?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libwbclient: fix returned LogonInfo in wbc_LogonUser().
[Samba/gbeck.git] / nsswitch / libwbclient / wbc_pam.c
blobd3bf6168ed370bb7f7822a3cd177079378b3bf52
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind client API
5
6 Copyright (C) Gerald (Jerry) Carter 2007
7 Copyright (C) Guenther Deschner 2008
8
9 This library is free software; you can redistribute it and/or
10 modify it under the terms of the GNU Lesser General Public
11 License as published by the Free Software Foundation; either
12 version 3 of the License, or (at your option) any later version.
13
14 This library is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 Library General Public License for more details.
18
19 You should have received a copy of the GNU Lesser General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 /* Required Headers */
24
25 #include "replace.h"
26 #include "libwbclient.h"
27
28 /* Authenticate a username/password pair */
29 wbcErr wbcAuthenticateUser(const char *username,
30 const char *password)
31 {
32 wbcErr wbc_status = WBC_ERR_SUCCESS;
33 struct wbcAuthUserParams params;
34
35 ZERO_STRUCT(params);
36
37 params.account_name = username;
38 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
39 params.password.plaintext = password;
40
41 wbc_status = wbcAuthenticateUserEx(&params, NULL, NULL);
42 BAIL_ON_WBC_ERROR(wbc_status);
43
44 done:
45 return wbc_status;
46 }
47
48 static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
49 const struct winbindd_response *resp,
50 struct wbcAuthUserInfo **_i)
51 {
52 wbcErr wbc_status = WBC_ERR_SUCCESS;
53 struct wbcAuthUserInfo *i;
54 struct wbcDomainSid domain_sid;
55 char *p;
56 uint32_t sn = 0;
57 uint32_t j;
58
59 i = talloc(mem_ctx, struct wbcAuthUserInfo);
60 BAIL_ON_PTR_ERROR(i, wbc_status);
61
62 i->user_flags = resp->data.auth.info3.user_flgs;
63
64 i->account_name = talloc_strdup(i, resp->data.auth.info3.user_name);
65 BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
66 i->user_principal= NULL;
67 i->full_name = talloc_strdup(i, resp->data.auth.info3.full_name);
68 BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
69 i->domain_name = talloc_strdup(i, resp->data.auth.info3.logon_dom);
70 BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
71 i->dns_domain_name= NULL;
72
73 i->acct_flags = resp->data.auth.info3.acct_flags;
74 memcpy(i->user_session_key,
75 resp->data.auth.user_session_key,
76 sizeof(i->user_session_key));
77 memcpy(i->lm_session_key,
78 resp->data.auth.first_8_lm_hash,
79 sizeof(i->lm_session_key));
80
81 i->logon_count = resp->data.auth.info3.logon_count;
82 i->bad_password_count = resp->data.auth.info3.bad_pw_count;
83
84 i->logon_time = resp->data.auth.info3.logon_time;
85 i->logoff_time = resp->data.auth.info3.logoff_time;
86 i->kickoff_time = resp->data.auth.info3.kickoff_time;
87 i->pass_last_set_time = resp->data.auth.info3.pass_last_set_time;
88 i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
89 i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
90
91 i->logon_server = talloc_strdup(i, resp->data.auth.info3.logon_srv);
92 BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
93 i->logon_script = talloc_strdup(i, resp->data.auth.info3.logon_script);
94 BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
95 i->profile_path = talloc_strdup(i, resp->data.auth.info3.profile_path);
96 BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
97 i->home_directory= talloc_strdup(i, resp->data.auth.info3.home_dir);
98 BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
99 i->home_drive = talloc_strdup(i, resp->data.auth.info3.dir_drive);
100 BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
101
102 i->num_sids = 2;
103 i->num_sids += resp->data.auth.info3.num_groups;
104 i->num_sids += resp->data.auth.info3.num_other_sids;
105
106 i->sids = talloc_array(i, struct wbcSidWithAttr, i->num_sids);
107 BAIL_ON_PTR_ERROR(i->sids, wbc_status);
108
109 wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
110 &domain_sid);
111 BAIL_ON_WBC_ERROR(wbc_status);
112
113 #define _SID_COMPOSE(s, d, r, a) { \
114 (s).sid = d; \
115 if ((s).sid.num_auths < WBC_MAXSUBAUTHS) { \
116 (s).sid.sub_auths[(s).sid.num_auths++] = r; \
117 } else { \
118 wbc_status = WBC_ERR_INVALID_SID; \
119 BAIL_ON_WBC_ERROR(wbc_status); \
120 } \
121 (s).attributes = a; \
122 } while (0)
123
124 sn = 0;
125 _SID_COMPOSE(i->sids[sn], domain_sid,
126 resp->data.auth.info3.user_rid,
127 0);
128 sn++;
129 _SID_COMPOSE(i->sids[sn], domain_sid,
130 resp->data.auth.info3.group_rid,
131 0);
132 sn++;
133
134 p = (char *)resp->extra_data.data;
135 if (!p) {
136 wbc_status = WBC_ERR_INVALID_RESPONSE;
137 BAIL_ON_WBC_ERROR(wbc_status);
138 }
139
140 for (j=0; j < resp->data.auth.info3.num_groups; j++) {
141 uint32_t rid;
142 uint32_t attrs;
143 int ret;
144 char *s = p;
145 char *e = strchr(p, '\n');
146 if (!e) {
147 wbc_status = WBC_ERR_INVALID_RESPONSE;
148 BAIL_ON_WBC_ERROR(wbc_status);
149 }
150 e[0] = '\0';
151 p = &e[1];
152
153 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
154 if (ret != 2) {
155 wbc_status = WBC_ERR_INVALID_RESPONSE;
156 BAIL_ON_WBC_ERROR(wbc_status);
157 }
158
159 _SID_COMPOSE(i->sids[sn], domain_sid,
160 rid, attrs);
161 sn++;
162 }
163
164 for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
165 uint32_t attrs;
166 int ret;
167 char *s = p;
168 char *a;
169 char *e = strchr(p, '\n');
170 if (!e) {
171 wbc_status = WBC_ERR_INVALID_RESPONSE;
172 BAIL_ON_WBC_ERROR(wbc_status);
173 }
174 e[0] = '\0';
175 p = &e[1];
176
177 e = strchr(s, ':');
178 if (!e) {
179 wbc_status = WBC_ERR_INVALID_RESPONSE;
180 BAIL_ON_WBC_ERROR(wbc_status);
181 }
182 e[0] = '\0';
183 a = &e[1];
184
185 ret = sscanf(a, "0x%08X",
186 &attrs);
187 if (ret != 1) {
188 wbc_status = WBC_ERR_INVALID_RESPONSE;
189 BAIL_ON_WBC_ERROR(wbc_status);
190 }
191
192 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
193 BAIL_ON_WBC_ERROR(wbc_status);
194
195 i->sids[sn].attributes = attrs;
196 sn++;
197 }
198
199 i->num_sids = sn;
200
201 *_i = i;
202 i = NULL;
203 done:
204 talloc_free(i);
205 return wbc_status;
206 }
207
208 static wbcErr wbc_create_error_info(TALLOC_CTX *mem_ctx,
209 const struct winbindd_response *resp,
210 struct wbcAuthErrorInfo **_e)
211 {
212 wbcErr wbc_status = WBC_ERR_SUCCESS;
213 struct wbcAuthErrorInfo *e;
214
215 e = talloc(mem_ctx, struct wbcAuthErrorInfo);
216 BAIL_ON_PTR_ERROR(e, wbc_status);
217
218 e->nt_status = resp->data.auth.nt_status;
219 e->pam_error = resp->data.auth.pam_error;
220 e->nt_string = talloc_strdup(e, resp->data.auth.nt_status_string);
221 BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
222
223 e->display_string = talloc_strdup(e, resp->data.auth.error_string);
224 BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
225
226 *_e = e;
227 e = NULL;
228
229 done:
230 talloc_free(e);
231 return wbc_status;
232 }
233
234 static wbcErr wbc_create_password_policy_info(TALLOC_CTX *mem_ctx,
235 const struct winbindd_response *resp,
236 struct wbcUserPasswordPolicyInfo **_i)
237 {
238 wbcErr wbc_status = WBC_ERR_SUCCESS;
239 struct wbcUserPasswordPolicyInfo *i;
240
241 i = talloc(mem_ctx, struct wbcUserPasswordPolicyInfo);
242 BAIL_ON_PTR_ERROR(i, wbc_status);
243
244 i->min_passwordage = resp->data.auth.policy.min_passwordage;
245 i->min_length_password = resp->data.auth.policy.min_length_password;
246 i->password_history = resp->data.auth.policy.password_history;
247 i->password_properties = resp->data.auth.policy.password_properties;
248 i->expire = resp->data.auth.policy.expire;
249
250 *_i = i;
251 i = NULL;
252
253 done:
254 talloc_free(i);
255 return wbc_status;
256 }
257
258 static wbcErr wbc_create_logon_info(TALLOC_CTX *mem_ctx,
259 struct winbindd_response *resp,
260 struct wbcLogonUserInfo **_i)
261 {
262 wbcErr wbc_status = WBC_ERR_SUCCESS;
263 struct wbcLogonUserInfo *i;
264
265 i = talloc_zero(mem_ctx, struct wbcLogonUserInfo);
266 BAIL_ON_PTR_ERROR(i, wbc_status);
267
268 wbc_status = wbc_create_auth_info(i, resp, &i->info);
269 BAIL_ON_WBC_ERROR(wbc_status);
270
271 if (resp->data.auth.krb5ccname &&
272 strlen(resp->data.auth.krb5ccname)) {
273 wbc_status = wbcAddNamedBlob(&i->num_blobs,
274 &i->blobs,
275 "krb5ccname",
276 0,
277 (uint8_t *)resp->data.auth.krb5ccname,
278 strlen(resp->data.auth.krb5ccname)+1);
279 BAIL_ON_WBC_ERROR(wbc_status);
280 }
281
282 if (resp->data.auth.unix_username &&
283 strlen(resp->data.auth.unix_username)) {
284 wbc_status = wbcAddNamedBlob(&i->num_blobs,
285 &i->blobs,
286 "unix_username",
287 0,
288 (uint8_t *)resp->data.auth.unix_username,
289 strlen(resp->data.auth.unix_username)+1);
290 BAIL_ON_WBC_ERROR(wbc_status);
291 }
292
293 *_i = i;
294 i = NULL;
295 done:
296 if (!WBC_ERROR_IS_OK(wbc_status) && i) {
297 wbcFreeMemory(i->blobs);
298 }
299
300 talloc_free(i);
301 return wbc_status;
302 }
303
304 /* Authenticate with more detailed information */
305 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
306 struct wbcAuthUserInfo **info,
307 struct wbcAuthErrorInfo **error)
308 {
309 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
310 int cmd = 0;
311 struct winbindd_request request;
312 struct winbindd_response response;
313
314 ZERO_STRUCT(request);
315 ZERO_STRUCT(response);
316
317 if (error) {
318 *error = NULL;
319 }
320
321 if (!params) {
322 wbc_status = WBC_ERR_INVALID_PARAM;
323 BAIL_ON_WBC_ERROR(wbc_status);
324 }
325
326 if (!params->account_name) {
327 wbc_status = WBC_ERR_INVALID_PARAM;
328 BAIL_ON_WBC_ERROR(wbc_status);
329 }
330
331 /* Initialize request */
332
333 switch (params->level) {
334 case WBC_AUTH_USER_LEVEL_PLAIN:
335 cmd = WINBINDD_PAM_AUTH;
336 request.flags = WBFLAG_PAM_INFO3_TEXT |
337 WBFLAG_PAM_USER_SESSION_KEY |
338 WBFLAG_PAM_LMKEY;
339
340 if (!params->password.plaintext) {
341 wbc_status = WBC_ERR_INVALID_PARAM;
342 BAIL_ON_WBC_ERROR(wbc_status);
343 }
344
345 if (params->domain_name && params->domain_name[0]) {
346 /* We need to get the winbind separator :-( */
347 struct winbindd_response sep_response;
348
349 ZERO_STRUCT(sep_response);
350
351 wbc_status = wbcRequestResponse(WINBINDD_INFO,
352 NULL, &sep_response);
353 BAIL_ON_WBC_ERROR(wbc_status);
354
355 snprintf(request.data.auth.user,
356 sizeof(request.data.auth.user)-1,
357 "%s%c%s",
358 params->domain_name,
359 sep_response.data.info.winbind_separator,
360 params->account_name);
361 } else {
362 strncpy(request.data.auth.user,
363 params->account_name,
364 sizeof(request.data.auth.user)-1);
365 }
366
367 strncpy(request.data.auth.pass,
368 params->password.plaintext,
369 sizeof(request.data.auth.pass)-1);
370 break;
371
372 case WBC_AUTH_USER_LEVEL_HASH:
373 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
374 BAIL_ON_WBC_ERROR(wbc_status);
375 break;
376
377 case WBC_AUTH_USER_LEVEL_RESPONSE:
378 cmd = WINBINDD_PAM_AUTH_CRAP;
379 request.flags = WBFLAG_PAM_INFO3_TEXT |
380 WBFLAG_PAM_USER_SESSION_KEY |
381 WBFLAG_PAM_LMKEY;
382
383 if (params->password.response.lm_length &&
384 !params->password.response.lm_data) {
385 wbc_status = WBC_ERR_INVALID_PARAM;
386 BAIL_ON_WBC_ERROR(wbc_status);
387 }
388 if (params->password.response.lm_length == 0 &&
389 params->password.response.lm_data) {
390 wbc_status = WBC_ERR_INVALID_PARAM;
391 BAIL_ON_WBC_ERROR(wbc_status);
392 }
393
394 if (params->password.response.nt_length &&
395 !params->password.response.nt_data) {
396 wbc_status = WBC_ERR_INVALID_PARAM;
397 BAIL_ON_WBC_ERROR(wbc_status);
398 }
399 if (params->password.response.nt_length == 0&&
400 params->password.response.nt_data) {
401 wbc_status = WBC_ERR_INVALID_PARAM;
402 BAIL_ON_WBC_ERROR(wbc_status);
403 }
404
405 strncpy(request.data.auth_crap.user,
406 params->account_name,
407 sizeof(request.data.auth_crap.user)-1);
408 if (params->domain_name) {
409 strncpy(request.data.auth_crap.domain,
410 params->domain_name,
411 sizeof(request.data.auth_crap.domain)-1);
412 }
413 if (params->workstation_name) {
414 strncpy(request.data.auth_crap.workstation,
415 params->workstation_name,
416 sizeof(request.data.auth_crap.workstation)-1);
417 }
418
419 request.data.auth_crap.logon_parameters =
420 params->parameter_control;
421
422 memcpy(request.data.auth_crap.chal,
423 params->password.response.challenge,
424 sizeof(request.data.auth_crap.chal));
425
426 request.data.auth_crap.lm_resp_len =
427 MIN(params->password.response.lm_length,
428 sizeof(request.data.auth_crap.lm_resp));
429 request.data.auth_crap.nt_resp_len =
430 MIN(params->password.response.nt_length,
431 sizeof(request.data.auth_crap.nt_resp));
432 if (params->password.response.lm_data) {
433 memcpy(request.data.auth_crap.lm_resp,
434 params->password.response.lm_data,
435 request.data.auth_crap.lm_resp_len);
436 }
437 if (params->password.response.nt_data) {
438 memcpy(request.data.auth_crap.nt_resp,
439 params->password.response.nt_data,
440 request.data.auth_crap.nt_resp_len);
441 }
442 break;
443 default:
444 break;
445 }
446
447 if (cmd == 0) {
448 wbc_status = WBC_ERR_INVALID_PARAM;
449 BAIL_ON_WBC_ERROR(wbc_status);
450 }
451
452 if (params->flags) {
453 request.flags |= params->flags;
454 }
455
456 wbc_status = wbcRequestResponse(cmd,
457 &request,
458 &response);
459 if (response.data.auth.nt_status != 0) {
460 if (error) {
461 wbc_status = wbc_create_error_info(NULL,
462 &response,
463 error);
464 BAIL_ON_WBC_ERROR(wbc_status);
465 }
466
467 wbc_status = WBC_ERR_AUTH_ERROR;
468 BAIL_ON_WBC_ERROR(wbc_status);
469 }
470 BAIL_ON_WBC_ERROR(wbc_status);
471
472 if (info) {
473 wbc_status = wbc_create_auth_info(NULL,
474 &response,
475 info);
476 BAIL_ON_WBC_ERROR(wbc_status);
477 }
478
479 done:
480 if (response.extra_data.data)
481 free(response.extra_data.data);
482
483 return wbc_status;
484 }
485
486 /* Trigger a verification of the trust credentials of a specific domain */
487 wbcErr wbcCheckTrustCredentials(const char *domain,
488 struct wbcAuthErrorInfo **error)
489 {
490 struct winbindd_request request;
491 struct winbindd_response response;
492 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
493
494 if (domain) {
495 /*
496 * the current protocol doesn't support
497 * specifying a domain
498 */
499 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
500 BAIL_ON_WBC_ERROR(wbc_status);
501 }
502
503 ZERO_STRUCT(request);
504 ZERO_STRUCT(response);
505
506 /* Send request */
507
508 wbc_status = wbcRequestResponse(WINBINDD_CHECK_MACHACC,
509 &request,
510 &response);
511 if (response.data.auth.nt_status != 0) {
512 if (error) {
513 wbc_status = wbc_create_error_info(NULL,
514 &response,
515 error);
516 BAIL_ON_WBC_ERROR(wbc_status);
517 }
518
519 wbc_status = WBC_ERR_AUTH_ERROR;
520 BAIL_ON_WBC_ERROR(wbc_status);
521 }
522 BAIL_ON_WBC_ERROR(wbc_status);
523
524 done:
525 return wbc_status;
526 }
527
528 /* Trigger an extended logoff notification to Winbind for a specific user */
529 wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
530 struct wbcAuthErrorInfo **error)
531 {
532 struct winbindd_request request;
533 struct winbindd_response response;
534 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
535 int i;
536
537 /* validate input */
538
539 if (!params || !params->username) {
540 wbc_status = WBC_ERR_INVALID_PARAM;
541 BAIL_ON_WBC_ERROR(wbc_status);
542 }
543
544 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
545 wbc_status = WBC_ERR_INVALID_PARAM;
546 BAIL_ON_WBC_ERROR(wbc_status);
547 }
548 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
549 wbc_status = WBC_ERR_INVALID_PARAM;
550 BAIL_ON_WBC_ERROR(wbc_status);
551 }
552
553 ZERO_STRUCT(request);
554 ZERO_STRUCT(response);
555
556 strncpy(request.data.logoff.user, params->username,
557 sizeof(request.data.logoff.user)-1);
558
559 for (i=0; i<params->num_blobs; i++) {
560
561 if (strcasecmp(params->blobs[i].name, "ccfilename") == 0) {
562 if (params->blobs[i].blob.data) {
563 strncpy(request.data.logoff.krb5ccname,
564 (const char *)params->blobs[i].blob.data,
565 sizeof(request.data.logoff.krb5ccname) - 1);
566 }
567 continue;
568 }
569
570 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
571 if (params->blobs[i].blob.data) {
572 memcpy(&request.data.logoff.uid,
573 params->blobs[i].blob.data,
574 MIN(params->blobs[i].blob.length,
575 sizeof(request.data.logoff.uid)));
576 }
577 continue;
578 }
579
580 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
581 if (params->blobs[i].blob.data) {
582 memcpy(&request.flags,
583 params->blobs[i].blob.data,
584 MIN(params->blobs[i].blob.length,
585 sizeof(request.flags)));
586 }
587 continue;
588 }
589 }
590
591 /* Send request */
592
593 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
594 &request,
595 &response);
596
597 /* Take the response above and return it to the caller */
598 if (response.data.auth.nt_status != 0) {
599 if (error) {
600 wbc_status = wbc_create_error_info(NULL,
601 &response,
602 error);
603 BAIL_ON_WBC_ERROR(wbc_status);
604 }
605
606 wbc_status = WBC_ERR_AUTH_ERROR;
607 BAIL_ON_WBC_ERROR(wbc_status);
608 }
609 BAIL_ON_WBC_ERROR(wbc_status);
610
611 done:
612 return wbc_status;
613 }
614
615 /* Trigger a logoff notification to Winbind for a specific user */
616 wbcErr wbcLogoffUser(const char *username,
617 uid_t uid,
618 const char *ccfilename)
619 {
620 struct winbindd_request request;
621 struct winbindd_response response;
622 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
623
624 /* validate input */
625
626 if (!username) {
627 wbc_status = WBC_ERR_INVALID_PARAM;
628 BAIL_ON_WBC_ERROR(wbc_status);
629 }
630
631 ZERO_STRUCT(request);
632 ZERO_STRUCT(response);
633
634 strncpy(request.data.logoff.user, username,
635 sizeof(request.data.logoff.user)-1);
636 request.data.logoff.uid = uid;
637
638 if (ccfilename) {
639 strncpy(request.data.logoff.krb5ccname, ccfilename,
640 sizeof(request.data.logoff.krb5ccname)-1);
641 }
642
643 /* Send request */
644
645 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
646 &request,
647 &response);
648
649 /* Take the response above and return it to the caller */
650
651 done:
652 return wbc_status;
653 }
654
655 /* Change a password for a user with more detailed information upon failure */
656 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
657 struct wbcAuthErrorInfo **error,
658 enum wbcPasswordChangeRejectReason *reject_reason,
659 struct wbcUserPasswordPolicyInfo **policy)
660 {
661 struct winbindd_request request;
662 struct winbindd_response response;
663 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
664 int cmd = 0;
665
666 /* validate input */
667
668 if (!params->account_name) {
669 wbc_status = WBC_ERR_INVALID_PARAM;
670 BAIL_ON_WBC_ERROR(wbc_status);
671 }
672
673 if (error) {
674 *error = NULL;
675 }
676
677 if (policy) {
678 *policy = NULL;
679 }
680
681 if (reject_reason) {
682 *reject_reason = -1;
683 }
684
685 ZERO_STRUCT(request);
686 ZERO_STRUCT(response);
687
688 switch (params->level) {
689 case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
690 cmd = WINBINDD_PAM_CHAUTHTOK;
691
692 if (!params->account_name) {
693 wbc_status = WBC_ERR_INVALID_PARAM;
694 BAIL_ON_WBC_ERROR(wbc_status);
695 }
696
697 strncpy(request.data.chauthtok.user, params->account_name,
698 sizeof(request.data.chauthtok.user) - 1);
699
700 if (params->old_password.plaintext) {
701 strncpy(request.data.chauthtok.oldpass,
702 params->old_password.plaintext,
703 sizeof(request.data.chauthtok.oldpass) - 1);
704 }
705
706 if (params->new_password.plaintext) {
707 strncpy(request.data.chauthtok.newpass,
708 params->new_password.plaintext,
709 sizeof(request.data.chauthtok.newpass) - 1);
710 }
711 break;
712
713 case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
714 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
715
716 if (!params->account_name || !params->domain_name) {
717 wbc_status = WBC_ERR_INVALID_PARAM;
718 BAIL_ON_WBC_ERROR(wbc_status);
719 }
720
721 if (params->old_password.response.old_lm_hash_enc_length &&
722 !params->old_password.response.old_lm_hash_enc_data) {
723 wbc_status = WBC_ERR_INVALID_PARAM;
724 BAIL_ON_WBC_ERROR(wbc_status);
725 }
726
727 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
728 params->old_password.response.old_lm_hash_enc_data) {
729 wbc_status = WBC_ERR_INVALID_PARAM;
730 BAIL_ON_WBC_ERROR(wbc_status);
731 }
732
733 if (params->old_password.response.old_nt_hash_enc_length &&
734 !params->old_password.response.old_nt_hash_enc_data) {
735 wbc_status = WBC_ERR_INVALID_PARAM;
736 BAIL_ON_WBC_ERROR(wbc_status);
737 }
738
739 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
740 params->old_password.response.old_nt_hash_enc_data) {
741 wbc_status = WBC_ERR_INVALID_PARAM;
742 BAIL_ON_WBC_ERROR(wbc_status);
743 }
744
745 if (params->new_password.response.lm_length &&
746 !params->new_password.response.lm_data) {
747 wbc_status = WBC_ERR_INVALID_PARAM;
748 BAIL_ON_WBC_ERROR(wbc_status);
749 }
750
751 if (params->new_password.response.lm_length == 0 &&
752 params->new_password.response.lm_data) {
753 wbc_status = WBC_ERR_INVALID_PARAM;
754 BAIL_ON_WBC_ERROR(wbc_status);
755 }
756
757 if (params->new_password.response.nt_length &&
758 !params->new_password.response.nt_data) {
759 wbc_status = WBC_ERR_INVALID_PARAM;
760 BAIL_ON_WBC_ERROR(wbc_status);
761 }
762
763 if (params->new_password.response.nt_length == 0 &&
764 params->new_password.response.nt_data) {
765 wbc_status = WBC_ERR_INVALID_PARAM;
766 BAIL_ON_WBC_ERROR(wbc_status);
767 }
768
769 strncpy(request.data.chng_pswd_auth_crap.user,
770 params->account_name,
771 sizeof(request.data.chng_pswd_auth_crap.user) - 1);
772
773 strncpy(request.data.chng_pswd_auth_crap.domain,
774 params->domain_name,
775 sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
776
777 if (params->new_password.response.nt_data) {
778 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
779 params->new_password.response.nt_data,
780 request.data.chng_pswd_auth_crap.new_nt_pswd_len);
781 request.data.chng_pswd_auth_crap.new_nt_pswd_len =
782 params->new_password.response.nt_length;
783 }
784
785 if (params->new_password.response.lm_data) {
786 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
787 params->new_password.response.lm_data,
788 request.data.chng_pswd_auth_crap.new_lm_pswd_len);
789 request.data.chng_pswd_auth_crap.new_lm_pswd_len =
790 params->new_password.response.lm_length;
791 }
792
793 if (params->old_password.response.old_nt_hash_enc_data) {
794 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
795 params->old_password.response.old_nt_hash_enc_data,
796 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
797 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
798 params->old_password.response.old_nt_hash_enc_length;
799 }
800
801 if (params->old_password.response.old_lm_hash_enc_data) {
802 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
803 params->old_password.response.old_lm_hash_enc_data,
804 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
805 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
806 params->old_password.response.old_lm_hash_enc_length;
807 }
808
809 break;
810 default:
811 wbc_status = WBC_ERR_INVALID_PARAM;
812 BAIL_ON_WBC_ERROR(wbc_status);
813 break;
814 }
815
816 /* Send request */
817
818 wbc_status = wbcRequestResponse(cmd,
819 &request,
820 &response);
821 if (WBC_ERROR_IS_OK(wbc_status)) {
822 goto done;
823 }
824
825 /* Take the response above and return it to the caller */
826
827 if (response.data.auth.nt_status != 0) {
828 if (error) {
829 wbc_status = wbc_create_error_info(NULL,
830 &response,
831 error);
832 BAIL_ON_WBC_ERROR(wbc_status);
833 }
834
835 }
836
837 if (policy) {
838 wbc_status = wbc_create_password_policy_info(NULL,
839 &response,
840 policy);
841 BAIL_ON_WBC_ERROR(wbc_status);
842 }
843
844 if (reject_reason) {
845 *reject_reason = response.data.auth.reject_reason;
846 }
847
848 wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
849 BAIL_ON_WBC_ERROR(wbc_status);
850
851 done:
852 return wbc_status;
853 }
854
855 /* Change a password for a user */
856 wbcErr wbcChangeUserPassword(const char *username,
857 const char *old_password,
858 const char *new_password)
859 {
860 wbcErr wbc_status = WBC_ERR_SUCCESS;
861 struct wbcChangePasswordParams params;
862
863 ZERO_STRUCT(params);
864
865 params.account_name = username;
866 params.level = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
867 params.old_password.plaintext = old_password;
868 params.new_password.plaintext = new_password;
869
870 wbc_status = wbcChangeUserPasswordEx(&params,
871 NULL,
872 NULL,
873 NULL);
874 BAIL_ON_WBC_ERROR(wbc_status);
875
876 done:
877 return wbc_status;
878 }
879
880 /* Logon a User */
881 wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
882 struct wbcLogonUserInfo **info,
883 struct wbcAuthErrorInfo **error,
884 struct wbcUserPasswordPolicyInfo **policy)
885 {
886 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
887 int cmd = 0;
888 struct winbindd_request request;
889 struct winbindd_response response;
890 uint32_t i;
891
892 ZERO_STRUCT(request);
893 ZERO_STRUCT(response);
894
895 if (info) {
896 *info = NULL;
897 }
898 if (error) {
899 *error = NULL;
900 }
901 if (policy) {
902 *policy = NULL;
903 }
904
905 if (!params) {
906 wbc_status = WBC_ERR_INVALID_PARAM;
907 BAIL_ON_WBC_ERROR(wbc_status);
908 }
909
910 if (!params->username) {
911 wbc_status = WBC_ERR_INVALID_PARAM;
912 BAIL_ON_WBC_ERROR(wbc_status);
913 }
914
915 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
916 wbc_status = WBC_ERR_INVALID_PARAM;
917 BAIL_ON_WBC_ERROR(wbc_status);
918 }
919 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
920 wbc_status = WBC_ERR_INVALID_PARAM;
921 BAIL_ON_WBC_ERROR(wbc_status);
922 }
923
924 /* Initialize request */
925
926 cmd = WINBINDD_PAM_AUTH;
927 request.flags = WBFLAG_PAM_INFO3_TEXT |
928 WBFLAG_PAM_USER_SESSION_KEY |
929 WBFLAG_PAM_LMKEY;
930
931 if (!params->password) {
932 wbc_status = WBC_ERR_INVALID_PARAM;
933 BAIL_ON_WBC_ERROR(wbc_status);
934 }
935
936 strncpy(request.data.auth.user,
937 params->username,
938 sizeof(request.data.auth.user)-1);
939
940 strncpy(request.data.auth.pass,
941 params->password,
942 sizeof(request.data.auth.pass)-1);
943
944 for (i=0; i<params->num_blobs; i++) {
945
946 if (strcasecmp(params->blobs[i].name, "krb5_cc_type") == 0) {
947 if (params->blobs[i].blob.data) {
948 strncpy(request.data.auth.krb5_cc_type,
949 (const char *)params->blobs[i].blob.data,
950 sizeof(request.data.auth.krb5_cc_type) - 1);
951 }
952 continue;
953 }
954
955 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
956 if (params->blobs[i].blob.data) {
957 memcpy(&request.data.auth.uid,
958 params->blobs[i].blob.data,
959 MIN(sizeof(request.data.auth.uid),
960 params->blobs[i].blob.length));
961 }
962 continue;
963 }
964
965 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
966 if (params->blobs[i].blob.data) {
967 uint32_t flags;
968 memcpy(&flags,
969 params->blobs[i].blob.data,
970 MIN(sizeof(flags),
971 params->blobs[i].blob.length));
972 request.flags |= flags;
973 }
974 continue;
975 }
976
977 if (strcasecmp(params->blobs[i].name, "membership_of") == 0) {
978 if (params->blobs[i].blob.data &&
979 params->blobs[i].blob.data[0] > 0) {
980 strncpy(request.data.auth.require_membership_of_sid,
981 (const char *)params->blobs[i].blob.data,
982 sizeof(request.data.auth.require_membership_of_sid) - 1);
983 }
984 continue;
985 }
986 }
987
988 wbc_status = wbcRequestResponse(cmd,
989 &request,
990 &response);
991
992 if (response.data.auth.nt_status != 0) {
993 if (error) {
994 wbc_status = wbc_create_error_info(NULL,
995 &response,
996 error);
997 BAIL_ON_WBC_ERROR(wbc_status);
998 }
999
1000 wbc_status = WBC_ERR_AUTH_ERROR;
1001 BAIL_ON_WBC_ERROR(wbc_status);
1002 }
1003 BAIL_ON_WBC_ERROR(wbc_status);
1004
1005 if (info) {
1006 wbc_status = wbc_create_logon_info(NULL,
1007 &response,
1008 info);
1009 BAIL_ON_WBC_ERROR(wbc_status);
1010 }
1011
1012 if (policy) {
1013 wbc_status = wbc_create_password_policy_info(NULL,
1014 &response,
1015 policy);
1016 BAIL_ON_WBC_ERROR(wbc_status);
1017 }
1018
1019 done:
1020 if (response.extra_data.data)
1021 free(response.extra_data.data);
1022
1023 return wbc_status;
1024 }
1025
1026 /* Authenticate a user with cached credentials */
1027 wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
1028 struct wbcCredentialCacheInfo **info,
1029 struct wbcAuthErrorInfo **error)
1030 {
1031 return WBC_ERR_NOT_IMPLEMENTED;
1032 }
WIP