1750 info3);
1751 }
1752
1753 if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
1754 struct winbindd_domain *our_domain = find_our_domain();
1755
1756 /* This is not entirely correct I believe, but it is
1757 consistent. Only apply the password policy settings
1758 too warn users for our own domain. Cannot obtain these
1759 from trusted DCs all the time so don't do it at all.
1760 -- jerry */
1761
1762 result = NT_STATUS_NOT_SUPPORTED;
1763 if (our_domain == domain ) {
1764 result = fillup_password_policy(
1765 our_domain, state->response);
1766 }
1767
1768 if (!NT_STATUS_IS_OK(result)
1769 && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1770 {
1771 DEBUG(10,("Failed to get password policies for domain %s: %s\n",
1772 domain->name, nt_errstr(result)));
1773 goto done;
1774 }
1775 }
1776
1777 result = NT_STATUS_OK;
1778 }
1779
1780 done:
1781 /* give us a more useful (more correct?) error code */
1782 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1783 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1784 result = NT_STATUS_NO_LOGON_SERVERS;
1785 }
1786
1787 set_auth_errors(state->response, result);
1788
1789 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1790 state->request->data.auth.user,
1791 state->response->data.auth.nt_status_string,
1792 state->response->data.auth.pam_error));
1793
1794 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1795 }
1796
1797 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1798 struct winbindd_cli_state *state)
1799 {
1800 NTSTATUS result;
1801 struct netr_SamInfo3 *info3 = NULL;
1802 const char *name_user = NULL;
1803 const char *name_domain = NULL;
1804 const char *workstation;
1805
1806 DATA_BLOB lm_resp, nt_resp;
1807
1808 /* This is child-only, so no check for privileged access is needed
1809 anymore */
1810
1811 /* Ensure null termination */
1812 state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
1813 state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
1814
1815 name_user = state->request->data.auth_crap.user;
1816 name_domain = state->request->data.auth_crap.domain;
1817 workstation = state->request->data.auth_crap.workstation;
1818
1819 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1820 name_domain, name_user));
1821
1822 if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
1823 || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
1824 if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
1825 state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
1826 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1827 state->request->data.auth_crap.lm_resp_len,
1828 state->request->data.auth_crap.nt_resp_len));
1829 result = NT_STATUS_INVALID_PARAMETER;
1830 goto done;
1831 }
1832 }
1833
1834 lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
1835 state->request->data.auth_crap.lm_resp_len);
1836
1837 if (state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) {
1838 nt_resp = data_blob_talloc(state->mem_ctx,
1839 state->request->extra_data.data,
1840 state->request->data.auth_crap.nt_resp_len);
1841 } else {
1842 nt_resp = data_blob_talloc(state->mem_ctx,
1843 state->request->data.auth_crap.nt_resp,
1844 state->request->data.auth_crap.nt_resp_len);
1845 }
1846
1847 if (strequal(name_domain, get_global_sam_name())) {
1848 DATA_BLOB chal_blob = data_blob_const(
1849 state->request->data.auth_crap.chal,
1850 sizeof(state->request->data.auth_crap.chal));
1851
1852 result = winbindd_dual_auth_passdb(
1853 state->mem_ctx,
1854 state->request->data.auth_crap.logon_parameters,
1855 name_domain, name_user,
1856 &chal_blob, &lm_resp, &nt_resp, &info3);
1857 goto process_result;
1858 }
1859
1860 result = winbind_samlogon_retry_loop(domain,
1861 state->mem_ctx,
1862 state->request->data.auth_crap.logon_parameters,
1863 domain->dcname,
1864 name_user,
1865 name_domain,
1866 /* Bug #3248 - found by Stefan Burkei. */
1867 workstation, /* We carefully set this above so use it... */
1868 state->request->data.auth_crap.chal,
1869 lm_resp,
1870 nt_resp,
1871 &info3);
1872 if (!NT_STATUS_IS_OK(result)) {
1873 goto done;
1874 }
1875
1876 process_result:
1877
1878 if (NT_STATUS_IS_OK(result)) {
1879 struct dom_sid user_sid;
1880
1881 sid_compose(&user_sid, info3->base.domain_sid,
1882 info3->base.rid);
1883 wcache_invalidate_samlogon(find_domain_from_name(name_domain),
1884 &user_sid);
1885 netsamlogon_cache_store(name_user, info3);
1886
1887 /* Check if the user is in the right group */
1888
1889 result = check_info3_in_group(
1890 info3,
1891 state->request->data.auth_crap.require_membership_of_sid);
1892 if (!NT_STATUS_IS_OK(result)) {
1893 DEBUG(3, ("User %s is not in the required group (%s), so "
1894 "crap authentication is rejected\n",
1895 state->request->data.auth_crap.user,
1896 state->request->data.auth_crap.require_membership_of_sid));
1897 goto done;
1898 }
1899
1900 result = append_auth_data(state->mem_ctx, state->response,
1901 state->request->flags, info3,
1902 name_domain, name_user);
1903 if (!NT_STATUS_IS_OK(result)) {
1904 goto done;
1905 }
1906 }
1907
1908 done:
1909
1910 /* give us a more useful (more correct?) error code */
1911 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1912 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1913 result = NT_STATUS_NO_LOGON_SERVERS;
1914 }
1915
1916 if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1917 result = nt_status_squash(result);
1918 }
1919
1920 set_auth_errors(state->response, result);
1921
1922 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1923 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1924 name_domain,
1925 name_user,
1926 state->response->data.auth.nt_status_string,
1927 state->response->data.auth.pam_error));
1928
1929 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1930 }
1931
1932 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1933 struct winbindd_cli_state *state)
1934 {
1935 char *oldpass;
1936 char *newpass = NULL;
1937 struct policy_handle dom_pol;
1938 struct rpc_pipe_client *cli = NULL;
1939 bool got_info = false;
1940 struct samr_DomInfo1 *info = NULL;
1941 struct userPwdChangeFailureInformation *reject = NULL;
1942 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1943 fstring domain, user;
1944 struct dcerpc_binding_handle *b = NULL;
1945
1946 ZERO_STRUCT(dom_pol);
1947
1948 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1949 state->request->data.auth.user));
1950
1951 if (!parse_domain_user(state->request->data.chauthtok.user, domain, user)) {
1952 goto done;
1953 }
1954
1955 /* Change password */
1956
1957 oldpass = state->request->data.chauthtok.oldpass;
1958 newpass = state->request->data.chauthtok.newpass;
1959
1960 /* Initialize reject reason */
1961 state->response->data.auth.reject_reason = Undefined;
1962
1963 /* Get sam handle */
1964
1965 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
1966 &dom_pol);
1967 if (!NT_STATUS_IS_OK(result)) {
1968 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
1969 goto done;
1970 }
1971
1972 b = cli->binding_handle;
1973
1974 result = rpccli_samr_chgpasswd_user3(cli, state->mem_ctx,
1975 user,
1976 newpass,
1977 oldpass,
1978 &info,
1979 &reject);
1980
1981 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
1982
1983 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
1984
1985 fill_in_password_policy(state->response, info);
1986
1987 state->response->data.auth.reject_reason =
1988 reject->extendedFailureReason;
1989
1990 got_info = true;
1991 }
1992
1993 /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
1994 * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
1995 * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
1996 * short to comply with the samr_ChangePasswordUser3 idl - gd */
1997
1998 /* only fallback when the chgpasswd_user3 call is not supported */
1999 if (NT_STATUS_EQUAL(result, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
2000 NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) ||
2001 NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL) ||
2002 NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
2003
2004 DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
2005 nt_errstr(result)));
2006
2007 result = rpccli_samr_chgpasswd_user2(cli, state->mem_ctx, user, newpass, oldpass);
2008
2009 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2010 Map to the same status code as Windows 2003. */
2011
2012 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2013 result = NT_STATUS_PASSWORD_RESTRICTION;
2014 }
2015 }
2016
2017 done:
2018
2019 if (NT_STATUS_IS_OK(result)
2020 && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)
2021 && lp_winbind_offline_logon()) {
2022 result = winbindd_update_creds_by_name(contact_domain, user,
2023 newpass);
2024 /* Again, this happens when we login from gdm or xdm
2025 * and the password expires, *BUT* cached crendentials
2026 * doesn't exist. winbindd_update_creds_by_name()
2027 * returns NT_STATUS_NO_SUCH_USER.
2028 * This is not a failure.
2029 * --- BoYang
2030 * */
2031 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
2032 result = NT_STATUS_OK;
2033 }
2034
2035 if (!NT_STATUS_IS_OK(result)) {
2036 DEBUG(10, ("Failed to store creds: %s\n",
2037 nt_errstr(result)));
2038 goto process_result;
2039 }
2040 }
2041
2042 if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2043
2044 NTSTATUS policy_ret;
2045
2046 policy_ret = fillup_password_policy(
2047 contact_domain, state->response);
2048
2049 /* failure of this is non critical, it will just provide no
2050 * additional information to the client why the change has
2051 * failed - Guenther */
2052
2053 if (!NT_STATUS_IS_OK(policy_ret)) {
2054 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2055 goto process_result;
2056 }
2057 }
2058
2059 process_result:
2060
2061 if (strequal(contact_domain->name, get_global_sam_name())) {
2062 /* FIXME: internal rpc pipe does not cache handles yet */
2063 if (b) {
2064 if (is_valid_policy_hnd(&dom_pol)) {
2065 NTSTATUS _result;
2066 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2067 }
2068 TALLOC_FREE(cli);
2069 }
2070 }
2071
2072 set_auth_errors(state->response, result);
2073
2074 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2075 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2076 domain,
2077 user,
2078 state->response->data.auth.nt_status_string,
2079 state->response->data.auth.pam_error));
2080
2081 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2082 }
2083
2084 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2085 struct winbindd_cli_state *state)
2086 {
2087 NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2088
2089 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2090 state->request->data.logoff.user));
2091
2092 if (!(state->request->flags & WBFLAG_PAM_KRB5)) {
2093 result = NT_STATUS_OK;
2094 goto process_result;
2095 }
2096
2097 if (state->request->data.logoff.krb5ccname[0] == '\0') {
2098 result = NT_STATUS_OK;
2099 goto process_result;
2100 }
2101
2102 #ifdef HAVE_KRB5
2103
2104 if (state->request->data.logoff.uid < 0) {
2105 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2106 goto process_result;
2107 }
2108
2109 /* what we need here is to find the corresponding krb5 ccache name *we*
2110 * created for a given username and destroy it */
2111
2112 if (!ccache_entry_exists(state->request->data.logoff.user)) {
2113 result = NT_STATUS_OK;
2114 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2115 goto process_result;
2116 }
2117
2118 if (!ccache_entry_identical(state->request->data.logoff.user,
2119 state->request->data.logoff.uid,
2120 state->request->data.logoff.krb5ccname)) {
2121 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2122 goto process_result;
2123 }
2124
2125 result = remove_ccache(state->request->data.logoff.user);
2126 if (!NT_STATUS_IS_OK(result)) {
2127 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2128 nt_errstr(result)));
2129 goto process_result;
2130 }
2131
2132 /*
2133 * Remove any mlock'ed memory creds in the child
2134 * we might be using for krb5 ticket renewal.
2135 */
2136
2137 winbindd_delete_memory_creds(state->request->data.logoff.user);
2138
2139 #else
2140 result = NT_STATUS_NOT_SUPPORTED;
2141 #endif
2142
2143 process_result:
2144
2145
2146 set_auth_errors(state->response, result);
2147
2148 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2149 }
2150
2151 /* Change user password with auth crap*/
2152
2153 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2154 {
2155 NTSTATUS result;
2156 DATA_BLOB new_nt_password;
2157 DATA_BLOB old_nt_hash_enc;
2158 DATA_BLOB new_lm_password;
2159 DATA_BLOB old_lm_hash_enc;
2160 fstring domain,user;
2161 struct policy_handle dom_pol;
2162 struct winbindd_domain *contact_domain = domainSt;
2163 struct rpc_pipe_client *cli = NULL;
2164 struct dcerpc_binding_handle *b = NULL;
2165
2166 ZERO_STRUCT(dom_pol);
2167
2168 /* Ensure null termination */
2169 state->request->data.chng_pswd_auth_crap.user[
2170 sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
2171 state->request->data.chng_pswd_auth_crap.domain[
2172 sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
2173 *domain = 0;
2174 *user = 0;
2175
2176 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2177 (unsigned long)state->pid,
2178 state->request->data.chng_pswd_auth_crap.domain,
2179 state->request->data.chng_pswd_auth_crap.user));
2180
2181 if (lp_winbind_offline_logon()) {
2182 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2183 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2184 result = NT_STATUS_ACCESS_DENIED;
2185 goto done;
2186 }
2187
2188 if (*state->request->data.chng_pswd_auth_crap.domain) {
2189 fstrcpy(domain,state->request->data.chng_pswd_auth_crap.domain);
2190 } else {
2191 parse_domain_user(state->request->data.chng_pswd_auth_crap.user,
2192 domain, user);
2193
2194 if(!*domain) {
2195 DEBUG(3,("no domain specified with username (%s) - "
2196 "failing auth\n",
2197 state->request->data.chng_pswd_auth_crap.user));
2198 result = NT_STATUS_NO_SUCH_USER;
2199 goto done;
2200 }
2201 }
2202
2203 if (!*domain && lp_winbind_use_default_domain()) {
2204 fstrcpy(domain,lp_workgroup());
2205 }
2206
2207 if(!*user) {
2208 fstrcpy(user, state->request->data.chng_pswd_auth_crap.user);
2209 }
2210
2211 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2212 (unsigned long)state->pid, domain, user));
2213
2214 /* Change password */
2215 new_nt_password = data_blob_const(
2216 state->request->data.chng_pswd_auth_crap.new_nt_pswd,
2217 state->request->data.chng_pswd_auth_crap.new_nt_pswd_len);
2218
2219 old_nt_hash_enc = data_blob_const(
2220 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
2221 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2222
2223 if(state->request->data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2224 new_lm_password = data_blob_const(
2225 state->request->data.chng_pswd_auth_crap.new_lm_pswd,
2226 state->request->data.chng_pswd_auth_crap.new_lm_pswd_len);
2227
2228 old_lm_hash_enc = data_blob_const(
2229 state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
2230 state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2231 } else {
2232 new_lm_password = data_blob_null;
2233 old_lm_hash_enc = data_blob_null;
2234 }
2235
2236 /* Get sam handle */
2237
2238 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2239 if (!NT_STATUS_IS_OK(result)) {
2240 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2241 goto done;
2242 }
2243
2244 b = cli->binding_handle;
2245
2246 result = rpccli_samr_chng_pswd_auth_crap(
2247 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2248 new_lm_password, old_lm_hash_enc);
2249
2250 done:
2251
2252 if (strequal(contact_domain->name, get_global_sam_name())) {
2253 /* FIXME: internal rpc pipe does not cache handles yet */
2254 if (b) {
2255 if (is_valid_policy_hnd(&dom_pol)) {
2256 NTSTATUS _result;
2257 dcerpc_samr_Close(b, state->mem_ctx, &dom_pol, &_result);
2258 }
2259 TALLOC_FREE(cli);
2260 }
2261 }
2262
2263 set_auth_errors(state->response, result);
2264
2265 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2266 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2267 domain, user,
2268 state->response->data.auth.nt_status_string,
2269 state->response->data.auth.pam_error));
2270
2271 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2272 }
WIP