?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-spoolss: Create a spoolss_map_to_os2_driver function.
[Samba/gebeck_regimport.git] / source3 / auth / auth_util.c
blob34c8190ee8c16f6757e533c9559a84efac1db6bb
1 /*
2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "smbd/globals.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
28
29 #undef DBGC_CLASS
30 #define DBGC_CLASS DBGC_AUTH
31
32 /****************************************************************************
33 Ensure primary group SID is always at position 0 in a
34 auth_serversupplied_info struct.
35 ****************************************************************************/
36
37 static void sort_sid_array_for_smbd(struct auth_serversupplied_info *result,
38 const DOM_SID *pgroup_sid)
39 {
40 unsigned int i;
41
42 if (!result->sids) {
43 return;
44 }
45
46 if (sid_compare(&result->sids[0], pgroup_sid)==0) {
47 return;
48 }
49
50 for (i = 1; i < result->num_sids; i++) {
51 if (sid_compare(pgroup_sid,
52 &result->sids[i]) == 0) {
53 sid_copy(&result->sids[i], &result->sids[0]);
54 sid_copy(&result->sids[0], pgroup_sid);
55 return;
56 }
57 }
58 }
59
60 /****************************************************************************
61 Create a UNIX user on demand.
62 ****************************************************************************/
63
64 static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
65 {
66 TALLOC_CTX *ctx = talloc_tos();
67 char *add_script;
68 int ret;
69
70 add_script = talloc_strdup(ctx, lp_adduser_script());
71 if (!add_script || !*add_script) {
72 return -1;
73 }
74 add_script = talloc_all_string_sub(ctx,
75 add_script,
76 "%u",
77 unix_username);
78 if (!add_script) {
79 return -1;
80 }
81 if (domain) {
82 add_script = talloc_all_string_sub(ctx,
83 add_script,
84 "%D",
85 domain);
86 if (!add_script) {
87 return -1;
88 }
89 }
90 if (homedir) {
91 add_script = talloc_all_string_sub(ctx,
92 add_script,
93 "%H",
94 homedir);
95 if (!add_script) {
96 return -1;
97 }
98 }
99 ret = smbrun(add_script,NULL);
100 flush_pwnam_cache();
101 DEBUG(ret ? 0 : 3,
102 ("smb_create_user: Running the command `%s' gave %d\n",
103 add_script,ret));
104 return ret;
105 }
106
107 /****************************************************************************
108 Create an auth_usersupplied_data structure after appropriate mapping.
109 ****************************************************************************/
110
111 NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info,
112 const char *smb_name,
113 const char *client_domain,
114 const char *wksta_name,
115 DATA_BLOB *lm_pwd,
116 DATA_BLOB *nt_pwd,
117 DATA_BLOB *lm_interactive_pwd,
118 DATA_BLOB *nt_interactive_pwd,
119 DATA_BLOB *plaintext,
120 bool encrypted)
121 {
122 struct smbd_server_connection *sconn = smbd_server_conn;
123 const char *domain;
124 NTSTATUS result;
125 bool was_mapped;
126 fstring internal_username;
127 fstrcpy(internal_username, smb_name);
128 was_mapped = map_username(sconn, internal_username);
129
130 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
131 client_domain, smb_name, wksta_name));
132
133 domain = client_domain;
134
135 /* If you connect to a Windows domain member using a bogus domain name,
136 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
137 * the Windows box is a DC the name will become DOMAIN\user and be
138 * authenticated against AD, if the Windows box is a member server but
139 * not a DC the name will become WORKSTATION\user. A standalone
140 * non-domain member box will also map to WORKSTATION\user.
141 * This also deals with the client passing in a "" domain */
142
143 if (!is_trusted_domain(domain) &&
144 !strequal(domain, my_sam_name()))
145 {
146 if (lp_map_untrusted_to_domain())
147 domain = my_sam_name();
148 else
149 domain = get_global_sam_name();
150 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
151 "workstation [%s]\n",
152 client_domain, domain, smb_name, wksta_name));
153 }
154
155 /* We know that the given domain is trusted (and we are allowing them),
156 * it is our global SAM name, or for legacy behavior it is our
157 * primary domain name */
158
159 result = make_user_info(user_info, smb_name, internal_username,
160 client_domain, domain, wksta_name,
161 lm_pwd, nt_pwd,
162 lm_interactive_pwd, nt_interactive_pwd,
163 plaintext, encrypted);
164 if (NT_STATUS_IS_OK(result)) {
165 (*user_info)->was_mapped = was_mapped;
166 }
167 return result;
168 }
169
170 /****************************************************************************
171 Create an auth_usersupplied_data, making the DATA_BLOBs here.
172 Decrypt and encrypt the passwords.
173 ****************************************************************************/
174
175 bool make_user_info_netlogon_network(struct auth_usersupplied_info **user_info,
176 const char *smb_name,
177 const char *client_domain,
178 const char *wksta_name,
179 uint32 logon_parameters,
180 const uchar *lm_network_pwd,
181 int lm_pwd_len,
182 const uchar *nt_network_pwd,
183 int nt_pwd_len)
184 {
185 bool ret;
186 NTSTATUS status;
187 DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
188 DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
189
190 status = make_user_info_map(user_info,
191 smb_name, client_domain,
192 wksta_name,
193 lm_pwd_len ? &lm_blob : NULL,
194 nt_pwd_len ? &nt_blob : NULL,
195 NULL, NULL, NULL,
196 True);
197
198 if (NT_STATUS_IS_OK(status)) {
199 (*user_info)->logon_parameters = logon_parameters;
200 }
201 ret = NT_STATUS_IS_OK(status) ? True : False;
202
203 data_blob_free(&lm_blob);
204 data_blob_free(&nt_blob);
205 return ret;
206 }
207
208 /****************************************************************************
209 Create an auth_usersupplied_data, making the DATA_BLOBs here.
210 Decrypt and encrypt the passwords.
211 ****************************************************************************/
212
213 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info,
214 const char *smb_name,
215 const char *client_domain,
216 const char *wksta_name,
217 uint32 logon_parameters,
218 const uchar chal[8],
219 const uchar lm_interactive_pwd[16],
220 const uchar nt_interactive_pwd[16],
221 const uchar *dc_sess_key)
222 {
223 unsigned char lm_pwd[16];
224 unsigned char nt_pwd[16];
225 unsigned char local_lm_response[24];
226 unsigned char local_nt_response[24];
227 unsigned char key[16];
228
229 memcpy(key, dc_sess_key, 16);
230
231 if (lm_interactive_pwd)
232 memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
233
234 if (nt_interactive_pwd)
235 memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
236
237 #ifdef DEBUG_PASSWORD
238 DEBUG(100,("key:"));
239 dump_data(100, key, sizeof(key));
240
241 DEBUG(100,("lm owf password:"));
242 dump_data(100, lm_pwd, sizeof(lm_pwd));
243
244 DEBUG(100,("nt owf password:"));
245 dump_data(100, nt_pwd, sizeof(nt_pwd));
246 #endif
247
248 if (lm_interactive_pwd)
249 arcfour_crypt(lm_pwd, key, sizeof(lm_pwd));
250
251 if (nt_interactive_pwd)
252 arcfour_crypt(nt_pwd, key, sizeof(nt_pwd));
253
254 #ifdef DEBUG_PASSWORD
255 DEBUG(100,("decrypt of lm owf password:"));
256 dump_data(100, lm_pwd, sizeof(lm_pwd));
257
258 DEBUG(100,("decrypt of nt owf password:"));
259 dump_data(100, nt_pwd, sizeof(nt_pwd));
260 #endif
261
262 if (lm_interactive_pwd)
263 SMBOWFencrypt(lm_pwd, chal,
264 local_lm_response);
265
266 if (nt_interactive_pwd)
267 SMBOWFencrypt(nt_pwd, chal,
268 local_nt_response);
269
270 /* Password info paranoia */
271 ZERO_STRUCT(key);
272
273 {
274 bool ret;
275 NTSTATUS nt_status;
276 DATA_BLOB local_lm_blob;
277 DATA_BLOB local_nt_blob;
278
279 DATA_BLOB lm_interactive_blob;
280 DATA_BLOB nt_interactive_blob;
281
282 if (lm_interactive_pwd) {
283 local_lm_blob = data_blob(local_lm_response,
284 sizeof(local_lm_response));
285 lm_interactive_blob = data_blob(lm_pwd,
286 sizeof(lm_pwd));
287 ZERO_STRUCT(lm_pwd);
288 }
289
290 if (nt_interactive_pwd) {
291 local_nt_blob = data_blob(local_nt_response,
292 sizeof(local_nt_response));
293 nt_interactive_blob = data_blob(nt_pwd,
294 sizeof(nt_pwd));
295 ZERO_STRUCT(nt_pwd);
296 }
297
298 nt_status = make_user_info_map(
299 user_info,
300 smb_name, client_domain, wksta_name,
301 lm_interactive_pwd ? &local_lm_blob : NULL,
302 nt_interactive_pwd ? &local_nt_blob : NULL,
303 lm_interactive_pwd ? &lm_interactive_blob : NULL,
304 nt_interactive_pwd ? &nt_interactive_blob : NULL,
305 NULL, True);
306
307 if (NT_STATUS_IS_OK(nt_status)) {
308 (*user_info)->logon_parameters = logon_parameters;
309 }
310
311 ret = NT_STATUS_IS_OK(nt_status) ? True : False;
312 data_blob_free(&local_lm_blob);
313 data_blob_free(&local_nt_blob);
314 data_blob_free(&lm_interactive_blob);
315 data_blob_free(&nt_interactive_blob);
316 return ret;
317 }
318 }
319
320
321 /****************************************************************************
322 Create an auth_usersupplied_data structure
323 ****************************************************************************/
324
325 bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
326 const char *smb_name,
327 const char *client_domain,
328 const uint8 chal[8],
329 DATA_BLOB plaintext_password)
330 {
331
332 DATA_BLOB local_lm_blob;
333 DATA_BLOB local_nt_blob;
334 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
335
336 /*
337 * Not encrypted - do so.
338 */
339
340 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
341 "format.\n"));
342
343 if (plaintext_password.data && plaintext_password.length) {
344 unsigned char local_lm_response[24];
345
346 #ifdef DEBUG_PASSWORD
347 DEBUG(10,("Unencrypted password (len %d):\n",
348 (int)plaintext_password.length));
349 dump_data(100, plaintext_password.data,
350 plaintext_password.length);
351 #endif
352
353 SMBencrypt( (const char *)plaintext_password.data,
354 (const uchar*)chal, local_lm_response);
355 local_lm_blob = data_blob(local_lm_response, 24);
356
357 /* We can't do an NT hash here, as the password needs to be
358 case insensitive */
359 local_nt_blob = data_blob_null;
360 } else {
361 local_lm_blob = data_blob_null;
362 local_nt_blob = data_blob_null;
363 }
364
365 ret = make_user_info_map(
366 user_info, smb_name, client_domain,
367 get_remote_machine_name(),
368 local_lm_blob.data ? &local_lm_blob : NULL,
369 local_nt_blob.data ? &local_nt_blob : NULL,
370 NULL, NULL,
371 plaintext_password.data && plaintext_password.length ? &plaintext_password : NULL,
372 False);
373
374 data_blob_free(&local_lm_blob);
375 return NT_STATUS_IS_OK(ret) ? True : False;
376 }
377
378 /****************************************************************************
379 Create an auth_usersupplied_data structure
380 ****************************************************************************/
381
382 NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info,
383 const char *smb_name,
384 const char *client_domain,
385 DATA_BLOB lm_resp, DATA_BLOB nt_resp)
386 {
387 return make_user_info_map(user_info, smb_name,
388 client_domain,
389 get_remote_machine_name(),
390 lm_resp.data ? &lm_resp : NULL,
391 nt_resp.data ? &nt_resp : NULL,
392 NULL, NULL, NULL,
393 True);
394 }
395
396 /****************************************************************************
397 Create a guest user_info blob, for anonymous authenticaion.
398 ****************************************************************************/
399
400 bool make_user_info_guest(struct auth_usersupplied_info **user_info)
401 {
402 NTSTATUS nt_status;
403
404 nt_status = make_user_info(user_info,
405 "","",
406 "","",
407 "",
408 NULL, NULL,
409 NULL, NULL,
410 NULL,
411 True);
412
413 return NT_STATUS_IS_OK(nt_status) ? True : False;
414 }
415
416 static NTSTATUS log_nt_token(NT_USER_TOKEN *token)
417 {
418 TALLOC_CTX *frame = talloc_stackframe();
419 char *command;
420 char *group_sidstr;
421 size_t i;
422
423 if ((lp_log_nt_token_command() == NULL) ||
424 (strlen(lp_log_nt_token_command()) == 0)) {
425 TALLOC_FREE(frame);
426 return NT_STATUS_OK;
427 }
428
429 group_sidstr = talloc_strdup(frame, "");
430 for (i=1; i<token->num_sids; i++) {
431 group_sidstr = talloc_asprintf(
432 frame, "%s %s", group_sidstr,
433 sid_string_talloc(frame, &token->user_sids[i]));
434 }
435
436 command = talloc_string_sub(
437 frame, lp_log_nt_token_command(),
438 "%s", sid_string_talloc(frame, &token->user_sids[0]));
439 command = talloc_string_sub(frame, command, "%t", group_sidstr);
440
441 if (command == NULL) {
442 TALLOC_FREE(frame);
443 return NT_STATUS_NO_MEMORY;
444 }
445
446 DEBUG(8, ("running command: [%s]\n", command));
447 if (smbrun(command, NULL) != 0) {
448 DEBUG(0, ("Could not log NT token\n"));
449 TALLOC_FREE(frame);
450 return NT_STATUS_ACCESS_DENIED;
451 }
452
453 TALLOC_FREE(frame);
454 return NT_STATUS_OK;
455 }
456
457 /*
458 * Create the token to use from server_info->sam_account and
459 * server_info->sids (the info3/sam groups). Find the unix gids.
460 */
461
462 NTSTATUS create_local_token(struct auth_serversupplied_info *server_info)
463 {
464 NTSTATUS status;
465 size_t i;
466 struct dom_sid tmp_sid;
467
468 /*
469 * If winbind is not around, we can not make much use of the SIDs the
470 * domain controller provided us with. Likewise if the user name was
471 * mapped to some local unix user.
472 */
473
474 if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
475 (server_info->nss_token)) {
476 status = create_token_from_username(server_info,
477 server_info->unix_name,
478 server_info->guest,
479 &server_info->utok.uid,
480 &server_info->utok.gid,
481 &server_info->unix_name,
482 &server_info->ptok);
483
484 } else {
485 server_info->ptok = create_local_nt_token(
486 server_info,
487 pdb_get_user_sid(server_info->sam_account),
488 server_info->guest,
489 server_info->num_sids, server_info->sids);
490 status = server_info->ptok ?
491 NT_STATUS_OK : NT_STATUS_NO_SUCH_USER;
492 }
493
494 if (!NT_STATUS_IS_OK(status)) {
495 return status;
496 }
497
498 /* Convert the SIDs to gids. */
499
500 server_info->utok.ngroups = 0;
501 server_info->utok.groups = NULL;
502
503 /* Start at index 1, where the groups start. */
504
505 for (i=1; i<server_info->ptok->num_sids; i++) {
506 gid_t gid;
507 DOM_SID *sid = &server_info->ptok->user_sids[i];
508
509 if (!sid_to_gid(sid, &gid)) {
510 DEBUG(10, ("Could not convert SID %s to gid, "
511 "ignoring it\n", sid_string_dbg(sid)));
512 continue;
513 }
514 add_gid_to_array_unique(server_info, gid,
515 &server_info->utok.groups,
516 &server_info->utok.ngroups);
517 }
518
519 /*
520 * Add the "Unix Group" SID for each gid to catch mapped groups
521 * and their Unix equivalent. This is to solve the backwards
522 * compatibility problem of 'valid users = +ntadmin' where
523 * ntadmin has been paired with "Domain Admins" in the group
524 * mapping table. Otherwise smb.conf would need to be changed
525 * to 'valid user = "Domain Admins"'. --jerry
526 *
527 * For consistency we also add the "Unix User" SID,
528 * so that the complete unix token is represented within
529 * the nt token.
530 */
531
532 if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
533 DEBUG(1,("create_local_token: Failed to create SID "
534 "for uid %u!\n", (unsigned int)server_info->utok.uid));
535 }
536 add_sid_to_array_unique(server_info->ptok, &tmp_sid,
537 &server_info->ptok->user_sids,
538 &server_info->ptok->num_sids);
539
540 for ( i=0; i<server_info->utok.ngroups; i++ ) {
541 if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
542 DEBUG(1,("create_local_token: Failed to create SID "
543 "for gid %u!\n", (unsigned int)server_info->utok.groups[i]));
544 continue;
545 }
546 add_sid_to_array_unique(server_info->ptok, &tmp_sid,
547 &server_info->ptok->user_sids,
548 &server_info->ptok->num_sids);
549 }
550
551 debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
552 debug_unix_user_token(DBGC_AUTH, 10,
553 server_info->utok.uid,
554 server_info->utok.gid,
555 server_info->utok.ngroups,
556 server_info->utok.groups);
557
558 status = log_nt_token(server_info->ptok);
559 return status;
560 }
561
562 /***************************************************************************
563 Make (and fill) a server_info struct from a 'struct passwd' by conversion
564 to a struct samu
565 ***************************************************************************/
566
567 NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
568 char *unix_username,
569 struct passwd *pwd)
570 {
571 NTSTATUS status;
572 struct samu *sampass = NULL;
573 gid_t *gids;
574 char *qualified_name = NULL;
575 TALLOC_CTX *mem_ctx = NULL;
576 DOM_SID u_sid;
577 enum lsa_SidType type;
578 struct auth_serversupplied_info *result;
579
580 if ( !(sampass = samu_new( NULL )) ) {
581 return NT_STATUS_NO_MEMORY;
582 }
583
584 status = samu_set_unix( sampass, pwd );
585 if (!NT_STATUS_IS_OK(status)) {
586 return status;
587 }
588
589 result = make_server_info(NULL);
590 if (result == NULL) {
591 TALLOC_FREE(sampass);
592 return NT_STATUS_NO_MEMORY;
593 }
594
595 result->sam_account = sampass;
596
597 result->unix_name = talloc_strdup(result, unix_username);
598 result->sanitized_username = sanitize_username(result, unix_username);
599
600 if ((result->unix_name == NULL)
601 || (result->sanitized_username == NULL)) {
602 TALLOC_FREE(sampass);
603 TALLOC_FREE(result);
604 return NT_STATUS_NO_MEMORY;
605 }
606
607 result->utok.uid = pwd->pw_uid;
608 result->utok.gid = pwd->pw_gid;
609
610 status = pdb_enum_group_memberships(result, sampass,
611 &result->sids, &gids,
612 &result->num_sids);
613
614 if (!NT_STATUS_IS_OK(status)) {
615 DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
616 nt_errstr(status)));
617 TALLOC_FREE(result);
618 return status;
619 }
620
621 /*
622 * The SID returned in server_info->sam_account is based
623 * on our SAM sid even though for a pure UNIX account this should
624 * not be the case as it doesn't really exist in the SAM db.
625 * This causes lookups on "[in]valid users" to fail as they
626 * will lookup this name as a "Unix User" SID to check against
627 * the user token. Fix this by adding the "Unix User"\unix_username
628 * SID to the sid array. The correct fix should probably be
629 * changing the server_info->sam_account user SID to be a
630 * S-1-22 Unix SID, but this might break old configs where
631 * plaintext passwords were used with no SAM backend.
632 */
633
634 mem_ctx = talloc_init("make_server_info_pw_tmp");
635 if (!mem_ctx) {
636 TALLOC_FREE(result);
637 return NT_STATUS_NO_MEMORY;
638 }
639
640 qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
641 unix_users_domain_name(),
642 unix_username );
643 if (!qualified_name) {
644 TALLOC_FREE(result);
645 TALLOC_FREE(mem_ctx);
646 return NT_STATUS_NO_MEMORY;
647 }
648
649 if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
650 NULL, NULL,
651 &u_sid, &type)) {
652 TALLOC_FREE(result);
653 TALLOC_FREE(mem_ctx);
654 return NT_STATUS_NO_SUCH_USER;
655 }
656
657 TALLOC_FREE(mem_ctx);
658
659 if (type != SID_NAME_USER) {
660 TALLOC_FREE(result);
661 return NT_STATUS_NO_SUCH_USER;
662 }
663
664 status = add_sid_to_array_unique(result, &u_sid,
665 &result->sids,
666 &result->num_sids);
667 if (!NT_STATUS_IS_OK(status)) {
668 TALLOC_FREE(result);
669 return status;
670 }
671
672 /* For now we throw away the gids and convert via sid_to_gid
673 * later. This needs fixing, but I'd like to get the code straight and
674 * simple first. */
675 TALLOC_FREE(gids);
676
677 *server_info = result;
678
679 return NT_STATUS_OK;
680 }
681
682 /***************************************************************************
683 Make (and fill) a user_info struct for a guest login.
684 This *must* succeed for smbd to start. If there is no mapping entry for
685 the guest gid, then create one.
686 ***************************************************************************/
687
688 static NTSTATUS make_new_server_info_guest(struct auth_serversupplied_info **server_info)
689 {
690 NTSTATUS status;
691 struct samu *sampass = NULL;
692 DOM_SID guest_sid;
693 bool ret;
694 static const char zeros[16] = {0, };
695 fstring tmp;
696
697 if ( !(sampass = samu_new( NULL )) ) {
698 return NT_STATUS_NO_MEMORY;
699 }
700
701 sid_compose(&guest_sid, get_global_sam_sid(), DOMAIN_RID_GUEST);
702
703 become_root();
704 ret = pdb_getsampwsid(sampass, &guest_sid);
705 unbecome_root();
706
707 if (!ret) {
708 TALLOC_FREE(sampass);
709 return NT_STATUS_NO_SUCH_USER;
710 }
711
712 status = make_server_info_sam(server_info, sampass);
713 if (!NT_STATUS_IS_OK(status)) {
714 TALLOC_FREE(sampass);
715 return status;
716 }
717
718 (*server_info)->guest = True;
719
720 status = create_local_token(*server_info);
721 if (!NT_STATUS_IS_OK(status)) {
722 DEBUG(10, ("create_local_token failed: %s\n",
723 nt_errstr(status)));
724 return status;
725 }
726
727 /* annoying, but the Guest really does have a session key, and it is
728 all zeros! */
729 (*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
730 (*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
731
732 alpha_strcpy(tmp, pdb_get_username(sampass), ". _-$", sizeof(tmp));
733 (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
734
735 return NT_STATUS_OK;
736 }
737
738 /****************************************************************************
739 Fake a auth_serversupplied_info just from a username
740 ****************************************************************************/
741
742 NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
743 const char *username,
744 bool is_guest,
745 struct auth_serversupplied_info **presult)
746 {
747 struct auth_serversupplied_info *result;
748 struct passwd *pwd;
749 NTSTATUS status;
750
751 pwd = getpwnam_alloc(talloc_tos(), username);
752 if (pwd == NULL) {
753 return NT_STATUS_NO_SUCH_USER;
754 }
755
756 status = make_server_info_pw(&result, pwd->pw_name, pwd);
757
758 TALLOC_FREE(pwd);
759
760 if (!NT_STATUS_IS_OK(status)) {
761 return status;
762 }
763
764 result->nss_token = true;
765 result->guest = is_guest;
766
767 status = create_local_token(result);
768
769 if (!NT_STATUS_IS_OK(status)) {
770 TALLOC_FREE(result);
771 return status;
772 }
773
774 *presult = result;
775 return NT_STATUS_OK;
776 }
777
778
779 struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
780 const struct auth_serversupplied_info *src)
781 {
782 struct auth_serversupplied_info *dst;
783
784 dst = make_server_info(mem_ctx);
785 if (dst == NULL) {
786 return NULL;
787 }
788
789 dst->guest = src->guest;
790 dst->utok.uid = src->utok.uid;
791 dst->utok.gid = src->utok.gid;
792 dst->utok.ngroups = src->utok.ngroups;
793 if (src->utok.ngroups != 0) {
794 dst->utok.groups = (gid_t *)TALLOC_MEMDUP(
795 dst, src->utok.groups,
796 sizeof(gid_t)*dst->utok.ngroups);
797 } else {
798 dst->utok.groups = NULL;
799 }
800
801 if (src->ptok) {
802 dst->ptok = dup_nt_token(dst, src->ptok);
803 if (!dst->ptok) {
804 TALLOC_FREE(dst);
805 return NULL;
806 }
807 }
808
809 dst->user_session_key = data_blob_talloc( dst, src->user_session_key.data,
810 src->user_session_key.length);
811
812 dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
813 src->lm_session_key.length);
814
815 dst->sam_account = samu_new(NULL);
816 if (!dst->sam_account) {
817 TALLOC_FREE(dst);
818 return NULL;
819 }
820
821 if (!pdb_copy_sam_account(dst->sam_account, src->sam_account)) {
822 TALLOC_FREE(dst);
823 return NULL;
824 }
825
826 dst->pam_handle = NULL;
827 dst->unix_name = talloc_strdup(dst, src->unix_name);
828 if (!dst->unix_name) {
829 TALLOC_FREE(dst);
830 return NULL;
831 }
832
833 dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
834 if (!dst->sanitized_username) {
835 TALLOC_FREE(dst);
836 return NULL;
837 }
838
839 return dst;
840 }
841
842 /*
843 * Set a new session key. Used in the rpc server where we have to override the
844 * SMB level session key with SystemLibraryDTC
845 */
846
847 bool server_info_set_session_key(struct auth_serversupplied_info *info,
848 DATA_BLOB session_key)
849 {
850 TALLOC_FREE(info->user_session_key.data);
851
852 info->user_session_key = data_blob_talloc(
853 info, session_key.data, session_key.length);
854
855 return (info->user_session_key.data != NULL);
856 }
857
858 static struct auth_serversupplied_info *guest_info = NULL;
859
860 bool init_guest_info(void)
861 {
862 if (guest_info != NULL)
863 return True;
864
865 return NT_STATUS_IS_OK(make_new_server_info_guest(&guest_info));
866 }
867
868 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
869 struct auth_serversupplied_info **server_info)
870 {
871 *server_info = copy_serverinfo(mem_ctx, guest_info);
872 return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
873 }
874
875 bool copy_current_user(struct current_user *dst, struct current_user *src)
876 {
877 gid_t *groups;
878 NT_USER_TOKEN *nt_token;
879
880 groups = (gid_t *)memdup(src->ut.groups,
881 sizeof(gid_t) * src->ut.ngroups);
882 if ((src->ut.ngroups != 0) && (groups == NULL)) {
883 return False;
884 }
885
886 nt_token = dup_nt_token(NULL, src->nt_user_token);
887 if (nt_token == NULL) {
888 SAFE_FREE(groups);
889 return False;
890 }
891
892 dst->conn = src->conn;
893 dst->vuid = src->vuid;
894 dst->ut.uid = src->ut.uid;
895 dst->ut.gid = src->ut.gid;
896 dst->ut.ngroups = src->ut.ngroups;
897 dst->ut.groups = groups;
898 dst->nt_user_token = nt_token;
899 return True;
900 }
901
902 /***************************************************************************
903 Purely internal function for make_server_info_info3
904 Fill the sam account from getpwnam
905 ***************************************************************************/
906 static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx,
907 const char *domain,
908 const char *username,
909 char **found_username,
910 uid_t *uid, gid_t *gid,
911 struct samu *account,
912 bool *username_was_mapped)
913 {
914 struct smbd_server_connection *sconn = smbd_server_conn;
915 NTSTATUS nt_status;
916 fstring dom_user, lower_username;
917 fstring real_username;
918 struct passwd *passwd;
919
920 fstrcpy( lower_username, username );
921 strlower_m( lower_username );
922
923 fstr_sprintf(dom_user, "%s%c%s", domain, *lp_winbind_separator(),
924 lower_username);
925
926 /* Get the passwd struct. Try to create the account is necessary. */
927
928 *username_was_mapped = map_username(sconn, dom_user);
929
930 if ( !(passwd = smb_getpwnam( NULL, dom_user, real_username, True )) )
931 return NT_STATUS_NO_SUCH_USER;
932
933 *uid = passwd->pw_uid;
934 *gid = passwd->pw_gid;
935
936 /* This is pointless -- there is no suport for differing
937 unix and windows names. Make sure to always store the
938 one we actually looked up and succeeded. Have I mentioned
939 why I hate the 'winbind use default domain' parameter?
940 --jerry */
941
942 *found_username = talloc_strdup( mem_ctx, real_username );
943
944 DEBUG(5,("fill_sam_account: located username was [%s]\n", *found_username));
945
946 nt_status = samu_set_unix( account, passwd );
947
948 TALLOC_FREE(passwd);
949
950 return nt_status;
951 }
952
953 /****************************************************************************
954 Wrapper to allow the getpwnam() call to strip the domain name and
955 try again in case a local UNIX user is already there. Also run through
956 the username if we fallback to the username only.
957 ****************************************************************************/
958
959 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,
960 fstring save_username, bool create )
961 {
962 struct passwd *pw = NULL;
963 char *p;
964 fstring username;
965
966 /* we only save a copy of the username it has been mangled
967 by winbindd use default domain */
968
969 save_username[0] = '\0';
970
971 /* don't call map_username() here since it has to be done higher
972 up the stack so we don't call it multiple times */
973
974 fstrcpy( username, domuser );
975
976 p = strchr_m( username, *lp_winbind_separator() );
977
978 /* code for a DOMAIN\user string */
979
980 if ( p ) {
981 fstring strip_username;
982
983 pw = Get_Pwnam_alloc( mem_ctx, domuser );
984 if ( pw ) {
985 /* make sure we get the case of the username correct */
986 /* work around 'winbind use default domain = yes' */
987
988 if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
989 char *domain;
990
991 /* split the domain and username into 2 strings */
992 *p = '\0';
993 domain = username;
994
995 fstr_sprintf(save_username, "%s%c%s", domain, *lp_winbind_separator(), pw->pw_name);
996 }
997 else
998 fstrcpy( save_username, pw->pw_name );
999
1000 /* whew -- done! */
1001 return pw;
1002 }
1003
1004 /* setup for lookup of just the username */
1005 /* remember that p and username are overlapping memory */
1006
1007 p++;
1008 fstrcpy( strip_username, p );
1009 fstrcpy( username, strip_username );
1010 }
1011
1012 /* just lookup a plain username */
1013
1014 pw = Get_Pwnam_alloc(mem_ctx, username);
1015
1016 /* Create local user if requested but only if winbindd
1017 is not running. We need to protect against cases
1018 where winbindd is failing and then prematurely
1019 creating users in /etc/passwd */
1020
1021 if ( !pw && create && !winbind_ping() ) {
1022 /* Don't add a machine account. */
1023 if (username[strlen(username)-1] == '$')
1024 return NULL;
1025
1026 _smb_create_user(NULL, username, NULL);
1027 pw = Get_Pwnam_alloc(mem_ctx, username);
1028 }
1029
1030 /* one last check for a valid passwd struct */
1031
1032 if ( pw )
1033 fstrcpy( save_username, pw->pw_name );
1034
1035 return pw;
1036 }
1037
1038 /***************************************************************************
1039 Make a server_info struct from the info3 returned by a domain logon
1040 ***************************************************************************/
1041
1042 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
1043 const char *sent_nt_username,
1044 const char *domain,
1045 struct auth_serversupplied_info **server_info,
1046 struct netr_SamInfo3 *info3)
1047 {
1048 static const char zeros[16] = {0, };
1049
1050 NTSTATUS nt_status = NT_STATUS_OK;
1051 char *found_username = NULL;
1052 const char *nt_domain;
1053 const char *nt_username;
1054 struct samu *sam_account = NULL;
1055 DOM_SID user_sid;
1056 DOM_SID group_sid;
1057 bool username_was_mapped;
1058
1059 uid_t uid = (uid_t)-1;
1060 gid_t gid = (gid_t)-1;
1061
1062 struct auth_serversupplied_info *result;
1063
1064 /*
1065 Here is where we should check the list of
1066 trusted domains, and verify that the SID
1067 matches.
1068 */
1069
1070 if (!sid_compose(&user_sid, info3->base.domain_sid, info3->base.rid)) {
1071 return NT_STATUS_INVALID_PARAMETER;
1072 }
1073
1074 if (!sid_compose(&group_sid, info3->base.domain_sid,
1075 info3->base.primary_gid)) {
1076 return NT_STATUS_INVALID_PARAMETER;
1077 }
1078
1079 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
1080 if (!nt_username) {
1081 /* If the server didn't give us one, just use the one we sent
1082 * them */
1083 nt_username = sent_nt_username;
1084 }
1085
1086 nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
1087 if (!nt_domain) {
1088 /* If the server didn't give us one, just use the one we sent
1089 * them */
1090 nt_domain = domain;
1091 }
1092
1093 /* try to fill the SAM account.. If getpwnam() fails, then try the
1094 add user script (2.2.x behavior).
1095
1096 We use the _unmapped_ username here in an attempt to provide
1097 consistent username mapping behavior between kerberos and NTLM[SSP]
1098 authentication in domain mode security. I.E. Username mapping
1099 should be applied to the fully qualified username
1100 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1101 called map_username() unnecessarily in make_user_info_map() but
1102 that is how the current code is designed. Making the change here
1103 is the least disruptive place. -- jerry */
1104
1105 if ( !(sam_account = samu_new( NULL )) ) {
1106 return NT_STATUS_NO_MEMORY;
1107 }
1108
1109 /* this call will try to create the user if necessary */
1110
1111 nt_status = fill_sam_account(mem_ctx, nt_domain, sent_nt_username,
1112 &found_username, &uid, &gid, sam_account,
1113 &username_was_mapped);
1114
1115
1116 /* if we still don't have a valid unix account check for
1117 'map to guest = bad uid' */
1118
1119 if (!NT_STATUS_IS_OK(nt_status)) {
1120 TALLOC_FREE( sam_account );
1121 if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
1122 make_server_info_guest(NULL, server_info);
1123 return NT_STATUS_OK;
1124 }
1125 return nt_status;
1126 }
1127
1128 if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
1129 TALLOC_FREE(sam_account);
1130 return NT_STATUS_NO_MEMORY;
1131 }
1132
1133 if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
1134 TALLOC_FREE(sam_account);
1135 return NT_STATUS_NO_MEMORY;
1136 }
1137
1138 if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
1139 TALLOC_FREE(sam_account);
1140 return NT_STATUS_NO_MEMORY;
1141 }
1142
1143 if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
1144 TALLOC_FREE(sam_account);
1145 return NT_STATUS_UNSUCCESSFUL;
1146 }
1147
1148 if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
1149 TALLOC_FREE(sam_account);
1150 return NT_STATUS_UNSUCCESSFUL;
1151 }
1152
1153 if (!pdb_set_fullname(sam_account,
1154 info3->base.full_name.string,
1155 PDB_CHANGED)) {
1156 TALLOC_FREE(sam_account);
1157 return NT_STATUS_NO_MEMORY;
1158 }
1159
1160 if (!pdb_set_logon_script(sam_account,
1161 info3->base.logon_script.string,
1162 PDB_CHANGED)) {
1163 TALLOC_FREE(sam_account);
1164 return NT_STATUS_NO_MEMORY;
1165 }
1166
1167 if (!pdb_set_profile_path(sam_account,
1168 info3->base.profile_path.string,
1169 PDB_CHANGED)) {
1170 TALLOC_FREE(sam_account);
1171 return NT_STATUS_NO_MEMORY;
1172 }
1173
1174 if (!pdb_set_homedir(sam_account,
1175 info3->base.home_directory.string,
1176 PDB_CHANGED)) {
1177 TALLOC_FREE(sam_account);
1178 return NT_STATUS_NO_MEMORY;
1179 }
1180
1181 if (!pdb_set_dir_drive(sam_account,
1182 info3->base.home_drive.string,
1183 PDB_CHANGED)) {
1184 TALLOC_FREE(sam_account);
1185 return NT_STATUS_NO_MEMORY;
1186 }
1187
1188 if (!pdb_set_acct_ctrl(sam_account, info3->base.acct_flags, PDB_CHANGED)) {
1189 TALLOC_FREE(sam_account);
1190 return NT_STATUS_NO_MEMORY;
1191 }
1192
1193 if (!pdb_set_pass_last_set_time(
1194 sam_account,
1195 nt_time_to_unix(info3->base.last_password_change),
1196 PDB_CHANGED)) {
1197 TALLOC_FREE(sam_account);
1198 return NT_STATUS_NO_MEMORY;
1199 }
1200
1201 if (!pdb_set_pass_can_change_time(
1202 sam_account,
1203 nt_time_to_unix(info3->base.allow_password_change),
1204 PDB_CHANGED)) {
1205 TALLOC_FREE(sam_account);
1206 return NT_STATUS_NO_MEMORY;
1207 }
1208
1209 if (!pdb_set_pass_must_change_time(
1210 sam_account,
1211 nt_time_to_unix(info3->base.force_password_change),
1212 PDB_CHANGED)) {
1213 TALLOC_FREE(sam_account);
1214 return NT_STATUS_NO_MEMORY;
1215 }
1216
1217 result = make_server_info(NULL);
1218 if (result == NULL) {
1219 DEBUG(4, ("make_server_info failed!\n"));
1220 TALLOC_FREE(sam_account);
1221 return NT_STATUS_NO_MEMORY;
1222 }
1223
1224 /* save this here to _net_sam_logon() doesn't fail (it assumes a
1225 valid struct samu) */
1226
1227 result->sam_account = sam_account;
1228 result->unix_name = talloc_strdup(result, found_username);
1229
1230 result->sanitized_username = sanitize_username(result,
1231 result->unix_name);
1232 if (result->sanitized_username == NULL) {
1233 TALLOC_FREE(result);
1234 return NT_STATUS_NO_MEMORY;
1235 }
1236
1237 /* Fill in the unix info we found on the way */
1238
1239 result->utok.uid = uid;
1240 result->utok.gid = gid;
1241
1242 /* Create a 'combined' list of all SIDs we might want in the SD */
1243
1244 result->num_sids = 0;
1245 result->sids = NULL;
1246
1247 nt_status = sid_array_from_info3(result, info3,
1248 &result->sids,
1249 &result->num_sids,
1250 false, false);
1251 if (!NT_STATUS_IS_OK(nt_status)) {
1252 TALLOC_FREE(result);
1253 return nt_status;
1254 }
1255
1256 /* Ensure the primary group sid is at position 0. */
1257 sort_sid_array_for_smbd(result, &group_sid);
1258
1259 result->login_server = talloc_strdup(result,
1260 info3->base.logon_server.string);
1261
1262 /* ensure we are never given NULL session keys */
1263
1264 if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
1265 result->user_session_key = data_blob_null;
1266 } else {
1267 result->user_session_key = data_blob_talloc(
1268 result, info3->base.key.key,
1269 sizeof(info3->base.key.key));
1270 }
1271
1272 if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
1273 result->lm_session_key = data_blob_null;
1274 } else {
1275 result->lm_session_key = data_blob_talloc(
1276 result, info3->base.LMSessKey.key,
1277 sizeof(info3->base.LMSessKey.key));
1278 }
1279
1280 result->nss_token |= username_was_mapped;
1281
1282 *server_info = result;
1283
1284 return NT_STATUS_OK;
1285 }
1286
1287 /*****************************************************************************
1288 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1289 ******************************************************************************/
1290
1291 NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
1292 const char *sent_nt_username,
1293 const char *domain,
1294 const struct wbcAuthUserInfo *info,
1295 struct auth_serversupplied_info **server_info)
1296 {
1297 static const char zeros[16] = {0, };
1298
1299 NTSTATUS nt_status = NT_STATUS_OK;
1300 char *found_username = NULL;
1301 const char *nt_domain;
1302 const char *nt_username;
1303 struct samu *sam_account = NULL;
1304 DOM_SID user_sid;
1305 DOM_SID group_sid;
1306 bool username_was_mapped;
1307 uint32_t i;
1308
1309 uid_t uid = (uid_t)-1;
1310 gid_t gid = (gid_t)-1;
1311
1312 struct auth_serversupplied_info *result;
1313
1314 result = make_server_info(NULL);
1315 if (result == NULL) {
1316 DEBUG(4, ("make_server_info failed!\n"));
1317 return NT_STATUS_NO_MEMORY;
1318 }
1319
1320 /*
1321 Here is where we should check the list of
1322 trusted domains, and verify that the SID
1323 matches.
1324 */
1325
1326 memcpy(&user_sid, &info->sids[0].sid, sizeof(user_sid));
1327 memcpy(&group_sid, &info->sids[1].sid, sizeof(group_sid));
1328
1329 if (info->account_name) {
1330 nt_username = talloc_strdup(result, info->account_name);
1331 } else {
1332 /* If the server didn't give us one, just use the one we sent
1333 * them */
1334 nt_username = talloc_strdup(result, sent_nt_username);
1335 }
1336 if (!nt_username) {
1337 TALLOC_FREE(result);
1338 return NT_STATUS_NO_MEMORY;
1339 }
1340
1341 if (info->domain_name) {
1342 nt_domain = talloc_strdup(result, info->domain_name);
1343 } else {
1344 /* If the server didn't give us one, just use the one we sent
1345 * them */
1346 nt_domain = talloc_strdup(result, domain);
1347 }
1348 if (!nt_domain) {
1349 TALLOC_FREE(result);
1350 return NT_STATUS_NO_MEMORY;
1351 }
1352
1353 /* try to fill the SAM account.. If getpwnam() fails, then try the
1354 add user script (2.2.x behavior).
1355
1356 We use the _unmapped_ username here in an attempt to provide
1357 consistent username mapping behavior between kerberos and NTLM[SSP]
1358 authentication in domain mode security. I.E. Username mapping
1359 should be applied to the fully qualified username
1360 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1361 called map_username() unnecessarily in make_user_info_map() but
1362 that is how the current code is designed. Making the change here
1363 is the least disruptive place. -- jerry */
1364
1365 if ( !(sam_account = samu_new( result )) ) {
1366 TALLOC_FREE(result);
1367 return NT_STATUS_NO_MEMORY;
1368 }
1369
1370 /* this call will try to create the user if necessary */
1371
1372 nt_status = fill_sam_account(result, nt_domain, sent_nt_username,
1373 &found_username, &uid, &gid, sam_account,
1374 &username_was_mapped);
1375
1376 /* if we still don't have a valid unix account check for
1377 'map to guest = bad uid' */
1378
1379 if (!NT_STATUS_IS_OK(nt_status)) {
1380 TALLOC_FREE( result );
1381 if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
1382 make_server_info_guest(NULL, server_info);
1383 return NT_STATUS_OK;
1384 }
1385 return nt_status;
1386 }
1387
1388 if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
1389 TALLOC_FREE(result);
1390 return NT_STATUS_NO_MEMORY;
1391 }
1392
1393 if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
1394 TALLOC_FREE(result);
1395 return NT_STATUS_NO_MEMORY;
1396 }
1397
1398 if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
1399 TALLOC_FREE(result);
1400 return NT_STATUS_NO_MEMORY;
1401 }
1402
1403 if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
1404 TALLOC_FREE(result);
1405 return NT_STATUS_UNSUCCESSFUL;
1406 }
1407
1408 if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
1409 TALLOC_FREE(result);
1410 return NT_STATUS_UNSUCCESSFUL;
1411 }
1412
1413 if (!pdb_set_fullname(sam_account, info->full_name, PDB_CHANGED)) {
1414 TALLOC_FREE(result);
1415 return NT_STATUS_NO_MEMORY;
1416 }
1417
1418 if (!pdb_set_logon_script(sam_account, info->logon_script, PDB_CHANGED)) {
1419 TALLOC_FREE(result);
1420 return NT_STATUS_NO_MEMORY;
1421 }
1422
1423 if (!pdb_set_profile_path(sam_account, info->profile_path, PDB_CHANGED)) {
1424 TALLOC_FREE(result);
1425 return NT_STATUS_NO_MEMORY;
1426 }
1427
1428 if (!pdb_set_homedir(sam_account, info->home_directory, PDB_CHANGED)) {
1429 TALLOC_FREE(result);
1430 return NT_STATUS_NO_MEMORY;
1431 }
1432
1433 if (!pdb_set_dir_drive(sam_account, info->home_drive, PDB_CHANGED)) {
1434 TALLOC_FREE(result);
1435 return NT_STATUS_NO_MEMORY;
1436 }
1437
1438 if (!pdb_set_acct_ctrl(sam_account, info->acct_flags, PDB_CHANGED)) {
1439 TALLOC_FREE(result);
1440 return NT_STATUS_NO_MEMORY;
1441 }
1442
1443 if (!pdb_set_pass_last_set_time(
1444 sam_account,
1445 nt_time_to_unix(info->pass_last_set_time),
1446 PDB_CHANGED)) {
1447 TALLOC_FREE(result);
1448 return NT_STATUS_NO_MEMORY;
1449 }
1450
1451 if (!pdb_set_pass_can_change_time(
1452 sam_account,
1453 nt_time_to_unix(info->pass_can_change_time),
1454 PDB_CHANGED)) {
1455 TALLOC_FREE(result);
1456 return NT_STATUS_NO_MEMORY;
1457 }
1458
1459 if (!pdb_set_pass_must_change_time(
1460 sam_account,
1461 nt_time_to_unix(info->pass_must_change_time),
1462 PDB_CHANGED)) {
1463 TALLOC_FREE(result);
1464 return NT_STATUS_NO_MEMORY;
1465 }
1466
1467 /* save this here to _net_sam_logon() doesn't fail (it assumes a
1468 valid struct samu) */
1469
1470 result->sam_account = sam_account;
1471 result->unix_name = talloc_strdup(result, found_username);
1472
1473 result->sanitized_username = sanitize_username(result,
1474 result->unix_name);
1475 result->login_server = talloc_strdup(result, info->logon_server);
1476
1477 if ((result->unix_name == NULL)
1478 || (result->sanitized_username == NULL)
1479 || (result->login_server == NULL)) {
1480 TALLOC_FREE(result);
1481 return NT_STATUS_NO_MEMORY;
1482 }
1483
1484 /* Fill in the unix info we found on the way */
1485
1486 result->utok.uid = uid;
1487 result->utok.gid = gid;
1488
1489 /* Create a 'combined' list of all SIDs we might want in the SD */
1490
1491 result->num_sids = info->num_sids - 2;
1492 result->sids = talloc_array(result, DOM_SID, result->num_sids);
1493 if (result->sids == NULL) {
1494 TALLOC_FREE(result);
1495 return NT_STATUS_NO_MEMORY;
1496 }
1497
1498 for (i=0; i < result->num_sids; i++) {
1499 memcpy(&result->sids[i], &info->sids[i+2].sid, sizeof(result->sids[i]));
1500 }
1501
1502 /* Ensure the primary group sid is at position 0. */
1503 sort_sid_array_for_smbd(result, &group_sid);
1504
1505 /* ensure we are never given NULL session keys */
1506
1507 if (memcmp(info->user_session_key, zeros, sizeof(zeros)) == 0) {
1508 result->user_session_key = data_blob_null;
1509 } else {
1510 result->user_session_key = data_blob_talloc(
1511 result, info->user_session_key,
1512 sizeof(info->user_session_key));
1513 }
1514
1515 if (memcmp(info->lm_session_key, zeros, 8) == 0) {
1516 result->lm_session_key = data_blob_null;
1517 } else {
1518 result->lm_session_key = data_blob_talloc(
1519 result, info->lm_session_key,
1520 sizeof(info->lm_session_key));
1521 }
1522
1523 result->nss_token |= username_was_mapped;
1524
1525 *server_info = result;
1526
1527 return NT_STATUS_OK;
1528 }
1529
1530 /**
1531 * Verify whether or not given domain is trusted.
1532 *
1533 * @param domain_name name of the domain to be verified
1534 * @return true if domain is one of the trusted ones or
1535 * false if otherwise
1536 **/
1537
1538 bool is_trusted_domain(const char* dom_name)
1539 {
1540 DOM_SID trustdom_sid;
1541 bool ret;
1542
1543 /* no trusted domains for a standalone server */
1544
1545 if ( lp_server_role() == ROLE_STANDALONE )
1546 return False;
1547
1548 if (dom_name == NULL || dom_name[0] == '\0') {
1549 return false;
1550 }
1551
1552 if (strequal(dom_name, get_global_sam_name())) {
1553 return false;
1554 }
1555
1556 /* if we are a DC, then check for a direct trust relationships */
1557
1558 if ( IS_DC ) {
1559 become_root();
1560 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1561 "[%s]\n", dom_name ));
1562 ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
1563 unbecome_root();
1564 if (ret)
1565 return True;
1566 }
1567 else {
1568 wbcErr result;
1569
1570 /* If winbind is around, ask it */
1571
1572 result = wb_is_trusted_domain(dom_name);
1573
1574 if (result == WBC_ERR_SUCCESS) {
1575 return True;
1576 }
1577
1578 if (result == WBC_ERR_DOMAIN_NOT_FOUND) {
1579 /* winbind could not find the domain */
1580 return False;
1581 }
1582
1583 /* The only other possible result is that winbind is not up
1584 and running. We need to update the trustdom_cache
1585 ourselves */
1586
1587 update_trustdom_cache();
1588 }
1589
1590 /* now the trustdom cache should be available a DC could still
1591 * have a transitive trust so fall back to the cache of trusted
1592 * domains (like a domain member would use */
1593
1594 if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) {
1595 return True;
1596 }
1597
1598 return False;
1599 }
1600
reg import