2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_AUTH
29 extern DOM_SID global_sid_World
;
30 extern DOM_SID global_sid_Network
;
31 extern DOM_SID global_sid_Builtin_Guests
;
32 extern DOM_SID global_sid_Authenticated_Users
;
35 /****************************************************************************
36 Create a UNIX user on demand.
37 ****************************************************************************/
39 static int smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
44 pstrcpy(add_script
, lp_adduser_script());
47 all_string_sub(add_script
, "%u", unix_username
, sizeof(pstring
));
49 all_string_sub(add_script
, "%D", domain
, sizeof(pstring
));
51 all_string_sub(add_script
, "%H", homedir
, sizeof(pstring
));
52 ret
= smbrun(add_script
,NULL
);
53 DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script
,ret
));
57 /****************************************************************************
58 Add and Delete UNIX users on demand, based on NTSTATUS codes.
59 We don't care about RID's here so ignore.
60 ****************************************************************************/
62 void auth_add_user_script(const char *domain
, const char *username
)
66 * User validated ok against Domain controller.
67 * If the admin wants us to try and create a UNIX
68 * user on the fly, do so.
71 if ( *lp_adduser_script() )
72 smb_create_user(domain
, username
, NULL
);
74 DEBUG(10,("auth_add_user_script: no 'add user script'. Asking winbindd\n"));
76 /* should never get here is we a re a domain member running winbindd
77 However, a host set for 'security = server' might run winbindd for
80 if ( !winbind_create_user(username
, NULL
) ) {
81 DEBUG(5,("auth_add_user_script: winbindd_create_user() failed\n"));
87 /****************************************************************************
88 Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
90 ****************************************************************************/
92 NTSTATUS
auth_get_sam_account(const char *user
, SAM_ACCOUNT
**account
)
96 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(account
))) {
101 pdb_ret
= pdb_getsampwnam(*account
, user
);
106 struct passwd
*pass
= Get_Pwnam(user
);
108 return NT_STATUS_NO_SUCH_USER
;
110 if (!NT_STATUS_IS_OK(nt_status
= pdb_fill_sam_pw(*account
, pass
))) {
117 /****************************************************************************
118 Create an auth_usersupplied_data structure
119 ****************************************************************************/
121 static NTSTATUS
make_user_info(auth_usersupplied_info
**user_info
,
122 const char *smb_name
,
123 const char *internal_username
,
124 const char *client_domain
,
126 const char *wksta_name
,
127 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
129 uint32 auth_flags
, BOOL encrypted
)
132 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username
, smb_name
));
134 *user_info
= malloc(sizeof(**user_info
));
136 DEBUG(0,("malloc failed for user_info (size %lu)\n", (unsigned long)sizeof(*user_info
)));
137 return NT_STATUS_NO_MEMORY
;
140 ZERO_STRUCTP(*user_info
);
142 DEBUG(5,("making strings for %s's user_info struct\n", internal_username
));
144 (*user_info
)->smb_name
.str
= strdup(smb_name
);
145 if ((*user_info
)->smb_name
.str
) {
146 (*user_info
)->smb_name
.len
= strlen(smb_name
);
148 free_user_info(user_info
);
149 return NT_STATUS_NO_MEMORY
;
152 (*user_info
)->internal_username
.str
= strdup(internal_username
);
153 if ((*user_info
)->internal_username
.str
) {
154 (*user_info
)->internal_username
.len
= strlen(internal_username
);
156 free_user_info(user_info
);
157 return NT_STATUS_NO_MEMORY
;
160 (*user_info
)->domain
.str
= strdup(domain
);
161 if ((*user_info
)->domain
.str
) {
162 (*user_info
)->domain
.len
= strlen(domain
);
164 free_user_info(user_info
);
165 return NT_STATUS_NO_MEMORY
;
168 (*user_info
)->client_domain
.str
= strdup(client_domain
);
169 if ((*user_info
)->client_domain
.str
) {
170 (*user_info
)->client_domain
.len
= strlen(client_domain
);
172 free_user_info(user_info
);
173 return NT_STATUS_NO_MEMORY
;
176 (*user_info
)->wksta_name
.str
= strdup(wksta_name
);
177 if ((*user_info
)->wksta_name
.str
) {
178 (*user_info
)->wksta_name
.len
= strlen(wksta_name
);
180 free_user_info(user_info
);
181 return NT_STATUS_NO_MEMORY
;
184 DEBUG(5,("making blobs for %s's user_info struct\n", internal_username
));
186 (*user_info
)->lm_resp
= data_blob(lm_pwd
.data
, lm_pwd
.length
);
187 (*user_info
)->nt_resp
= data_blob(nt_pwd
.data
, nt_pwd
.length
);
188 (*user_info
)->plaintext_password
= data_blob(plaintext
.data
, plaintext
.length
);
190 (*user_info
)->encrypted
= encrypted
;
191 (*user_info
)->auth_flags
= auth_flags
;
193 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted
? "":"un" , internal_username
, smb_name
));
198 /****************************************************************************
199 Create an auth_usersupplied_data structure after appropriate mapping.
200 ****************************************************************************/
202 NTSTATUS
make_user_info_map(auth_usersupplied_info
**user_info
,
203 const char *smb_name
,
204 const char *client_domain
,
205 const char *wksta_name
,
206 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
208 uint32 ntlmssp_flags
, BOOL encrypted
)
211 fstring internal_username
;
212 fstrcpy(internal_username
, smb_name
);
213 map_username(internal_username
);
215 DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
216 client_domain
, smb_name
, wksta_name
));
218 /* don't allow "" as a domain, fixes a Win9X bug
219 where it doens't supply a domain for logon script
220 'net use' commands. */
222 if ( *client_domain
)
223 domain
= client_domain
;
225 domain
= lp_workgroup();
227 /* do what win2k does. Always map unknown domains to our own
228 and let the "passdb backend" handle unknown users. */
230 if ( !is_trusted_domain(domain
) && !strequal(domain
, get_global_sam_name()) )
231 domain
= get_default_sam_name();
233 /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
235 return make_user_info(user_info
, smb_name
, internal_username
,
236 client_domain
, domain
, wksta_name
, lm_pwd
, nt_pwd
,
237 plaintext
, ntlmssp_flags
, encrypted
);
240 /****************************************************************************
241 Create an auth_usersupplied_data, making the DATA_BLOBs here.
242 Decrypt and encrypt the passwords.
243 ****************************************************************************/
245 BOOL
make_user_info_netlogon_network(auth_usersupplied_info
**user_info
,
246 const char *smb_name
,
247 const char *client_domain
,
248 const char *wksta_name
,
249 const uchar
*lm_network_pwd
, int lm_pwd_len
,
250 const uchar
*nt_network_pwd
, int nt_pwd_len
)
254 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
255 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
256 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
257 uint32 auth_flags
= AUTH_FLAG_NONE
;
260 auth_flags
|= AUTH_FLAG_LM_RESP
;
261 if (nt_pwd_len
== 24) {
262 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
263 } else if (nt_pwd_len
!= 0) {
264 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
267 nt_status
= make_user_info_map(user_info
,
268 smb_name
, client_domain
,
274 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
276 data_blob_free(&lm_blob
);
277 data_blob_free(&nt_blob
);
281 /****************************************************************************
282 Create an auth_usersupplied_data, making the DATA_BLOBs here.
283 Decrypt and encrypt the passwords.
284 ****************************************************************************/
286 BOOL
make_user_info_netlogon_interactive(auth_usersupplied_info
**user_info
,
287 const char *smb_name
,
288 const char *client_domain
,
289 const char *wksta_name
,
291 const uchar lm_interactive_pwd
[16],
292 const uchar nt_interactive_pwd
[16],
293 const uchar
*dc_sess_key
)
297 unsigned char local_lm_response
[24];
298 unsigned char local_nt_response
[24];
299 unsigned char key
[16];
300 uint32 auth_flags
= AUTH_FLAG_NONE
;
303 memcpy(key
, dc_sess_key
, 8);
305 if (lm_interactive_pwd
) memcpy(lm_pwd
, lm_interactive_pwd
, sizeof(lm_pwd
));
306 if (nt_interactive_pwd
) memcpy(nt_pwd
, nt_interactive_pwd
, sizeof(nt_pwd
));
308 #ifdef DEBUG_PASSWORD
310 dump_data(100, (char *)key
, sizeof(key
));
312 DEBUG(100,("lm owf password:"));
313 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
315 DEBUG(100,("nt owf password:"));
316 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
319 SamOEMhash((uchar
*)lm_pwd
, key
, sizeof(lm_pwd
));
320 SamOEMhash((uchar
*)nt_pwd
, key
, sizeof(nt_pwd
));
322 #ifdef DEBUG_PASSWORD
323 DEBUG(100,("decrypt of lm owf password:"));
324 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
326 DEBUG(100,("decrypt of nt owf password:"));
327 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
330 SMBOWFencrypt((const unsigned char *)lm_pwd
, chal
, local_lm_response
);
331 SMBOWFencrypt((const unsigned char *)nt_pwd
, chal
, local_nt_response
);
333 /* Password info paranoia */
341 DATA_BLOB local_lm_blob
= data_blob(local_lm_response
, sizeof(local_lm_response
));
342 DATA_BLOB local_nt_blob
= data_blob(local_nt_response
, sizeof(local_nt_response
));
343 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
345 if (lm_interactive_pwd
)
346 auth_flags
|= AUTH_FLAG_LM_RESP
;
347 if (nt_interactive_pwd
)
348 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
350 nt_status
= make_user_info_map(user_info
,
351 smb_name
, client_domain
,
358 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
359 data_blob_free(&local_lm_blob
);
360 data_blob_free(&local_nt_blob
);
366 /****************************************************************************
367 Create an auth_usersupplied_data structure
368 ****************************************************************************/
370 BOOL
make_user_info_for_reply(auth_usersupplied_info
**user_info
,
371 const char *smb_name
,
372 const char *client_domain
,
374 DATA_BLOB plaintext_password
)
377 DATA_BLOB local_lm_blob
;
378 DATA_BLOB local_nt_blob
;
379 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
380 uint32 auth_flags
= AUTH_FLAG_NONE
;
383 * Not encrypted - do so.
386 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
388 if (plaintext_password
.data
) {
389 unsigned char local_lm_response
[24];
391 #ifdef DEBUG_PASSWORD
392 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password
.length
));
393 dump_data(100, plaintext_password
.data
, plaintext_password
.length
);
396 SMBencrypt( (const char *)plaintext_password
.data
, (const uchar
*)chal
, local_lm_response
);
397 local_lm_blob
= data_blob(local_lm_response
, 24);
399 /* We can't do an NT hash here, as the password needs to be
401 local_nt_blob
= data_blob(NULL
, 0);
403 auth_flags
= (AUTH_FLAG_PLAINTEXT
| AUTH_FLAG_LM_RESP
);
405 local_lm_blob
= data_blob(NULL
, 0);
406 local_nt_blob
= data_blob(NULL
, 0);
409 ret
= make_user_info_map(user_info
, smb_name
,
411 get_remote_machine_name(),
417 data_blob_free(&local_lm_blob
);
418 return NT_STATUS_IS_OK(ret
) ? True
: False
;
421 /****************************************************************************
422 Create an auth_usersupplied_data structure
423 ****************************************************************************/
425 NTSTATUS
make_user_info_for_reply_enc(auth_usersupplied_info
**user_info
,
426 const char *smb_name
,
427 const char *client_domain
,
428 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
430 uint32 auth_flags
= AUTH_FLAG_NONE
;
432 DATA_BLOB no_plaintext_blob
= data_blob(NULL
, 0);
434 if (lm_resp
.length
== 24) {
435 auth_flags
|= AUTH_FLAG_LM_RESP
;
437 if (nt_resp
.length
== 0) {
438 } else if (nt_resp
.length
== 24) {
439 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
441 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
444 return make_user_info_map(user_info
, smb_name
,
446 get_remote_machine_name(),
453 /****************************************************************************
454 Create a guest user_info blob, for anonymous authenticaion.
455 ****************************************************************************/
457 BOOL
make_user_info_guest(auth_usersupplied_info
**user_info
)
459 DATA_BLOB lm_blob
= data_blob(NULL
, 0);
460 DATA_BLOB nt_blob
= data_blob(NULL
, 0);
461 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
462 uint32 auth_flags
= AUTH_FLAG_NONE
;
465 nt_status
= make_user_info(user_info
,
473 return NT_STATUS_IS_OK(nt_status
) ? True
: False
;
476 /****************************************************************************
477 prints a NT_USER_TOKEN to debug output.
478 ****************************************************************************/
480 void debug_nt_user_token(int dbg_class
, int dbg_lev
, NT_USER_TOKEN
*token
)
486 DEBUGC(dbg_class
, dbg_lev
, ("NT user token: (NULL)\n"));
490 DEBUGC(dbg_class
, dbg_lev
, ("NT user token of user %s\n",
491 sid_to_string(sid_str
, &token
->user_sids
[0]) ));
492 DEBUGADDC(dbg_class
, dbg_lev
, ("contains %lu SIDs\n", (unsigned long)token
->num_sids
));
493 for (i
= 0; i
< token
->num_sids
; i
++)
494 DEBUGADDC(dbg_class
, dbg_lev
, ("SID[%3lu]: %s\n", (unsigned long)i
,
495 sid_to_string(sid_str
, &token
->user_sids
[i
])));
498 /****************************************************************************
499 prints a UNIX 'token' to debug output.
500 ****************************************************************************/
502 void debug_unix_user_token(int dbg_class
, int dbg_lev
, uid_t uid
, gid_t gid
, int n_groups
, gid_t
*groups
)
505 DEBUGC(dbg_class
, dbg_lev
, ("UNIX token of user %ld\n", (long int)uid
));
507 DEBUGADDC(dbg_class
, dbg_lev
, ("Primary group is %ld and contains %i supplementary groups\n", (long int)gid
, n_groups
));
508 for (i
= 0; i
< n_groups
; i
++)
509 DEBUGADDC(dbg_class
, dbg_lev
, ("Group[%3i]: %ld\n", i
,
510 (long int)groups
[i
]));
513 /****************************************************************************
514 Create the SID list for this user.
515 ****************************************************************************/
517 static NTSTATUS
create_nt_user_token(const DOM_SID
*user_sid
, const DOM_SID
*group_sid
,
518 int n_groupSIDs
, DOM_SID
*groupSIDs
,
519 BOOL is_guest
, NT_USER_TOKEN
**token
)
521 NTSTATUS nt_status
= NT_STATUS_OK
;
522 NT_USER_TOKEN
*ptoken
;
526 if ((ptoken
= malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
) {
527 DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
528 nt_status
= NT_STATUS_NO_MEMORY
;
532 ZERO_STRUCTP(ptoken
);
534 ptoken
->num_sids
= n_groupSIDs
+ 5;
536 if ((ptoken
->user_sids
= (DOM_SID
*)malloc( sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
537 DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
538 nt_status
= NT_STATUS_NO_MEMORY
;
542 memset((char*)ptoken
->user_sids
,0,sizeof(DOM_SID
) * ptoken
->num_sids
);
545 * Note - user SID *MUST* be first in token !
546 * se_access_check depends on this.
548 * Primary group SID is second in token. Convention.
551 sid_copy(&ptoken
->user_sids
[PRIMARY_USER_SID_INDEX
], user_sid
);
553 sid_copy(&ptoken
->user_sids
[PRIMARY_GROUP_SID_INDEX
], group_sid
);
556 * Finally add the "standard" SIDs.
557 * The only difference between guest and "anonymous" (which we
558 * don't really support) is the addition of Authenticated_Users.
561 sid_copy(&ptoken
->user_sids
[2], &global_sid_World
);
562 sid_copy(&ptoken
->user_sids
[3], &global_sid_Network
);
565 sid_copy(&ptoken
->user_sids
[4], &global_sid_Builtin_Guests
);
567 sid_copy(&ptoken
->user_sids
[4], &global_sid_Authenticated_Users
);
569 sid_ndx
= 5; /* next available spot */
571 for (i
= 0; i
< n_groupSIDs
; i
++) {
572 size_t check_sid_idx
;
573 for (check_sid_idx
= 1; check_sid_idx
< ptoken
->num_sids
; check_sid_idx
++) {
574 if (sid_equal(&ptoken
->user_sids
[check_sid_idx
],
580 if (check_sid_idx
>= ptoken
->num_sids
) /* Not found already */ {
581 sid_copy(&ptoken
->user_sids
[sid_ndx
++], &groupSIDs
[i
]);
587 debug_nt_user_token(DBGC_AUTH
, 10, ptoken
);
594 /****************************************************************************
595 Create the SID list for this user.
596 ****************************************************************************/
598 NT_USER_TOKEN
*create_nt_token(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
, BOOL is_guest
)
603 NT_USER_TOKEN
*token
;
606 if (!NT_STATUS_IS_OK(uid_to_sid(&user_sid
, uid
))) {
609 if (!NT_STATUS_IS_OK(gid_to_sid(&group_sid
, gid
))) {
613 group_sids
= malloc(sizeof(DOM_SID
) * ngroups
);
615 DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
619 for (i
= 0; i
< ngroups
; i
++) {
620 if (!NT_STATUS_IS_OK(gid_to_sid(&(group_sids
)[i
], (groups
)[i
]))) {
621 DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups
[i
]));
622 SAFE_FREE(group_sids
);
627 if (!NT_STATUS_IS_OK(create_nt_user_token(&user_sid
, &group_sid
,
628 ngroups
, group_sids
, is_guest
, &token
))) {
629 SAFE_FREE(group_sids
);
633 SAFE_FREE(group_sids
);
638 /******************************************************************************
639 * this function returns the groups (SIDs) of the local SAM the user is in.
640 * If this samba server is a DC of the domain the user belongs to, it returns
641 * both domain groups and local / builtin groups. If the user is in a trusted
642 * domain, or samba is a member server of a domain, then this function returns
643 * local and builtin groups the user is a member of.
645 * currently this is a hack, as there is no sam implementation that is capable
648 * NOTE!! This function will fail if you pass in a winbind user without
650 ******************************************************************************/
652 static NTSTATUS
get_user_groups(const char *username
, uid_t uid
, gid_t gid
,
653 int *n_groups
, DOM_SID
**groups
, gid_t
**unix_groups
)
661 /* Try winbind first */
663 if ( strchr(username
, *lp_winbind_separator()) ) {
664 n_unix_groups
= winbind_getgroups( username
, unix_groups
);
666 DEBUG(10,("get_user_groups: winbind_getgroups(%s): result = %s\n", username
,
667 n_unix_groups
== -1 ? "FAIL" : "SUCCESS"));
669 if ( n_unix_groups
== -1 )
670 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
673 /* fallback to getgrouplist() */
675 n_unix_groups
= groups_max();
677 if ((*unix_groups
= malloc( sizeof(gid_t
) * n_unix_groups
) ) == NULL
) {
678 DEBUG(0, ("get_user_groups: Out of memory allocating unix group list\n"));
679 return NT_STATUS_NO_MEMORY
;
682 if (sys_getgrouplist(username
, gid
, *unix_groups
, &n_unix_groups
) == -1) {
686 groups_tmp
= Realloc(*unix_groups
, sizeof(gid_t
) * n_unix_groups
);
689 SAFE_FREE(*unix_groups
);
690 return NT_STATUS_NO_MEMORY
;
692 *unix_groups
= groups_tmp
;
694 if (sys_getgrouplist(username
, gid
, *unix_groups
, &n_unix_groups
) == -1) {
695 DEBUG(0, ("get_user_groups: failed to get the unix group list\n"));
696 SAFE_FREE(*unix_groups
);
697 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
702 debug_unix_user_token(DBGC_CLASS
, 5, uid
, gid
, n_unix_groups
, *unix_groups
);
704 /* now setup the space for storing the SIDS */
706 if (n_unix_groups
> 0) {
708 *groups
= malloc(sizeof(DOM_SID
) * n_unix_groups
);
711 DEBUG(0, ("get_user_group: malloc() failed for DOM_SID list!\n"));
712 SAFE_FREE(*unix_groups
);
713 return NT_STATUS_NO_MEMORY
;
717 *n_groups
= n_unix_groups
;
719 for (i
= 0; i
< *n_groups
; i
++) {
720 if (!NT_STATUS_IS_OK(gid_to_sid(&(*groups
)[i
], (*unix_groups
)[i
]))) {
721 DEBUG(1, ("get_user_groups: failed to convert gid %ld to a sid!\n",
722 (long int)(*unix_groups
)[i
+1]));
724 SAFE_FREE(*unix_groups
);
725 return NT_STATUS_NO_SUCH_USER
;
732 /***************************************************************************
733 Make a user_info struct
734 ***************************************************************************/
736 static NTSTATUS
make_server_info(auth_serversupplied_info
**server_info
)
738 *server_info
= malloc(sizeof(**server_info
));
740 DEBUG(0,("make_server_info: malloc failed!\n"));
741 return NT_STATUS_NO_MEMORY
;
743 ZERO_STRUCTP(*server_info
);
745 /* Initialise the uid and gid values to something non-zero
746 which may save us from giving away root access if there
747 is a bug in allocating these fields. */
749 (*server_info
)->uid
= -1;
750 (*server_info
)->gid
= -1;
755 /***************************************************************************
756 Fill a server_info struct from a SAM_ACCOUNT with their groups
757 ***************************************************************************/
759 static NTSTATUS
add_user_groups(auth_serversupplied_info
**server_info
,
760 SAM_ACCOUNT
*sampass
,
761 uid_t uid
, gid_t gid
)
764 const DOM_SID
*user_sid
= pdb_get_user_sid(sampass
);
765 const DOM_SID
*group_sid
= pdb_get_group_sid(sampass
);
767 DOM_SID
*groupSIDs
= NULL
;
768 gid_t
*unix_groups
= NULL
;
769 NT_USER_TOKEN
*token
;
773 nt_status
= get_user_groups(pdb_get_username(sampass
), uid
, gid
,
774 &n_groupSIDs
, &groupSIDs
, &unix_groups
);
776 if (!NT_STATUS_IS_OK(nt_status
)) {
777 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
778 free_server_info(server_info
);
782 is_guest
= (sid_peek_rid(user_sid
, &rid
) && rid
== DOMAIN_USER_RID_GUEST
);
784 if (!NT_STATUS_IS_OK(nt_status
= create_nt_user_token(user_sid
, group_sid
,
785 n_groupSIDs
, groupSIDs
, is_guest
,
788 DEBUG(4,("create_nt_user_token failed\n"));
789 SAFE_FREE(groupSIDs
);
790 SAFE_FREE(unix_groups
);
791 free_server_info(server_info
);
795 SAFE_FREE(groupSIDs
);
797 (*server_info
)->n_groups
= n_groupSIDs
;
798 (*server_info
)->groups
= unix_groups
;
799 (*server_info
)->ptok
= token
;
804 /***************************************************************************
805 Make (and fill) a user_info struct from a SAM_ACCOUNT
806 ***************************************************************************/
808 NTSTATUS
make_server_info_sam(auth_serversupplied_info
**server_info
,
809 SAM_ACCOUNT
*sampass
)
814 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
)))
817 (*server_info
)->sam_account
= sampass
;
819 if ( !(pwd
= getpwnam_alloc(pdb_get_username(sampass
))) ) {
820 DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
821 pdb_get_username(sampass
)));
822 free_server_info(server_info
);
823 return NT_STATUS_NO_SUCH_USER
;
825 (*server_info
)->unix_name
= smb_xstrdup(pwd
->pw_name
);
826 (*server_info
)->gid
= pwd
->pw_gid
;
827 (*server_info
)->uid
= pwd
->pw_uid
;
831 if (!NT_STATUS_IS_OK(nt_status
= add_user_groups(server_info
, sampass
,
833 (*server_info
)->gid
))) {
834 free_server_info(server_info
);
838 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
839 DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
840 pdb_get_username(sampass
),
841 (*server_info
)->unix_name
));
846 /***************************************************************************
847 Make (and fill) a user_info struct from a 'struct passwd' by conversion
849 ***************************************************************************/
851 NTSTATUS
make_server_info_pw(auth_serversupplied_info
**server_info
, const struct passwd
*pwd
)
854 SAM_ACCOUNT
*sampass
= NULL
;
855 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam_pw(&sampass
, pwd
))) {
858 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
))) {
862 (*server_info
)->sam_account
= sampass
;
864 if (!NT_STATUS_IS_OK(nt_status
= add_user_groups(server_info
, sampass
, pwd
->pw_uid
, pwd
->pw_gid
))) {
868 (*server_info
)->unix_name
= smb_xstrdup(pwd
->pw_name
);
870 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
871 (*server_info
)->uid
= pwd
->pw_uid
;
872 (*server_info
)->gid
= pwd
->pw_gid
;
876 /***************************************************************************
877 Make (and fill) a user_info struct for a guest login.
878 ***************************************************************************/
880 NTSTATUS
make_server_info_guest(auth_serversupplied_info
**server_info
)
883 SAM_ACCOUNT
*sampass
= NULL
;
886 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(&sampass
))) {
890 sid_copy(&guest_sid
, get_global_sam_sid());
891 sid_append_rid(&guest_sid
, DOMAIN_USER_RID_GUEST
);
894 if (!pdb_getsampwsid(sampass
, &guest_sid
)) {
896 return NT_STATUS_NO_SUCH_USER
;
900 nt_status
= make_server_info_sam(server_info
, sampass
);
902 if (NT_STATUS_IS_OK(nt_status
)) {
903 (*server_info
)->guest
= True
;
909 /***************************************************************************
910 Purely internal function for make_server_info_info3
911 Fill the sam account from getpwnam
912 ***************************************************************************/
913 static NTSTATUS
fill_sam_account(TALLOC_CTX
*mem_ctx
,
915 const char *username
,
916 char **found_username
,
917 uid_t
*uid
, gid_t
*gid
,
918 SAM_ACCOUNT
**sam_account
)
921 struct passwd
*passwd
;
923 fstr_sprintf(dom_user
, "%s%s%s",
924 domain
, lp_winbind_separator(), username
);
926 passwd
= Get_Pwnam(dom_user
);
928 /* if the lookup for DOMAIN\username failed, try again
929 with just 'username'. This is need for accessing the server
930 as a trust user that actually maps to a local account */
933 fstrcpy( dom_user
, username
);
934 passwd
= Get_Pwnam( dom_user
);
938 return NT_STATUS_NO_SUCH_USER
;
940 *uid
= passwd
->pw_uid
;
941 *gid
= passwd
->pw_gid
;
943 /* This is pointless -- there is no suport for differeing
944 unix and windows names. Make sure to always store the
945 one we actually looked up and succeeded. Have I mentioned
946 why I hate the 'winbind use default domain' parameter?
949 *found_username
= talloc_strdup(mem_ctx
, dom_user
);
951 return pdb_init_sam_pw(sam_account
, passwd
);
954 /****************************************************************************
955 Wrapper to allow the getpwnam() call to strip the domain name and
956 try again in case a local UNIX user is already there. Also run through
957 the username if we fallback to the username only.
958 ****************************************************************************/
960 struct passwd
*smb_getpwnam( char *domuser
)
964 fstring mapped_username
;
966 pw
= Get_Pwnam( domuser
);
970 /* fallback to looking up just the username */
972 p
= strchr( domuser
, *lp_winbind_separator() );
976 fstrcpy( mapped_username
, p
);
977 map_username( mapped_username
);
978 return Get_Pwnam(mapped_username
);
984 /***************************************************************************
985 Make a server_info struct from the info3 returned by a domain logon
986 ***************************************************************************/
988 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
989 const char *internal_username
,
990 const char *sent_nt_username
,
992 auth_serversupplied_info
**server_info
,
993 NET_USER_INFO_3
*info3
)
995 NTSTATUS nt_status
= NT_STATUS_OK
;
996 char *found_username
;
997 const char *nt_domain
;
998 const char *nt_username
;
1000 SAM_ACCOUNT
*sam_account
= NULL
;
1008 DOM_SID
*lgroupSIDs
= NULL
;
1010 gid_t
*unix_groups
= NULL
;
1011 NT_USER_TOKEN
*token
;
1013 DOM_SID
*all_group_SIDs
;
1017 Here is where we should check the list of
1018 trusted domains, and verify that the SID
1022 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
1023 if (!sid_append_rid(&user_sid
, info3
->user_rid
)) {
1024 return NT_STATUS_INVALID_PARAMETER
;
1027 sid_copy(&group_sid
, &info3
->dom_sid
.sid
);
1028 if (!sid_append_rid(&group_sid
, info3
->group_rid
)) {
1029 return NT_STATUS_INVALID_PARAMETER
;
1032 if (!(nt_username
= unistr2_tdup(mem_ctx
, &(info3
->uni_user_name
)))) {
1033 /* If the server didn't give us one, just use the one we sent them */
1034 nt_username
= sent_nt_username
;
1037 if (!(nt_domain
= unistr2_tdup(mem_ctx
, &(info3
->uni_logon_dom
)))) {
1038 /* If the server didn't give us one, just use the one we sent them */
1042 /* try to fill the SAM account.. If getpwnam() fails, then try the
1043 add user script (2.2.x behavior) */
1045 nt_status
= fill_sam_account(mem_ctx
, nt_domain
, internal_username
,
1046 &found_username
, &uid
, &gid
, &sam_account
);
1048 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
)) {
1049 DEBUG(3,("User %s does not exist, trying to add it\n",
1050 internal_username
));
1051 auth_add_user_script(nt_domain
, internal_username
);
1052 nt_status
= fill_sam_account(mem_ctx
, nt_domain
,
1053 internal_username
, &found_username
,
1054 &uid
, &gid
, &sam_account
);
1057 if (!NT_STATUS_IS_OK(nt_status
)) {
1058 DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
1062 if (!pdb_set_nt_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1063 pdb_free_sam(&sam_account
);
1064 return NT_STATUS_NO_MEMORY
;
1067 if (!pdb_set_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1068 pdb_free_sam(&sam_account
);
1069 return NT_STATUS_NO_MEMORY
;
1072 if (!pdb_set_domain(sam_account
, nt_domain
, PDB_CHANGED
)) {
1073 pdb_free_sam(&sam_account
);
1074 return NT_STATUS_NO_MEMORY
;
1077 if (!pdb_set_user_sid(sam_account
, &user_sid
, PDB_CHANGED
)) {
1078 pdb_free_sam(&sam_account
);
1079 return NT_STATUS_UNSUCCESSFUL
;
1082 if (!pdb_set_group_sid(sam_account
, &group_sid
, PDB_CHANGED
)) {
1083 pdb_free_sam(&sam_account
);
1084 return NT_STATUS_UNSUCCESSFUL
;
1087 if (!pdb_set_fullname(sam_account
, unistr2_static(&(info3
->uni_full_name
)),
1089 pdb_free_sam(&sam_account
);
1090 return NT_STATUS_NO_MEMORY
;
1093 if (!pdb_set_logon_script(sam_account
, unistr2_static(&(info3
->uni_logon_script
)), PDB_CHANGED
)) {
1094 pdb_free_sam(&sam_account
);
1095 return NT_STATUS_NO_MEMORY
;
1098 if (!pdb_set_profile_path(sam_account
, unistr2_static(&(info3
->uni_profile_path
)), PDB_CHANGED
)) {
1099 pdb_free_sam(&sam_account
);
1100 return NT_STATUS_NO_MEMORY
;
1103 if (!pdb_set_homedir(sam_account
, unistr2_static(&(info3
->uni_home_dir
)), PDB_CHANGED
)) {
1104 pdb_free_sam(&sam_account
);
1105 return NT_STATUS_NO_MEMORY
;
1108 if (!pdb_set_dir_drive(sam_account
, unistr2_static(&(info3
->uni_dir_drive
)), PDB_CHANGED
)) {
1109 pdb_free_sam(&sam_account
);
1110 return NT_STATUS_NO_MEMORY
;
1113 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
))) {
1114 DEBUG(4, ("make_server_info failed!\n"));
1115 pdb_free_sam(&sam_account
);
1119 /* save this here to _net_sam_logon() doesn't fail (it assumes a
1120 valid SAM_ACCOUNT) */
1122 (*server_info
)->sam_account
= sam_account
;
1124 (*server_info
)->unix_name
= smb_xstrdup(found_username
);
1126 /* Fill in the unix info we found on the way */
1128 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
1129 (*server_info
)->uid
= uid
;
1130 (*server_info
)->gid
= gid
;
1132 /* Store the user group information in the server_info
1133 returned to the caller. */
1135 nt_status
= get_user_groups((*server_info
)->unix_name
,
1136 uid
, gid
, &n_lgroupSIDs
, &lgroupSIDs
, &unix_groups
);
1138 if ( !NT_STATUS_IS_OK(nt_status
) ) {
1139 DEBUG(4,("get_user_groups failed\n"));
1143 (*server_info
)->groups
= unix_groups
;
1144 (*server_info
)->n_groups
= n_lgroupSIDs
;
1146 /* Create a 'combined' list of all SIDs we might want in the SD */
1148 all_group_SIDs
= malloc(sizeof(DOM_SID
) * (info3
->num_groups2
+info3
->num_other_sids
));
1150 if (!all_group_SIDs
) {
1151 DEBUG(0, ("malloc() failed for DOM_SID list!\n"));
1152 SAFE_FREE(lgroupSIDs
);
1153 free_server_info(server_info
);
1154 return NT_STATUS_NO_MEMORY
;
1157 #if 0 /* JERRY -- no such thing as local groups in current code */
1158 /* Copy the 'local' sids */
1159 memcpy(all_group_SIDs
, lgroupSIDs
, sizeof(DOM_SID
) * n_lgroupSIDs
);
1160 SAFE_FREE(lgroupSIDs
);
1163 /* and create (by appending rids) the 'domain' sids */
1165 for (i
= 0; i
< info3
->num_groups2
; i
++) {
1167 sid_copy(&all_group_SIDs
[i
], &(info3
->dom_sid
.sid
));
1169 if (!sid_append_rid(&all_group_SIDs
[i
], info3
->gids
[i
].g_rid
)) {
1171 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1173 DEBUG(3,("could not append additional group rid 0x%x\n",
1174 info3
->gids
[i
].g_rid
));
1176 SAFE_FREE(lgroupSIDs
);
1177 free_server_info(server_info
);
1184 /* Copy 'other' sids. We need to do sid filtering here to
1185 prevent possible elevation of privileges. See:
1187 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
1190 for (i
= 0; i
< info3
->num_other_sids
; i
++) {
1191 sid_copy(&all_group_SIDs
[info3
->num_groups2
+ i
],
1192 &info3
->other_sids
[i
].sid
);
1195 /* Where are the 'global' sids... */
1197 /* can the user be guest? if yes, where is it stored? */
1199 nt_status
= create_nt_user_token(&user_sid
, &group_sid
,
1200 info3
->num_groups2
+ info3
->num_other_sids
,
1201 all_group_SIDs
, False
, &token
);
1203 if ( !NT_STATUS_IS_OK(nt_status
) ) {
1204 DEBUG(4,("create_nt_user_token failed\n"));
1205 SAFE_FREE(all_group_SIDs
);
1206 free_server_info(server_info
);
1210 (*server_info
)->ptok
= token
;
1212 SAFE_FREE(all_group_SIDs
);
1214 memcpy((*server_info
)->session_key
, info3
->user_sess_key
, sizeof((*server_info
)->session_key
)/* 16 */);
1215 memcpy((*server_info
)->first_8_lm_hash
, info3
->padding
, 8);
1217 return NT_STATUS_OK
;
1220 /***************************************************************************
1221 Free a user_info struct
1222 ***************************************************************************/
1224 void free_user_info(auth_usersupplied_info
**user_info
)
1226 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
1227 if (*user_info
!= NULL
) {
1228 if ((*user_info
)->smb_name
.str
) {
1229 DEBUG(10,("structure was created for %s\n", (*user_info
)->smb_name
.str
));
1231 SAFE_FREE((*user_info
)->smb_name
.str
);
1232 SAFE_FREE((*user_info
)->internal_username
.str
);
1233 SAFE_FREE((*user_info
)->client_domain
.str
);
1234 SAFE_FREE((*user_info
)->domain
.str
);
1235 SAFE_FREE((*user_info
)->wksta_name
.str
);
1236 data_blob_free(&(*user_info
)->lm_resp
);
1237 data_blob_free(&(*user_info
)->nt_resp
);
1238 SAFE_FREE((*user_info
)->interactive_password
);
1239 data_blob_clear_free(&(*user_info
)->plaintext_password
);
1240 ZERO_STRUCT(**user_info
);
1242 SAFE_FREE(*user_info
);
1245 /***************************************************************************
1246 Clear out a server_info struct that has been allocated
1247 ***************************************************************************/
1249 void free_server_info(auth_serversupplied_info
**server_info
)
1251 DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
1252 if (*server_info
!= NULL
) {
1253 pdb_free_sam(&(*server_info
)->sam_account
);
1255 /* call pam_end here, unless we know we are keeping it */
1256 delete_nt_token( &(*server_info
)->ptok
);
1257 SAFE_FREE((*server_info
)->groups
);
1258 SAFE_FREE((*server_info
)->unix_name
);
1259 ZERO_STRUCT(**server_info
);
1261 SAFE_FREE(*server_info
);
1264 /***************************************************************************
1265 Make an auth_methods struct
1266 ***************************************************************************/
1268 BOOL
make_auth_methods(struct auth_context
*auth_context
, auth_methods
**auth_method
)
1270 if (!auth_context
) {
1271 smb_panic("no auth_context supplied to make_auth_methods()!\n");
1275 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
1278 *auth_method
= talloc(auth_context
->mem_ctx
, sizeof(**auth_method
));
1279 if (!*auth_method
) {
1280 DEBUG(0,("make_auth_method: malloc failed!\n"));
1283 ZERO_STRUCTP(*auth_method
);
1288 /****************************************************************************
1290 ****************************************************************************/
1292 void delete_nt_token(NT_USER_TOKEN
**pptoken
)
1295 NT_USER_TOKEN
*ptoken
= *pptoken
;
1296 SAFE_FREE( ptoken
->user_sids
);
1297 ZERO_STRUCTP(ptoken
);
1299 SAFE_FREE(*pptoken
);
1302 /****************************************************************************
1303 Duplicate a SID token.
1304 ****************************************************************************/
1306 NT_USER_TOKEN
*dup_nt_token(NT_USER_TOKEN
*ptoken
)
1308 NT_USER_TOKEN
*token
;
1313 if ((token
= (NT_USER_TOKEN
*)malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
)
1316 ZERO_STRUCTP(token
);
1318 if ((token
->user_sids
= (DOM_SID
*)memdup( ptoken
->user_sids
, sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
1323 token
->num_sids
= ptoken
->num_sids
;
1329 * Squash an NT_STATUS in line with security requirements.
1330 * In an attempt to avoid giving the whole game away when users
1331 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
1332 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
1333 * (session setups in particular).
1335 * @param nt_status NTSTATUS input for squashing.
1336 * @return the 'squashed' nt_status
1339 NTSTATUS
nt_status_squash(NTSTATUS nt_status
)
1341 if NT_STATUS_IS_OK(nt_status
) {
1343 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
) {
1344 /* Match WinXP and don't give the game away */
1345 return NT_STATUS_LOGON_FAILURE
;
1347 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_WRONG_PASSWORD
) {
1348 /* Match WinXP and don't give the game away */
1349 return NT_STATUS_LOGON_FAILURE
;
1357 * Verify whether or not given domain is trusted.
1359 * @param domain_name name of the domain to be verified
1360 * @return true if domain is one of the trusted once or
1361 * false if otherwise
1364 BOOL
is_trusted_domain(const char* dom_name
)
1366 DOM_SID trustdom_sid
;
1371 /* no trusted domains for a standalone server */
1373 if ( lp_server_role() == ROLE_STANDALONE
)
1376 /* if we are a DC, then check for a direct trust relationships */
1378 if (lp_server_role() == ROLE_DOMAIN_BDC
|| lp_server_role() == ROLE_DOMAIN_PDC
) {
1380 ret
= secrets_fetch_trusted_domain_password(dom_name
, &pass
, &trustdom_sid
, &lct
);
1387 /* if winbindd is not up and we are a domain member) then we need to update the
1388 trustdom_cache ourselves */
1390 if ( !winbind_ping() )
1391 update_trustdom_cache();
1394 /* now the trustdom cache should be available a DC could still
1395 * have a transitive trust so fall back to the cache of trusted
1396 * domains (like a domain member would use */
1398 if ( trustdom_cache_fetch(dom_name
, &trustdom_sid
) ) {