2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Jeremy Allison 1996-2001
5 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6 Copyright (C) Gerald (Jerry) Carter 2000-2001
7 Copyright (C) Andrew Bartlett 2001-2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_PASSDB
30 * This is set on startup - it defines the SID for this
31 * machine, and therefore the SAM database for which it is
35 /************************************************************
36 Fill the SAM_ACCOUNT with default values.
37 ***********************************************************/
39 static void pdb_fill_default_sam(SAM_ACCOUNT
*user
)
41 ZERO_STRUCT(user
->private); /* Don't touch the talloc context */
43 /* no initial methods */
46 /* Don't change these timestamp settings without a good reason.
47 They are important for NT member server compatibility. */
49 user
->private.uid
= user
->private.gid
= -1;
51 user
->private.logon_time
= (time_t)0;
52 user
->private.pass_last_set_time
= (time_t)0;
53 user
->private.pass_can_change_time
= (time_t)0;
54 user
->private.logoff_time
=
55 user
->private.kickoff_time
=
56 user
->private.pass_must_change_time
= get_time_t_max();
57 user
->private.unknown_3
= 0x00ffffff; /* don't know */
58 user
->private.logon_divs
= 168; /* hours per week */
59 user
->private.hours_len
= 21; /* 21 times 8 bits = 168 */
60 memset(user
->private.hours
, 0xff, user
->private.hours_len
); /* available at all hours */
61 user
->private.unknown_5
= 0x00000000; /* don't know */
62 user
->private.unknown_6
= 0x000004ec; /* don't know */
64 /* Some parts of samba strlen their pdb_get...() returns,
65 so this keeps the interface unchanged for now. */
67 user
->private.username
= "";
68 user
->private.domain
= "";
69 user
->private.nt_username
= "";
70 user
->private.full_name
= "";
71 user
->private.home_dir
= "";
72 user
->private.logon_script
= "";
73 user
->private.profile_path
= "";
74 user
->private.acct_desc
= "";
75 user
->private.workstations
= "";
76 user
->private.unknown_str
= "";
77 user
->private.munged_dial
= "";
79 user
->private.plaintext_pw
= NULL
;
83 static void destroy_pdb_talloc(SAM_ACCOUNT
**user
)
86 data_blob_clear_free(&((*user
)->private.lm_pw
));
87 data_blob_clear_free(&((*user
)->private.nt_pw
));
89 if((*user
)->private.plaintext_pw
!=NULL
)
90 memset((*user
)->private.plaintext_pw
,'\0',strlen((*user
)->private.plaintext_pw
));
91 talloc_destroy((*user
)->mem_ctx
);
97 /**********************************************************************
98 Alloc memory and initialises a struct sam_passwd on supplied mem_ctx.
99 ***********************************************************************/
101 NTSTATUS
pdb_init_sam_talloc(TALLOC_CTX
*mem_ctx
, SAM_ACCOUNT
**user
)
104 DEBUG(0,("pdb_init_sam_talloc: SAM_ACCOUNT was non NULL\n"));
106 smb_panic("non-NULL pointer passed to pdb_init_sam\n");
108 return NT_STATUS_UNSUCCESSFUL
;
112 DEBUG(0,("pdb_init_sam_talloc: mem_ctx was NULL!\n"));
113 return NT_STATUS_UNSUCCESSFUL
;
116 *user
=(SAM_ACCOUNT
*)talloc(mem_ctx
, sizeof(SAM_ACCOUNT
));
119 DEBUG(0,("pdb_init_sam_talloc: error while allocating memory\n"));
120 return NT_STATUS_NO_MEMORY
;
123 (*user
)->mem_ctx
= mem_ctx
;
125 (*user
)->free_fn
= NULL
;
127 pdb_fill_default_sam(*user
);
133 /*************************************************************
134 Alloc memory and initialises a struct sam_passwd.
135 ************************************************************/
137 NTSTATUS
pdb_init_sam(SAM_ACCOUNT
**user
)
142 mem_ctx
= talloc_init("passdb internal SAM_ACCOUNT allocation");
145 DEBUG(0,("pdb_init_sam: error while doing talloc_init()\n"));
146 return NT_STATUS_NO_MEMORY
;
149 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam_talloc(mem_ctx
, user
))) {
150 talloc_destroy(mem_ctx
);
154 (*user
)->free_fn
= destroy_pdb_talloc
;
160 /*************************************************************
161 Initialises a struct sam_passwd with sane values.
162 ************************************************************/
164 NTSTATUS
pdb_fill_sam_pw(SAM_ACCOUNT
*sam_account
, const struct passwd
*pwd
)
168 const char *guest_account
= lp_guestaccount();
169 if (!(guest_account
&& *guest_account
)) {
170 DEBUG(1, ("NULL guest account!?!?\n"));
171 return NT_STATUS_UNSUCCESSFUL
;
175 return NT_STATUS_UNSUCCESSFUL
;
178 pdb_fill_default_sam(sam_account
);
180 pdb_set_username(sam_account
, pwd
->pw_name
, PDB_SET
);
181 pdb_set_fullname(sam_account
, pwd
->pw_gecos
, PDB_SET
);
183 pdb_set_unix_homedir(sam_account
, pwd
->pw_dir
, PDB_SET
);
185 pdb_set_domain (sam_account
, lp_workgroup(), PDB_DEFAULT
);
187 pdb_set_uid(sam_account
, pwd
->pw_uid
, PDB_SET
);
188 pdb_set_gid(sam_account
, pwd
->pw_gid
, PDB_SET
);
190 /* When we get a proper uid -> SID and SID -> uid allocation
191 mechinism, we should call it here.
193 We can't just set this to 0 or allow it only to be filled
194 in when added to the backend, becouse the user's SID
195 may already be in security descriptors etc.
197 -- abartlet 11-May-02
201 /* Ensure this *must* be set right */
202 if (strcmp(pwd
->pw_name
, guest_account
) == 0) {
203 if (!pdb_set_user_sid_from_rid(sam_account
, DOMAIN_USER_RID_GUEST
, PDB_DEFAULT
)) {
204 return NT_STATUS_UNSUCCESSFUL
;
206 if (!pdb_set_group_sid_from_rid(sam_account
, DOMAIN_GROUP_RID_GUESTS
, PDB_DEFAULT
)) {
207 return NT_STATUS_UNSUCCESSFUL
;
211 if (!pdb_set_user_sid_from_rid(sam_account
,
212 fallback_pdb_uid_to_user_rid(pwd
->pw_uid
), PDB_SET
)) {
213 DEBUG(0,("Can't set User SID from RID!\n"));
214 return NT_STATUS_INVALID_PARAMETER
;
217 /* call the mapping code here */
218 if(pdb_getgrgid(&map
, pwd
->pw_gid
, MAPPING_WITHOUT_PRIV
)) {
219 if (!pdb_set_group_sid(sam_account
,&map
.sid
, PDB_SET
)){
220 DEBUG(0,("Can't set Group SID!\n"));
221 return NT_STATUS_INVALID_PARAMETER
;
225 if (!pdb_set_group_sid_from_rid(sam_account
,pdb_gid_to_group_rid(pwd
->pw_gid
), PDB_SET
)) {
226 DEBUG(0,("Can't set Group SID\n"));
227 return NT_STATUS_INVALID_PARAMETER
;
232 /* check if this is a user account or a machine account */
233 if (pwd
->pw_name
[strlen(pwd
->pw_name
)-1] != '$')
235 pdb_set_profile_path(sam_account
,
236 talloc_sub_specified((sam_account
)->mem_ctx
,
238 pwd
->pw_name
, global_myname(),
239 pwd
->pw_uid
, pwd
->pw_gid
),
242 pdb_set_homedir(sam_account
,
243 talloc_sub_specified((sam_account
)->mem_ctx
,
245 pwd
->pw_name
, global_myname(),
246 pwd
->pw_uid
, pwd
->pw_gid
),
249 pdb_set_dir_drive(sam_account
,
250 talloc_sub_specified((sam_account
)->mem_ctx
,
252 pwd
->pw_name
, global_myname(),
253 pwd
->pw_uid
, pwd
->pw_gid
),
256 pdb_set_logon_script(sam_account
,
257 talloc_sub_specified((sam_account
)->mem_ctx
,
259 pwd
->pw_name
, global_myname(),
260 pwd
->pw_uid
, pwd
->pw_gid
),
262 if (!pdb_set_acct_ctrl(sam_account
, ACB_NORMAL
, PDB_DEFAULT
)) {
263 DEBUG(1, ("Failed to set 'normal account' flags for user %s.\n", pwd
->pw_name
));
264 return NT_STATUS_UNSUCCESSFUL
;
267 if (!pdb_set_acct_ctrl(sam_account
, ACB_WSTRUST
, PDB_DEFAULT
)) {
268 DEBUG(1, ("Failed to set 'trusted workstation account' flags for user %s.\n", pwd
->pw_name
));
269 return NT_STATUS_UNSUCCESSFUL
;
276 /*************************************************************
277 Initialises a struct sam_passwd with sane values.
278 ************************************************************/
280 NTSTATUS
pdb_init_sam_pw(SAM_ACCOUNT
**new_sam_acct
, const struct passwd
*pwd
)
286 return NT_STATUS_INVALID_PARAMETER
;
289 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(new_sam_acct
))) {
294 if (!NT_STATUS_IS_OK(nt_status
= pdb_fill_sam_pw(*new_sam_acct
, pwd
))) {
295 pdb_free_sam(new_sam_acct
);
305 * Free the contets of the SAM_ACCOUNT, but not the structure.
307 * Also wipes the LM and NT hashes and plaintext password from
310 * @param user SAM_ACCOUNT to free members of.
313 static void pdb_free_sam_contents(SAM_ACCOUNT
*user
)
316 /* Kill off sensitive data. Free()ed by the
319 data_blob_clear_free(&(user
->private.lm_pw
));
320 data_blob_clear_free(&(user
->private.nt_pw
));
321 if (user
->private.plaintext_pw
!=NULL
)
322 memset(user
->private.plaintext_pw
,'\0',strlen(user
->private.plaintext_pw
));
326 /************************************************************
327 Reset the SAM_ACCOUNT and free the NT/LM hashes.
328 ***********************************************************/
330 NTSTATUS
pdb_reset_sam(SAM_ACCOUNT
*user
)
333 DEBUG(0,("pdb_reset_sam: SAM_ACCOUNT was NULL\n"));
335 smb_panic("NULL pointer passed to pdb_free_sam\n");
337 return NT_STATUS_UNSUCCESSFUL
;
340 pdb_free_sam_contents(user
);
342 pdb_fill_default_sam(user
);
348 /************************************************************
349 Free the SAM_ACCOUNT and the member pointers.
350 ***********************************************************/
352 NTSTATUS
pdb_free_sam(SAM_ACCOUNT
**user
)
355 DEBUG(0,("pdb_free_sam: SAM_ACCOUNT was NULL\n"));
357 smb_panic("NULL pointer passed to pdb_free_sam\n");
359 return NT_STATUS_UNSUCCESSFUL
;
362 pdb_free_sam_contents(*user
);
364 if ((*user
)->free_fn
) {
365 (*user
)->free_fn(user
);
372 /**********************************************************
373 Encode the account control bits into a string.
374 length = length of string to encode into (including terminating
375 null). length *MUST BE MORE THAN 2* !
376 **********************************************************/
378 char *pdb_encode_acct_ctrl(uint16 acct_ctrl
, size_t length
)
380 static fstring acct_str
;
385 if (acct_ctrl
& ACB_PWNOTREQ
) acct_str
[i
++] = 'N';
386 if (acct_ctrl
& ACB_DISABLED
) acct_str
[i
++] = 'D';
387 if (acct_ctrl
& ACB_HOMDIRREQ
) acct_str
[i
++] = 'H';
388 if (acct_ctrl
& ACB_TEMPDUP
) acct_str
[i
++] = 'T';
389 if (acct_ctrl
& ACB_NORMAL
) acct_str
[i
++] = 'U';
390 if (acct_ctrl
& ACB_MNS
) acct_str
[i
++] = 'M';
391 if (acct_ctrl
& ACB_WSTRUST
) acct_str
[i
++] = 'W';
392 if (acct_ctrl
& ACB_SVRTRUST
) acct_str
[i
++] = 'S';
393 if (acct_ctrl
& ACB_AUTOLOCK
) acct_str
[i
++] = 'L';
394 if (acct_ctrl
& ACB_PWNOEXP
) acct_str
[i
++] = 'X';
395 if (acct_ctrl
& ACB_DOMTRUST
) acct_str
[i
++] = 'I';
397 for ( ; i
< length
- 2 ; i
++ )
402 acct_str
[i
++] = '\0';
407 /**********************************************************
408 Decode the account control bits from a string.
409 **********************************************************/
411 uint16
pdb_decode_acct_ctrl(const char *p
)
413 uint16 acct_ctrl
= 0;
414 BOOL finished
= False
;
417 * Check if the account type bits have been encoded after the
418 * NT password (in the form [NDHTUWSLXI]).
424 for (p
++; *p
&& !finished
; p
++) {
426 case 'N': { acct_ctrl
|= ACB_PWNOTREQ
; break; /* 'N'o password. */ }
427 case 'D': { acct_ctrl
|= ACB_DISABLED
; break; /* 'D'isabled. */ }
428 case 'H': { acct_ctrl
|= ACB_HOMDIRREQ
; break; /* 'H'omedir required. */ }
429 case 'T': { acct_ctrl
|= ACB_TEMPDUP
; break; /* 'T'emp account. */ }
430 case 'U': { acct_ctrl
|= ACB_NORMAL
; break; /* 'U'ser account (normal). */ }
431 case 'M': { acct_ctrl
|= ACB_MNS
; break; /* 'M'NS logon user account. What is this ? */ }
432 case 'W': { acct_ctrl
|= ACB_WSTRUST
; break; /* 'W'orkstation account. */ }
433 case 'S': { acct_ctrl
|= ACB_SVRTRUST
; break; /* 'S'erver account. */ }
434 case 'L': { acct_ctrl
|= ACB_AUTOLOCK
; break; /* 'L'ocked account. */ }
435 case 'X': { acct_ctrl
|= ACB_PWNOEXP
; break; /* No 'X'piry on password */ }
436 case 'I': { acct_ctrl
|= ACB_DOMTRUST
; break; /* 'I'nterdomain trust account. */ }
442 default: { finished
= True
; }
449 /*************************************************************
450 Routine to set 32 hex password characters from a 16 byte array.
451 **************************************************************/
453 void pdb_sethexpwd(char *p
, const unsigned char *pwd
, uint16 acct_ctrl
)
457 for (i
= 0; i
< 16; i
++)
458 slprintf(&p
[i
*2], 3, "%02X", pwd
[i
]);
460 if (acct_ctrl
& ACB_PWNOTREQ
)
461 safe_strcpy(p
, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX", 33);
463 safe_strcpy(p
, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 33);
467 /*************************************************************
468 Routine to get the 32 hex characters and turn them
469 into a 16 byte array.
470 **************************************************************/
472 BOOL
pdb_gethexpwd(const char *p
, unsigned char *pwd
)
475 unsigned char lonybble
, hinybble
;
476 const char *hexchars
= "0123456789ABCDEF";
482 for (i
= 0; i
< 32; i
+= 2) {
483 hinybble
= toupper(p
[i
]);
484 lonybble
= toupper(p
[i
+ 1]);
486 p1
= strchr(hexchars
, hinybble
);
487 p2
= strchr(hexchars
, lonybble
);
492 hinybble
= PTR_DIFF(p1
, hexchars
);
493 lonybble
= PTR_DIFF(p2
, hexchars
);
495 pwd
[i
/ 2] = (hinybble
<< 4) | lonybble
;
500 /*******************************************************************
501 Converts NT user RID to a UNIX uid.
502 ********************************************************************/
504 static int algorithmic_rid_base(void)
506 static int rid_offset
= 0;
511 rid_offset
= lp_algorithmic_rid_base();
513 if (rid_offset
< BASE_RID
) {
514 /* Try to prevent admin foot-shooting, we can't put algorithmic
515 rids below 1000, that's the 'well known RIDs' on NT */
516 DEBUG(0, ("'algorithmic rid base' must be equal to or above %ld\n", BASE_RID
));
517 rid_offset
= BASE_RID
;
519 if (rid_offset
& 1) {
520 DEBUG(0, ("algorithmic rid base must be even\n"));
527 uid_t
fallback_pdb_user_rid_to_uid(uint32 user_rid
)
529 int rid_offset
= algorithmic_rid_base();
530 return (uid_t
)(((user_rid
& (~USER_RID_TYPE
))- rid_offset
)/RID_MULTIPLIER
);
534 /*******************************************************************
535 converts UNIX uid to an NT User RID.
536 ********************************************************************/
538 uint32
fallback_pdb_uid_to_user_rid(uid_t uid
)
540 int rid_offset
= algorithmic_rid_base();
541 return (((((uint32
)uid
)*RID_MULTIPLIER
) + rid_offset
) | USER_RID_TYPE
);
544 /*******************************************************************
545 Converts NT group RID to a UNIX gid.
546 ********************************************************************/
548 gid_t
pdb_group_rid_to_gid(uint32 group_rid
)
550 int rid_offset
= algorithmic_rid_base();
551 return (gid_t
)(((group_rid
& (~GROUP_RID_TYPE
))- rid_offset
)/RID_MULTIPLIER
);
554 /*******************************************************************
555 converts NT Group RID to a UNIX uid.
557 warning: you must not call that function only
558 you must do a call to the group mapping first.
559 there is not anymore a direct link between the gid and the rid.
560 ********************************************************************/
562 uint32
pdb_gid_to_group_rid(gid_t gid
)
564 int rid_offset
= algorithmic_rid_base();
565 return (((((uint32
)gid
)*RID_MULTIPLIER
) + rid_offset
) | GROUP_RID_TYPE
);
568 /*******************************************************************
569 Decides if a RID is a well known RID.
570 ********************************************************************/
572 static BOOL
pdb_rid_is_well_known(uint32 rid
)
574 /* Not using rid_offset here, becouse this is the actual
575 NT fixed value (1000) */
577 return (rid
< BASE_RID
);
580 /*******************************************************************
581 Decides if a RID is a user or group RID.
582 ********************************************************************/
584 BOOL
pdb_rid_is_user(uint32 rid
)
586 /* lkcl i understand that NT attaches an enumeration to a RID
587 * such that it can be identified as either a user, group etc
588 * type. there are 5 such categories, and they are documented.
590 /* However, they are not in the RID, just somthing you can query
591 seperatly. Sorry luke :-) */
593 if(pdb_rid_is_well_known(rid
)) {
595 * The only well known user RIDs are DOMAIN_USER_RID_ADMIN
596 * and DOMAIN_USER_RID_GUEST.
598 if(rid
== DOMAIN_USER_RID_ADMIN
|| rid
== DOMAIN_USER_RID_GUEST
)
600 } else if((rid
& RID_TYPE_MASK
) == USER_RID_TYPE
) {
606 /*******************************************************************
607 Convert a rid into a name. Used in the lookup SID rpc.
608 ********************************************************************/
610 BOOL
local_lookup_sid(DOM_SID
*sid
, char *name
, enum SID_NAME_USE
*psid_name_use
)
613 SAM_ACCOUNT
*sam_account
= NULL
;
616 if (!sid_peek_check_rid(get_global_sam_sid(), sid
, &rid
)){
617 DEBUG(0,("local_sid_to_gid: sid_peek_check_rid return False! SID: %s\n",
618 sid_string_static(&map
.sid
)));
621 *psid_name_use
= SID_NAME_UNKNOWN
;
623 DEBUG(5,("local_lookup_sid: looking up RID %u.\n", (unsigned int)rid
));
625 if (rid
== DOMAIN_USER_RID_ADMIN
) {
626 const char **admin_list
= lp_admin_users(-1);
627 *psid_name_use
= SID_NAME_USER
;
629 const char *p
= *admin_list
;
630 if(!next_token(&p
, name
, NULL
, sizeof(fstring
)))
631 fstrcpy(name
, "Administrator");
633 fstrcpy(name
, "Administrator");
639 * Don't try to convert the rid to a name if
640 * running in appliance mode
643 if (lp_hide_local_users())
646 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account
))) {
650 /* see if the passdb can help us with the name of the user */
651 if (pdb_getsampwsid(sam_account
, sid
)) {
652 fstrcpy(name
, pdb_get_username(sam_account
));
653 *psid_name_use
= SID_NAME_USER
;
655 pdb_free_sam(&sam_account
);
660 pdb_free_sam(&sam_account
);
662 if (pdb_getgrsid(&map
, *sid
, MAPPING_WITHOUT_PRIV
)) {
663 if (map
.gid
!=(gid_t
)-1) {
664 DEBUG(5,("local_lookup_sid: mapped group %s to gid %u\n", map
.nt_name
, (unsigned int)map
.gid
));
666 DEBUG(5,("local_lookup_sid: mapped group %s to no unix gid. Returning name.\n", map
.nt_name
));
669 fstrcpy(name
, map
.nt_name
);
670 *psid_name_use
= map
.sid_name_use
;
674 if (pdb_rid_is_user(rid
)) {
677 DEBUG(5, ("assuming RID %u is a user\n", (unsigned)rid
));
679 uid
= fallback_pdb_user_rid_to_uid(rid
);
680 slprintf(name
, sizeof(fstring
)-1, "unix_user.%u", (unsigned int)uid
);
682 return False
; /* Indicates that this user was 'not mapped' */
687 DEBUG(5, ("assuming RID %u is a group\n", (unsigned)rid
));
689 gid
= pdb_group_rid_to_gid(rid
);
692 *psid_name_use
= SID_NAME_ALIAS
;
694 DEBUG(5,("local_lookup_sid: looking up gid %u %s\n", (unsigned int)gid
,
695 gr
? "succeeded" : "failed" ));
698 slprintf(name
, sizeof(fstring
)-1, "unix_group.%u", (unsigned int)gid
);
699 return False
; /* Indicates that this group was 'not mapped' */
702 fstrcpy( name
, gr
->gr_name
);
704 DEBUG(5,("local_lookup_sid: found group %s for rid %u\n", name
,
705 (unsigned int)rid
));
710 /*******************************************************************
711 Convert a name into a SID. Used in the lookup name rpc.
712 ********************************************************************/
714 BOOL
local_lookup_name(const char *c_user
, DOM_SID
*psid
, enum SID_NAME_USE
*psid_name_use
)
716 extern DOM_SID global_sid_World_Domain
;
719 SAM_ACCOUNT
*sam_account
= NULL
;
723 *psid_name_use
= SID_NAME_UNKNOWN
;
726 * user may be quoted a const string, and map_username and
727 * friends can modify it. Make a modifiable copy. JRA.
730 fstrcpy(user
, c_user
);
732 sid_copy(&local_sid
, get_global_sam_sid());
735 * Special case for MACHINE\Everyone. Map to the world_sid.
738 if(strequal(user
, "Everyone")) {
739 sid_copy( psid
, &global_sid_World_Domain
);
740 sid_append_rid(psid
, 0);
741 *psid_name_use
= SID_NAME_ALIAS
;
746 * Don't lookup local unix users if running in appliance mode
748 if (lp_hide_local_users())
751 (void)map_username(user
);
753 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account
))) {
757 if (pdb_getsampwnam(sam_account
, user
)) {
758 sid_copy(psid
, pdb_get_user_sid(sam_account
));
759 *psid_name_use
= SID_NAME_USER
;
761 pdb_free_sam(&sam_account
);
765 pdb_free_sam(&sam_account
);
768 * Maybe it was a group ?
771 /* check if it's a mapped group */
772 if (pdb_getgrnam(&map
, user
, MAPPING_WITHOUT_PRIV
)) {
773 /* yes it's a mapped group */
774 sid_copy(&local_sid
, &map
.sid
);
775 *psid_name_use
= map
.sid_name_use
;
777 /* it's not a mapped group */
778 grp
= getgrnam(user
);
783 *check if it's mapped, if it is reply it doesn't exist
785 * that's to prevent this case:
787 * unix group ug is mapped to nt group ng
788 * someone does a lookup on ug
789 * we must not reply as it doesn't "exist" anymore
790 * for NT. For NT only ng exists.
794 if (pdb_getgrgid(&map
, grp
->gr_gid
, MAPPING_WITHOUT_PRIV
)){
798 sid_append_rid( &local_sid
, pdb_gid_to_group_rid(grp
->gr_gid
));
799 *psid_name_use
= SID_NAME_ALIAS
;
802 sid_copy( psid
, &local_sid
);
807 /****************************************************************************
808 Convert a uid to SID - locally.
809 ****************************************************************************/
811 DOM_SID
*local_uid_to_sid(DOM_SID
*psid
, uid_t uid
)
814 SAM_ACCOUNT
*sam_user
= NULL
;
815 fstring str
; /* sid string buffer */
817 sid_copy(psid
, get_global_sam_sid());
819 if((pass
= getpwuid_alloc(uid
))) {
821 if (NT_STATUS_IS_ERR(pdb_init_sam(&sam_user
))) {
826 if (pdb_getsampwnam(sam_user
, pass
->pw_name
)) {
827 sid_copy(psid
, pdb_get_user_sid(sam_user
));
829 sid_append_rid(psid
, fallback_pdb_uid_to_user_rid(uid
));
832 DEBUG(10,("local_uid_to_sid: uid %u -> SID (%s) (%s).\n",
833 (unsigned)uid
, sid_to_string( str
, psid
),
837 pdb_free_sam(&sam_user
);
840 sid_append_rid(psid
, fallback_pdb_uid_to_user_rid(uid
));
842 DEBUG(10,("local_uid_to_sid: uid %u -> SID (%s) (unknown user).\n",
843 (unsigned)uid
, sid_to_string( str
, psid
)));
849 /****************************************************************************
850 Convert a SID to uid - locally.
851 ****************************************************************************/
853 BOOL
local_sid_to_uid(uid_t
*puid
, const DOM_SID
*psid
, enum SID_NAME_USE
*name_type
)
856 SAM_ACCOUNT
*sam_user
= NULL
;
858 *name_type
= SID_NAME_UNKNOWN
;
860 if (NT_STATUS_IS_ERR(pdb_init_sam(&sam_user
)))
863 if (pdb_getsampwsid(sam_user
, psid
)) {
865 if (!IS_SAM_SET(sam_user
,PDB_UID
)&&!IS_SAM_CHANGED(sam_user
,PDB_UID
)) {
866 pdb_free_sam(&sam_user
);
870 *puid
= pdb_get_uid(sam_user
);
872 DEBUG(10,("local_sid_to_uid: SID %s -> uid (%u) (%s).\n", sid_to_string( str
, psid
),
873 (unsigned int)*puid
, pdb_get_username(sam_user
)));
874 pdb_free_sam(&sam_user
);
881 pdb_free_sam(&sam_user
);
883 if (pdb_getgrsid(&map
, *psid
, MAPPING_WITHOUT_PRIV
)) {
884 DEBUG(3, ("local_sid_to_uid: SID '%s' is a group, not a user... \n", sid_to_string(str
, psid
)));
885 /* It's a group, not a user... */
889 sid_copy(&dom_sid
, psid
);
890 if (!sid_peek_check_rid(get_global_sam_sid(), psid
, &rid
)) {
891 DEBUG(3, ("sid_peek_rid failed - sid '%s' is not in our domain\n", sid_to_string(str
, psid
)));
895 if (!pdb_rid_is_user(rid
)) {
896 DEBUG(3, ("local_sid_to_uid: sid '%s' cannot be mapped to a uid algorithmicly becouse it is a group\n", sid_to_string(str
, psid
)));
900 *puid
= fallback_pdb_user_rid_to_uid(rid
);
902 DEBUG(5,("local_sid_to_uid: SID %s algorithmicly mapped to %ld mapped becouse SID was not found in passdb.\n",
903 sid_to_string(str
, psid
), (signed long int)(*puid
)));
906 *name_type
= SID_NAME_USER
;
911 /****************************************************************************
912 Convert a gid to SID - locally.
913 ****************************************************************************/
915 DOM_SID
*local_gid_to_sid(DOM_SID
*psid
, gid_t gid
)
919 sid_copy(psid
, get_global_sam_sid());
921 if (pdb_getgrgid(&map
, gid
, MAPPING_WITHOUT_PRIV
)) {
922 sid_copy(psid
, &map
.sid
);
925 sid_append_rid(psid
, pdb_gid_to_group_rid(gid
));
931 /****************************************************************************
932 Convert a SID to gid - locally.
933 ****************************************************************************/
935 BOOL
local_sid_to_gid(gid_t
*pgid
, const DOM_SID
*psid
, enum SID_NAME_USE
*name_type
)
940 *name_type
= SID_NAME_UNKNOWN
;
943 * We can only convert to a gid if this is our local
944 * Domain SID (ie. we are the controling authority).
946 * Or in the Builtin SID too. JFM, 11/30/2001
949 if (pdb_getgrsid(&map
, *psid
, MAPPING_WITHOUT_PRIV
)) {
951 /* the SID is in the mapping table but not mapped */
952 if (map
.gid
==(gid_t
)-1)
956 *name_type
= map
.sid_name_use
;
957 DEBUG(10,("local_sid_to_gid: mapped SID %s (%s) -> gid (%u).\n",
958 sid_to_string( str
, psid
),
959 map
.nt_name
, (unsigned int)*pgid
));
963 SAM_ACCOUNT
*sam_user
= NULL
;
964 if (NT_STATUS_IS_ERR(pdb_init_sam(&sam_user
)))
967 if (pdb_getsampwsid(sam_user
, psid
)) {
969 pdb_free_sam(&sam_user
);
972 pdb_free_sam(&sam_user
);
974 if (!sid_peek_check_rid(get_global_sam_sid(), psid
, &rid
)) {
975 DEBUG(3, ("sid_peek_rid failed - sid '%s' is not in our domain\n", sid_to_string(str
, psid
)));
979 if (pdb_rid_is_user(rid
))
982 *pgid
= pdb_group_rid_to_gid(rid
);
983 *name_type
= SID_NAME_ALIAS
;
984 DEBUG(10,("local_sid_to_gid: SID %s -> gid (%u).\n", sid_to_string( str
, psid
),
985 (unsigned int)*pgid
));
991 /*************************************************************
992 Change a password entry in the local smbpasswd file.
994 It is currently being called by SWAT and by smbpasswd.
997 *************************************************************/
999 BOOL
local_password_change(const char *user_name
, int local_flags
,
1000 const char *new_passwd
,
1001 char *err_str
, size_t err_str_len
,
1002 char *msg_str
, size_t msg_str_len
)
1004 struct passwd
*pwd
= NULL
;
1005 SAM_ACCOUNT
*sam_pass
=NULL
;
1011 /* Get the smb passwd entry for this user */
1012 pdb_init_sam(&sam_pass
);
1013 if(!pdb_getsampwnam(sam_pass
, user_name
)) {
1014 pdb_free_sam(&sam_pass
);
1016 if (local_flags
& LOCAL_ADD_USER
) {
1017 pwd
= getpwnam_alloc(user_name
);
1018 } else if (local_flags
& LOCAL_DELETE_USER
) {
1019 /* Might not exist in /etc/passwd */
1021 slprintf(err_str
, err_str_len
-1,"Failed to find entry for user %s.\n", user_name
);
1026 /* Local user found, so init from this */
1027 if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sam_pass
, pwd
))){
1028 slprintf(err_str
, err_str_len
-1, "Failed initialise SAM_ACCOUNT for user %s.\n", user_name
);
1035 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_pass
))){
1036 slprintf(err_str
, err_str_len
-1, "Failed initialise SAM_ACCOUNT for user %s.\n", user_name
);
1040 if (!pdb_set_username(sam_pass
, user_name
, PDB_CHANGED
)) {
1041 slprintf(err_str
, err_str_len
- 1, "Failed to set username for user %s.\n", user_name
);
1042 pdb_free_sam(&sam_pass
);
1047 /* the entry already existed */
1048 local_flags
&= ~LOCAL_ADD_USER
;
1051 /* the 'other' acb bits not being changed here */
1052 other_acb
= (pdb_get_acct_ctrl(sam_pass
) & (!(ACB_WSTRUST
|ACB_DOMTRUST
|ACB_SVRTRUST
|ACB_NORMAL
)));
1053 if (local_flags
& LOCAL_TRUST_ACCOUNT
) {
1054 if (!pdb_set_acct_ctrl(sam_pass
, ACB_WSTRUST
| other_acb
, PDB_CHANGED
) ) {
1055 slprintf(err_str
, err_str_len
- 1, "Failed to set 'trusted workstation account' flags for user %s.\n", user_name
);
1056 pdb_free_sam(&sam_pass
);
1059 } else if (local_flags
& LOCAL_INTERDOM_ACCOUNT
) {
1060 if (!pdb_set_acct_ctrl(sam_pass
, ACB_DOMTRUST
| other_acb
, PDB_CHANGED
)) {
1061 slprintf(err_str
, err_str_len
- 1, "Failed to set 'domain trust account' flags for user %s.\n", user_name
);
1062 pdb_free_sam(&sam_pass
);
1066 if (!pdb_set_acct_ctrl(sam_pass
, ACB_NORMAL
| other_acb
, PDB_CHANGED
)) {
1067 slprintf(err_str
, err_str_len
- 1, "Failed to set 'normal account' flags for user %s.\n", user_name
);
1068 pdb_free_sam(&sam_pass
);
1074 * We are root - just write the new password
1075 * and the valid last change time.
1078 if (local_flags
& LOCAL_DISABLE_USER
) {
1079 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)|ACB_DISABLED
, PDB_CHANGED
)) {
1080 slprintf(err_str
, err_str_len
-1, "Failed to set 'disabled' flag for user %s.\n", user_name
);
1081 pdb_free_sam(&sam_pass
);
1084 } else if (local_flags
& LOCAL_ENABLE_USER
) {
1085 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)&(~ACB_DISABLED
), PDB_CHANGED
)) {
1086 slprintf(err_str
, err_str_len
-1, "Failed to unset 'disabled' flag for user %s.\n", user_name
);
1087 pdb_free_sam(&sam_pass
);
1092 if (local_flags
& LOCAL_SET_NO_PASSWORD
) {
1093 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)|ACB_PWNOTREQ
, PDB_CHANGED
)) {
1094 slprintf(err_str
, err_str_len
-1, "Failed to set 'no password required' flag for user %s.\n", user_name
);
1095 pdb_free_sam(&sam_pass
);
1098 } else if (local_flags
& LOCAL_SET_PASSWORD
) {
1100 * If we're dealing with setting a completely empty user account
1101 * ie. One with a password of 'XXXX', but not set disabled (like
1102 * an account created from scratch) then if the old password was
1103 * 'XX's then getsmbpwent will have set the ACB_DISABLED flag.
1104 * We remove that as we're giving this user their first password
1105 * and the decision hasn't really been made to disable them (ie.
1106 * don't create them disabled). JRA.
1108 if ((pdb_get_lanman_passwd(sam_pass
)==NULL
) && (pdb_get_acct_ctrl(sam_pass
)&ACB_DISABLED
)) {
1109 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)&(~ACB_DISABLED
), PDB_CHANGED
)) {
1110 slprintf(err_str
, err_str_len
-1, "Failed to unset 'disabled' flag for user %s.\n", user_name
);
1111 pdb_free_sam(&sam_pass
);
1115 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)&(~ACB_PWNOTREQ
), PDB_CHANGED
)) {
1116 slprintf(err_str
, err_str_len
-1, "Failed to unset 'no password required' flag for user %s.\n", user_name
);
1117 pdb_free_sam(&sam_pass
);
1121 if (!pdb_set_plaintext_passwd (sam_pass
, new_passwd
)) {
1122 slprintf(err_str
, err_str_len
-1, "Failed to set password for user %s.\n", user_name
);
1123 pdb_free_sam(&sam_pass
);
1128 if (local_flags
& LOCAL_ADD_USER
) {
1129 if (pdb_add_sam_account(sam_pass
)) {
1130 slprintf(msg_str
, msg_str_len
-1, "Added user %s.\n", user_name
);
1131 pdb_free_sam(&sam_pass
);
1134 slprintf(err_str
, err_str_len
-1, "Failed to add entry for user %s.\n", user_name
);
1135 pdb_free_sam(&sam_pass
);
1138 } else if (local_flags
& LOCAL_DELETE_USER
) {
1139 if (!pdb_delete_sam_account(sam_pass
)) {
1140 slprintf(err_str
,err_str_len
-1, "Failed to delete entry for user %s.\n", user_name
);
1141 pdb_free_sam(&sam_pass
);
1144 slprintf(msg_str
, msg_str_len
-1, "Deleted user %s.\n", user_name
);
1146 if(!pdb_update_sam_account(sam_pass
)) {
1147 slprintf(err_str
, err_str_len
-1, "Failed to modify entry for user %s.\n", user_name
);
1148 pdb_free_sam(&sam_pass
);
1151 if(local_flags
& LOCAL_DISABLE_USER
)
1152 slprintf(msg_str
, msg_str_len
-1, "Disabled user %s.\n", user_name
);
1153 else if (local_flags
& LOCAL_ENABLE_USER
)
1154 slprintf(msg_str
, msg_str_len
-1, "Enabled user %s.\n", user_name
);
1155 else if (local_flags
& LOCAL_SET_NO_PASSWORD
)
1156 slprintf(msg_str
, msg_str_len
-1, "User %s password set to none.\n", user_name
);
1159 pdb_free_sam(&sam_pass
);