2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2011
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006-2008
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
28 #include "rpc_client/init_lsa.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/util_pw.h"
31 #include "lib/winbind_util.h"
33 #include "../librpc/gen_ndr/ndr_auth.h"
34 #include "../auth/auth_sam_reply.h"
35 #include "../librpc/gen_ndr/idmap.h"
38 #define DBGC_CLASS DBGC_AUTH
40 /****************************************************************************
41 Create a UNIX user on demand.
42 ****************************************************************************/
44 static int _smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
46 TALLOC_CTX
*ctx
= talloc_tos();
50 add_script
= talloc_strdup(ctx
, lp_adduser_script());
51 if (!add_script
|| !*add_script
) {
54 add_script
= talloc_all_string_sub(ctx
,
62 add_script
= talloc_all_string_sub(ctx
,
71 add_script
= talloc_all_string_sub(ctx
,
79 ret
= smbrun(add_script
,NULL
);
82 ("smb_create_user: Running the command `%s' gave %d\n",
87 /****************************************************************************
88 Create an auth_usersupplied_data structure after appropriate mapping.
89 ****************************************************************************/
91 NTSTATUS
make_user_info_map(struct auth_usersupplied_info
**user_info
,
93 const char *client_domain
,
94 const char *workstation_name
,
95 const struct tsocket_address
*remote_address
,
96 const DATA_BLOB
*lm_pwd
,
97 const DATA_BLOB
*nt_pwd
,
98 const struct samr_Password
*lm_interactive_pwd
,
99 const struct samr_Password
*nt_interactive_pwd
,
100 const char *plaintext
,
101 enum auth_password_state password_state
)
106 char *internal_username
= NULL
;
108 was_mapped
= map_username(talloc_tos(), smb_name
, &internal_username
);
109 if (!internal_username
) {
110 return NT_STATUS_NO_MEMORY
;
113 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
114 client_domain
, smb_name
, workstation_name
));
116 domain
= client_domain
;
118 /* If you connect to a Windows domain member using a bogus domain name,
119 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
120 * the Windows box is a DC the name will become DOMAIN\user and be
121 * authenticated against AD, if the Windows box is a member server but
122 * not a DC the name will become WORKSTATION\user. A standalone
123 * non-domain member box will also map to WORKSTATION\user.
124 * This also deals with the client passing in a "" domain */
126 if (!is_trusted_domain(domain
) &&
127 !strequal(domain
, my_sam_name()))
129 if (lp_map_untrusted_to_domain())
130 domain
= my_sam_name();
132 domain
= get_global_sam_name();
133 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
134 "workstation [%s]\n",
135 client_domain
, domain
, smb_name
, workstation_name
));
138 /* We know that the given domain is trusted (and we are allowing them),
139 * it is our global SAM name, or for legacy behavior it is our
140 * primary domain name */
142 result
= make_user_info(user_info
, smb_name
, internal_username
,
143 client_domain
, domain
, workstation_name
,
144 remote_address
, lm_pwd
, nt_pwd
,
145 lm_interactive_pwd
, nt_interactive_pwd
,
146 plaintext
, password_state
);
147 if (NT_STATUS_IS_OK(result
)) {
148 /* We have tried mapping */
149 (*user_info
)->mapped_state
= true;
150 /* did we actually map the user to a different name? */
151 (*user_info
)->was_mapped
= was_mapped
;
156 /****************************************************************************
157 Create an auth_usersupplied_data, making the DATA_BLOBs here.
158 Decrypt and encrypt the passwords.
159 ****************************************************************************/
161 bool make_user_info_netlogon_network(struct auth_usersupplied_info
**user_info
,
162 const char *smb_name
,
163 const char *client_domain
,
164 const char *workstation_name
,
165 const struct tsocket_address
*remote_address
,
166 uint32 logon_parameters
,
167 const uchar
*lm_network_pwd
,
169 const uchar
*nt_network_pwd
,
174 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
175 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
177 status
= make_user_info_map(user_info
,
178 smb_name
, client_domain
,
181 lm_pwd_len
? &lm_blob
: NULL
,
182 nt_pwd_len
? &nt_blob
: NULL
,
184 AUTH_PASSWORD_RESPONSE
);
186 if (NT_STATUS_IS_OK(status
)) {
187 (*user_info
)->logon_parameters
= logon_parameters
;
189 ret
= NT_STATUS_IS_OK(status
) ? true : false;
191 data_blob_free(&lm_blob
);
192 data_blob_free(&nt_blob
);
196 /****************************************************************************
197 Create an auth_usersupplied_data, making the DATA_BLOBs here.
198 Decrypt and encrypt the passwords.
199 ****************************************************************************/
201 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info
**user_info
,
202 const char *smb_name
,
203 const char *client_domain
,
204 const char *workstation_name
,
205 const struct tsocket_address
*remote_address
,
206 uint32 logon_parameters
,
208 const uchar lm_interactive_pwd
[16],
209 const uchar nt_interactive_pwd
[16],
210 const uchar
*dc_sess_key
)
212 struct samr_Password lm_pwd
;
213 struct samr_Password nt_pwd
;
214 unsigned char local_lm_response
[24];
215 unsigned char local_nt_response
[24];
216 unsigned char key
[16];
218 memcpy(key
, dc_sess_key
, 16);
220 if (lm_interactive_pwd
)
221 memcpy(lm_pwd
.hash
, lm_interactive_pwd
, sizeof(lm_pwd
.hash
));
223 if (nt_interactive_pwd
)
224 memcpy(nt_pwd
.hash
, nt_interactive_pwd
, sizeof(nt_pwd
.hash
));
226 #ifdef DEBUG_PASSWORD
228 dump_data(100, key
, sizeof(key
));
230 DEBUG(100,("lm owf password:"));
231 dump_data(100, lm_pwd
.hash
, sizeof(lm_pwd
.hash
));
233 DEBUG(100,("nt owf password:"));
234 dump_data(100, nt_pwd
.hash
, sizeof(nt_pwd
.hash
));
237 if (lm_interactive_pwd
)
238 arcfour_crypt(lm_pwd
.hash
, key
, sizeof(lm_pwd
.hash
));
240 if (nt_interactive_pwd
)
241 arcfour_crypt(nt_pwd
.hash
, key
, sizeof(nt_pwd
.hash
));
243 #ifdef DEBUG_PASSWORD
244 DEBUG(100,("decrypt of lm owf password:"));
245 dump_data(100, lm_pwd
.hash
, sizeof(lm_pwd
));
247 DEBUG(100,("decrypt of nt owf password:"));
248 dump_data(100, nt_pwd
.hash
, sizeof(nt_pwd
));
251 if (lm_interactive_pwd
)
252 SMBOWFencrypt(lm_pwd
.hash
, chal
,
255 if (nt_interactive_pwd
)
256 SMBOWFencrypt(nt_pwd
.hash
, chal
,
259 /* Password info paranoia */
265 DATA_BLOB local_lm_blob
;
266 DATA_BLOB local_nt_blob
;
268 if (lm_interactive_pwd
) {
269 local_lm_blob
= data_blob(local_lm_response
,
270 sizeof(local_lm_response
));
273 if (nt_interactive_pwd
) {
274 local_nt_blob
= data_blob(local_nt_response
,
275 sizeof(local_nt_response
));
278 nt_status
= make_user_info_map(
280 smb_name
, client_domain
, workstation_name
,
282 lm_interactive_pwd
? &local_lm_blob
: NULL
,
283 nt_interactive_pwd
? &local_nt_blob
: NULL
,
284 lm_interactive_pwd
? &lm_pwd
: NULL
,
285 nt_interactive_pwd
? &nt_pwd
: NULL
,
286 NULL
, AUTH_PASSWORD_HASH
);
288 if (NT_STATUS_IS_OK(nt_status
)) {
289 (*user_info
)->logon_parameters
= logon_parameters
;
292 ret
= NT_STATUS_IS_OK(nt_status
) ? true : false;
293 data_blob_free(&local_lm_blob
);
294 data_blob_free(&local_nt_blob
);
300 /****************************************************************************
301 Create an auth_usersupplied_data structure
302 ****************************************************************************/
304 bool make_user_info_for_reply(struct auth_usersupplied_info
**user_info
,
305 const char *smb_name
,
306 const char *client_domain
,
307 const struct tsocket_address
*remote_address
,
309 DATA_BLOB plaintext_password
)
312 DATA_BLOB local_lm_blob
;
313 DATA_BLOB local_nt_blob
;
314 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
315 char *plaintext_password_string
;
317 * Not encrypted - do so.
320 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
322 if (plaintext_password
.data
&& plaintext_password
.length
) {
323 unsigned char local_lm_response
[24];
325 #ifdef DEBUG_PASSWORD
326 DEBUG(10,("Unencrypted password (len %d):\n",
327 (int)plaintext_password
.length
));
328 dump_data(100, plaintext_password
.data
,
329 plaintext_password
.length
);
332 SMBencrypt( (const char *)plaintext_password
.data
,
333 (const uchar
*)chal
, local_lm_response
);
334 local_lm_blob
= data_blob(local_lm_response
, 24);
336 /* We can't do an NT hash here, as the password needs to be
338 local_nt_blob
= data_blob_null
;
340 local_lm_blob
= data_blob_null
;
341 local_nt_blob
= data_blob_null
;
344 plaintext_password_string
= talloc_strndup(talloc_tos(),
345 (const char *)plaintext_password
.data
,
346 plaintext_password
.length
);
347 if (!plaintext_password_string
) {
351 ret
= make_user_info(
352 user_info
, smb_name
, smb_name
, client_domain
, client_domain
,
353 get_remote_machine_name(),
355 local_lm_blob
.data
? &local_lm_blob
: NULL
,
356 local_nt_blob
.data
? &local_nt_blob
: NULL
,
358 plaintext_password_string
,
359 AUTH_PASSWORD_PLAIN
);
361 if (plaintext_password_string
) {
362 memset(plaintext_password_string
, '\0', strlen(plaintext_password_string
));
363 talloc_free(plaintext_password_string
);
366 data_blob_free(&local_lm_blob
);
367 return NT_STATUS_IS_OK(ret
) ? true : false;
370 /****************************************************************************
371 Create an auth_usersupplied_data structure
372 ****************************************************************************/
374 NTSTATUS
make_user_info_for_reply_enc(struct auth_usersupplied_info
**user_info
,
375 const char *smb_name
,
376 const char *client_domain
,
377 const struct tsocket_address
*remote_address
,
378 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
380 return make_user_info(user_info
, smb_name
, smb_name
,
381 client_domain
, client_domain
,
382 get_remote_machine_name(),
384 lm_resp
.data
&& (lm_resp
.length
> 0) ? &lm_resp
: NULL
,
385 nt_resp
.data
&& (nt_resp
.length
> 0) ? &nt_resp
: NULL
,
387 AUTH_PASSWORD_RESPONSE
);
390 /****************************************************************************
391 Create a guest user_info blob, for anonymous authentication.
392 ****************************************************************************/
394 bool make_user_info_guest(const struct tsocket_address
*remote_address
,
395 struct auth_usersupplied_info
**user_info
)
399 nt_status
= make_user_info(user_info
,
407 AUTH_PASSWORD_RESPONSE
);
409 return NT_STATUS_IS_OK(nt_status
) ? true : false;
412 static NTSTATUS
log_nt_token(struct security_token
*token
)
414 TALLOC_CTX
*frame
= talloc_stackframe();
419 if ((lp_log_nt_token_command() == NULL
) ||
420 (strlen(lp_log_nt_token_command()) == 0)) {
425 group_sidstr
= talloc_strdup(frame
, "");
426 for (i
=1; i
<token
->num_sids
; i
++) {
427 group_sidstr
= talloc_asprintf(
428 frame
, "%s %s", group_sidstr
,
429 sid_string_talloc(frame
, &token
->sids
[i
]));
432 command
= talloc_string_sub(
433 frame
, lp_log_nt_token_command(),
434 "%s", sid_string_talloc(frame
, &token
->sids
[0]));
435 command
= talloc_string_sub(frame
, command
, "%t", group_sidstr
);
437 if (command
== NULL
) {
439 return NT_STATUS_NO_MEMORY
;
442 DEBUG(8, ("running command: [%s]\n", command
));
443 if (smbrun(command
, NULL
) != 0) {
444 DEBUG(0, ("Could not log NT token\n"));
446 return NT_STATUS_ACCESS_DENIED
;
454 * Create the token to use from server_info->info3 and
455 * server_info->sids (the info3/sam groups). Find the unix gids.
458 NTSTATUS
create_local_token(TALLOC_CTX
*mem_ctx
,
459 const struct auth_serversupplied_info
*server_info
,
460 DATA_BLOB
*session_key
,
461 const char *smb_username
, /* for ->sanitized_username, for %U subs */
462 struct auth_session_info
**session_info_out
)
464 struct security_token
*t
;
467 struct dom_sid tmp_sid
;
468 struct auth_session_info
*session_info
;
472 /* Ensure we can't possible take a code path leading to a
475 return NT_STATUS_LOGON_FAILURE
;
478 session_info
= talloc_zero(mem_ctx
, struct auth_session_info
);
480 return NT_STATUS_NO_MEMORY
;
483 session_info
->unix_token
= talloc_zero(session_info
, struct security_unix_token
);
484 if (!session_info
->unix_token
) {
485 TALLOC_FREE(session_info
);
486 return NT_STATUS_NO_MEMORY
;
489 session_info
->unix_token
->uid
= server_info
->utok
.uid
;
490 session_info
->unix_token
->gid
= server_info
->utok
.gid
;
492 session_info
->unix_info
= talloc_zero(session_info
, struct auth_user_info_unix
);
493 if (!session_info
->unix_info
) {
494 TALLOC_FREE(session_info
);
495 return NT_STATUS_NO_MEMORY
;
498 session_info
->unix_info
->unix_name
= talloc_strdup(session_info
, server_info
->unix_name
);
499 if (!session_info
->unix_info
->unix_name
) {
500 TALLOC_FREE(session_info
);
501 return NT_STATUS_NO_MEMORY
;
504 /* This is a potentially untrusted username for use in %U */
505 alpha_strcpy(tmp
, smb_username
, ". _-$", sizeof(tmp
));
506 session_info
->unix_info
->sanitized_username
=
507 talloc_strdup(session_info
->unix_info
, tmp
);
510 data_blob_free(&session_info
->session_key
);
511 session_info
->session_key
= data_blob_talloc(session_info
,
513 session_key
->length
);
514 if (!session_info
->session_key
.data
&& session_key
->length
) {
515 return NT_STATUS_NO_MEMORY
;
518 session_info
->session_key
= data_blob_talloc( session_info
, server_info
->session_key
.data
,
519 server_info
->session_key
.length
);
522 /* We need to populate session_info->info with the information found in server_info->info3 */
523 status
= make_user_info_SamBaseInfo(session_info
, "", &server_info
->info3
->base
,
524 server_info
->guest
== false,
525 &session_info
->info
);
526 if (!NT_STATUS_IS_OK(status
)) {
527 DEBUG(0, ("conversion of info3 into auth_user_info failed!\n"));
528 TALLOC_FREE(session_info
);
532 if (server_info
->security_token
) {
533 /* Just copy the token, it has already been finalised
534 * (nasty hack to support a cached guest session_info,
535 * and a possible strategy for auth_samba4 to pass in
536 * a finalised session) */
538 session_info
->security_token
= dup_nt_token(session_info
, server_info
->security_token
);
539 if (!session_info
->security_token
) {
540 TALLOC_FREE(session_info
);
541 return NT_STATUS_NO_MEMORY
;
544 session_info
->unix_token
->ngroups
= server_info
->utok
.ngroups
;
545 if (server_info
->utok
.ngroups
!= 0) {
546 session_info
->unix_token
->groups
= (gid_t
*)talloc_memdup(
547 session_info
->unix_token
, server_info
->utok
.groups
,
548 sizeof(gid_t
)*session_info
->unix_token
->ngroups
);
550 session_info
->unix_token
->groups
= NULL
;
553 *session_info_out
= session_info
;
558 * If winbind is not around, we can not make much use of the SIDs the
559 * domain controller provided us with. Likewise if the user name was
560 * mapped to some local unix user.
563 if (((lp_server_role() == ROLE_DOMAIN_MEMBER
) && !winbind_ping()) ||
564 (server_info
->nss_token
)) {
565 char *found_username
= NULL
;
566 status
= create_token_from_username(session_info
,
567 server_info
->unix_name
,
569 &session_info
->unix_token
->uid
,
570 &session_info
->unix_token
->gid
,
572 &session_info
->security_token
);
573 if (NT_STATUS_IS_OK(status
)) {
574 session_info
->unix_info
->unix_name
= found_username
;
577 status
= create_local_nt_token_from_info3(session_info
,
581 &session_info
->security_token
);
584 if (!NT_STATUS_IS_OK(status
)) {
588 /* Convert the SIDs to gids. */
590 session_info
->unix_token
->ngroups
= 0;
591 session_info
->unix_token
->groups
= NULL
;
593 t
= session_info
->security_token
;
595 ids
= talloc_array(talloc_tos(), struct unixid
,
598 return NT_STATUS_NO_MEMORY
;
601 if (!sids_to_unixids(t
->sids
, t
->num_sids
, ids
)) {
603 return NT_STATUS_NO_MEMORY
;
606 for (i
=0; i
<t
->num_sids
; i
++) {
608 if (i
== 0 && ids
[i
].type
!= ID_TYPE_BOTH
) {
612 if (ids
[i
].type
!= ID_TYPE_GID
&&
613 ids
[i
].type
!= ID_TYPE_BOTH
) {
614 DEBUG(10, ("Could not convert SID %s to gid, "
616 sid_string_dbg(&t
->sids
[i
])));
619 if (!add_gid_to_array_unique(session_info
, ids
[i
].id
,
620 &session_info
->unix_token
->groups
,
621 &session_info
->unix_token
->ngroups
)) {
622 return NT_STATUS_NO_MEMORY
;
627 * Add the "Unix Group" SID for each gid to catch mapped groups
628 * and their Unix equivalent. This is to solve the backwards
629 * compatibility problem of 'valid users = +ntadmin' where
630 * ntadmin has been paired with "Domain Admins" in the group
631 * mapping table. Otherwise smb.conf would need to be changed
632 * to 'valid user = "Domain Admins"'. --jerry
634 * For consistency we also add the "Unix User" SID,
635 * so that the complete unix token is represented within
639 uid_to_unix_users_sid(session_info
->unix_token
->uid
, &tmp_sid
);
641 add_sid_to_array_unique(session_info
->security_token
, &tmp_sid
,
642 &session_info
->security_token
->sids
,
643 &session_info
->security_token
->num_sids
);
645 for ( i
=0; i
<session_info
->unix_token
->ngroups
; i
++ ) {
646 gid_to_unix_groups_sid(session_info
->unix_token
->groups
[i
], &tmp_sid
);
647 add_sid_to_array_unique(session_info
->security_token
, &tmp_sid
,
648 &session_info
->security_token
->sids
,
649 &session_info
->security_token
->num_sids
);
652 security_token_debug(DBGC_AUTH
, 10, session_info
->security_token
);
653 debug_unix_user_token(DBGC_AUTH
, 10,
654 session_info
->unix_token
->uid
,
655 session_info
->unix_token
->gid
,
656 session_info
->unix_token
->ngroups
,
657 session_info
->unix_token
->groups
);
659 status
= log_nt_token(session_info
->security_token
);
660 if (!NT_STATUS_IS_OK(status
)) {
664 *session_info_out
= session_info
;
668 /***************************************************************************
669 Make (and fill) a server_info struct from a 'struct passwd' by conversion
671 ***************************************************************************/
673 NTSTATUS
make_server_info_pw(struct auth_serversupplied_info
**server_info
,
678 struct samu
*sampass
= NULL
;
679 char *qualified_name
= NULL
;
680 TALLOC_CTX
*mem_ctx
= NULL
;
681 struct dom_sid u_sid
;
682 enum lsa_SidType type
;
683 struct auth_serversupplied_info
*result
;
686 * The SID returned in server_info->sam_account is based
687 * on our SAM sid even though for a pure UNIX account this should
688 * not be the case as it doesn't really exist in the SAM db.
689 * This causes lookups on "[in]valid users" to fail as they
690 * will lookup this name as a "Unix User" SID to check against
691 * the user token. Fix this by adding the "Unix User"\unix_username
692 * SID to the sid array. The correct fix should probably be
693 * changing the server_info->sam_account user SID to be a
694 * S-1-22 Unix SID, but this might break old configs where
695 * plaintext passwords were used with no SAM backend.
698 mem_ctx
= talloc_init("make_server_info_pw_tmp");
700 return NT_STATUS_NO_MEMORY
;
703 qualified_name
= talloc_asprintf(mem_ctx
, "%s\\%s",
704 unix_users_domain_name(),
706 if (!qualified_name
) {
707 TALLOC_FREE(mem_ctx
);
708 return NT_STATUS_NO_MEMORY
;
711 if (!lookup_name(mem_ctx
, qualified_name
, LOOKUP_NAME_ALL
,
714 TALLOC_FREE(mem_ctx
);
715 return NT_STATUS_NO_SUCH_USER
;
718 TALLOC_FREE(mem_ctx
);
720 if (type
!= SID_NAME_USER
) {
721 return NT_STATUS_NO_SUCH_USER
;
724 if ( !(sampass
= samu_new( NULL
)) ) {
725 return NT_STATUS_NO_MEMORY
;
728 status
= samu_set_unix( sampass
, pwd
);
729 if (!NT_STATUS_IS_OK(status
)) {
733 /* In pathological cases the above call can set the account
734 * name to the DOMAIN\username form. Reset the account name
735 * using unix_username */
736 pdb_set_username(sampass
, unix_username
, PDB_SET
);
738 /* set the user sid to be the calculated u_sid */
739 pdb_set_user_sid(sampass
, &u_sid
, PDB_SET
);
741 result
= make_server_info(NULL
);
742 if (result
== NULL
) {
743 TALLOC_FREE(sampass
);
744 return NT_STATUS_NO_MEMORY
;
747 status
= samu_to_SamInfo3(result
, sampass
, lp_netbios_name(),
748 &result
->info3
, &result
->extra
);
749 TALLOC_FREE(sampass
);
750 if (!NT_STATUS_IS_OK(status
)) {
751 DEBUG(10, ("Failed to convert samu to info3: %s\n",
757 result
->unix_name
= talloc_strdup(result
, unix_username
);
759 if (result
->unix_name
== NULL
) {
761 return NT_STATUS_NO_MEMORY
;
764 result
->utok
.uid
= pwd
->pw_uid
;
765 result
->utok
.gid
= pwd
->pw_gid
;
767 *server_info
= result
;
772 static NTSTATUS
get_system_info3(TALLOC_CTX
*mem_ctx
,
774 struct netr_SamInfo3
*info3
)
777 struct dom_sid
*system_sid
;
780 /* Set account name */
781 tmp
= talloc_strdup(mem_ctx
, pwd
->pw_name
);
783 return NT_STATUS_NO_MEMORY
;
785 init_lsa_String(&info3
->base
.account_name
, tmp
);
787 /* Set domain name */
788 tmp
= talloc_strdup(mem_ctx
, get_global_sam_name());
790 return NT_STATUS_NO_MEMORY
;
792 init_lsa_StringLarge(&info3
->base
.logon_domain
, tmp
);
795 /* The SID set here will be overwirtten anyway, but try and make it SID_NT_SYSTEM anyway */
796 /* Domain sid is NT_AUTHORITY */
798 system_sid
= dom_sid_parse_talloc(mem_ctx
, SID_NT_SYSTEM
);
799 if (system_sid
== NULL
) {
800 return NT_STATUS_NO_MEMORY
;
803 status
= dom_sid_split_rid(mem_ctx
, system_sid
, &info3
->base
.domain_sid
,
805 TALLOC_FREE(system_sid
);
806 if (!NT_STATUS_IS_OK(status
)) {
810 /* Primary gid is the same */
811 info3
->base
.primary_gid
= info3
->base
.rid
;
816 static NTSTATUS
get_guest_info3(TALLOC_CTX
*mem_ctx
,
817 struct netr_SamInfo3
*info3
)
819 const char *guest_account
= lp_guestaccount();
820 struct dom_sid domain_sid
;
824 pwd
= Get_Pwnam_alloc(mem_ctx
, guest_account
);
826 DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
827 "account [%s]!\n", guest_account
));
828 return NT_STATUS_NO_SUCH_USER
;
831 /* Set account name */
832 tmp
= talloc_strdup(mem_ctx
, pwd
->pw_name
);
834 return NT_STATUS_NO_MEMORY
;
836 init_lsa_String(&info3
->base
.account_name
, tmp
);
838 /* Set domain name */
839 tmp
= talloc_strdup(mem_ctx
, get_global_sam_name());
841 return NT_STATUS_NO_MEMORY
;
843 init_lsa_StringLarge(&info3
->base
.logon_domain
, tmp
);
846 sid_copy(&domain_sid
, get_global_sam_sid());
848 info3
->base
.domain_sid
= dom_sid_dup(mem_ctx
, &domain_sid
);
849 if (info3
->base
.domain_sid
== NULL
) {
850 return NT_STATUS_NO_MEMORY
;
854 info3
->base
.rid
= DOMAIN_RID_GUEST
;
857 info3
->base
.primary_gid
= BUILTIN_RID_GUESTS
;
860 info3
->base
.user_flags
= NETLOGON_GUEST
;
866 /***************************************************************************
867 Make (and fill) a user_info struct for a guest login.
868 This *must* succeed for smbd to start. If there is no mapping entry for
869 the guest gid, then create one.
871 The resulting structure is a 'session_info' because
872 create_local_token() has already been called on it. This is quite
873 nasty, as the auth subsystem isn't expect this, but the behavior is
875 ***************************************************************************/
877 static NTSTATUS
make_new_session_info_guest(struct auth_session_info
**session_info
, struct auth_serversupplied_info
**server_info
)
879 static const char zeros
[16] = {0};
880 const char *guest_account
= lp_guestaccount();
881 const char *domain
= lp_netbios_name();
882 struct netr_SamInfo3 info3
;
886 tmp_ctx
= talloc_stackframe();
887 if (tmp_ctx
== NULL
) {
888 return NT_STATUS_NO_MEMORY
;
893 status
= get_guest_info3(tmp_ctx
, &info3
);
894 if (!NT_STATUS_IS_OK(status
)) {
895 DEBUG(0, ("get_guest_info3 failed with %s\n",
900 status
= make_server_info_info3(tmp_ctx
,
905 if (!NT_STATUS_IS_OK(status
)) {
906 DEBUG(0, ("make_server_info_info3 failed with %s\n",
911 (*server_info
)->guest
= true;
913 /* This should not be done here (we should produce a server
914 * info, and later construct a session info from it), but for
915 * now this does not change the previous behavior */
916 status
= create_local_token(tmp_ctx
, *server_info
, NULL
,
917 (*server_info
)->info3
->base
.account_name
.string
,
919 if (!NT_STATUS_IS_OK(status
)) {
920 DEBUG(0, ("create_local_token failed: %s\n",
924 talloc_steal(NULL
, *session_info
);
925 talloc_steal(NULL
, *server_info
);
927 /* annoying, but the Guest really does have a session key, and it is
929 (*session_info
)->session_key
= data_blob(zeros
, sizeof(zeros
));
931 status
= NT_STATUS_OK
;
933 TALLOC_FREE(tmp_ctx
);
937 /***************************************************************************
938 Make (and fill) a auth_session_info struct for a system user login.
939 This *must* succeed for smbd to start.
940 ***************************************************************************/
942 static NTSTATUS
make_new_session_info_system(TALLOC_CTX
*mem_ctx
,
943 struct auth_session_info
**session_info
)
948 struct auth_serversupplied_info
*server_info
;
949 const char *domain
= lp_netbios_name();
950 struct netr_SamInfo3 info3
;
953 tmp_ctx
= talloc_stackframe();
954 if (tmp_ctx
== NULL
) {
955 return NT_STATUS_NO_MEMORY
;
958 pwd
= getpwuid_alloc(tmp_ctx
, sec_initial_uid());
960 status
= NT_STATUS_NO_SUCH_USER
;
966 status
= get_system_info3(tmp_ctx
, pwd
, &info3
);
967 if (!NT_STATUS_IS_OK(status
)) {
968 DEBUG(0, ("Failed creating system info3 with %s\n",
973 status
= make_server_info_info3(tmp_ctx
,
978 if (!NT_STATUS_IS_OK(status
)) {
979 DEBUG(0, ("make_server_info_info3 failed with %s\n",
984 server_info
->nss_token
= true;
986 /* Now turn the server_info into a session_info with the full token etc */
987 status
= create_local_token(mem_ctx
, server_info
, NULL
, pwd
->pw_name
, session_info
);
988 talloc_free(server_info
);
990 if (!NT_STATUS_IS_OK(status
)) {
991 DEBUG(0, ("create_local_token failed: %s\n",
996 TALLOC_FREE((*session_info
)->security_token
->sids
);
997 (*session_info
)->security_token
->num_sids
= 0;
999 status
= add_sid_to_array_unique((*session_info
)->security_token
->sids
,
1001 &(*session_info
)->security_token
->sids
,
1002 &(*session_info
)->security_token
->num_sids
);
1003 if (!NT_STATUS_IS_OK(status
)) {
1007 /* SYSTEM has all privilages */
1008 (*session_info
)->security_token
->privilege_mask
= ~0;
1010 talloc_steal(mem_ctx
, *session_info
);
1013 TALLOC_FREE(tmp_ctx
);
1017 /****************************************************************************
1018 Fake a auth_session_info just from a username (as a
1019 session_info structure, with create_local_token() already called on
1021 ****************************************************************************/
1023 NTSTATUS
make_session_info_from_username(TALLOC_CTX
*mem_ctx
,
1024 const char *username
,
1026 struct auth_session_info
**session_info
)
1030 struct auth_serversupplied_info
*result
;
1032 pwd
= Get_Pwnam_alloc(talloc_tos(), username
);
1034 return NT_STATUS_NO_SUCH_USER
;
1037 status
= make_server_info_pw(&result
, pwd
->pw_name
, pwd
);
1039 if (!NT_STATUS_IS_OK(status
)) {
1043 result
->nss_token
= true;
1044 result
->guest
= is_guest
;
1046 /* Now turn the server_info into a session_info with the full token etc */
1047 status
= create_local_token(mem_ctx
, result
, NULL
, pwd
->pw_name
, session_info
);
1048 TALLOC_FREE(result
);
1054 /* This function MUST only used to create the cached server_info for
1057 * This is a lossy conversion. Variables known to be lost so far
1060 * - nss_token (not needed because the only read doesn't happen
1061 * for the GUEST user, as this routine populates ->security_token
1063 * - extra (not needed because the guest account must have valid RIDs per the output of get_guest_info3())
1065 * - The 'server_info' parameter allows the missing 'info3' to be copied across.
1067 static struct auth_serversupplied_info
*copy_session_info_serverinfo_guest(TALLOC_CTX
*mem_ctx
,
1068 const struct auth_session_info
*src
,
1069 struct auth_serversupplied_info
*server_info
)
1071 struct auth_serversupplied_info
*dst
;
1073 dst
= make_server_info(mem_ctx
);
1078 /* This element must be provided to convert back to an auth_serversupplied_info */
1079 SMB_ASSERT(src
->unix_info
);
1082 dst
->system
= false;
1084 /* This element must be provided to convert back to an
1085 * auth_serversupplied_info. This needs to be from the
1086 * auth_session_info because the group values in particular
1087 * may change during create_local_token() processing */
1088 SMB_ASSERT(src
->unix_token
);
1089 dst
->utok
.uid
= src
->unix_token
->uid
;
1090 dst
->utok
.gid
= src
->unix_token
->gid
;
1091 dst
->utok
.ngroups
= src
->unix_token
->ngroups
;
1092 if (src
->unix_token
->ngroups
!= 0) {
1093 dst
->utok
.groups
= (gid_t
*)talloc_memdup(
1094 dst
, src
->unix_token
->groups
,
1095 sizeof(gid_t
)*dst
->utok
.ngroups
);
1097 dst
->utok
.groups
= NULL
;
1100 /* We must have a security_token as otherwise the lossy
1101 * conversion without nss_token would cause create_local_token
1102 * to take the wrong path */
1103 SMB_ASSERT(src
->security_token
);
1105 dst
->security_token
= dup_nt_token(dst
, src
->security_token
);
1106 if (!dst
->security_token
) {
1111 dst
->session_key
= data_blob_talloc( dst
, src
->session_key
.data
,
1112 src
->session_key
.length
);
1114 /* This is OK because this functions is only used for the
1115 * GUEST account, which has all-zero keys for both values */
1116 dst
->lm_session_key
= data_blob_talloc(dst
, src
->session_key
.data
,
1117 src
->session_key
.length
);
1119 dst
->info3
= copy_netr_SamInfo3(dst
, server_info
->info3
);
1125 dst
->unix_name
= talloc_strdup(dst
, src
->unix_info
->unix_name
);
1126 if (!dst
->unix_name
) {
1134 struct auth_session_info
*copy_session_info(TALLOC_CTX
*mem_ctx
,
1135 const struct auth_session_info
*src
)
1137 struct auth_session_info
*dst
;
1139 enum ndr_err_code ndr_err
;
1141 ndr_err
= ndr_push_struct_blob(
1142 &blob
, talloc_tos(), src
,
1143 (ndr_push_flags_fn_t
)ndr_push_auth_session_info
);
1144 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1145 DEBUG(0, ("copy_session_info(): ndr_push_auth_session_info failed: "
1146 "%s\n", ndr_errstr(ndr_err
)));
1150 dst
= talloc(mem_ctx
, struct auth_session_info
);
1152 DEBUG(0, ("talloc failed\n"));
1153 TALLOC_FREE(blob
.data
);
1157 ndr_err
= ndr_pull_struct_blob(
1159 (ndr_pull_flags_fn_t
)ndr_pull_auth_session_info
);
1160 TALLOC_FREE(blob
.data
);
1162 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1163 DEBUG(0, ("copy_session_info(): ndr_pull_auth_session_info failed: "
1164 "%s\n", ndr_errstr(ndr_err
)));
1173 * Set a new session key. Used in the rpc server where we have to override the
1174 * SMB level session key with SystemLibraryDTC
1177 bool session_info_set_session_key(struct auth_session_info
*info
,
1178 DATA_BLOB session_key
)
1180 TALLOC_FREE(info
->session_key
.data
);
1182 info
->session_key
= data_blob_talloc(
1183 info
, session_key
.data
, session_key
.length
);
1185 return (info
->session_key
.data
!= NULL
);
1188 static struct auth_session_info
*guest_info
= NULL
;
1190 static struct auth_serversupplied_info
*guest_server_info
= NULL
;
1192 bool init_guest_info(void)
1194 if (guest_info
!= NULL
)
1197 return NT_STATUS_IS_OK(make_new_session_info_guest(&guest_info
, &guest_server_info
));
1200 NTSTATUS
make_server_info_guest(TALLOC_CTX
*mem_ctx
,
1201 struct auth_serversupplied_info
**server_info
)
1203 /* This is trickier than it would appear to need to be because
1204 * we are trying to avoid certain costly operations when the
1205 * structure is converted to a 'auth_session_info' again in
1206 * create_local_token() */
1207 *server_info
= copy_session_info_serverinfo_guest(mem_ctx
, guest_info
, guest_server_info
);
1208 return (*server_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1211 NTSTATUS
make_session_info_guest(TALLOC_CTX
*mem_ctx
,
1212 struct auth_session_info
**session_info
)
1214 *session_info
= copy_session_info(mem_ctx
, guest_info
);
1215 return (*session_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1218 static struct auth_session_info
*system_info
= NULL
;
1220 NTSTATUS
init_system_session_info(void)
1222 if (system_info
!= NULL
)
1223 return NT_STATUS_OK
;
1225 return make_new_session_info_system(NULL
, &system_info
);
1228 NTSTATUS
make_session_info_system(TALLOC_CTX
*mem_ctx
,
1229 struct auth_session_info
**session_info
)
1231 if (system_info
== NULL
) return NT_STATUS_UNSUCCESSFUL
;
1232 *session_info
= copy_session_info(mem_ctx
, system_info
);
1233 return (*session_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1236 const struct auth_session_info
*get_session_info_system(void)
1241 /***************************************************************************
1242 Purely internal function for make_server_info_info3
1243 ***************************************************************************/
1245 static NTSTATUS
check_account(TALLOC_CTX
*mem_ctx
, const char *domain
,
1246 const char *username
, char **found_username
,
1247 struct passwd
**pwd
,
1248 bool *username_was_mapped
)
1250 char *orig_dom_user
= NULL
;
1251 char *dom_user
= NULL
;
1252 char *lower_username
= NULL
;
1253 char *real_username
= NULL
;
1254 struct passwd
*passwd
;
1256 lower_username
= talloc_strdup(mem_ctx
, username
);
1257 if (!lower_username
) {
1258 return NT_STATUS_NO_MEMORY
;
1260 strlower_m( lower_username
);
1262 orig_dom_user
= talloc_asprintf(mem_ctx
,
1265 *lp_winbind_separator(),
1267 if (!orig_dom_user
) {
1268 return NT_STATUS_NO_MEMORY
;
1271 /* Get the passwd struct. Try to create the account if necessary. */
1273 *username_was_mapped
= map_username(mem_ctx
, orig_dom_user
, &dom_user
);
1275 return NT_STATUS_NO_MEMORY
;
1278 passwd
= smb_getpwnam(mem_ctx
, dom_user
, &real_username
, true );
1280 DEBUG(3, ("Failed to find authenticated user %s via "
1281 "getpwnam(), denying access.\n", dom_user
));
1282 return NT_STATUS_NO_SUCH_USER
;
1285 if (!real_username
) {
1286 return NT_STATUS_NO_MEMORY
;
1291 /* This is pointless -- there is no support for differing
1292 unix and windows names. Make sure to always store the
1293 one we actually looked up and succeeded. Have I mentioned
1294 why I hate the 'winbind use default domain' parameter?
1297 *found_username
= talloc_strdup( mem_ctx
, real_username
);
1299 return NT_STATUS_OK
;
1302 /****************************************************************************
1303 Wrapper to allow the getpwnam() call to strip the domain name and
1304 try again in case a local UNIX user is already there. Also run through
1305 the username if we fallback to the username only.
1306 ****************************************************************************/
1308 struct passwd
*smb_getpwnam( TALLOC_CTX
*mem_ctx
, const char *domuser
,
1309 char **p_save_username
, bool create
)
1311 struct passwd
*pw
= NULL
;
1313 char *username
= NULL
;
1315 /* we only save a copy of the username it has been mangled
1316 by winbindd use default domain */
1317 *p_save_username
= NULL
;
1319 /* don't call map_username() here since it has to be done higher
1320 up the stack so we don't call it multiple times */
1322 username
= talloc_strdup(mem_ctx
, domuser
);
1327 p
= strchr_m( username
, *lp_winbind_separator() );
1329 /* code for a DOMAIN\user string */
1332 pw
= Get_Pwnam_alloc( mem_ctx
, domuser
);
1334 /* make sure we get the case of the username correct */
1335 /* work around 'winbind use default domain = yes' */
1337 if ( !strchr_m( pw
->pw_name
, *lp_winbind_separator() ) ) {
1340 /* split the domain and username into 2 strings */
1344 *p_save_username
= talloc_asprintf(mem_ctx
,
1347 *lp_winbind_separator(),
1349 if (!*p_save_username
) {
1354 *p_save_username
= talloc_strdup(mem_ctx
, pw
->pw_name
);
1361 /* setup for lookup of just the username */
1362 /* remember that p and username are overlapping memory */
1365 username
= talloc_strdup(mem_ctx
, p
);
1371 /* just lookup a plain username */
1373 pw
= Get_Pwnam_alloc(mem_ctx
, username
);
1375 /* Create local user if requested but only if winbindd
1376 is not running. We need to protect against cases
1377 where winbindd is failing and then prematurely
1378 creating users in /etc/passwd */
1380 if ( !pw
&& create
&& !winbind_ping() ) {
1381 /* Don't add a machine account. */
1382 if (username
[strlen(username
)-1] == '$')
1385 _smb_create_user(NULL
, username
, NULL
);
1386 pw
= Get_Pwnam_alloc(mem_ctx
, username
);
1389 /* one last check for a valid passwd struct */
1392 *p_save_username
= talloc_strdup(mem_ctx
, pw
->pw_name
);
1397 /***************************************************************************
1398 Make a server_info struct from the info3 returned by a domain logon
1399 ***************************************************************************/
1401 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
1402 const char *sent_nt_username
,
1404 struct auth_serversupplied_info
**server_info
,
1405 struct netr_SamInfo3
*info3
)
1407 static const char zeros
[16] = {0, };
1409 NTSTATUS nt_status
= NT_STATUS_OK
;
1410 char *found_username
= NULL
;
1411 const char *nt_domain
;
1412 const char *nt_username
;
1413 bool username_was_mapped
;
1415 struct auth_serversupplied_info
*result
;
1416 struct dom_sid
*group_sid
;
1417 struct netr_SamInfo3
*i3
;
1420 Here is where we should check the list of
1421 trusted domains, and verify that the SID
1425 nt_username
= talloc_strdup(mem_ctx
, info3
->base
.account_name
.string
);
1427 /* If the server didn't give us one, just use the one we sent
1429 nt_username
= sent_nt_username
;
1432 nt_domain
= talloc_strdup(mem_ctx
, info3
->base
.logon_domain
.string
);
1434 /* If the server didn't give us one, just use the one we sent
1439 /* If getpwnam() fails try the add user script (2.2.x behavior).
1441 We use the _unmapped_ username here in an attempt to provide
1442 consistent username mapping behavior between kerberos and NTLM[SSP]
1443 authentication in domain mode security. I.E. Username mapping
1444 should be applied to the fully qualified username
1445 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1446 called map_username() unnecessarily in make_user_info_map() but
1447 that is how the current code is designed. Making the change here
1448 is the least disruptive place. -- jerry */
1450 /* this call will try to create the user if necessary */
1452 nt_status
= check_account(mem_ctx
, nt_domain
, sent_nt_username
,
1453 &found_username
, &pwd
,
1454 &username_was_mapped
);
1456 if (!NT_STATUS_IS_OK(nt_status
)) {
1460 result
= make_server_info(NULL
);
1461 if (result
== NULL
) {
1462 DEBUG(4, ("make_server_info failed!\n"));
1463 return NT_STATUS_NO_MEMORY
;
1466 result
->unix_name
= talloc_strdup(result
, found_username
);
1468 /* copy in the info3 */
1469 result
->info3
= i3
= copy_netr_SamInfo3(result
, info3
);
1470 if (result
->info3
== NULL
) {
1471 TALLOC_FREE(result
);
1472 return NT_STATUS_NO_MEMORY
;
1475 /* Fill in the unix info we found on the way */
1476 result
->utok
.uid
= pwd
->pw_uid
;
1477 result
->utok
.gid
= pwd
->pw_gid
;
1479 /* We can't just trust that the primary group sid sent us is something
1480 * we can really use. Obtain the usable sid, and store the original
1481 * one as an additional group if it had to be replaced */
1482 nt_status
= get_primary_group_sid(mem_ctx
, found_username
,
1484 if (!NT_STATUS_IS_OK(nt_status
)) {
1485 TALLOC_FREE(result
);
1489 /* store and check if it is the same we got originally */
1490 sid_peek_rid(group_sid
, &i3
->base
.primary_gid
);
1491 if (i3
->base
.primary_gid
!= info3
->base
.primary_gid
) {
1492 uint32_t n
= i3
->base
.groups
.count
;
1493 /* not the same, store the original as an additional group */
1494 i3
->base
.groups
.rids
=
1495 talloc_realloc(i3
, i3
->base
.groups
.rids
,
1496 struct samr_RidWithAttribute
, n
+ 1);
1497 if (i3
->base
.groups
.rids
== NULL
) {
1498 TALLOC_FREE(result
);
1499 return NT_STATUS_NO_MEMORY
;
1501 i3
->base
.groups
.rids
[n
].rid
= info3
->base
.primary_gid
;
1502 i3
->base
.groups
.rids
[n
].attributes
= SE_GROUP_ENABLED
;
1503 i3
->base
.groups
.count
= n
+ 1;
1506 /* ensure we are never given NULL session keys */
1508 if (memcmp(info3
->base
.key
.key
, zeros
, sizeof(zeros
)) == 0) {
1509 result
->session_key
= data_blob_null
;
1511 result
->session_key
= data_blob_talloc(
1512 result
, info3
->base
.key
.key
,
1513 sizeof(info3
->base
.key
.key
));
1516 if (memcmp(info3
->base
.LMSessKey
.key
, zeros
, 8) == 0) {
1517 result
->lm_session_key
= data_blob_null
;
1519 result
->lm_session_key
= data_blob_talloc(
1520 result
, info3
->base
.LMSessKey
.key
,
1521 sizeof(info3
->base
.LMSessKey
.key
));
1524 result
->nss_token
|= username_was_mapped
;
1526 result
->guest
= (info3
->base
.user_flags
& NETLOGON_GUEST
);
1528 *server_info
= result
;
1530 return NT_STATUS_OK
;
1533 /*****************************************************************************
1534 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1535 ******************************************************************************/
1537 NTSTATUS
make_server_info_wbcAuthUserInfo(TALLOC_CTX
*mem_ctx
,
1538 const char *sent_nt_username
,
1540 const struct wbcAuthUserInfo
*info
,
1541 struct auth_serversupplied_info
**server_info
)
1543 struct netr_SamInfo3
*info3
;
1545 info3
= wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx
, info
);
1547 return NT_STATUS_NO_MEMORY
;
1550 return make_server_info_info3(mem_ctx
,
1551 sent_nt_username
, domain
,
1552 server_info
, info3
);
1556 * Verify whether or not given domain is trusted.
1558 * @param domain_name name of the domain to be verified
1559 * @return true if domain is one of the trusted ones or
1560 * false if otherwise
1563 bool is_trusted_domain(const char* dom_name
)
1565 struct dom_sid trustdom_sid
;
1568 /* no trusted domains for a standalone server */
1570 if ( lp_server_role() == ROLE_STANDALONE
)
1573 if (dom_name
== NULL
|| dom_name
[0] == '\0') {
1577 if (strequal(dom_name
, get_global_sam_name())) {
1581 /* if we are a DC, then check for a direct trust relationships */
1585 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1586 "[%s]\n", dom_name
));
1587 ret
= pdb_get_trusteddom_pw(dom_name
, NULL
, NULL
, NULL
);
1595 /* If winbind is around, ask it */
1597 result
= wb_is_trusted_domain(dom_name
);
1599 if (result
== WBC_ERR_SUCCESS
) {
1603 if (result
== WBC_ERR_DOMAIN_NOT_FOUND
) {
1604 /* winbind could not find the domain */
1608 /* The only other possible result is that winbind is not up
1609 and running. We need to update the trustdom_cache
1612 update_trustdom_cache();
1615 /* now the trustdom cache should be available a DC could still
1616 * have a transitive trust so fall back to the cache of trusted
1617 * domains (like a domain member would use */
1619 if ( trustdom_cache_fetch(dom_name
, &trustdom_sid
) ) {
1629 on a logon error possibly map the error to success if "map to guest"
1632 NTSTATUS
do_map_to_guest_server_info(NTSTATUS status
,
1633 struct auth_serversupplied_info
**server_info
,
1634 const char *user
, const char *domain
)
1636 user
= user
? user
: "";
1637 domain
= domain
? domain
: "";
1639 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)) {
1640 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER
) ||
1641 (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD
)) {
1642 DEBUG(3,("No such user %s [%s] - using guest account\n",
1644 return make_server_info_guest(NULL
, server_info
);
1646 } else if (NT_STATUS_EQUAL(status
, NT_STATUS_WRONG_PASSWORD
)) {
1647 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD
) {
1648 DEBUG(3,("Registered username %s for guest access\n",
1650 return make_server_info_guest(NULL
, server_info
);
1658 Extract session key from a session info and return it in a blob
1659 if intent is KEY_USE_16BYTES, truncate it to 16 bytes
1661 See sections 3.2.4.15 and 3.3.4.2 of MS-SMB
1662 Also see https://lists.samba.org/archive/cifs-protocol/2012-January/002265.html for details
1664 Note that returned session_key is referencing the original key, it is supposed to be
1665 short-lived. If original session_info->session_key is gone, the reference will be broken.
1667 NTSTATUS
session_extract_session_key(const struct auth_session_info
*session_info
, DATA_BLOB
*session_key
, enum session_key_use_intent intent
)
1670 if (session_key
== NULL
|| session_info
== NULL
) {
1671 return NT_STATUS_INVALID_PARAMETER
;
1674 if (session_info
->session_key
.length
== 0) {
1675 return NT_STATUS_NO_USER_SESSION_KEY
;
1678 *session_key
= session_info
->session_key
;
1679 if (intent
== KEY_USE_16BYTES
) {
1680 session_key
->length
= MIN(session_info
->session_key
.length
, 16);
1682 return NT_STATUS_OK
;