2 Unix SMB/CIFS implementation.
3 struct samu access routines
4 Copyright (C) Jeremy Allison 1996-2001
5 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6 Copyright (C) Gerald (Jerry) Carter 2000-2006
7 Copyright (C) Andrew Bartlett 2001-2002
8 Copyright (C) Stefan (metze) Metzmacher 2002
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../libcli/security/security.h"
28 #include "../lib/util/bitmap.h"
31 #define DBGC_CLASS DBGC_PASSDB
34 * @todo Redefine this to NULL, but this changes the API because
35 * much of samba assumes that the pdb_get...() funtions
36 * return strings. (ie not null-pointers).
37 * See also pdb_fill_default_sam().
40 #define PDB_NOT_QUITE_NULL ""
42 /*********************************************************************
43 Test if a change time is a max value. Copes with old and new values
45 ********************************************************************/
47 bool pdb_is_password_change_time_max(time_t test_time
)
49 if (test_time
== get_time_t_max()) {
52 #if (defined(SIZEOF_TIME_T) && (SIZEOF_TIME_T == 8))
53 if (test_time
== 0x7FFFFFFFFFFFFFFFLL
) {
57 if (test_time
== 0x7FFFFFFF) {
63 /*********************************************************************
64 Return an unchanging version of max password change time - 0x7FFFFFFF.
65 ********************************************************************/
67 static time_t pdb_password_change_time_max(void)
72 /*********************************************************************
73 Collection of get...() functions for struct samu.
74 ********************************************************************/
76 uint32_t pdb_get_acct_ctrl(const struct samu
*sampass
)
78 return sampass
->acct_ctrl
;
81 time_t pdb_get_logon_time(const struct samu
*sampass
)
83 return sampass
->logon_time
;
86 time_t pdb_get_logoff_time(const struct samu
*sampass
)
88 return sampass
->logoff_time
;
91 time_t pdb_get_kickoff_time(const struct samu
*sampass
)
93 return sampass
->kickoff_time
;
96 time_t pdb_get_bad_password_time(const struct samu
*sampass
)
98 return sampass
->bad_password_time
;
101 time_t pdb_get_pass_last_set_time(const struct samu
*sampass
)
103 return sampass
->pass_last_set_time
;
106 time_t pdb_get_pass_can_change_time(const struct samu
*sampass
)
110 /* if the last set time is zero, it means the user cannot
111 change their password, and this time must be zero. jmcd
113 if (sampass
->pass_last_set_time
== 0)
116 /* if the time is max, and the field has been changed,
117 we're trying to update this real value from the sampass
118 to indicate that the user cannot change their password. jmcd
120 if (pdb_is_password_change_time_max(sampass
->pass_can_change_time
) &&
121 IS_SAM_CHANGED(sampass
, PDB_CANCHANGETIME
))
122 return sampass
->pass_can_change_time
;
124 if (!pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE
, &allow
))
127 /* in normal cases, just calculate it from policy */
128 return sampass
->pass_last_set_time
+ allow
;
131 /* we need this for loading from the backend, so that we don't overwrite
132 non-changed max times, otherwise the pass_can_change checking won't work */
133 time_t pdb_get_pass_can_change_time_noncalc(const struct samu
*sampass
)
135 return sampass
->pass_can_change_time
;
138 time_t pdb_get_pass_must_change_time(const struct samu
*sampass
)
142 if (sampass
->pass_last_set_time
== 0)
145 if (sampass
->acct_ctrl
& ACB_PWNOEXP
)
146 return pdb_password_change_time_max();
148 if (!pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE
, &expire
)
149 || expire
== (uint32_t)-1 || expire
== 0)
150 return get_time_t_max();
152 return sampass
->pass_last_set_time
+ expire
;
155 bool pdb_get_pass_can_change(const struct samu
*sampass
)
157 if (pdb_is_password_change_time_max(sampass
->pass_can_change_time
))
162 uint16_t pdb_get_logon_divs(const struct samu
*sampass
)
164 return sampass
->logon_divs
;
167 uint32_t pdb_get_hours_len(const struct samu
*sampass
)
169 return sampass
->hours_len
;
172 const uint8
*pdb_get_hours(const struct samu
*sampass
)
174 return (sampass
->hours
);
177 const uint8
*pdb_get_nt_passwd(const struct samu
*sampass
)
179 SMB_ASSERT((!sampass
->nt_pw
.data
)
180 || sampass
->nt_pw
.length
== NT_HASH_LEN
);
181 return (uint8
*)sampass
->nt_pw
.data
;
184 const uint8
*pdb_get_lanman_passwd(const struct samu
*sampass
)
186 SMB_ASSERT((!sampass
->lm_pw
.data
)
187 || sampass
->lm_pw
.length
== LM_HASH_LEN
);
188 return (uint8
*)sampass
->lm_pw
.data
;
191 const uint8
*pdb_get_pw_history(const struct samu
*sampass
, uint32_t *current_hist_len
)
193 SMB_ASSERT((!sampass
->nt_pw_his
.data
)
194 || ((sampass
->nt_pw_his
.length
% PW_HISTORY_ENTRY_LEN
) == 0));
195 *current_hist_len
= sampass
->nt_pw_his
.length
/ PW_HISTORY_ENTRY_LEN
;
196 return (uint8
*)sampass
->nt_pw_his
.data
;
199 /* Return the plaintext password if known. Most of the time
200 it isn't, so don't assume anything magic about this function.
202 Used to pass the plaintext to passdb backends that might
203 want to store more than just the NTLM hashes.
205 const char *pdb_get_plaintext_passwd(const struct samu
*sampass
)
207 return sampass
->plaintext_pw
;
210 const struct dom_sid
*pdb_get_user_sid(const struct samu
*sampass
)
212 return &sampass
->user_sid
;
215 const struct dom_sid
*pdb_get_group_sid(struct samu
*sampass
)
219 /* Return the cached group SID if we have that */
220 if (sampass
->group_sid
) {
221 return sampass
->group_sid
;
224 /* No algorithmic mapping, meaning that we have to figure out the
225 primary group SID according to group mapping and the user SID must
226 be a newly allocated one. We rely on the user's Unix primary gid.
227 We have no choice but to fail if we can't find it. */
228 status
= get_primary_group_sid(sampass
,
229 pdb_get_username(sampass
),
231 &sampass
->group_sid
);
232 if (!NT_STATUS_IS_OK(status
)) {
236 return sampass
->group_sid
;
240 * Get flags showing what is initalised in the struct samu
241 * @param sampass the struct samu in question
242 * @return the flags indicating the members initialised in the struct.
245 enum pdb_value_state
pdb_get_init_flags(const struct samu
*sampass
, enum pdb_elements element
)
247 enum pdb_value_state ret
= PDB_DEFAULT
;
249 if (!sampass
->change_flags
|| !sampass
->set_flags
)
252 if (bitmap_query(sampass
->set_flags
, element
)) {
253 DEBUG(11, ("element %d: SET\n", element
));
257 if (bitmap_query(sampass
->change_flags
, element
)) {
258 DEBUG(11, ("element %d: CHANGED\n", element
));
262 if (ret
== PDB_DEFAULT
) {
263 DEBUG(11, ("element %d: DEFAULT\n", element
));
269 const char *pdb_get_username(const struct samu
*sampass
)
271 return sampass
->username
;
274 const char *pdb_get_domain(const struct samu
*sampass
)
276 return sampass
->domain
;
279 const char *pdb_get_nt_username(const struct samu
*sampass
)
281 return sampass
->nt_username
;
284 const char *pdb_get_fullname(const struct samu
*sampass
)
286 return sampass
->full_name
;
289 const char *pdb_get_homedir(const struct samu
*sampass
)
291 return sampass
->home_dir
;
294 const char *pdb_get_dir_drive(const struct samu
*sampass
)
296 return sampass
->dir_drive
;
299 const char *pdb_get_logon_script(const struct samu
*sampass
)
301 return sampass
->logon_script
;
304 const char *pdb_get_profile_path(const struct samu
*sampass
)
306 return sampass
->profile_path
;
309 const char *pdb_get_acct_desc(const struct samu
*sampass
)
311 return sampass
->acct_desc
;
314 const char *pdb_get_workstations(const struct samu
*sampass
)
316 return sampass
->workstations
;
319 const char *pdb_get_comment(const struct samu
*sampass
)
321 return sampass
->comment
;
324 const char *pdb_get_munged_dial(const struct samu
*sampass
)
326 return sampass
->munged_dial
;
329 uint16_t pdb_get_bad_password_count(const struct samu
*sampass
)
331 return sampass
->bad_password_count
;
334 uint16_t pdb_get_logon_count(const struct samu
*sampass
)
336 return sampass
->logon_count
;
339 uint16_t pdb_get_country_code(const struct samu
*sampass
)
341 return sampass
->country_code
;
344 uint16_t pdb_get_code_page(const struct samu
*sampass
)
346 return sampass
->code_page
;
349 uint32_t pdb_get_unknown_6(const struct samu
*sampass
)
351 return sampass
->unknown_6
;
354 void *pdb_get_backend_private_data(const struct samu
*sampass
, const struct pdb_methods
*my_methods
)
356 if (my_methods
== sampass
->backend_private_methods
) {
357 return sampass
->backend_private_data
;
363 /*********************************************************************
364 Collection of set...() functions for struct samu.
365 ********************************************************************/
367 bool pdb_set_acct_ctrl(struct samu
*sampass
, uint32_t acct_ctrl
, enum pdb_value_state flag
)
369 sampass
->acct_ctrl
= acct_ctrl
;
370 return pdb_set_init_flags(sampass
, PDB_ACCTCTRL
, flag
);
373 bool pdb_set_logon_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
375 sampass
->logon_time
= mytime
;
376 return pdb_set_init_flags(sampass
, PDB_LOGONTIME
, flag
);
379 bool pdb_set_logoff_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
381 sampass
->logoff_time
= mytime
;
382 return pdb_set_init_flags(sampass
, PDB_LOGOFFTIME
, flag
);
385 bool pdb_set_kickoff_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
387 sampass
->kickoff_time
= mytime
;
388 return pdb_set_init_flags(sampass
, PDB_KICKOFFTIME
, flag
);
391 bool pdb_set_bad_password_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
393 sampass
->bad_password_time
= mytime
;
394 return pdb_set_init_flags(sampass
, PDB_BAD_PASSWORD_TIME
, flag
);
397 bool pdb_set_pass_can_change_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
399 sampass
->pass_can_change_time
= mytime
;
400 return pdb_set_init_flags(sampass
, PDB_CANCHANGETIME
, flag
);
403 bool pdb_set_pass_must_change_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
405 sampass
->pass_must_change_time
= mytime
;
406 return pdb_set_init_flags(sampass
, PDB_MUSTCHANGETIME
, flag
);
409 bool pdb_set_pass_last_set_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
411 sampass
->pass_last_set_time
= mytime
;
412 return pdb_set_init_flags(sampass
, PDB_PASSLASTSET
, flag
);
415 bool pdb_set_hours_len(struct samu
*sampass
, uint32_t len
, enum pdb_value_state flag
)
417 sampass
->hours_len
= len
;
418 return pdb_set_init_flags(sampass
, PDB_HOURSLEN
, flag
);
421 bool pdb_set_logon_divs(struct samu
*sampass
, uint16_t hours
, enum pdb_value_state flag
)
423 sampass
->logon_divs
= hours
;
424 return pdb_set_init_flags(sampass
, PDB_LOGONDIVS
, flag
);
428 * Set flags showing what is initalised in the struct samu
429 * @param sampass the struct samu in question
430 * @param flag The *new* flag to be set. Old flags preserved
431 * this flag is only added.
434 bool pdb_set_init_flags(struct samu
*sampass
, enum pdb_elements element
, enum pdb_value_state value_flag
)
436 if (!sampass
->set_flags
) {
437 if ((sampass
->set_flags
=
438 bitmap_talloc(sampass
,
440 DEBUG(0,("bitmap_talloc failed\n"));
444 if (!sampass
->change_flags
) {
445 if ((sampass
->change_flags
=
446 bitmap_talloc(sampass
,
448 DEBUG(0,("bitmap_talloc failed\n"));
455 if (!bitmap_set(sampass
->change_flags
, element
)) {
456 DEBUG(0,("Can't set flag: %d in change_flags.\n",element
));
459 if (!bitmap_set(sampass
->set_flags
, element
)) {
460 DEBUG(0,("Can't set flag: %d in set_flags.\n",element
));
463 DEBUG(11, ("element %d -> now CHANGED\n", element
));
466 if (!bitmap_clear(sampass
->change_flags
, element
)) {
467 DEBUG(0,("Can't set flag: %d in change_flags.\n",element
));
470 if (!bitmap_set(sampass
->set_flags
, element
)) {
471 DEBUG(0,("Can't set flag: %d in set_flags.\n",element
));
474 DEBUG(11, ("element %d -> now SET\n", element
));
478 if (!bitmap_clear(sampass
->change_flags
, element
)) {
479 DEBUG(0,("Can't set flag: %d in change_flags.\n",element
));
482 if (!bitmap_clear(sampass
->set_flags
, element
)) {
483 DEBUG(0,("Can't set flag: %d in set_flags.\n",element
));
486 DEBUG(11, ("element %d -> now DEFAULT\n", element
));
493 bool pdb_set_user_sid(struct samu
*sampass
, const struct dom_sid
*u_sid
, enum pdb_value_state flag
)
498 sid_copy(&sampass
->user_sid
, u_sid
);
500 DEBUG(10, ("pdb_set_user_sid: setting user sid %s\n",
501 sid_string_dbg(&sampass
->user_sid
)));
503 return pdb_set_init_flags(sampass
, PDB_USERSID
, flag
);
506 bool pdb_set_user_sid_from_string(struct samu
*sampass
, const char *u_sid
, enum pdb_value_state flag
)
508 struct dom_sid new_sid
;
513 DEBUG(10, ("pdb_set_user_sid_from_string: setting user sid %s\n",
516 if (!string_to_sid(&new_sid
, u_sid
)) {
517 DEBUG(1, ("pdb_set_user_sid_from_string: %s isn't a valid SID!\n", u_sid
));
521 if (!pdb_set_user_sid(sampass
, &new_sid
, flag
)) {
522 DEBUG(1, ("pdb_set_user_sid_from_string: could not set sid %s on struct samu!\n", u_sid
));
529 /********************************************************************
530 We never fill this in from a passdb backend but rather set is
531 based on the user's primary group membership. However, the
532 struct samu* is overloaded and reused in domain memship code
533 as well and built from the netr_SamInfo3 or PAC so we
534 have to allow the explicitly setting of a group SID here.
535 ********************************************************************/
537 bool pdb_set_group_sid(struct samu
*sampass
, const struct dom_sid
*g_sid
, enum pdb_value_state flag
)
540 struct dom_sid dug_sid
;
545 if ( !(sampass
->group_sid
= talloc( sampass
, struct dom_sid
)) ) {
549 /* if we cannot resolve the SID to gid, then just ignore it and
550 store DOMAIN_USERS as the primary groupSID */
552 sid_compose(&dug_sid
, get_global_sam_sid(), DOMAIN_RID_USERS
);
554 if (dom_sid_equal(&dug_sid
, g_sid
)) {
555 sid_copy(sampass
->group_sid
, &dug_sid
);
556 } else if (sid_to_gid( g_sid
, &gid
) ) {
557 sid_copy(sampass
->group_sid
, g_sid
);
559 sid_copy(sampass
->group_sid
, &dug_sid
);
562 DEBUG(10, ("pdb_set_group_sid: setting group sid %s\n",
563 sid_string_dbg(sampass
->group_sid
)));
565 return pdb_set_init_flags(sampass
, PDB_GROUPSID
, flag
);
568 /*********************************************************************
569 Set the user's UNIX name.
570 ********************************************************************/
572 bool pdb_set_username(struct samu
*sampass
, const char *username
, enum pdb_value_state flag
)
575 DEBUG(10, ("pdb_set_username: setting username %s, was %s\n", username
,
576 (sampass
->username
)?(sampass
->username
):"NULL"));
578 sampass
->username
= talloc_strdup(sampass
, username
);
580 if (!sampass
->username
) {
581 DEBUG(0, ("pdb_set_username: talloc_strdup() failed!\n"));
585 sampass
->username
= PDB_NOT_QUITE_NULL
;
588 return pdb_set_init_flags(sampass
, PDB_USERNAME
, flag
);
591 /*********************************************************************
593 ********************************************************************/
595 bool pdb_set_domain(struct samu
*sampass
, const char *domain
, enum pdb_value_state flag
)
598 DEBUG(10, ("pdb_set_domain: setting domain %s, was %s\n", domain
,
599 (sampass
->domain
)?(sampass
->domain
):"NULL"));
601 sampass
->domain
= talloc_strdup(sampass
, domain
);
603 if (!sampass
->domain
) {
604 DEBUG(0, ("pdb_set_domain: talloc_strdup() failed!\n"));
608 sampass
->domain
= PDB_NOT_QUITE_NULL
;
611 return pdb_set_init_flags(sampass
, PDB_DOMAIN
, flag
);
614 /*********************************************************************
615 Set the user's NT name.
616 ********************************************************************/
618 bool pdb_set_nt_username(struct samu
*sampass
, const char *nt_username
, enum pdb_value_state flag
)
621 DEBUG(10, ("pdb_set_nt_username: setting nt username %s, was %s\n", nt_username
,
622 (sampass
->nt_username
)?(sampass
->nt_username
):"NULL"));
624 sampass
->nt_username
= talloc_strdup(sampass
, nt_username
);
626 if (!sampass
->nt_username
) {
627 DEBUG(0, ("pdb_set_nt_username: talloc_strdup() failed!\n"));
631 sampass
->nt_username
= PDB_NOT_QUITE_NULL
;
634 return pdb_set_init_flags(sampass
, PDB_NTUSERNAME
, flag
);
637 /*********************************************************************
638 Set the user's full name.
639 ********************************************************************/
641 bool pdb_set_fullname(struct samu
*sampass
, const char *full_name
, enum pdb_value_state flag
)
644 DEBUG(10, ("pdb_set_full_name: setting full name %s, was %s\n", full_name
,
645 (sampass
->full_name
)?(sampass
->full_name
):"NULL"));
647 sampass
->full_name
= talloc_strdup(sampass
, full_name
);
649 if (!sampass
->full_name
) {
650 DEBUG(0, ("pdb_set_fullname: talloc_strdup() failed!\n"));
654 sampass
->full_name
= PDB_NOT_QUITE_NULL
;
657 return pdb_set_init_flags(sampass
, PDB_FULLNAME
, flag
);
660 /*********************************************************************
661 Set the user's logon script.
662 ********************************************************************/
664 bool pdb_set_logon_script(struct samu
*sampass
, const char *logon_script
, enum pdb_value_state flag
)
667 DEBUG(10, ("pdb_set_logon_script: setting logon script %s, was %s\n", logon_script
,
668 (sampass
->logon_script
)?(sampass
->logon_script
):"NULL"));
670 sampass
->logon_script
= talloc_strdup(sampass
, logon_script
);
672 if (!sampass
->logon_script
) {
673 DEBUG(0, ("pdb_set_logon_script: talloc_strdup() failed!\n"));
677 sampass
->logon_script
= PDB_NOT_QUITE_NULL
;
680 return pdb_set_init_flags(sampass
, PDB_LOGONSCRIPT
, flag
);
683 /*********************************************************************
684 Set the user's profile path.
685 ********************************************************************/
687 bool pdb_set_profile_path(struct samu
*sampass
, const char *profile_path
, enum pdb_value_state flag
)
690 DEBUG(10, ("pdb_set_profile_path: setting profile path %s, was %s\n", profile_path
,
691 (sampass
->profile_path
)?(sampass
->profile_path
):"NULL"));
693 sampass
->profile_path
= talloc_strdup(sampass
, profile_path
);
695 if (!sampass
->profile_path
) {
696 DEBUG(0, ("pdb_set_profile_path: talloc_strdup() failed!\n"));
700 sampass
->profile_path
= PDB_NOT_QUITE_NULL
;
703 return pdb_set_init_flags(sampass
, PDB_PROFILE
, flag
);
706 /*********************************************************************
707 Set the user's directory drive.
708 ********************************************************************/
710 bool pdb_set_dir_drive(struct samu
*sampass
, const char *dir_drive
, enum pdb_value_state flag
)
713 DEBUG(10, ("pdb_set_dir_drive: setting dir drive %s, was %s\n", dir_drive
,
714 (sampass
->dir_drive
)?(sampass
->dir_drive
):"NULL"));
716 sampass
->dir_drive
= talloc_strdup(sampass
, dir_drive
);
718 if (!sampass
->dir_drive
) {
719 DEBUG(0, ("pdb_set_dir_drive: talloc_strdup() failed!\n"));
724 sampass
->dir_drive
= PDB_NOT_QUITE_NULL
;
727 return pdb_set_init_flags(sampass
, PDB_DRIVE
, flag
);
730 /*********************************************************************
731 Set the user's home directory.
732 ********************************************************************/
734 bool pdb_set_homedir(struct samu
*sampass
, const char *home_dir
, enum pdb_value_state flag
)
737 DEBUG(10, ("pdb_set_homedir: setting home dir %s, was %s\n", home_dir
,
738 (sampass
->home_dir
)?(sampass
->home_dir
):"NULL"));
740 sampass
->home_dir
= talloc_strdup(sampass
, home_dir
);
742 if (!sampass
->home_dir
) {
743 DEBUG(0, ("pdb_set_home_dir: talloc_strdup() failed!\n"));
747 sampass
->home_dir
= PDB_NOT_QUITE_NULL
;
750 return pdb_set_init_flags(sampass
, PDB_SMBHOME
, flag
);
753 /*********************************************************************
754 Set the user's account description.
755 ********************************************************************/
757 bool pdb_set_acct_desc(struct samu
*sampass
, const char *acct_desc
, enum pdb_value_state flag
)
760 sampass
->acct_desc
= talloc_strdup(sampass
, acct_desc
);
762 if (!sampass
->acct_desc
) {
763 DEBUG(0, ("pdb_set_acct_desc: talloc_strdup() failed!\n"));
767 sampass
->acct_desc
= PDB_NOT_QUITE_NULL
;
770 return pdb_set_init_flags(sampass
, PDB_ACCTDESC
, flag
);
773 /*********************************************************************
774 Set the user's workstation allowed list.
775 ********************************************************************/
777 bool pdb_set_workstations(struct samu
*sampass
, const char *workstations
, enum pdb_value_state flag
)
780 DEBUG(10, ("pdb_set_workstations: setting workstations %s, was %s\n", workstations
,
781 (sampass
->workstations
)?(sampass
->workstations
):"NULL"));
783 sampass
->workstations
= talloc_strdup(sampass
, workstations
);
785 if (!sampass
->workstations
) {
786 DEBUG(0, ("pdb_set_workstations: talloc_strdup() failed!\n"));
790 sampass
->workstations
= PDB_NOT_QUITE_NULL
;
793 return pdb_set_init_flags(sampass
, PDB_WORKSTATIONS
, flag
);
796 /*********************************************************************
797 ********************************************************************/
799 bool pdb_set_comment(struct samu
*sampass
, const char *comment
, enum pdb_value_state flag
)
802 sampass
->comment
= talloc_strdup(sampass
, comment
);
804 if (!sampass
->comment
) {
805 DEBUG(0, ("pdb_set_comment: talloc_strdup() failed!\n"));
809 sampass
->comment
= PDB_NOT_QUITE_NULL
;
812 return pdb_set_init_flags(sampass
, PDB_COMMENT
, flag
);
815 /*********************************************************************
816 Set the user's dial string.
817 ********************************************************************/
819 bool pdb_set_munged_dial(struct samu
*sampass
, const char *munged_dial
, enum pdb_value_state flag
)
822 sampass
->munged_dial
= talloc_strdup(sampass
, munged_dial
);
824 if (!sampass
->munged_dial
) {
825 DEBUG(0, ("pdb_set_munged_dial: talloc_strdup() failed!\n"));
829 sampass
->munged_dial
= PDB_NOT_QUITE_NULL
;
832 return pdb_set_init_flags(sampass
, PDB_MUNGEDDIAL
, flag
);
835 /*********************************************************************
836 Set the user's NT hash.
837 ********************************************************************/
839 bool pdb_set_nt_passwd(struct samu
*sampass
, const uint8 pwd
[NT_HASH_LEN
], enum pdb_value_state flag
)
841 data_blob_clear_free(&sampass
->nt_pw
);
845 data_blob_talloc(sampass
, pwd
, NT_HASH_LEN
);
847 sampass
->nt_pw
= data_blob_null
;
850 return pdb_set_init_flags(sampass
, PDB_NTPASSWD
, flag
);
853 /*********************************************************************
854 Set the user's LM hash.
855 ********************************************************************/
857 bool pdb_set_lanman_passwd(struct samu
*sampass
, const uint8 pwd
[LM_HASH_LEN
], enum pdb_value_state flag
)
859 data_blob_clear_free(&sampass
->lm_pw
);
861 /* on keep the password if we are allowing LANMAN authentication */
863 if (pwd
&& lp_lanman_auth() ) {
864 sampass
->lm_pw
= data_blob_talloc(sampass
, pwd
, LM_HASH_LEN
);
866 sampass
->lm_pw
= data_blob_null
;
869 return pdb_set_init_flags(sampass
, PDB_LMPASSWD
, flag
);
872 /*********************************************************************
873 Set the user's password history hash. historyLen is the number of
874 PW_HISTORY_SALT_LEN+SALTED_MD5_HASH_LEN length
875 entries to store in the history - this must match the size of the uint8 array
877 ********************************************************************/
879 bool pdb_set_pw_history(struct samu
*sampass
, const uint8
*pwd
, uint32_t historyLen
, enum pdb_value_state flag
)
881 if (historyLen
&& pwd
){
882 data_blob_free(&(sampass
->nt_pw_his
));
883 sampass
->nt_pw_his
= data_blob_talloc(sampass
,
884 pwd
, historyLen
*PW_HISTORY_ENTRY_LEN
);
885 if (!sampass
->nt_pw_his
.length
) {
886 DEBUG(0, ("pdb_set_pw_history: data_blob_talloc() failed!\n"));
890 sampass
->nt_pw_his
= data_blob_talloc(sampass
, NULL
, 0);
893 return pdb_set_init_flags(sampass
, PDB_PWHISTORY
, flag
);
896 /*********************************************************************
897 Set the user's plaintext password only (base procedure, see helper
899 ********************************************************************/
901 bool pdb_set_plaintext_pw_only(struct samu
*sampass
, const char *password
, enum pdb_value_state flag
)
904 if (sampass
->plaintext_pw
!=NULL
)
905 memset(sampass
->plaintext_pw
,'\0',strlen(sampass
->plaintext_pw
)+1);
907 sampass
->plaintext_pw
= talloc_strdup(sampass
, password
);
909 if (!sampass
->plaintext_pw
) {
910 DEBUG(0, ("pdb_set_unknown_str: talloc_strdup() failed!\n"));
914 sampass
->plaintext_pw
= NULL
;
917 return pdb_set_init_flags(sampass
, PDB_PLAINTEXT_PW
, flag
);
920 bool pdb_set_bad_password_count(struct samu
*sampass
, uint16_t bad_password_count
, enum pdb_value_state flag
)
922 sampass
->bad_password_count
= bad_password_count
;
923 return pdb_set_init_flags(sampass
, PDB_BAD_PASSWORD_COUNT
, flag
);
926 bool pdb_set_logon_count(struct samu
*sampass
, uint16_t logon_count
, enum pdb_value_state flag
)
928 sampass
->logon_count
= logon_count
;
929 return pdb_set_init_flags(sampass
, PDB_LOGON_COUNT
, flag
);
932 bool pdb_set_country_code(struct samu
*sampass
, uint16_t country_code
,
933 enum pdb_value_state flag
)
935 sampass
->country_code
= country_code
;
936 return pdb_set_init_flags(sampass
, PDB_COUNTRY_CODE
, flag
);
939 bool pdb_set_code_page(struct samu
*sampass
, uint16_t code_page
,
940 enum pdb_value_state flag
)
942 sampass
->code_page
= code_page
;
943 return pdb_set_init_flags(sampass
, PDB_CODE_PAGE
, flag
);
946 bool pdb_set_unknown_6(struct samu
*sampass
, uint32_t unkn
, enum pdb_value_state flag
)
948 sampass
->unknown_6
= unkn
;
949 return pdb_set_init_flags(sampass
, PDB_UNKNOWN6
, flag
);
952 bool pdb_set_hours(struct samu
*sampass
, const uint8
*hours
, int hours_len
,
953 enum pdb_value_state flag
)
955 if (hours_len
> sizeof(sampass
->hours
)) {
960 memset ((char *)sampass
->hours
, 0, hours_len
);
962 memcpy (sampass
->hours
, hours
, hours_len
);
965 return pdb_set_init_flags(sampass
, PDB_HOURS
, flag
);
968 bool pdb_set_backend_private_data(struct samu
*sampass
, void *private_data
,
969 void (*free_fn
)(void **),
970 const struct pdb_methods
*my_methods
,
971 enum pdb_value_state flag
)
973 if (sampass
->backend_private_data
&&
974 sampass
->backend_private_data_free_fn
) {
975 sampass
->backend_private_data_free_fn(
976 &sampass
->backend_private_data
);
979 sampass
->backend_private_data
= private_data
;
980 sampass
->backend_private_data_free_fn
= free_fn
;
981 sampass
->backend_private_methods
= my_methods
;
983 return pdb_set_init_flags(sampass
, PDB_BACKEND_PRIVATE_DATA
, flag
);
987 /* Helpful interfaces to the above */
989 bool pdb_set_pass_can_change(struct samu
*sampass
, bool canchange
)
991 return pdb_set_pass_can_change_time(sampass
,
992 canchange
? 0 : pdb_password_change_time_max(),
997 /*********************************************************************
998 Set the user's PLAINTEXT password. Used as an interface to the above.
999 Also sets the last change time to NOW.
1000 ********************************************************************/
1002 bool pdb_set_plaintext_passwd(struct samu
*sampass
, const char *plaintext
)
1004 uchar new_lanman_p16
[LM_HASH_LEN
];
1005 uchar new_nt_p16
[NT_HASH_LEN
];
1008 uint32_t current_history_len
;
1013 /* Calculate the MD4 hash (NT compatible) of the password */
1014 E_md4hash(plaintext
, new_nt_p16
);
1016 if (!pdb_set_nt_passwd (sampass
, new_nt_p16
, PDB_CHANGED
))
1019 if (!E_deshash(plaintext
, new_lanman_p16
)) {
1020 /* E_deshash returns false for 'long' passwords (> 14
1021 DOS chars). This allows us to match Win2k, which
1022 does not store a LM hash for these passwords (which
1023 would reduce the effective password length to 14 */
1025 if (!pdb_set_lanman_passwd (sampass
, NULL
, PDB_CHANGED
))
1028 if (!pdb_set_lanman_passwd (sampass
, new_lanman_p16
, PDB_CHANGED
))
1032 if (!pdb_set_plaintext_pw_only (sampass
, plaintext
, PDB_CHANGED
))
1035 if (!pdb_set_pass_last_set_time (sampass
, time(NULL
), PDB_CHANGED
))
1038 if ((pdb_get_acct_ctrl(sampass
) & ACB_NORMAL
) == 0) {
1040 * No password history for non-user accounts
1045 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY
, &pwHistLen
);
1047 if (pwHistLen
== 0) {
1048 /* Set the history length to zero. */
1049 pdb_set_pw_history(sampass
, NULL
, 0, PDB_CHANGED
);
1054 * We need to make sure we don't have a race condition here -
1055 * the account policy history length can change between when
1056 * the pw_history was first loaded into the struct samu struct
1059 pwhistory
= (uchar
*)pdb_get_pw_history(sampass
, ¤t_history_len
);
1061 if ((current_history_len
!= 0) && (pwhistory
== NULL
)) {
1062 DEBUG(1, ("pdb_set_plaintext_passwd: pwhistory == NULL!\n"));
1066 if (current_history_len
< pwHistLen
) {
1068 * Ensure we have space for the needed history. This
1069 * also takes care of an account which did not have
1070 * any history at all so far, i.e. pwhistory==NULL
1072 uchar
*new_history
= talloc_zero_array(
1074 pwHistLen
*PW_HISTORY_ENTRY_LEN
);
1080 memcpy(new_history
, pwhistory
,
1081 current_history_len
*PW_HISTORY_ENTRY_LEN
);
1083 pwhistory
= new_history
;
1087 * Make room for the new password in the history list.
1089 if (pwHistLen
> 1) {
1090 memmove(&pwhistory
[PW_HISTORY_ENTRY_LEN
], pwhistory
,
1091 (pwHistLen
-1)*PW_HISTORY_ENTRY_LEN
);
1095 * Fill the salt area with 0-s: this indicates that
1096 * a plain nt hash is stored in the has area.
1097 * The old format was to store a 16 byte salt and
1098 * then an md5hash of the nt_hash concatenated with
1101 memset(pwhistory
, 0, PW_HISTORY_SALT_LEN
);
1104 * Store the plain nt hash in the second 16 bytes.
1105 * The old format was to store the md5 hash of
1108 memcpy(&pwhistory
[PW_HISTORY_SALT_LEN
], new_nt_p16
, SALTED_MD5_HASH_LEN
);
1110 pdb_set_pw_history(sampass
, pwhistory
, pwHistLen
, PDB_CHANGED
);
1115 /* check for any PDB_SET/CHANGED field and fill the appropriate mask bit */
1116 uint32_t pdb_build_fields_present(struct samu
*sampass
)
1118 /* value set to all for testing */
1122 /**********************************************************************
1123 Helper function to determine for update_sam_account whether
1124 we need LDAP modification.
1125 *********************************************************************/
1127 bool pdb_element_is_changed(const struct samu
*sampass
,
1128 enum pdb_elements element
)
1130 return IS_SAM_CHANGED(sampass
, element
);
1133 /**********************************************************************
1134 Helper function to determine for update_sam_account whether
1135 we need LDAP modification.
1136 *********************************************************************/
1138 bool pdb_element_is_set_or_changed(const struct samu
*sampass
,
1139 enum pdb_elements element
)
1141 return (IS_SAM_SET(sampass
, element
) ||
1142 IS_SAM_CHANGED(sampass
, element
));