2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_AUTH
29 extern DOM_SID global_sid_World
;
30 extern DOM_SID global_sid_Network
;
31 extern DOM_SID global_sid_Builtin_Guests
;
32 extern DOM_SID global_sid_Authenticated_Users
;
35 /****************************************************************************
36 Create a UNIX user on demand.
37 ****************************************************************************/
39 static int smb_create_user(const char *unix_user
, const char *homedir
)
44 pstrcpy(add_script
, lp_adduser_script());
47 all_string_sub(add_script
, "%u", unix_user
, sizeof(pstring
));
49 all_string_sub(add_script
, "%H", homedir
, sizeof(pstring
));
50 ret
= smbrun(add_script
,NULL
);
51 DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script
,ret
));
55 /****************************************************************************
56 Add and Delete UNIX users on demand, based on NTSTATUS codes.
57 ****************************************************************************/
59 void smb_user_control(const auth_usersupplied_info
*user_info
, auth_serversupplied_info
*server_info
, NTSTATUS nt_status
)
61 struct passwd
*pwd
=NULL
;
63 if (NT_STATUS_IS_OK(nt_status
)) {
65 if (!(server_info
->sam_fill_level
& SAM_FILL_UNIX
)) {
68 * User validated ok against Domain controller.
69 * If the admin wants us to try and create a UNIX
70 * user on the fly, do so.
73 if(lp_adduser_script() && !(pwd
= Get_Pwnam(user_info
->internal_username
.str
))) {
74 smb_create_user(user_info
->internal_username
.str
, NULL
);
80 /****************************************************************************
81 Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
83 ****************************************************************************/
85 NTSTATUS
auth_get_sam_account(const char *user
, SAM_ACCOUNT
**account
)
89 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(account
))) {
94 pdb_ret
= pdb_getsampwnam(*account
, user
);
99 struct passwd
*pass
= Get_Pwnam(user
);
101 return NT_STATUS_NO_SUCH_USER
;
103 if (!NT_STATUS_IS_OK(nt_status
= pdb_fill_sam_pw(*account
, pass
))) {
110 /****************************************************************************
111 Create an auth_usersupplied_data structure
112 ****************************************************************************/
114 static NTSTATUS
make_user_info(auth_usersupplied_info
**user_info
,
115 const char *smb_name
,
116 const char *internal_username
,
117 const char *client_domain
,
119 const char *wksta_name
,
120 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
122 uint32 auth_flags
, BOOL encrypted
)
125 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username
, smb_name
));
127 *user_info
= malloc(sizeof(**user_info
));
129 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info
)));
130 return NT_STATUS_NO_MEMORY
;
133 ZERO_STRUCTP(*user_info
);
135 DEBUG(5,("making strings for %s's user_info struct\n", internal_username
));
137 (*user_info
)->smb_name
.str
= strdup(smb_name
);
138 if ((*user_info
)->smb_name
.str
) {
139 (*user_info
)->smb_name
.len
= strlen(smb_name
);
141 free_user_info(user_info
);
142 return NT_STATUS_NO_MEMORY
;
145 (*user_info
)->internal_username
.str
= strdup(internal_username
);
146 if ((*user_info
)->internal_username
.str
) {
147 (*user_info
)->internal_username
.len
= strlen(internal_username
);
149 free_user_info(user_info
);
150 return NT_STATUS_NO_MEMORY
;
153 (*user_info
)->domain
.str
= strdup(domain
);
154 if ((*user_info
)->domain
.str
) {
155 (*user_info
)->domain
.len
= strlen(domain
);
157 free_user_info(user_info
);
158 return NT_STATUS_NO_MEMORY
;
161 (*user_info
)->client_domain
.str
= strdup(client_domain
);
162 if ((*user_info
)->client_domain
.str
) {
163 (*user_info
)->client_domain
.len
= strlen(client_domain
);
165 free_user_info(user_info
);
166 return NT_STATUS_NO_MEMORY
;
169 (*user_info
)->wksta_name
.str
= strdup(wksta_name
);
170 if ((*user_info
)->wksta_name
.str
) {
171 (*user_info
)->wksta_name
.len
= strlen(wksta_name
);
173 free_user_info(user_info
);
174 return NT_STATUS_NO_MEMORY
;
177 DEBUG(5,("making blobs for %s's user_info struct\n", internal_username
));
179 (*user_info
)->lm_resp
= data_blob(lm_pwd
.data
, lm_pwd
.length
);
180 (*user_info
)->nt_resp
= data_blob(nt_pwd
.data
, nt_pwd
.length
);
181 (*user_info
)->plaintext_password
= data_blob(plaintext
.data
, plaintext
.length
);
183 (*user_info
)->encrypted
= encrypted
;
184 (*user_info
)->auth_flags
= auth_flags
;
186 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted
? "":"un" , internal_username
, smb_name
));
191 /****************************************************************************
192 Create an auth_usersupplied_data structure after appropriate mapping.
193 ****************************************************************************/
195 NTSTATUS
make_user_info_map(auth_usersupplied_info
**user_info
,
196 const char *smb_name
,
197 const char *client_domain
,
198 const char *wksta_name
,
199 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
201 uint32 ntlmssp_flags
, BOOL encrypted
)
204 fstring internal_username
;
205 fstrcpy(internal_username
, smb_name
);
206 map_username(internal_username
);
208 DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
209 client_domain
, smb_name
, wksta_name
));
211 if (lp_allow_trusted_domains() && *client_domain
) {
213 /* the client could have given us a workstation name
214 or other crap for the workgroup - we really need a
215 way of telling if this domain name is one of our
218 Also don't allow "" as a domain, fixes a Win9X bug
219 where it doens't supply a domain for logon script
222 Finally, we do this by looking up a cache of trusted domains!
225 domain
= client_domain
;
227 if (is_trusted_domain(domain
)) {
228 return make_user_info(user_info
, smb_name
, internal_username
,
229 client_domain
, domain
, wksta_name
,
230 lm_pwd
, nt_pwd
, plaintext
, ntlmssp_flags
,
235 domain
= lp_workgroup();
238 return make_user_info(user_info
,
239 smb_name
, internal_username
,
240 client_domain
, domain
,
244 ntlmssp_flags
, encrypted
);
248 /****************************************************************************
249 Create an auth_usersupplied_data, making the DATA_BLOBs here.
250 Decrypt and encrypt the passwords.
251 ****************************************************************************/
253 BOOL
make_user_info_netlogon_network(auth_usersupplied_info
**user_info
,
254 const char *smb_name
,
255 const char *client_domain
,
256 const char *wksta_name
,
257 const uchar
*lm_network_pwd
, int lm_pwd_len
,
258 const uchar
*nt_network_pwd
, int nt_pwd_len
)
262 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
263 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
264 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
265 uint32 auth_flags
= AUTH_FLAG_NONE
;
268 auth_flags
|= AUTH_FLAG_LM_RESP
;
269 if (nt_pwd_len
== 24) {
270 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
271 } else if (nt_pwd_len
!= 0) {
272 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
275 nt_status
= make_user_info_map(user_info
,
276 smb_name
, client_domain
,
282 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
284 data_blob_free(&lm_blob
);
285 data_blob_free(&nt_blob
);
289 /****************************************************************************
290 Create an auth_usersupplied_data, making the DATA_BLOBs here.
291 Decrypt and encrypt the passwords.
292 ****************************************************************************/
294 BOOL
make_user_info_netlogon_interactive(auth_usersupplied_info
**user_info
,
295 const char *smb_name
,
296 const char *client_domain
,
297 const char *wksta_name
,
299 const uchar lm_interactive_pwd
[16],
300 const uchar nt_interactive_pwd
[16],
301 const uchar
*dc_sess_key
)
305 unsigned char local_lm_response
[24];
306 unsigned char local_nt_response
[24];
307 unsigned char key
[16];
308 uint32 auth_flags
= AUTH_FLAG_NONE
;
311 memcpy(key
, dc_sess_key
, 8);
313 if (lm_interactive_pwd
) memcpy(lm_pwd
, lm_interactive_pwd
, sizeof(lm_pwd
));
314 if (nt_interactive_pwd
) memcpy(nt_pwd
, nt_interactive_pwd
, sizeof(nt_pwd
));
316 #ifdef DEBUG_PASSWORD
318 dump_data(100, (char *)key
, sizeof(key
));
320 DEBUG(100,("lm owf password:"));
321 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
323 DEBUG(100,("nt owf password:"));
324 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
327 SamOEMhash((uchar
*)lm_pwd
, key
, sizeof(lm_pwd
));
328 SamOEMhash((uchar
*)nt_pwd
, key
, sizeof(nt_pwd
));
330 #ifdef DEBUG_PASSWORD
331 DEBUG(100,("decrypt of lm owf password:"));
332 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
334 DEBUG(100,("decrypt of nt owf password:"));
335 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
338 SMBOWFencrypt((const unsigned char *)lm_pwd
, chal
, local_lm_response
);
339 SMBOWFencrypt((const unsigned char *)nt_pwd
, chal
, local_nt_response
);
341 /* Password info paranoia */
349 DATA_BLOB local_lm_blob
= data_blob(local_lm_response
, sizeof(local_lm_response
));
350 DATA_BLOB local_nt_blob
= data_blob(local_nt_response
, sizeof(local_nt_response
));
351 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
353 if (lm_interactive_pwd
)
354 auth_flags
|= AUTH_FLAG_LM_RESP
;
355 if (nt_interactive_pwd
)
356 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
358 nt_status
= make_user_info_map(user_info
,
359 smb_name
, client_domain
,
366 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
367 data_blob_free(&local_lm_blob
);
368 data_blob_free(&local_nt_blob
);
374 /****************************************************************************
375 Create an auth_usersupplied_data structure
376 ****************************************************************************/
378 BOOL
make_user_info_for_reply(auth_usersupplied_info
**user_info
,
379 const char *smb_name
,
380 const char *client_domain
,
382 DATA_BLOB plaintext_password
)
385 DATA_BLOB local_lm_blob
;
386 DATA_BLOB local_nt_blob
;
387 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
388 uint32 auth_flags
= AUTH_FLAG_NONE
;
391 * Not encrypted - do so.
394 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
396 if (plaintext_password
.data
) {
397 unsigned char local_lm_response
[24];
399 #ifdef DEBUG_PASSWORD
400 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password
.length
));
401 dump_data(100, plaintext_password
.data
, plaintext_password
.length
);
404 SMBencrypt( (const uchar
*)plaintext_password
.data
, (const uchar
*)chal
, local_lm_response
);
405 local_lm_blob
= data_blob(local_lm_response
, 24);
407 /* We can't do an NT hash here, as the password needs to be
409 local_nt_blob
= data_blob(NULL
, 0);
411 auth_flags
= (AUTH_FLAG_PLAINTEXT
| AUTH_FLAG_LM_RESP
);
413 local_lm_blob
= data_blob(NULL
, 0);
414 local_nt_blob
= data_blob(NULL
, 0);
417 ret
= make_user_info_map(user_info
, smb_name
,
419 get_remote_machine_name(),
425 data_blob_free(&local_lm_blob
);
426 return NT_STATUS_IS_OK(ret
) ? True
: False
;
429 /****************************************************************************
430 Create an auth_usersupplied_data structure
431 ****************************************************************************/
433 NTSTATUS
make_user_info_for_reply_enc(auth_usersupplied_info
**user_info
,
434 const char *smb_name
,
435 const char *client_domain
,
436 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
438 uint32 auth_flags
= AUTH_FLAG_NONE
;
440 DATA_BLOB no_plaintext_blob
= data_blob(NULL
, 0);
442 if (lm_resp
.length
== 24) {
443 auth_flags
|= AUTH_FLAG_LM_RESP
;
445 if (nt_resp
.length
== 0) {
446 } else if (nt_resp
.length
== 24) {
447 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
449 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
452 return make_user_info_map(user_info
, smb_name
,
454 get_remote_machine_name(),
461 /****************************************************************************
462 Create a guest user_info blob, for anonymous authenticaion.
463 ****************************************************************************/
465 BOOL
make_user_info_guest(auth_usersupplied_info
**user_info
)
467 DATA_BLOB lm_blob
= data_blob(NULL
, 0);
468 DATA_BLOB nt_blob
= data_blob(NULL
, 0);
469 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
470 uint32 auth_flags
= AUTH_FLAG_NONE
;
473 nt_status
= make_user_info(user_info
,
481 return NT_STATUS_IS_OK(nt_status
) ? True
: False
;
484 /****************************************************************************
485 prints a NT_USER_TOKEN to debug output.
486 ****************************************************************************/
488 void debug_nt_user_token(int dbg_class
, int dbg_lev
, NT_USER_TOKEN
*token
)
494 DEBUGC(dbg_class
, dbg_lev
, ("NT user token: (NULL)\n"));
498 DEBUGC(dbg_class
, dbg_lev
, ("NT user token of user %s\n",
499 sid_to_string(sid_str
, &token
->user_sids
[0]) ));
500 DEBUGADDC(dbg_class
, dbg_lev
, ("contains %i SIDs\n", token
->num_sids
));
501 for (i
= 0; i
< token
->num_sids
; i
++)
502 DEBUGADDC(dbg_class
, dbg_lev
, ("SID[%3i]: %s\n", i
,
503 sid_to_string(sid_str
, &token
->user_sids
[i
])));
506 /****************************************************************************
507 prints a UNIX 'token' to debug output.
508 ****************************************************************************/
510 void debug_unix_user_token(int dbg_class
, int dbg_lev
, uid_t uid
, gid_t gid
, int n_groups
, gid_t
*groups
)
513 DEBUGC(dbg_class
, dbg_lev
, ("UNIX token of user %ld\n", (long int)uid
));
515 DEBUGADDC(dbg_class
, dbg_lev
, ("Primary group is %ld and contains %i supplementary groups\n", (long int)gid
, n_groups
));
516 for (i
= 0; i
< n_groups
; i
++)
517 DEBUGADDC(dbg_class
, dbg_lev
, ("Group[%3i]: %ld\n", i
,
518 (long int)groups
[i
]));
521 /****************************************************************************
522 Create the SID list for this user.
523 ****************************************************************************/
525 static NTSTATUS
create_nt_user_token(const DOM_SID
*user_sid
, const DOM_SID
*group_sid
,
526 int n_groupSIDs
, DOM_SID
*groupSIDs
,
527 BOOL is_guest
, NT_USER_TOKEN
**token
)
529 NTSTATUS nt_status
= NT_STATUS_OK
;
530 NT_USER_TOKEN
*ptoken
;
534 if ((ptoken
= malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
) {
535 DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
536 nt_status
= NT_STATUS_NO_MEMORY
;
540 ZERO_STRUCTP(ptoken
);
542 ptoken
->num_sids
= n_groupSIDs
+ 5;
544 if ((ptoken
->user_sids
= (DOM_SID
*)malloc( sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
545 DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
546 nt_status
= NT_STATUS_NO_MEMORY
;
550 memset((char*)ptoken
->user_sids
,0,sizeof(DOM_SID
) * ptoken
->num_sids
);
553 * Note - user SID *MUST* be first in token !
554 * se_access_check depends on this.
556 * Primary group SID is second in token. Convention.
559 sid_copy(&ptoken
->user_sids
[PRIMARY_USER_SID_INDEX
], user_sid
);
561 sid_copy(&ptoken
->user_sids
[PRIMARY_GROUP_SID_INDEX
], group_sid
);
564 * Finally add the "standard" SIDs.
565 * The only difference between guest and "anonymous" (which we
566 * don't really support) is the addition of Authenticated_Users.
569 sid_copy(&ptoken
->user_sids
[2], &global_sid_World
);
570 sid_copy(&ptoken
->user_sids
[3], &global_sid_Network
);
573 sid_copy(&ptoken
->user_sids
[4], &global_sid_Builtin_Guests
);
575 sid_copy(&ptoken
->user_sids
[4], &global_sid_Authenticated_Users
);
577 sid_ndx
= 5; /* next available spot */
579 for (i
= 0; i
< n_groupSIDs
; i
++) {
580 size_t check_sid_idx
;
581 for (check_sid_idx
= 1; check_sid_idx
< ptoken
->num_sids
; check_sid_idx
++) {
582 if (sid_equal(&ptoken
->user_sids
[check_sid_idx
],
588 if (check_sid_idx
>= ptoken
->num_sids
) /* Not found already */ {
589 sid_copy(&ptoken
->user_sids
[sid_ndx
++], &groupSIDs
[i
]);
595 debug_nt_user_token(DBGC_AUTH
, 10, ptoken
);
602 /****************************************************************************
603 Create the SID list for this user.
604 ****************************************************************************/
606 NT_USER_TOKEN
*create_nt_token(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
, BOOL is_guest
)
611 NT_USER_TOKEN
*token
;
614 if (!uid_to_sid(&user_sid
, uid
)) {
617 if (!gid_to_sid(&group_sid
, gid
)) {
621 group_sids
= malloc(sizeof(DOM_SID
) * ngroups
);
623 DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
627 for (i
= 0; i
< ngroups
; i
++) {
628 if (!gid_to_sid(&(group_sids
)[i
], (groups
)[i
])) {
629 DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups
[i
]));
630 SAFE_FREE(group_sids
);
635 if (!NT_STATUS_IS_OK(create_nt_user_token(&user_sid
, &group_sid
,
636 ngroups
, group_sids
, is_guest
, &token
))) {
637 SAFE_FREE(group_sids
);
641 SAFE_FREE(group_sids
);
646 /******************************************************************************
647 * this function returns the groups (SIDs) of the local SAM the user is in.
648 * If this samba server is a DC of the domain the user belongs to, it returns
649 * both domain groups and local / builtin groups. If the user is in a trusted
650 * domain, or samba is a member server of a domain, then this function returns
651 * local and builtin groups the user is a member of.
653 * currently this is a hack, as there is no sam implementation that is capable
655 ******************************************************************************/
657 static NTSTATUS
get_user_groups_from_local_sam(SAM_ACCOUNT
*sampass
,
658 int *n_groups
, DOM_SID
**groups
, gid_t
**unix_groups
)
669 if (!IS_SAM_UNIX_USER(sampass
)) {
670 DEBUG(1, ("user %s does not have a unix identity!\n", pdb_get_username(sampass
)));
671 return NT_STATUS_NO_SUCH_USER
;
674 uid
= pdb_get_uid(sampass
);
675 gid
= pdb_get_gid(sampass
);
677 n_unix_groups
= groups_max();
678 if ((*unix_groups
= malloc( sizeof(gid_t
) * n_unix_groups
) ) == NULL
) {
679 DEBUG(0, ("get_user_groups_from_local_sam: Out of memory allocating unix group list\n"));
681 return NT_STATUS_NO_MEMORY
;
684 if (sys_getgrouplist(pdb_get_username(sampass
), gid
, *unix_groups
, &n_unix_groups
) == -1) {
686 groups_tmp
= Realloc(*unix_groups
, sizeof(gid_t
) * n_unix_groups
);
688 SAFE_FREE(*unix_groups
);
690 return NT_STATUS_NO_MEMORY
;
692 *unix_groups
= groups_tmp
;
694 if (sys_getgrouplist(pdb_get_username(sampass
), gid
, *unix_groups
, &n_unix_groups
) == -1) {
695 DEBUG(0, ("get_user_groups_from_local_sam: failed to get the unix group list\n"));
696 SAFE_FREE(*unix_groups
);
698 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
702 debug_unix_user_token(DBGC_CLASS
, 5, uid
, gid
, n_unix_groups
, *unix_groups
);
704 if (n_unix_groups
> 0) {
705 *groups
= malloc(sizeof(DOM_SID
) * n_unix_groups
);
707 DEBUG(0, ("get_user_group_from_local_sam: malloc() failed for DOM_SID list!\n"));
708 SAFE_FREE(*unix_groups
);
709 return NT_STATUS_NO_MEMORY
;
713 *n_groups
= n_unix_groups
;
715 for (i
= 0; i
< *n_groups
; i
++) {
716 if (!gid_to_sid(&(*groups
)[i
], (*unix_groups
)[i
])) {
717 DEBUG(1, ("get_user_groups_from_local_sam: failed to convert gid %ld to a sid!\n", (long int)(*unix_groups
)[i
+1]));
719 SAFE_FREE(*unix_groups
);
720 return NT_STATUS_NO_SUCH_USER
;
727 /***************************************************************************
728 Make a user_info struct
729 ***************************************************************************/
731 static NTSTATUS
make_server_info(auth_serversupplied_info
**server_info
, SAM_ACCOUNT
*sampass
)
733 *server_info
= malloc(sizeof(**server_info
));
735 DEBUG(0,("make_server_info: malloc failed!\n"));
736 return NT_STATUS_NO_MEMORY
;
738 ZERO_STRUCTP(*server_info
);
740 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
741 (*server_info
)->sam_account
= sampass
;
746 /***************************************************************************
747 Make (and fill) a user_info struct from a SAM_ACCOUNT
748 ***************************************************************************/
750 NTSTATUS
make_server_info_sam(auth_serversupplied_info
**server_info
,
751 SAM_ACCOUNT
*sampass
)
753 NTSTATUS nt_status
= NT_STATUS_OK
;
754 const DOM_SID
*user_sid
= pdb_get_user_sid(sampass
);
755 const DOM_SID
*group_sid
= pdb_get_group_sid(sampass
);
757 DOM_SID
*groupSIDs
= NULL
;
758 gid_t
*unix_groups
= NULL
;
759 NT_USER_TOKEN
*token
;
763 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
, sampass
))) {
767 if (!NT_STATUS_IS_OK(nt_status
768 = get_user_groups_from_local_sam(sampass
,
769 &n_groupSIDs
, &groupSIDs
, &unix_groups
)))
771 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
772 free_server_info(server_info
);
776 is_guest
= (sid_peek_rid(user_sid
, &rid
) && rid
== DOMAIN_USER_RID_GUEST
);
778 if (!NT_STATUS_IS_OK(nt_status
= create_nt_user_token(user_sid
, group_sid
,
779 n_groupSIDs
, groupSIDs
, is_guest
,
782 DEBUG(4,("create_nt_user_token failed\n"));
783 SAFE_FREE(groupSIDs
);
784 SAFE_FREE(unix_groups
);
785 free_server_info(server_info
);
789 SAFE_FREE(groupSIDs
);
791 (*server_info
)->n_groups
= n_groupSIDs
;
792 (*server_info
)->groups
= unix_groups
;
794 (*server_info
)->ptok
= token
;
796 DEBUG(5,("make_server_info_sam: made server info for user %s\n",
797 pdb_get_username((*server_info
)->sam_account
)));
802 /***************************************************************************
803 Make (and fill) a user_info struct from a 'struct passwd' by conversion
805 ***************************************************************************/
807 NTSTATUS
make_server_info_pw(auth_serversupplied_info
**server_info
, const struct passwd
*pwd
)
810 SAM_ACCOUNT
*sampass
= NULL
;
811 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam_pw(&sampass
, pwd
))) {
814 return make_server_info_sam(server_info
, sampass
);
817 /***************************************************************************
818 Make (and fill) a user_info struct for a guest login.
819 ***************************************************************************/
821 NTSTATUS
make_server_info_guest(auth_serversupplied_info
**server_info
)
824 SAM_ACCOUNT
*sampass
= NULL
;
827 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(&sampass
))) {
831 sid_copy(&guest_sid
, get_global_sam_sid());
832 sid_append_rid(&guest_sid
, DOMAIN_USER_RID_GUEST
);
835 if (!pdb_getsampwsid(sampass
, &guest_sid
)) {
837 return NT_STATUS_NO_SUCH_USER
;
841 nt_status
= make_server_info_sam(server_info
, sampass
);
843 if (NT_STATUS_IS_OK(nt_status
)) {
844 (*server_info
)->guest
= True
;
850 /***************************************************************************
851 Make a server_info struct from the info3 returned by a domain logon
852 ***************************************************************************/
854 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
855 const char *internal_username
,
856 const char *sent_nt_username
,
858 auth_serversupplied_info
**server_info
,
859 NET_USER_INFO_3
*info3
)
861 NTSTATUS nt_status
= NT_STATUS_OK
;
863 const char *nt_domain
;
864 const char *nt_username
;
866 SAM_ACCOUNT
*sam_account
= NULL
;
870 struct passwd
*passwd
;
876 DOM_SID
*lgroupSIDs
= NULL
;
878 gid_t
*unix_groups
= NULL
;
879 NT_USER_TOKEN
*token
;
881 DOM_SID
*all_group_SIDs
;
885 Here is where we should check the list of
886 trusted domains, and verify that the SID
890 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
891 if (!sid_append_rid(&user_sid
, info3
->user_rid
)) {
892 return NT_STATUS_INVALID_PARAMETER
;
895 sid_copy(&group_sid
, &info3
->dom_sid
.sid
);
896 if (!sid_append_rid(&group_sid
, info3
->group_rid
)) {
897 return NT_STATUS_INVALID_PARAMETER
;
900 if (!(nt_username
= unistr2_tdup(mem_ctx
, &(info3
->uni_user_name
)))) {
901 /* If the server didn't give us one, just use the one we sent them */
902 nt_username
= sent_nt_username
;
905 if (!(nt_domain
= unistr2_tdup(mem_ctx
, &(info3
->uni_logon_dom
)))) {
906 /* If the server didn't give us one, just use the one we sent them */
912 if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&u_id
, &u_type
, &user_sid
))
913 && NT_STATUS_IS_OK(idmap_get_id_from_sid(&g_id
, &g_type
, &group_sid
))
914 && ((passwd
= getpwuid_alloc(u_id
.uid
)))) {
915 nt_status
= pdb_init_sam_pw(&sam_account
, passwd
);
916 passwd_free(&passwd
);
919 dom_user
= talloc_asprintf(mem_ctx
, "%s%s%s",
921 lp_winbind_separator(),
925 DEBUG(0, ("talloc_asprintf failed!\n"));
926 return NT_STATUS_NO_MEMORY
;
929 if (!(passwd
= Get_Pwnam(dom_user
))
930 /* Only lookup local for the local
931 domain, we don't want this for
933 && strequal(nt_domain
, lp_workgroup())) {
934 passwd
= Get_Pwnam(internal_username
);
938 return NT_STATUS_NO_SUCH_USER
;
940 nt_status
= pdb_init_sam_pw(&sam_account
, passwd
);
945 if (!NT_STATUS_IS_OK(nt_status
)) {
946 DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
950 if (!pdb_set_user_sid(sam_account
, &user_sid
, PDB_CHANGED
)) {
951 pdb_free_sam(&sam_account
);
952 return NT_STATUS_UNSUCCESSFUL
;
955 if (!pdb_set_group_sid(sam_account
, &group_sid
, PDB_CHANGED
)) {
956 pdb_free_sam(&sam_account
);
957 return NT_STATUS_UNSUCCESSFUL
;
960 if (!pdb_set_nt_username(sam_account
, nt_username
, PDB_CHANGED
)) {
961 pdb_free_sam(&sam_account
);
962 return NT_STATUS_NO_MEMORY
;
965 if (!pdb_set_domain(sam_account
, nt_domain
, PDB_CHANGED
)) {
966 pdb_free_sam(&sam_account
);
967 return NT_STATUS_NO_MEMORY
;
970 if (!pdb_set_fullname(sam_account
, unistr2_static(&(info3
->uni_full_name
)), PDB_CHANGED
)) {
971 pdb_free_sam(&sam_account
);
972 return NT_STATUS_NO_MEMORY
;
975 if (!pdb_set_logon_script(sam_account
, unistr2_static(&(info3
->uni_logon_script
)), PDB_CHANGED
)) {
976 pdb_free_sam(&sam_account
);
977 return NT_STATUS_NO_MEMORY
;
980 if (!pdb_set_profile_path(sam_account
, unistr2_static(&(info3
->uni_profile_path
)), PDB_CHANGED
)) {
981 pdb_free_sam(&sam_account
);
982 return NT_STATUS_NO_MEMORY
;
985 if (!pdb_set_homedir(sam_account
, unistr2_static(&(info3
->uni_home_dir
)), PDB_CHANGED
)) {
986 pdb_free_sam(&sam_account
);
987 return NT_STATUS_NO_MEMORY
;
990 if (!pdb_set_dir_drive(sam_account
, unistr2_static(&(info3
->uni_dir_drive
)), PDB_CHANGED
)) {
991 pdb_free_sam(&sam_account
);
992 return NT_STATUS_NO_MEMORY
;
995 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
, sam_account
))) {
996 DEBUG(4, ("make_server_info failed!\n"));
997 pdb_free_sam(&sam_account
);
1001 /* Store the user group information in the server_info
1002 returned to the caller. */
1004 if (!NT_STATUS_IS_OK(nt_status
1005 = get_user_groups_from_local_sam(sam_account
,
1010 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
1014 (*server_info
)->groups
= unix_groups
;
1015 (*server_info
)->n_groups
= n_lgroupSIDs
;
1017 /* Create a 'combined' list of all SIDs we might want in the SD */
1018 all_group_SIDs
= malloc(sizeof(DOM_SID
) *
1019 (n_lgroupSIDs
+ info3
->num_groups2
+
1020 info3
->num_other_sids
));
1021 if (!all_group_SIDs
) {
1022 DEBUG(0, ("create_nt_token_info3: malloc() failed for DOM_SID list!\n"));
1023 SAFE_FREE(lgroupSIDs
);
1024 return NT_STATUS_NO_MEMORY
;
1027 /* Copy the 'local' sids */
1028 memcpy(all_group_SIDs
, lgroupSIDs
, sizeof(DOM_SID
) * n_lgroupSIDs
);
1029 SAFE_FREE(lgroupSIDs
);
1031 /* and create (by appending rids) the 'domain' sids */
1032 for (i
= 0; i
< info3
->num_groups2
; i
++) {
1033 sid_copy(&all_group_SIDs
[i
+n_lgroupSIDs
], &(info3
->dom_sid
.sid
));
1034 if (!sid_append_rid(&all_group_SIDs
[i
+n_lgroupSIDs
], info3
->gids
[i
].g_rid
)) {
1035 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1036 DEBUG(3,("create_nt_token_info3: could not append additional group rid 0x%x\n",
1037 info3
->gids
[i
].g_rid
));
1038 SAFE_FREE(lgroupSIDs
);
1043 /* Copy 'other' sids. We need to do sid filtering here to
1044 prevent possible elevation of privileges. See:
1046 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
1049 for (i
= 0; i
< info3
->num_other_sids
; i
++)
1050 sid_copy(&all_group_SIDs
[
1051 n_lgroupSIDs
+ info3
->num_groups2
+ i
],
1052 &info3
->other_sids
[i
].sid
);
1054 /* Where are the 'global' sids... */
1056 /* can the user be guest? if yes, where is it stored? */
1057 if (!NT_STATUS_IS_OK(
1058 nt_status
= create_nt_user_token(
1059 &user_sid
, &group_sid
,
1060 n_lgroupSIDs
+ info3
->num_groups2
+ info3
->num_other_sids
,
1061 all_group_SIDs
, False
, &token
))) {
1062 DEBUG(4,("create_nt_user_token failed\n"));
1063 SAFE_FREE(all_group_SIDs
);
1067 (*server_info
)->ptok
= token
;
1069 SAFE_FREE(all_group_SIDs
);
1071 memcpy((*server_info
)->session_key
, info3
->user_sess_key
, sizeof((*server_info
)->session_key
)/* 16 */);
1072 memcpy((*server_info
)->first_8_lm_hash
, info3
->padding
, 8);
1074 return NT_STATUS_OK
;
1077 /***************************************************************************
1078 Free a user_info struct
1079 ***************************************************************************/
1081 void free_user_info(auth_usersupplied_info
**user_info
)
1083 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
1084 if (*user_info
!= NULL
) {
1085 if ((*user_info
)->smb_name
.str
) {
1086 DEBUG(10,("structure was created for %s\n", (*user_info
)->smb_name
.str
));
1088 SAFE_FREE((*user_info
)->smb_name
.str
);
1089 SAFE_FREE((*user_info
)->internal_username
.str
);
1090 SAFE_FREE((*user_info
)->client_domain
.str
);
1091 SAFE_FREE((*user_info
)->domain
.str
);
1092 SAFE_FREE((*user_info
)->wksta_name
.str
);
1093 data_blob_free(&(*user_info
)->lm_resp
);
1094 data_blob_free(&(*user_info
)->nt_resp
);
1095 SAFE_FREE((*user_info
)->interactive_password
);
1096 data_blob_clear_free(&(*user_info
)->plaintext_password
);
1097 ZERO_STRUCT(**user_info
);
1099 SAFE_FREE(*user_info
);
1102 /***************************************************************************
1103 Clear out a server_info struct that has been allocated
1104 ***************************************************************************/
1106 void free_server_info(auth_serversupplied_info
**server_info
)
1108 DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
1109 if (*server_info
!= NULL
) {
1110 pdb_free_sam(&(*server_info
)->sam_account
);
1112 /* call pam_end here, unless we know we are keeping it */
1113 delete_nt_token( &(*server_info
)->ptok
);
1114 SAFE_FREE((*server_info
)->groups
);
1115 ZERO_STRUCT(**server_info
);
1117 SAFE_FREE(*server_info
);
1120 /***************************************************************************
1121 Make an auth_methods struct
1122 ***************************************************************************/
1124 BOOL
make_auth_methods(struct auth_context
*auth_context
, auth_methods
**auth_method
)
1126 if (!auth_context
) {
1127 smb_panic("no auth_context supplied to make_auth_methods()!\n");
1131 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
1134 *auth_method
= talloc(auth_context
->mem_ctx
, sizeof(**auth_method
));
1135 if (!*auth_method
) {
1136 DEBUG(0,("make_auth_method: malloc failed!\n"));
1139 ZERO_STRUCTP(*auth_method
);
1144 /****************************************************************************
1146 ****************************************************************************/
1148 void delete_nt_token(NT_USER_TOKEN
**pptoken
)
1151 NT_USER_TOKEN
*ptoken
= *pptoken
;
1152 SAFE_FREE( ptoken
->user_sids
);
1153 ZERO_STRUCTP(ptoken
);
1155 SAFE_FREE(*pptoken
);
1158 /****************************************************************************
1159 Duplicate a SID token.
1160 ****************************************************************************/
1162 NT_USER_TOKEN
*dup_nt_token(NT_USER_TOKEN
*ptoken
)
1164 NT_USER_TOKEN
*token
;
1169 if ((token
= (NT_USER_TOKEN
*)malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
)
1172 ZERO_STRUCTP(token
);
1174 if ((token
->user_sids
= (DOM_SID
*)memdup( ptoken
->user_sids
, sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
1179 token
->num_sids
= ptoken
->num_sids
;
1185 * Squash an NT_STATUS in line with security requirements.
1186 * In an attempt to avoid giving the whole game away when users
1187 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
1188 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
1189 * (session setups in particular).
1191 * @param nt_status NTSTATUS input for squashing.
1192 * @return the 'squashed' nt_status
1195 NTSTATUS
nt_status_squash(NTSTATUS nt_status
)
1197 if NT_STATUS_IS_OK(nt_status
) {
1199 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
) {
1200 /* Match WinXP and don't give the game away */
1201 return NT_STATUS_LOGON_FAILURE
;
1203 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_WRONG_PASSWORD
) {
1204 /* Match WinXP and don't give the game away */
1205 return NT_STATUS_LOGON_FAILURE
;