2 Unix SMB/CIFS implementation.
3 Standardised Authentication types
4 Copyright (C) Andrew Bartlett 2001
5 Copyright (C) Stefan Metzmacher 2005
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "librpc/gen_ndr/ndr_krb5pac.h"
26 extern const char *krbtgt_attrs
[];
27 extern const char *server_attrs
[];
28 extern const char *user_attrs
[];
30 union netr_Validation
;
31 struct netr_SamBaseInfo
;
33 struct loadparm_context
;
35 /* modules can use the following to determine if the interface has changed
36 * please increment the version number after each interface change
37 * with a comment and maybe update struct auth_critical_sizes.
39 /* version 1 - version from samba 3.0 - metze */
40 /* version 2 - initial samba4 version - metze */
41 /* version 3 - subsequent samba4 version - abartlet */
42 /* version 4 - subsequent samba4 version - metze */
43 /* version 0 - till samba4 is stable - metze */
44 #define AUTH_INTERFACE_VERSION 0
46 #define USER_INFO_CASE_INSENSITIVE_USERNAME 0x01 /* username may be in any case */
47 #define USER_INFO_CASE_INSENSITIVE_PASSWORD 0x02 /* password may be in any case */
48 #define USER_INFO_DONT_CHECK_UNIX_ACCOUNT 0x04 /* don't check unix account status */
49 #define USER_INFO_INTERACTIVE_LOGON 0x08 /* don't check unix account status */
51 enum auth_password_state
{
52 AUTH_PASSWORD_RESPONSE
,
57 struct auth_usersupplied_info
59 const char *workstation_name
;
60 const struct tsocket_address
*remote_host
;
62 uint32_t logon_parameters
;
65 /* the values the client gives us */
67 const char *account_name
;
68 const char *domain_name
;
71 enum auth_password_state password_state
;
79 struct samr_Password
*lanman
;
80 struct samr_Password
*nt
;
88 struct auth_serversupplied_info
90 struct dom_sid
*account_sid
;
91 struct dom_sid
*primary_group_sid
;
93 size_t n_domain_groups
;
94 struct dom_sid
**domain_groups
;
96 DATA_BLOB user_session_key
;
97 DATA_BLOB lm_session_key
;
99 const char *account_name
;
100 const char *domain_name
;
102 const char *full_name
;
103 const char *logon_script
;
104 const char *profile_path
;
105 const char *home_directory
;
106 const char *home_drive
;
107 const char *logon_server
;
112 NTTIME last_password_change
;
113 NTTIME allow_password_change
;
114 NTTIME force_password_change
;
116 uint16_t logon_count
;
117 uint16_t bad_password_count
;
123 struct PAC_SIGNATURE_DATA pac_srv_sig
, pac_kdc_sig
;
126 struct auth_method_context
;
127 struct auth_check_password_request
;
129 struct auth_session_info
;
131 struct auth_operations
{
134 /* If you are using this interface, then you are probably
135 * getting something wrong. This interface is only for
136 * security=server, and makes a number of compromises to allow
137 * that. It is not compatible with being a PDC. */
139 NTSTATUS (*get_challenge
)(struct auth_method_context
*ctx
, TALLOC_CTX
*mem_ctx
, uint8_t chal
[8]);
141 /* Given the user supplied info, check if this backend want to handle the password checking */
143 NTSTATUS (*want_check
)(struct auth_method_context
*ctx
, TALLOC_CTX
*mem_ctx
,
144 const struct auth_usersupplied_info
*user_info
);
146 /* Given the user supplied info, check a password */
148 NTSTATUS (*check_password
)(struct auth_method_context
*ctx
, TALLOC_CTX
*mem_ctx
,
149 const struct auth_usersupplied_info
*user_info
,
150 struct auth_serversupplied_info
**server_info
);
152 /* Lookup a 'server info' return based only on the principal */
153 NTSTATUS (*get_server_info_principal
)(TALLOC_CTX
*mem_ctx
,
154 struct auth_context
*auth_context
,
155 const char *principal
,
156 struct auth_serversupplied_info
**server_info
);
159 struct auth_method_context
{
160 struct auth_method_context
*prev
, *next
;
161 struct auth_context
*auth_ctx
;
162 const struct auth_operations
*ops
;
167 struct auth_context
{
169 /* Who set this up in the first place? */
172 bool may_be_modified
;
177 /* methods, in the order they should be called */
178 struct auth_method_context
*methods
;
180 /* the event context to use for calls that can block */
181 struct tevent_context
*event_ctx
;
183 /* the messaging context which can be used by backends */
184 struct messaging_context
*msg_ctx
;
186 /* loadparm context */
187 struct loadparm_context
*lp_ctx
;
189 /* SAM database for this local machine - to fill in local groups, or to authenticate local NTLM users */
190 struct ldb_context
*sam_ctx
;
192 NTSTATUS (*check_password
)(struct auth_context
*auth_ctx
,
194 const struct auth_usersupplied_info
*user_info
,
195 struct auth_serversupplied_info
**server_info
);
197 NTSTATUS (*get_challenge
)(struct auth_context
*auth_ctx
, uint8_t chal
[8]);
199 bool (*challenge_may_be_modified
)(struct auth_context
*auth_ctx
);
201 NTSTATUS (*set_challenge
)(struct auth_context
*auth_ctx
, const uint8_t chal
[8], const char *set_by
);
203 NTSTATUS (*get_server_info_principal
)(TALLOC_CTX
*mem_ctx
,
204 struct auth_context
*auth_context
,
205 const char *principal
,
206 struct auth_serversupplied_info
**server_info
);
208 NTSTATUS (*generate_session_info
)(TALLOC_CTX
*mem_ctx
,
209 struct auth_context
*auth_context
,
210 struct auth_serversupplied_info
*server_info
,
211 struct auth_session_info
**session_info
);
214 /* this structure is used by backends to determine the size of some critical types */
215 struct auth_critical_sizes
{
216 int interface_version
;
217 int sizeof_auth_operations
;
218 int sizeof_auth_methods
;
219 int sizeof_auth_context
;
220 int sizeof_auth_usersupplied_info
;
221 int sizeof_auth_serversupplied_info
;
224 NTSTATUS
encrypt_user_info(TALLOC_CTX
*mem_ctx
, struct auth_context
*auth_context
,
225 enum auth_password_state to_state
,
226 const struct auth_usersupplied_info
*user_info_in
,
227 const struct auth_usersupplied_info
**user_info_encrypted
);
229 #include "auth/session.h"
230 #include "auth/system_session_proto.h"
235 struct gensec_security
;
237 NTSTATUS
auth_get_challenge(struct auth_context
*auth_ctx
, uint8_t chal
[8]);
238 NTSTATUS
authsam_account_ok(TALLOC_CTX
*mem_ctx
,
239 struct ldb_context
*sam_ctx
,
240 uint32_t logon_parameters
,
241 struct ldb_dn
*domain_dn
,
242 struct ldb_message
*msg
,
243 const char *logon_workstation
,
244 const char *name_for_logs
,
245 bool allow_domain_trust
,
246 bool password_change
);
247 struct auth_session_info
*system_session(struct loadparm_context
*lp_ctx
);
248 NTSTATUS
authsam_expand_nested_groups(struct ldb_context
*sam_ctx
,
249 const struct dom_sid
*sid
,
250 const bool only_childs
,
251 TALLOC_CTX
*res_sids_ctx
,
252 struct dom_sid
***res_sids
,
253 unsigned int *num_res_sids
);
254 NTSTATUS
authsam_make_server_info(TALLOC_CTX
*mem_ctx
, struct ldb_context
*sam_ctx
,
255 const char *netbios_name
,
256 const char *domain_name
,
257 struct ldb_dn
*domain_dn
,
258 struct ldb_message
*msg
,
259 DATA_BLOB user_sess_key
, DATA_BLOB lm_sess_key
,
260 struct auth_serversupplied_info
**_server_info
);
261 NTSTATUS
auth_system_session_info(TALLOC_CTX
*parent_ctx
,
262 struct loadparm_context
*lp_ctx
,
263 struct auth_session_info
**_session_info
) ;
264 NTSTATUS
auth_nt_status_squash(NTSTATUS nt_status
);
266 NTSTATUS
auth_context_create_methods(TALLOC_CTX
*mem_ctx
, const char **methods
,
267 struct tevent_context
*ev
,
268 struct messaging_context
*msg
,
269 struct loadparm_context
*lp_ctx
,
270 struct auth_context
**auth_ctx
);
272 NTSTATUS
auth_context_create(TALLOC_CTX
*mem_ctx
,
273 struct tevent_context
*ev
,
274 struct messaging_context
*msg
,
275 struct loadparm_context
*lp_ctx
,
276 struct auth_context
**auth_ctx
);
278 NTSTATUS
auth_check_password(struct auth_context
*auth_ctx
,
280 const struct auth_usersupplied_info
*user_info
,
281 struct auth_serversupplied_info
**server_info
);
282 NTSTATUS
auth_init(void);
283 NTSTATUS
auth_register(const struct auth_operations
*ops
);
284 NTSTATUS
authenticate_username_pw(TALLOC_CTX
*mem_ctx
,
285 struct tevent_context
*ev
,
286 struct messaging_context
*msg
,
287 struct loadparm_context
*lp_ctx
,
288 const char *nt4_domain
,
289 const char *nt4_username
,
290 const char *password
,
291 struct auth_session_info
**session_info
);
293 struct tevent_req
*auth_check_password_send(TALLOC_CTX
*mem_ctx
,
294 struct tevent_context
*ev
,
295 struct auth_context
*auth_ctx
,
296 const struct auth_usersupplied_info
*user_info
);
297 NTSTATUS
auth_check_password_recv(struct tevent_req
*req
,
299 struct auth_serversupplied_info
**server_info
);
301 bool auth_challenge_may_be_modified(struct auth_context
*auth_ctx
);
302 NTSTATUS
auth_context_set_challenge(struct auth_context
*auth_ctx
, const uint8_t chal
[8], const char *set_by
);
304 NTSTATUS
auth_get_server_info_principal(TALLOC_CTX
*mem_ctx
,
305 struct auth_context
*auth_ctx
,
306 const char *principal
,
307 struct auth_serversupplied_info
**server_info
);
309 NTSTATUS
samba_server_gensec_start(TALLOC_CTX
*mem_ctx
,
310 struct tevent_context
*event_ctx
,
311 struct messaging_context
*msg_ctx
,
312 struct loadparm_context
*lp_ctx
,
313 struct cli_credentials
*server_credentials
,
314 const char *target_service
,
315 struct gensec_security
**gensec_context
);
317 #endif /* _SMBAUTH_H_ */