2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_AUTH
29 extern DOM_SID global_sid_World
;
30 extern DOM_SID global_sid_Network
;
31 extern DOM_SID global_sid_Builtin_Guests
;
32 extern DOM_SID global_sid_Authenticated_Users
;
35 /****************************************************************************
36 Create a UNIX user on demand.
37 ****************************************************************************/
39 static int smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
44 pstrcpy(add_script
, lp_adduser_script());
47 all_string_sub(add_script
, "%u", unix_username
, sizeof(pstring
));
49 all_string_sub(add_script
, "%D", domain
, sizeof(pstring
));
51 all_string_sub(add_script
, "%H", homedir
, sizeof(pstring
));
52 ret
= smbrun(add_script
,NULL
);
53 DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script
,ret
));
57 /****************************************************************************
58 Add and Delete UNIX users on demand, based on NTSTATUS codes.
59 ****************************************************************************/
61 void auth_add_user_script(const char *domain
, const char *username
)
63 struct passwd
*pwd
=NULL
;
66 * User validated ok against Domain controller.
67 * If the admin wants us to try and create a UNIX
68 * user on the fly, do so.
71 if(lp_adduser_script() && !(pwd
= Get_Pwnam(username
))) {
72 smb_create_user(domain
, username
, NULL
);
76 /****************************************************************************
77 Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
79 ****************************************************************************/
81 NTSTATUS
auth_get_sam_account(const char *user
, SAM_ACCOUNT
**account
)
85 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(account
))) {
90 pdb_ret
= pdb_getsampwnam(*account
, user
);
95 struct passwd
*pass
= Get_Pwnam(user
);
97 return NT_STATUS_NO_SUCH_USER
;
99 if (!NT_STATUS_IS_OK(nt_status
= pdb_fill_sam_pw(*account
, pass
))) {
106 /****************************************************************************
107 Create an auth_usersupplied_data structure
108 ****************************************************************************/
110 static NTSTATUS
make_user_info(auth_usersupplied_info
**user_info
,
111 const char *smb_name
,
112 const char *internal_username
,
113 const char *client_domain
,
115 const char *wksta_name
,
116 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
118 uint32 auth_flags
, BOOL encrypted
)
121 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username
, smb_name
));
123 *user_info
= malloc(sizeof(**user_info
));
125 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info
)));
126 return NT_STATUS_NO_MEMORY
;
129 ZERO_STRUCTP(*user_info
);
131 DEBUG(5,("making strings for %s's user_info struct\n", internal_username
));
133 (*user_info
)->smb_name
.str
= strdup(smb_name
);
134 if ((*user_info
)->smb_name
.str
) {
135 (*user_info
)->smb_name
.len
= strlen(smb_name
);
137 free_user_info(user_info
);
138 return NT_STATUS_NO_MEMORY
;
141 (*user_info
)->internal_username
.str
= strdup(internal_username
);
142 if ((*user_info
)->internal_username
.str
) {
143 (*user_info
)->internal_username
.len
= strlen(internal_username
);
145 free_user_info(user_info
);
146 return NT_STATUS_NO_MEMORY
;
149 (*user_info
)->domain
.str
= strdup(domain
);
150 if ((*user_info
)->domain
.str
) {
151 (*user_info
)->domain
.len
= strlen(domain
);
153 free_user_info(user_info
);
154 return NT_STATUS_NO_MEMORY
;
157 (*user_info
)->client_domain
.str
= strdup(client_domain
);
158 if ((*user_info
)->client_domain
.str
) {
159 (*user_info
)->client_domain
.len
= strlen(client_domain
);
161 free_user_info(user_info
);
162 return NT_STATUS_NO_MEMORY
;
165 (*user_info
)->wksta_name
.str
= strdup(wksta_name
);
166 if ((*user_info
)->wksta_name
.str
) {
167 (*user_info
)->wksta_name
.len
= strlen(wksta_name
);
169 free_user_info(user_info
);
170 return NT_STATUS_NO_MEMORY
;
173 DEBUG(5,("making blobs for %s's user_info struct\n", internal_username
));
175 (*user_info
)->lm_resp
= data_blob(lm_pwd
.data
, lm_pwd
.length
);
176 (*user_info
)->nt_resp
= data_blob(nt_pwd
.data
, nt_pwd
.length
);
177 (*user_info
)->plaintext_password
= data_blob(plaintext
.data
, plaintext
.length
);
179 (*user_info
)->encrypted
= encrypted
;
180 (*user_info
)->auth_flags
= auth_flags
;
182 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted
? "":"un" , internal_username
, smb_name
));
187 /****************************************************************************
188 Create an auth_usersupplied_data structure after appropriate mapping.
189 ****************************************************************************/
191 NTSTATUS
make_user_info_map(auth_usersupplied_info
**user_info
,
192 const char *smb_name
,
193 const char *client_domain
,
194 const char *wksta_name
,
195 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
197 uint32 ntlmssp_flags
, BOOL encrypted
)
200 fstring internal_username
;
201 fstrcpy(internal_username
, smb_name
);
202 map_username(internal_username
);
204 DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
205 client_domain
, smb_name
, wksta_name
));
207 if (lp_allow_trusted_domains() && *client_domain
) {
209 /* the client could have given us a workstation name
210 or other crap for the workgroup - we really need a
211 way of telling if this domain name is one of our
214 Also don't allow "" as a domain, fixes a Win9X bug
215 where it doens't supply a domain for logon script
218 Finally, we do this by looking up a cache of trusted domains!
221 domain
= client_domain
;
223 if (is_trusted_domain(domain
)) {
224 return make_user_info(user_info
, smb_name
, internal_username
,
225 client_domain
, domain
, wksta_name
,
226 lm_pwd
, nt_pwd
, plaintext
, ntlmssp_flags
,
231 domain
= lp_workgroup();
234 return make_user_info(user_info
,
235 smb_name
, internal_username
,
236 client_domain
, domain
,
240 ntlmssp_flags
, encrypted
);
244 /****************************************************************************
245 Create an auth_usersupplied_data, making the DATA_BLOBs here.
246 Decrypt and encrypt the passwords.
247 ****************************************************************************/
249 BOOL
make_user_info_netlogon_network(auth_usersupplied_info
**user_info
,
250 const char *smb_name
,
251 const char *client_domain
,
252 const char *wksta_name
,
253 const uchar
*lm_network_pwd
, int lm_pwd_len
,
254 const uchar
*nt_network_pwd
, int nt_pwd_len
)
258 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
259 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
260 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
261 uint32 auth_flags
= AUTH_FLAG_NONE
;
264 auth_flags
|= AUTH_FLAG_LM_RESP
;
265 if (nt_pwd_len
== 24) {
266 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
267 } else if (nt_pwd_len
!= 0) {
268 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
271 nt_status
= make_user_info_map(user_info
,
272 smb_name
, client_domain
,
278 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
280 data_blob_free(&lm_blob
);
281 data_blob_free(&nt_blob
);
285 /****************************************************************************
286 Create an auth_usersupplied_data, making the DATA_BLOBs here.
287 Decrypt and encrypt the passwords.
288 ****************************************************************************/
290 BOOL
make_user_info_netlogon_interactive(auth_usersupplied_info
**user_info
,
291 const char *smb_name
,
292 const char *client_domain
,
293 const char *wksta_name
,
295 const uchar lm_interactive_pwd
[16],
296 const uchar nt_interactive_pwd
[16],
297 const uchar
*dc_sess_key
)
301 unsigned char local_lm_response
[24];
302 unsigned char local_nt_response
[24];
303 unsigned char key
[16];
304 uint32 auth_flags
= AUTH_FLAG_NONE
;
307 memcpy(key
, dc_sess_key
, 8);
309 if (lm_interactive_pwd
) memcpy(lm_pwd
, lm_interactive_pwd
, sizeof(lm_pwd
));
310 if (nt_interactive_pwd
) memcpy(nt_pwd
, nt_interactive_pwd
, sizeof(nt_pwd
));
312 #ifdef DEBUG_PASSWORD
314 dump_data(100, (char *)key
, sizeof(key
));
316 DEBUG(100,("lm owf password:"));
317 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
319 DEBUG(100,("nt owf password:"));
320 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
323 SamOEMhash((uchar
*)lm_pwd
, key
, sizeof(lm_pwd
));
324 SamOEMhash((uchar
*)nt_pwd
, key
, sizeof(nt_pwd
));
326 #ifdef DEBUG_PASSWORD
327 DEBUG(100,("decrypt of lm owf password:"));
328 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
330 DEBUG(100,("decrypt of nt owf password:"));
331 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
334 SMBOWFencrypt((const unsigned char *)lm_pwd
, chal
, local_lm_response
);
335 SMBOWFencrypt((const unsigned char *)nt_pwd
, chal
, local_nt_response
);
337 /* Password info paranoia */
345 DATA_BLOB local_lm_blob
= data_blob(local_lm_response
, sizeof(local_lm_response
));
346 DATA_BLOB local_nt_blob
= data_blob(local_nt_response
, sizeof(local_nt_response
));
347 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
349 if (lm_interactive_pwd
)
350 auth_flags
|= AUTH_FLAG_LM_RESP
;
351 if (nt_interactive_pwd
)
352 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
354 nt_status
= make_user_info_map(user_info
,
355 smb_name
, client_domain
,
362 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
363 data_blob_free(&local_lm_blob
);
364 data_blob_free(&local_nt_blob
);
370 /****************************************************************************
371 Create an auth_usersupplied_data structure
372 ****************************************************************************/
374 BOOL
make_user_info_for_reply(auth_usersupplied_info
**user_info
,
375 const char *smb_name
,
376 const char *client_domain
,
378 DATA_BLOB plaintext_password
)
381 DATA_BLOB local_lm_blob
;
382 DATA_BLOB local_nt_blob
;
383 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
384 uint32 auth_flags
= AUTH_FLAG_NONE
;
387 * Not encrypted - do so.
390 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
392 if (plaintext_password
.data
) {
393 unsigned char local_lm_response
[24];
395 #ifdef DEBUG_PASSWORD
396 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password
.length
));
397 dump_data(100, plaintext_password
.data
, plaintext_password
.length
);
400 SMBencrypt( (const uchar
*)plaintext_password
.data
, (const uchar
*)chal
, local_lm_response
);
401 local_lm_blob
= data_blob(local_lm_response
, 24);
403 /* We can't do an NT hash here, as the password needs to be
405 local_nt_blob
= data_blob(NULL
, 0);
407 auth_flags
= (AUTH_FLAG_PLAINTEXT
| AUTH_FLAG_LM_RESP
);
409 local_lm_blob
= data_blob(NULL
, 0);
410 local_nt_blob
= data_blob(NULL
, 0);
413 ret
= make_user_info_map(user_info
, smb_name
,
415 get_remote_machine_name(),
421 data_blob_free(&local_lm_blob
);
422 return NT_STATUS_IS_OK(ret
) ? True
: False
;
425 /****************************************************************************
426 Create an auth_usersupplied_data structure
427 ****************************************************************************/
429 NTSTATUS
make_user_info_for_reply_enc(auth_usersupplied_info
**user_info
,
430 const char *smb_name
,
431 const char *client_domain
,
432 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
434 uint32 auth_flags
= AUTH_FLAG_NONE
;
436 DATA_BLOB no_plaintext_blob
= data_blob(NULL
, 0);
438 if (lm_resp
.length
== 24) {
439 auth_flags
|= AUTH_FLAG_LM_RESP
;
441 if (nt_resp
.length
== 0) {
442 } else if (nt_resp
.length
== 24) {
443 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
445 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
448 return make_user_info_map(user_info
, smb_name
,
450 get_remote_machine_name(),
457 /****************************************************************************
458 Create a guest user_info blob, for anonymous authenticaion.
459 ****************************************************************************/
461 BOOL
make_user_info_guest(auth_usersupplied_info
**user_info
)
463 DATA_BLOB lm_blob
= data_blob(NULL
, 0);
464 DATA_BLOB nt_blob
= data_blob(NULL
, 0);
465 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
466 uint32 auth_flags
= AUTH_FLAG_NONE
;
469 nt_status
= make_user_info(user_info
,
477 return NT_STATUS_IS_OK(nt_status
) ? True
: False
;
480 /****************************************************************************
481 prints a NT_USER_TOKEN to debug output.
482 ****************************************************************************/
484 void debug_nt_user_token(int dbg_class
, int dbg_lev
, NT_USER_TOKEN
*token
)
490 DEBUGC(dbg_class
, dbg_lev
, ("NT user token: (NULL)\n"));
494 DEBUGC(dbg_class
, dbg_lev
, ("NT user token of user %s\n",
495 sid_to_string(sid_str
, &token
->user_sids
[0]) ));
496 DEBUGADDC(dbg_class
, dbg_lev
, ("contains %i SIDs\n", token
->num_sids
));
497 for (i
= 0; i
< token
->num_sids
; i
++)
498 DEBUGADDC(dbg_class
, dbg_lev
, ("SID[%3i]: %s\n", i
,
499 sid_to_string(sid_str
, &token
->user_sids
[i
])));
502 /****************************************************************************
503 prints a UNIX 'token' to debug output.
504 ****************************************************************************/
506 void debug_unix_user_token(int dbg_class
, int dbg_lev
, uid_t uid
, gid_t gid
, int n_groups
, gid_t
*groups
)
509 DEBUGC(dbg_class
, dbg_lev
, ("UNIX token of user %ld\n", (long int)uid
));
511 DEBUGADDC(dbg_class
, dbg_lev
, ("Primary group is %ld and contains %i supplementary groups\n", (long int)gid
, n_groups
));
512 for (i
= 0; i
< n_groups
; i
++)
513 DEBUGADDC(dbg_class
, dbg_lev
, ("Group[%3i]: %ld\n", i
,
514 (long int)groups
[i
]));
517 /****************************************************************************
518 Create the SID list for this user.
519 ****************************************************************************/
521 static NTSTATUS
create_nt_user_token(const DOM_SID
*user_sid
, const DOM_SID
*group_sid
,
522 int n_groupSIDs
, DOM_SID
*groupSIDs
,
523 BOOL is_guest
, NT_USER_TOKEN
**token
)
525 NTSTATUS nt_status
= NT_STATUS_OK
;
526 NT_USER_TOKEN
*ptoken
;
530 if ((ptoken
= malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
) {
531 DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
532 nt_status
= NT_STATUS_NO_MEMORY
;
536 ZERO_STRUCTP(ptoken
);
538 ptoken
->num_sids
= n_groupSIDs
+ 5;
540 if ((ptoken
->user_sids
= (DOM_SID
*)malloc( sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
541 DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
542 nt_status
= NT_STATUS_NO_MEMORY
;
546 memset((char*)ptoken
->user_sids
,0,sizeof(DOM_SID
) * ptoken
->num_sids
);
549 * Note - user SID *MUST* be first in token !
550 * se_access_check depends on this.
552 * Primary group SID is second in token. Convention.
555 sid_copy(&ptoken
->user_sids
[PRIMARY_USER_SID_INDEX
], user_sid
);
557 sid_copy(&ptoken
->user_sids
[PRIMARY_GROUP_SID_INDEX
], group_sid
);
560 * Finally add the "standard" SIDs.
561 * The only difference between guest and "anonymous" (which we
562 * don't really support) is the addition of Authenticated_Users.
565 sid_copy(&ptoken
->user_sids
[2], &global_sid_World
);
566 sid_copy(&ptoken
->user_sids
[3], &global_sid_Network
);
569 sid_copy(&ptoken
->user_sids
[4], &global_sid_Builtin_Guests
);
571 sid_copy(&ptoken
->user_sids
[4], &global_sid_Authenticated_Users
);
573 sid_ndx
= 5; /* next available spot */
575 for (i
= 0; i
< n_groupSIDs
; i
++) {
576 size_t check_sid_idx
;
577 for (check_sid_idx
= 1; check_sid_idx
< ptoken
->num_sids
; check_sid_idx
++) {
578 if (sid_equal(&ptoken
->user_sids
[check_sid_idx
],
584 if (check_sid_idx
>= ptoken
->num_sids
) /* Not found already */ {
585 sid_copy(&ptoken
->user_sids
[sid_ndx
++], &groupSIDs
[i
]);
591 debug_nt_user_token(DBGC_AUTH
, 10, ptoken
);
598 /****************************************************************************
599 Create the SID list for this user.
600 ****************************************************************************/
602 NT_USER_TOKEN
*create_nt_token(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
, BOOL is_guest
)
607 NT_USER_TOKEN
*token
;
610 if (NT_STATUS_IS_ERR(uid_to_sid(&user_sid
, uid
))) {
613 if (NT_STATUS_IS_ERR(gid_to_sid(&group_sid
, gid
))) {
617 group_sids
= malloc(sizeof(DOM_SID
) * ngroups
);
619 DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
623 for (i
= 0; i
< ngroups
; i
++) {
624 if (NT_STATUS_IS_ERR(gid_to_sid(&(group_sids
)[i
], (groups
)[i
]))) {
625 DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups
[i
]));
626 SAFE_FREE(group_sids
);
631 if (!NT_STATUS_IS_OK(create_nt_user_token(&user_sid
, &group_sid
,
632 ngroups
, group_sids
, is_guest
, &token
))) {
633 SAFE_FREE(group_sids
);
637 SAFE_FREE(group_sids
);
642 /******************************************************************************
643 * this function returns the groups (SIDs) of the local SAM the user is in.
644 * If this samba server is a DC of the domain the user belongs to, it returns
645 * both domain groups and local / builtin groups. If the user is in a trusted
646 * domain, or samba is a member server of a domain, then this function returns
647 * local and builtin groups the user is a member of.
649 * currently this is a hack, as there is no sam implementation that is capable
651 ******************************************************************************/
653 static NTSTATUS
get_user_groups_from_local_sam(SAM_ACCOUNT
*sampass
,
654 int *n_groups
, DOM_SID
**groups
, gid_t
**unix_groups
)
664 if (NT_STATUS_IS_ERR(sid_to_uid(pdb_get_user_sid(sampass
), &uid
)) || NT_STATUS_IS_ERR(sid_to_gid(pdb_get_group_sid(sampass
), &gid
))) {
665 DEBUG(0, ("get_user_groups_from_local_sam: error fetching uid or gid for user!\n"));
666 return NT_STATUS_UNSUCCESSFUL
;
669 n_unix_groups
= groups_max();
670 if ((*unix_groups
= malloc( sizeof(gid_t
) * n_unix_groups
) ) == NULL
) {
671 DEBUG(0, ("get_user_groups_from_local_sam: Out of memory allocating unix group list\n"));
672 return NT_STATUS_NO_MEMORY
;
675 if (sys_getgrouplist(pdb_get_username(sampass
), gid
, *unix_groups
, &n_unix_groups
) == -1) {
677 groups_tmp
= Realloc(*unix_groups
, sizeof(gid_t
) * n_unix_groups
);
679 SAFE_FREE(*unix_groups
);
680 return NT_STATUS_NO_MEMORY
;
682 *unix_groups
= groups_tmp
;
684 if (sys_getgrouplist(pdb_get_username(sampass
), gid
, *unix_groups
, &n_unix_groups
) == -1) {
685 DEBUG(0, ("get_user_groups_from_local_sam: failed to get the unix group list\n"));
686 SAFE_FREE(*unix_groups
);
687 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
691 debug_unix_user_token(DBGC_CLASS
, 5, uid
, gid
, n_unix_groups
, *unix_groups
);
693 if (n_unix_groups
> 0) {
694 *groups
= malloc(sizeof(DOM_SID
) * n_unix_groups
);
696 DEBUG(0, ("get_user_group_from_local_sam: malloc() failed for DOM_SID list!\n"));
697 SAFE_FREE(*unix_groups
);
698 return NT_STATUS_NO_MEMORY
;
702 *n_groups
= n_unix_groups
;
704 for (i
= 0; i
< *n_groups
; i
++) {
705 if (NT_STATUS_IS_ERR(gid_to_sid(&(*groups
)[i
], (*unix_groups
)[i
]))) {
706 DEBUG(1, ("get_user_groups_from_local_sam: failed to convert gid %ld to a sid!\n", (long int)(*unix_groups
)[i
+1]));
708 SAFE_FREE(*unix_groups
);
709 return NT_STATUS_NO_SUCH_USER
;
716 /***************************************************************************
717 Make a user_info struct
718 ***************************************************************************/
720 static NTSTATUS
make_server_info(auth_serversupplied_info
**server_info
, SAM_ACCOUNT
*sampass
)
724 *server_info
= malloc(sizeof(**server_info
));
726 DEBUG(0,("make_server_info: malloc failed!\n"));
727 return NT_STATUS_NO_MEMORY
;
729 ZERO_STRUCTP(*server_info
);
731 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
732 (*server_info
)->sam_account
= sampass
;
733 if (NT_STATUS_IS_ERR(ret
= sid_to_uid(pdb_get_user_sid(sampass
), &((*server_info
)->uid
))))
735 if (NT_STATUS_IS_ERR(ret
= sid_to_gid(pdb_get_group_sid(sampass
), &((*server_info
)->gid
))))
741 /***************************************************************************
742 Make (and fill) a user_info struct from a SAM_ACCOUNT
743 ***************************************************************************/
745 NTSTATUS
make_server_info_sam(auth_serversupplied_info
**server_info
,
746 SAM_ACCOUNT
*sampass
)
748 NTSTATUS nt_status
= NT_STATUS_OK
;
749 const DOM_SID
*user_sid
= pdb_get_user_sid(sampass
);
750 const DOM_SID
*group_sid
= pdb_get_group_sid(sampass
);
752 DOM_SID
*groupSIDs
= NULL
;
753 gid_t
*unix_groups
= NULL
;
754 NT_USER_TOKEN
*token
;
758 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
, sampass
))) {
762 if (!NT_STATUS_IS_OK(nt_status
763 = get_user_groups_from_local_sam(sampass
,
764 &n_groupSIDs
, &groupSIDs
, &unix_groups
)))
766 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
767 free_server_info(server_info
);
771 is_guest
= (sid_peek_rid(user_sid
, &rid
) && rid
== DOMAIN_USER_RID_GUEST
);
773 if (!NT_STATUS_IS_OK(nt_status
= create_nt_user_token(user_sid
, group_sid
,
774 n_groupSIDs
, groupSIDs
, is_guest
,
777 DEBUG(4,("create_nt_user_token failed\n"));
778 SAFE_FREE(groupSIDs
);
779 SAFE_FREE(unix_groups
);
780 free_server_info(server_info
);
784 SAFE_FREE(groupSIDs
);
786 (*server_info
)->n_groups
= n_groupSIDs
;
787 (*server_info
)->groups
= unix_groups
;
789 (*server_info
)->ptok
= token
;
791 DEBUG(5,("make_server_info_sam: made server info for user %s\n",
792 pdb_get_username((*server_info
)->sam_account
)));
797 /***************************************************************************
798 Make (and fill) a user_info struct from a 'struct passwd' by conversion
800 ***************************************************************************/
802 NTSTATUS
make_server_info_pw(auth_serversupplied_info
**server_info
, const struct passwd
*pwd
)
805 SAM_ACCOUNT
*sampass
= NULL
;
806 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam_pw(&sampass
, pwd
))) {
809 return make_server_info_sam(server_info
, sampass
);
812 /***************************************************************************
813 Make (and fill) a user_info struct for a guest login.
814 ***************************************************************************/
816 NTSTATUS
make_server_info_guest(auth_serversupplied_info
**server_info
)
819 SAM_ACCOUNT
*sampass
= NULL
;
822 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(&sampass
))) {
826 sid_copy(&guest_sid
, get_global_sam_sid());
827 sid_append_rid(&guest_sid
, DOMAIN_USER_RID_GUEST
);
830 if (!pdb_getsampwsid(sampass
, &guest_sid
)) {
832 return NT_STATUS_NO_SUCH_USER
;
836 nt_status
= make_server_info_sam(server_info
, sampass
);
838 if (NT_STATUS_IS_OK(nt_status
)) {
839 (*server_info
)->guest
= True
;
845 /***************************************************************************
846 Purely internal function for make_server_info_info3
847 Fill the sam account from getpwnam
848 ***************************************************************************/
849 static NTSTATUS
fill_sam_account(const char *domain
,
850 const char *username
,
851 SAM_ACCOUNT
**sam_account
)
854 struct passwd
*passwd
;
856 fstr_sprintf(dom_user
, "%s%s%s",
857 domain
, lp_winbind_separator(), username
);
859 passwd
= Get_Pwnam(dom_user
);
861 if ( (passwd
== NULL
) && is_myworkgroup(domain
) ) {
862 /* For our own domain also try unqualified */
863 passwd
= Get_Pwnam(username
);
867 return NT_STATUS_NO_SUCH_USER
;
869 return pdb_init_sam_pw(sam_account
, passwd
);
872 /***************************************************************************
873 Make a server_info struct from the info3 returned by a domain logon
874 ***************************************************************************/
876 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
877 const char *internal_username
,
878 const char *sent_nt_username
,
880 auth_serversupplied_info
**server_info
,
881 NET_USER_INFO_3
*info3
)
883 NTSTATUS nt_status
= NT_STATUS_OK
;
885 const char *nt_domain
;
886 const char *nt_username
;
888 SAM_ACCOUNT
*sam_account
= NULL
;
892 struct passwd
*passwd
;
898 DOM_SID
*lgroupSIDs
= NULL
;
900 gid_t
*unix_groups
= NULL
;
901 NT_USER_TOKEN
*token
;
903 DOM_SID
*all_group_SIDs
;
907 Here is where we should check the list of
908 trusted domains, and verify that the SID
912 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
913 if (!sid_append_rid(&user_sid
, info3
->user_rid
)) {
914 return NT_STATUS_INVALID_PARAMETER
;
917 sid_copy(&group_sid
, &info3
->dom_sid
.sid
);
918 if (!sid_append_rid(&group_sid
, info3
->group_rid
)) {
919 return NT_STATUS_INVALID_PARAMETER
;
922 if (!(nt_username
= unistr2_tdup(mem_ctx
, &(info3
->uni_user_name
)))) {
923 /* If the server didn't give us one, just use the one we sent them */
924 nt_username
= sent_nt_username
;
927 if (!(nt_domain
= unistr2_tdup(mem_ctx
, &(info3
->uni_logon_dom
)))) {
928 /* If the server didn't give us one, just use the one we sent them */
934 if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&u_id
, &u_type
, &user_sid
))
935 && NT_STATUS_IS_OK(idmap_get_id_from_sid(&g_id
, &g_type
, &group_sid
))
936 && ((passwd
= getpwuid_alloc(u_id
.uid
)))) {
937 nt_status
= pdb_init_sam_pw(&sam_account
, passwd
);
938 passwd_free(&passwd
);
941 nt_status
= fill_sam_account(nt_domain
,
945 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
)) {
946 DEBUG(3,("User %s does not exist, trying to add it\n",
948 auth_add_user_script(nt_domain
, internal_username
);
949 nt_status
= fill_sam_account(nt_domain
,
955 if (!NT_STATUS_IS_OK(nt_status
)) {
956 DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
960 if (!pdb_set_user_sid(sam_account
, &user_sid
, PDB_CHANGED
)) {
961 pdb_free_sam(&sam_account
);
962 return NT_STATUS_UNSUCCESSFUL
;
965 if (!pdb_set_group_sid(sam_account
, &group_sid
, PDB_CHANGED
)) {
966 pdb_free_sam(&sam_account
);
967 return NT_STATUS_UNSUCCESSFUL
;
970 if (!pdb_set_nt_username(sam_account
, nt_username
, PDB_CHANGED
)) {
971 pdb_free_sam(&sam_account
);
972 return NT_STATUS_NO_MEMORY
;
975 if (!pdb_set_domain(sam_account
, nt_domain
, PDB_CHANGED
)) {
976 pdb_free_sam(&sam_account
);
977 return NT_STATUS_NO_MEMORY
;
980 if (!pdb_set_fullname(sam_account
, unistr2_static(&(info3
->uni_full_name
)), PDB_CHANGED
)) {
981 pdb_free_sam(&sam_account
);
982 return NT_STATUS_NO_MEMORY
;
985 if (!pdb_set_logon_script(sam_account
, unistr2_static(&(info3
->uni_logon_script
)), PDB_CHANGED
)) {
986 pdb_free_sam(&sam_account
);
987 return NT_STATUS_NO_MEMORY
;
990 if (!pdb_set_profile_path(sam_account
, unistr2_static(&(info3
->uni_profile_path
)), PDB_CHANGED
)) {
991 pdb_free_sam(&sam_account
);
992 return NT_STATUS_NO_MEMORY
;
995 if (!pdb_set_homedir(sam_account
, unistr2_static(&(info3
->uni_home_dir
)), PDB_CHANGED
)) {
996 pdb_free_sam(&sam_account
);
997 return NT_STATUS_NO_MEMORY
;
1000 if (!pdb_set_dir_drive(sam_account
, unistr2_static(&(info3
->uni_dir_drive
)), PDB_CHANGED
)) {
1001 pdb_free_sam(&sam_account
);
1002 return NT_STATUS_NO_MEMORY
;
1005 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
, sam_account
))) {
1006 DEBUG(4, ("make_server_info failed!\n"));
1007 pdb_free_sam(&sam_account
);
1011 /* Store the user group information in the server_info
1012 returned to the caller. */
1014 if (!NT_STATUS_IS_OK(nt_status
1015 = get_user_groups_from_local_sam(sam_account
,
1020 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
1024 (*server_info
)->groups
= unix_groups
;
1025 (*server_info
)->n_groups
= n_lgroupSIDs
;
1027 /* Create a 'combined' list of all SIDs we might want in the SD */
1028 all_group_SIDs
= malloc(sizeof(DOM_SID
) *
1029 (n_lgroupSIDs
+ info3
->num_groups2
+
1030 info3
->num_other_sids
));
1031 if (!all_group_SIDs
) {
1032 DEBUG(0, ("malloc() failed for DOM_SID list!\n"));
1033 SAFE_FREE(lgroupSIDs
);
1034 return NT_STATUS_NO_MEMORY
;
1037 /* Copy the 'local' sids */
1038 memcpy(all_group_SIDs
, lgroupSIDs
, sizeof(DOM_SID
) * n_lgroupSIDs
);
1039 SAFE_FREE(lgroupSIDs
);
1041 /* and create (by appending rids) the 'domain' sids */
1042 for (i
= 0; i
< info3
->num_groups2
; i
++) {
1043 sid_copy(&all_group_SIDs
[i
+n_lgroupSIDs
], &(info3
->dom_sid
.sid
));
1044 if (!sid_append_rid(&all_group_SIDs
[i
+n_lgroupSIDs
], info3
->gids
[i
].g_rid
)) {
1045 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1046 DEBUG(3,("could not append additional group rid 0x%x\n",
1047 info3
->gids
[i
].g_rid
));
1048 SAFE_FREE(lgroupSIDs
);
1053 /* Copy 'other' sids. We need to do sid filtering here to
1054 prevent possible elevation of privileges. See:
1056 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
1059 for (i
= 0; i
< info3
->num_other_sids
; i
++)
1060 sid_copy(&all_group_SIDs
[
1061 n_lgroupSIDs
+ info3
->num_groups2
+ i
],
1062 &info3
->other_sids
[i
].sid
);
1064 /* Where are the 'global' sids... */
1066 /* can the user be guest? if yes, where is it stored? */
1067 if (!NT_STATUS_IS_OK(
1068 nt_status
= create_nt_user_token(
1069 &user_sid
, &group_sid
,
1070 n_lgroupSIDs
+ info3
->num_groups2
+ info3
->num_other_sids
,
1071 all_group_SIDs
, False
, &token
))) {
1072 DEBUG(4,("create_nt_user_token failed\n"));
1073 SAFE_FREE(all_group_SIDs
);
1077 (*server_info
)->ptok
= token
;
1079 SAFE_FREE(all_group_SIDs
);
1081 memcpy((*server_info
)->session_key
, info3
->user_sess_key
, sizeof((*server_info
)->session_key
)/* 16 */);
1082 memcpy((*server_info
)->first_8_lm_hash
, info3
->padding
, 8);
1084 return NT_STATUS_OK
;
1087 /***************************************************************************
1088 Free a user_info struct
1089 ***************************************************************************/
1091 void free_user_info(auth_usersupplied_info
**user_info
)
1093 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
1094 if (*user_info
!= NULL
) {
1095 if ((*user_info
)->smb_name
.str
) {
1096 DEBUG(10,("structure was created for %s\n", (*user_info
)->smb_name
.str
));
1098 SAFE_FREE((*user_info
)->smb_name
.str
);
1099 SAFE_FREE((*user_info
)->internal_username
.str
);
1100 SAFE_FREE((*user_info
)->client_domain
.str
);
1101 SAFE_FREE((*user_info
)->domain
.str
);
1102 SAFE_FREE((*user_info
)->wksta_name
.str
);
1103 data_blob_free(&(*user_info
)->lm_resp
);
1104 data_blob_free(&(*user_info
)->nt_resp
);
1105 SAFE_FREE((*user_info
)->interactive_password
);
1106 data_blob_clear_free(&(*user_info
)->plaintext_password
);
1107 ZERO_STRUCT(**user_info
);
1109 SAFE_FREE(*user_info
);
1112 /***************************************************************************
1113 Clear out a server_info struct that has been allocated
1114 ***************************************************************************/
1116 void free_server_info(auth_serversupplied_info
**server_info
)
1118 DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
1119 if (*server_info
!= NULL
) {
1120 pdb_free_sam(&(*server_info
)->sam_account
);
1122 /* call pam_end here, unless we know we are keeping it */
1123 delete_nt_token( &(*server_info
)->ptok
);
1124 SAFE_FREE((*server_info
)->groups
);
1125 ZERO_STRUCT(**server_info
);
1127 SAFE_FREE(*server_info
);
1130 /***************************************************************************
1131 Make an auth_methods struct
1132 ***************************************************************************/
1134 BOOL
make_auth_methods(struct auth_context
*auth_context
, auth_methods
**auth_method
)
1136 if (!auth_context
) {
1137 smb_panic("no auth_context supplied to make_auth_methods()!\n");
1141 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
1144 *auth_method
= talloc(auth_context
->mem_ctx
, sizeof(**auth_method
));
1145 if (!*auth_method
) {
1146 DEBUG(0,("make_auth_method: malloc failed!\n"));
1149 ZERO_STRUCTP(*auth_method
);
1154 /****************************************************************************
1156 ****************************************************************************/
1158 void delete_nt_token(NT_USER_TOKEN
**pptoken
)
1161 NT_USER_TOKEN
*ptoken
= *pptoken
;
1162 SAFE_FREE( ptoken
->user_sids
);
1163 ZERO_STRUCTP(ptoken
);
1165 SAFE_FREE(*pptoken
);
1168 /****************************************************************************
1169 Duplicate a SID token.
1170 ****************************************************************************/
1172 NT_USER_TOKEN
*dup_nt_token(NT_USER_TOKEN
*ptoken
)
1174 NT_USER_TOKEN
*token
;
1179 if ((token
= (NT_USER_TOKEN
*)malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
)
1182 ZERO_STRUCTP(token
);
1184 if ((token
->user_sids
= (DOM_SID
*)memdup( ptoken
->user_sids
, sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
1189 token
->num_sids
= ptoken
->num_sids
;
1195 * Squash an NT_STATUS in line with security requirements.
1196 * In an attempt to avoid giving the whole game away when users
1197 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
1198 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
1199 * (session setups in particular).
1201 * @param nt_status NTSTATUS input for squashing.
1202 * @return the 'squashed' nt_status
1205 NTSTATUS
nt_status_squash(NTSTATUS nt_status
)
1207 if NT_STATUS_IS_OK(nt_status
) {
1209 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
) {
1210 /* Match WinXP and don't give the game away */
1211 return NT_STATUS_LOGON_FAILURE
;
1213 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_WRONG_PASSWORD
) {
1214 /* Match WinXP and don't give the game away */
1215 return NT_STATUS_LOGON_FAILURE
;