2 Unix SMB/CIFS implementation.
3 Standardised Authentication types
4 Copyright (C) Andrew Bartlett 2001
5 Copyright (C) Stefan Metzmacher 2005
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "librpc/gen_ndr/ndr_krb5pac.h"
25 #include "librpc/gen_ndr/auth.h"
26 #include "../auth/common_auth.h"
28 extern const char *krbtgt_attrs
[];
29 extern const char *server_attrs
[];
30 extern const char *user_attrs
[];
32 union netr_Validation
;
33 struct netr_SamBaseInfo
;
35 struct loadparm_context
;
37 /* modules can use the following to determine if the interface has changed
38 * please increment the version number after each interface change
39 * with a comment and maybe update struct auth_critical_sizes.
41 /* version 1 - version from samba 3.0 - metze */
42 /* version 2 - initial samba4 version - metze */
43 /* version 3 - subsequent samba4 version - abartlet */
44 /* version 4 - subsequent samba4 version - metze */
45 /* version 0 - till samba4 is stable - metze */
46 #define AUTH4_INTERFACE_VERSION 0
48 #define AUTH_SESSION_INFO_DEFAULT_GROUPS 0x01 /* Add the user to the default world and network groups */
49 #define AUTH_SESSION_INFO_AUTHENTICATED 0x02 /* Add the user to the 'authenticated users' group */
50 #define AUTH_SESSION_INFO_SIMPLE_PRIVILEGES 0x04 /* Use a trivial map between users and privilages, rather than a DB */
52 struct auth_method_context
;
53 struct auth_check_password_request
;
55 struct auth_session_info
;
58 struct auth_operations
{
61 /* If you are using this interface, then you are probably
62 * getting something wrong. This interface is only for
63 * security=server, and makes a number of compromises to allow
64 * that. It is not compatible with being a PDC. */
66 NTSTATUS (*get_challenge
)(struct auth_method_context
*ctx
, TALLOC_CTX
*mem_ctx
, uint8_t chal
[8]);
68 /* Given the user supplied info, check if this backend want to handle the password checking */
70 NTSTATUS (*want_check
)(struct auth_method_context
*ctx
, TALLOC_CTX
*mem_ctx
,
71 const struct auth_usersupplied_info
*user_info
);
73 /* Given the user supplied info, check a password */
75 NTSTATUS (*check_password
)(struct auth_method_context
*ctx
, TALLOC_CTX
*mem_ctx
,
76 const struct auth_usersupplied_info
*user_info
,
77 struct auth_user_info_dc
**interim_info
);
79 /* Lookup a 'session info interim' return based only on the principal or DN */
80 NTSTATUS (*get_user_info_dc_principal
)(TALLOC_CTX
*mem_ctx
,
81 struct auth4_context
*auth_context
,
82 const char *principal
,
83 struct ldb_dn
*user_dn
,
84 struct auth_user_info_dc
**interim_info
);
87 struct auth_method_context
{
88 struct auth_method_context
*prev
, *next
;
89 struct auth4_context
*auth_ctx
;
90 const struct auth_operations
*ops
;
95 struct auth4_context
{
97 /* Who set this up in the first place? */
100 bool may_be_modified
;
105 /* methods, in the order they should be called */
106 struct auth_method_context
*methods
;
108 /* the event context to use for calls that can block */
109 struct tevent_context
*event_ctx
;
111 /* the messaging context which can be used by backends */
112 struct imessaging_context
*msg_ctx
;
114 /* loadparm context */
115 struct loadparm_context
*lp_ctx
;
117 /* SAM database for this local machine - to fill in local groups, or to authenticate local NTLM users */
118 struct ldb_context
*sam_ctx
;
120 NTSTATUS (*check_password
)(struct auth4_context
*auth_ctx
,
122 const struct auth_usersupplied_info
*user_info
,
123 struct auth_user_info_dc
**user_info_dc
);
125 NTSTATUS (*get_challenge
)(struct auth4_context
*auth_ctx
, uint8_t chal
[8]);
127 bool (*challenge_may_be_modified
)(struct auth4_context
*auth_ctx
);
129 NTSTATUS (*set_challenge
)(struct auth4_context
*auth_ctx
, const uint8_t chal
[8], const char *set_by
);
131 NTSTATUS (*get_user_info_dc_principal
)(TALLOC_CTX
*mem_ctx
,
132 struct auth4_context
*auth_ctx
,
133 const char *principal
,
134 struct ldb_dn
*user_dn
,
135 struct auth_user_info_dc
**user_info_dc
);
137 NTSTATUS (*generate_session_info
)(TALLOC_CTX
*mem_ctx
,
138 struct auth4_context
*auth_context
,
139 struct auth_user_info_dc
*user_info_dc
,
140 uint32_t session_info_flags
,
141 struct auth_session_info
**session_info
);
144 /* this structure is used by backends to determine the size of some critical types */
145 struct auth_critical_sizes
{
146 int interface_version
;
147 int sizeof_auth_operations
;
148 int sizeof_auth_methods
;
149 int sizeof_auth_context
;
150 int sizeof_auth_usersupplied_info
;
151 int sizeof_auth_user_info_dc
;
154 NTSTATUS
encrypt_user_info(TALLOC_CTX
*mem_ctx
, struct auth4_context
*auth_context
,
155 enum auth_password_state to_state
,
156 const struct auth_usersupplied_info
*user_info_in
,
157 const struct auth_usersupplied_info
**user_info_encrypted
);
159 #include "auth/session.h"
160 #include "auth/system_session_proto.h"
161 #include "libcli/security/security.h"
165 struct gensec_security
;
166 struct cli_credentials
;
168 NTSTATUS
auth_get_challenge(struct auth4_context
*auth_ctx
, uint8_t chal
[8]);
169 NTSTATUS
authsam_account_ok(TALLOC_CTX
*mem_ctx
,
170 struct ldb_context
*sam_ctx
,
171 uint32_t logon_parameters
,
172 struct ldb_dn
*domain_dn
,
173 struct ldb_message
*msg
,
174 const char *logon_workstation
,
175 const char *name_for_logs
,
176 bool allow_domain_trust
,
177 bool password_change
);
179 struct auth_session_info
*system_session(struct loadparm_context
*lp_ctx
);
180 NTSTATUS
authsam_make_user_info_dc(TALLOC_CTX
*mem_ctx
, struct ldb_context
*sam_ctx
,
181 const char *netbios_name
,
182 const char *domain_name
,
183 struct ldb_dn
*domain_dn
,
184 struct ldb_message
*msg
,
185 DATA_BLOB user_sess_key
, DATA_BLOB lm_sess_key
,
186 struct auth_user_info_dc
**_user_info_dc
);
187 NTSTATUS
auth_system_session_info(TALLOC_CTX
*parent_ctx
,
188 struct loadparm_context
*lp_ctx
,
189 struct auth_session_info
**_session_info
) ;
191 NTSTATUS
auth_context_create_methods(TALLOC_CTX
*mem_ctx
, const char **methods
,
192 struct tevent_context
*ev
,
193 struct imessaging_context
*msg
,
194 struct loadparm_context
*lp_ctx
,
195 struct ldb_context
*sam_ctx
,
196 struct auth4_context
**auth_ctx
);
197 const char **auth_methods_from_lp(TALLOC_CTX
*mem_ctx
, struct loadparm_context
*lp_ctx
);
199 NTSTATUS
auth_context_create(TALLOC_CTX
*mem_ctx
,
200 struct tevent_context
*ev
,
201 struct imessaging_context
*msg
,
202 struct loadparm_context
*lp_ctx
,
203 struct auth4_context
**auth_ctx
);
204 NTSTATUS
auth_context_create_from_ldb(TALLOC_CTX
*mem_ctx
, struct ldb_context
*ldb
, struct auth4_context
**auth_ctx
);
206 NTSTATUS
auth_check_password(struct auth4_context
*auth_ctx
,
208 const struct auth_usersupplied_info
*user_info
,
209 struct auth_user_info_dc
**user_info_dc
);
210 NTSTATUS
auth4_init(void);
211 NTSTATUS
auth_register(const struct auth_operations
*ops
);
212 NTSTATUS
server_service_auth_init(void);
213 NTSTATUS
authenticate_username_pw(TALLOC_CTX
*mem_ctx
,
214 struct tevent_context
*ev
,
215 struct imessaging_context
*msg
,
216 struct loadparm_context
*lp_ctx
,
217 const char *nt4_domain
,
218 const char *nt4_username
,
219 const char *password
,
220 const uint32_t logon_parameters
,
221 struct auth_session_info
**session_info
);
223 struct tevent_req
*auth_check_password_send(TALLOC_CTX
*mem_ctx
,
224 struct tevent_context
*ev
,
225 struct auth4_context
*auth_ctx
,
226 const struct auth_usersupplied_info
*user_info
);
227 NTSTATUS
auth_check_password_recv(struct tevent_req
*req
,
229 struct auth_user_info_dc
**user_info_dc
);
231 bool auth_challenge_may_be_modified(struct auth4_context
*auth_ctx
);
232 NTSTATUS
auth_context_set_challenge(struct auth4_context
*auth_ctx
, const uint8_t chal
[8], const char *set_by
);
234 NTSTATUS
auth_get_user_info_dc_principal(TALLOC_CTX
*mem_ctx
,
235 struct auth4_context
*auth_ctx
,
236 const char *principal
,
237 struct ldb_dn
*user_dn
,
238 struct auth_user_info_dc
**user_info_dc
);
240 NTSTATUS
samba_server_gensec_start(TALLOC_CTX
*mem_ctx
,
241 struct tevent_context
*event_ctx
,
242 struct imessaging_context
*msg_ctx
,
243 struct loadparm_context
*lp_ctx
,
244 struct cli_credentials
*server_credentials
,
245 const char *target_service
,
246 struct gensec_security
**gensec_context
);
248 #endif /* _SMBAUTH_H_ */