?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Revert "s3:configure: add --enable-as-needed"
[Samba/gebeck_regimport.git] / nsswitch / libwbclient / wbc_pam.c
blob03039a26ac2069693cc31880674b954f8e47b207
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind client API
5
6 Copyright (C) Gerald (Jerry) Carter 2007
7 Copyright (C) Guenther Deschner 2008
8 Copyright (C) Volker Lendecke 2009
9
10 This library is free software; you can redistribute it and/or
11 modify it under the terms of the GNU Lesser General Public
12 License as published by the Free Software Foundation; either
13 version 3 of the License, or (at your option) any later version.
14
15 This library is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Library General Public License for more details.
19
20 You should have received a copy of the GNU Lesser General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /* Required Headers */
25
26 #include "replace.h"
27 #include "libwbclient.h"
28 #include "../winbind_client.h"
29
30 /* Authenticate a username/password pair */
31 wbcErr wbcAuthenticateUser(const char *username,
32 const char *password)
33 {
34 wbcErr wbc_status = WBC_ERR_SUCCESS;
35 struct wbcAuthUserParams params;
36
37 ZERO_STRUCT(params);
38
39 params.account_name = username;
40 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
41 params.password.plaintext = password;
42
43 wbc_status = wbcAuthenticateUserEx(&params, NULL, NULL);
44 BAIL_ON_WBC_ERROR(wbc_status);
45
46 done:
47 return wbc_status;
48 }
49
50 static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
51 const struct winbindd_response *resp,
52 struct wbcAuthUserInfo **_i)
53 {
54 wbcErr wbc_status = WBC_ERR_SUCCESS;
55 struct wbcAuthUserInfo *i;
56 struct wbcDomainSid domain_sid;
57 char *p;
58 uint32_t sn = 0;
59 uint32_t j;
60
61 i = talloc(mem_ctx, struct wbcAuthUserInfo);
62 BAIL_ON_PTR_ERROR(i, wbc_status);
63
64 i->user_flags = resp->data.auth.info3.user_flgs;
65
66 i->account_name = talloc_strdup(i, resp->data.auth.info3.user_name);
67 BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
68 i->user_principal= NULL;
69 i->full_name = talloc_strdup(i, resp->data.auth.info3.full_name);
70 BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
71 i->domain_name = talloc_strdup(i, resp->data.auth.info3.logon_dom);
72 BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
73 i->dns_domain_name= NULL;
74
75 i->acct_flags = resp->data.auth.info3.acct_flags;
76 memcpy(i->user_session_key,
77 resp->data.auth.user_session_key,
78 sizeof(i->user_session_key));
79 memcpy(i->lm_session_key,
80 resp->data.auth.first_8_lm_hash,
81 sizeof(i->lm_session_key));
82
83 i->logon_count = resp->data.auth.info3.logon_count;
84 i->bad_password_count = resp->data.auth.info3.bad_pw_count;
85
86 i->logon_time = resp->data.auth.info3.logon_time;
87 i->logoff_time = resp->data.auth.info3.logoff_time;
88 i->kickoff_time = resp->data.auth.info3.kickoff_time;
89 i->pass_last_set_time = resp->data.auth.info3.pass_last_set_time;
90 i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
91 i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
92
93 i->logon_server = talloc_strdup(i, resp->data.auth.info3.logon_srv);
94 BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
95 i->logon_script = talloc_strdup(i, resp->data.auth.info3.logon_script);
96 BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
97 i->profile_path = talloc_strdup(i, resp->data.auth.info3.profile_path);
98 BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
99 i->home_directory= talloc_strdup(i, resp->data.auth.info3.home_dir);
100 BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
101 i->home_drive = talloc_strdup(i, resp->data.auth.info3.dir_drive);
102 BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
103
104 i->num_sids = 2;
105 i->num_sids += resp->data.auth.info3.num_groups;
106 i->num_sids += resp->data.auth.info3.num_other_sids;
107
108 i->sids = talloc_array(i, struct wbcSidWithAttr, i->num_sids);
109 BAIL_ON_PTR_ERROR(i->sids, wbc_status);
110
111 wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
112 &domain_sid);
113 BAIL_ON_WBC_ERROR(wbc_status);
114
115 #define _SID_COMPOSE(s, d, r, a) { \
116 (s).sid = d; \
117 if ((s).sid.num_auths < WBC_MAXSUBAUTHS) { \
118 (s).sid.sub_auths[(s).sid.num_auths++] = r; \
119 } else { \
120 wbc_status = WBC_ERR_INVALID_SID; \
121 BAIL_ON_WBC_ERROR(wbc_status); \
122 } \
123 (s).attributes = a; \
124 } while (0)
125
126 sn = 0;
127 _SID_COMPOSE(i->sids[sn], domain_sid,
128 resp->data.auth.info3.user_rid,
129 0);
130 sn++;
131 _SID_COMPOSE(i->sids[sn], domain_sid,
132 resp->data.auth.info3.group_rid,
133 0);
134 sn++;
135
136 p = (char *)resp->extra_data.data;
137 if (!p) {
138 wbc_status = WBC_ERR_INVALID_RESPONSE;
139 BAIL_ON_WBC_ERROR(wbc_status);
140 }
141
142 for (j=0; j < resp->data.auth.info3.num_groups; j++) {
143 uint32_t rid;
144 uint32_t attrs;
145 int ret;
146 char *s = p;
147 char *e = strchr(p, '\n');
148 if (!e) {
149 wbc_status = WBC_ERR_INVALID_RESPONSE;
150 BAIL_ON_WBC_ERROR(wbc_status);
151 }
152 e[0] = '\0';
153 p = &e[1];
154
155 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
156 if (ret != 2) {
157 wbc_status = WBC_ERR_INVALID_RESPONSE;
158 BAIL_ON_WBC_ERROR(wbc_status);
159 }
160
161 _SID_COMPOSE(i->sids[sn], domain_sid,
162 rid, attrs);
163 sn++;
164 }
165
166 for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
167 uint32_t attrs;
168 int ret;
169 char *s = p;
170 char *a;
171 char *e = strchr(p, '\n');
172 if (!e) {
173 wbc_status = WBC_ERR_INVALID_RESPONSE;
174 BAIL_ON_WBC_ERROR(wbc_status);
175 }
176 e[0] = '\0';
177 p = &e[1];
178
179 e = strchr(s, ':');
180 if (!e) {
181 wbc_status = WBC_ERR_INVALID_RESPONSE;
182 BAIL_ON_WBC_ERROR(wbc_status);
183 }
184 e[0] = '\0';
185 a = &e[1];
186
187 ret = sscanf(a, "0x%08X",
188 &attrs);
189 if (ret != 1) {
190 wbc_status = WBC_ERR_INVALID_RESPONSE;
191 BAIL_ON_WBC_ERROR(wbc_status);
192 }
193
194 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
195 BAIL_ON_WBC_ERROR(wbc_status);
196
197 i->sids[sn].attributes = attrs;
198 sn++;
199 }
200
201 i->num_sids = sn;
202
203 *_i = i;
204 i = NULL;
205 done:
206 talloc_free(i);
207 return wbc_status;
208 }
209
210 static wbcErr wbc_create_error_info(const struct winbindd_response *resp,
211 struct wbcAuthErrorInfo **_e)
212 {
213 wbcErr wbc_status = WBC_ERR_SUCCESS;
214 struct wbcAuthErrorInfo *e;
215
216 e = talloc(NULL, struct wbcAuthErrorInfo);
217 BAIL_ON_PTR_ERROR(e, wbc_status);
218
219 e->nt_status = resp->data.auth.nt_status;
220 e->pam_error = resp->data.auth.pam_error;
221 e->nt_string = talloc_strdup(e, resp->data.auth.nt_status_string);
222 BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
223
224 e->display_string = talloc_strdup(e, resp->data.auth.error_string);
225 BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
226
227 *_e = e;
228 e = NULL;
229
230 done:
231 talloc_free(e);
232 return wbc_status;
233 }
234
235 static wbcErr wbc_create_password_policy_info(const struct winbindd_response *resp,
236 struct wbcUserPasswordPolicyInfo **_i)
237 {
238 wbcErr wbc_status = WBC_ERR_SUCCESS;
239 struct wbcUserPasswordPolicyInfo *i;
240
241 i = talloc(NULL, struct wbcUserPasswordPolicyInfo);
242 BAIL_ON_PTR_ERROR(i, wbc_status);
243
244 i->min_passwordage = resp->data.auth.policy.min_passwordage;
245 i->min_length_password = resp->data.auth.policy.min_length_password;
246 i->password_history = resp->data.auth.policy.password_history;
247 i->password_properties = resp->data.auth.policy.password_properties;
248 i->expire = resp->data.auth.policy.expire;
249
250 *_i = i;
251 i = NULL;
252
253 done:
254 talloc_free(i);
255 return wbc_status;
256 }
257
258 static wbcErr wbc_create_logon_info(struct winbindd_response *resp,
259 struct wbcLogonUserInfo **_i)
260 {
261 wbcErr wbc_status = WBC_ERR_SUCCESS;
262 struct wbcLogonUserInfo *i;
263
264 i = talloc_zero(NULL, struct wbcLogonUserInfo);
265 BAIL_ON_PTR_ERROR(i, wbc_status);
266
267 wbc_status = wbc_create_auth_info(i, resp, &i->info);
268 BAIL_ON_WBC_ERROR(wbc_status);
269
270 if (resp->data.auth.krb5ccname &&
271 strlen(resp->data.auth.krb5ccname)) {
272 wbc_status = wbcAddNamedBlob(&i->num_blobs,
273 &i->blobs,
274 "krb5ccname",
275 0,
276 (uint8_t *)resp->data.auth.krb5ccname,
277 strlen(resp->data.auth.krb5ccname)+1);
278 BAIL_ON_WBC_ERROR(wbc_status);
279 }
280
281 if (resp->data.auth.unix_username &&
282 strlen(resp->data.auth.unix_username)) {
283 wbc_status = wbcAddNamedBlob(&i->num_blobs,
284 &i->blobs,
285 "unix_username",
286 0,
287 (uint8_t *)resp->data.auth.unix_username,
288 strlen(resp->data.auth.unix_username)+1);
289 BAIL_ON_WBC_ERROR(wbc_status);
290 }
291
292 *_i = i;
293 i = NULL;
294 done:
295 if (!WBC_ERROR_IS_OK(wbc_status) && i) {
296 wbcFreeMemory(i->blobs);
297 }
298
299 talloc_free(i);
300 return wbc_status;
301 }
302
303
304 /* Authenticate with more detailed information */
305 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
306 struct wbcAuthUserInfo **info,
307 struct wbcAuthErrorInfo **error)
308 {
309 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
310 int cmd = 0;
311 struct winbindd_request request;
312 struct winbindd_response response;
313
314 ZERO_STRUCT(request);
315 ZERO_STRUCT(response);
316
317 if (error) {
318 *error = NULL;
319 }
320
321 if (!params) {
322 wbc_status = WBC_ERR_INVALID_PARAM;
323 BAIL_ON_WBC_ERROR(wbc_status);
324 }
325
326 if (!params->account_name) {
327 wbc_status = WBC_ERR_INVALID_PARAM;
328 BAIL_ON_WBC_ERROR(wbc_status);
329 }
330
331 /* Initialize request */
332
333 switch (params->level) {
334 case WBC_AUTH_USER_LEVEL_PLAIN:
335 cmd = WINBINDD_PAM_AUTH;
336 request.flags = WBFLAG_PAM_INFO3_TEXT |
337 WBFLAG_PAM_USER_SESSION_KEY |
338 WBFLAG_PAM_LMKEY;
339
340 if (!params->password.plaintext) {
341 wbc_status = WBC_ERR_INVALID_PARAM;
342 BAIL_ON_WBC_ERROR(wbc_status);
343 }
344
345 if (params->domain_name && params->domain_name[0]) {
346 /* We need to get the winbind separator :-( */
347 struct winbindd_response sep_response;
348
349 ZERO_STRUCT(sep_response);
350
351 wbc_status = wbcRequestResponse(WINBINDD_INFO,
352 NULL, &sep_response);
353 BAIL_ON_WBC_ERROR(wbc_status);
354
355 snprintf(request.data.auth.user,
356 sizeof(request.data.auth.user)-1,
357 "%s%c%s",
358 params->domain_name,
359 sep_response.data.info.winbind_separator,
360 params->account_name);
361 } else {
362 strncpy(request.data.auth.user,
363 params->account_name,
364 sizeof(request.data.auth.user)-1);
365 }
366
367 strncpy(request.data.auth.pass,
368 params->password.plaintext,
369 sizeof(request.data.auth.pass)-1);
370 break;
371
372 case WBC_AUTH_USER_LEVEL_HASH:
373 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
374 BAIL_ON_WBC_ERROR(wbc_status);
375 break;
376
377 case WBC_AUTH_USER_LEVEL_RESPONSE:
378 cmd = WINBINDD_PAM_AUTH_CRAP;
379 request.flags = WBFLAG_PAM_INFO3_TEXT |
380 WBFLAG_PAM_USER_SESSION_KEY |
381 WBFLAG_PAM_LMKEY;
382
383 if (params->password.response.lm_length &&
384 !params->password.response.lm_data) {
385 wbc_status = WBC_ERR_INVALID_PARAM;
386 BAIL_ON_WBC_ERROR(wbc_status);
387 }
388 if (params->password.response.lm_length == 0 &&
389 params->password.response.lm_data) {
390 wbc_status = WBC_ERR_INVALID_PARAM;
391 BAIL_ON_WBC_ERROR(wbc_status);
392 }
393
394 if (params->password.response.nt_length &&
395 !params->password.response.nt_data) {
396 wbc_status = WBC_ERR_INVALID_PARAM;
397 BAIL_ON_WBC_ERROR(wbc_status);
398 }
399 if (params->password.response.nt_length == 0&&
400 params->password.response.nt_data) {
401 wbc_status = WBC_ERR_INVALID_PARAM;
402 BAIL_ON_WBC_ERROR(wbc_status);
403 }
404
405 strncpy(request.data.auth_crap.user,
406 params->account_name,
407 sizeof(request.data.auth_crap.user)-1);
408 if (params->domain_name) {
409 strncpy(request.data.auth_crap.domain,
410 params->domain_name,
411 sizeof(request.data.auth_crap.domain)-1);
412 }
413 if (params->workstation_name) {
414 strncpy(request.data.auth_crap.workstation,
415 params->workstation_name,
416 sizeof(request.data.auth_crap.workstation)-1);
417 }
418
419 request.data.auth_crap.logon_parameters =
420 params->parameter_control;
421
422 memcpy(request.data.auth_crap.chal,
423 params->password.response.challenge,
424 sizeof(request.data.auth_crap.chal));
425
426 request.data.auth_crap.lm_resp_len =
427 MIN(params->password.response.lm_length,
428 sizeof(request.data.auth_crap.lm_resp));
429 if (params->password.response.lm_data) {
430 memcpy(request.data.auth_crap.lm_resp,
431 params->password.response.lm_data,
432 request.data.auth_crap.lm_resp_len);
433 }
434 request.data.auth_crap.nt_resp_len = params->password.response.nt_length;
435 if (params->password.response.nt_length > sizeof(request.data.auth_crap.nt_resp)) {
436 request.flags |= WBFLAG_BIG_NTLMV2_BLOB;
437 request.extra_len = params->password.response.nt_length;
438 request.extra_data.data = talloc_zero_array(NULL, char, request.extra_len);
439 if (request.extra_data.data == NULL) {
440 wbc_status = WBC_ERR_NO_MEMORY;
441 BAIL_ON_WBC_ERROR(wbc_status);
442 }
443 memcpy(request.extra_data.data,
444 params->password.response.nt_data,
445 request.data.auth_crap.nt_resp_len);
446 } else if (params->password.response.nt_data) {
447 memcpy(request.data.auth_crap.nt_resp,
448 params->password.response.nt_data,
449 request.data.auth_crap.nt_resp_len);
450 }
451 break;
452 default:
453 break;
454 }
455
456 if (cmd == 0) {
457 wbc_status = WBC_ERR_INVALID_PARAM;
458 BAIL_ON_WBC_ERROR(wbc_status);
459 }
460
461 if (params->flags) {
462 request.flags |= params->flags;
463 }
464
465 wbc_status = wbcRequestResponse(cmd,
466 &request,
467 &response);
468 if (response.data.auth.nt_status != 0) {
469 if (error) {
470 wbc_status = wbc_create_error_info(&response,
471 error);
472 BAIL_ON_WBC_ERROR(wbc_status);
473 }
474
475 wbc_status = WBC_ERR_AUTH_ERROR;
476 BAIL_ON_WBC_ERROR(wbc_status);
477 }
478 BAIL_ON_WBC_ERROR(wbc_status);
479
480 if (info) {
481 wbc_status = wbc_create_auth_info(NULL,
482 &response,
483 info);
484 BAIL_ON_WBC_ERROR(wbc_status);
485 }
486
487 done:
488 winbindd_free_response(&response);
489
490 talloc_free(request.extra_data.data);
491
492 return wbc_status;
493 }
494
495 /* Trigger a verification of the trust credentials of a specific domain */
496 wbcErr wbcCheckTrustCredentials(const char *domain,
497 struct wbcAuthErrorInfo **error)
498 {
499 struct winbindd_request request;
500 struct winbindd_response response;
501 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
502
503 ZERO_STRUCT(request);
504 ZERO_STRUCT(response);
505
506 if (domain) {
507 strncpy(request.domain_name, domain,
508 sizeof(request.domain_name)-1);
509 }
510
511 /* Send request */
512
513 wbc_status = wbcRequestResponse(WINBINDD_CHECK_MACHACC,
514 &request,
515 &response);
516 if (response.data.auth.nt_status != 0) {
517 if (error) {
518 wbc_status = wbc_create_error_info(&response,
519 error);
520 BAIL_ON_WBC_ERROR(wbc_status);
521 }
522
523 wbc_status = WBC_ERR_AUTH_ERROR;
524 BAIL_ON_WBC_ERROR(wbc_status);
525 }
526 BAIL_ON_WBC_ERROR(wbc_status);
527
528 done:
529 return wbc_status;
530 }
531
532 /* Trigger a change of the trust credentials for a specific domain */
533 wbcErr wbcChangeTrustCredentials(const char *domain,
534 struct wbcAuthErrorInfo **error)
535 {
536 struct winbindd_request request;
537 struct winbindd_response response;
538 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
539
540 ZERO_STRUCT(request);
541 ZERO_STRUCT(response);
542
543 if (domain) {
544 strncpy(request.domain_name, domain,
545 sizeof(request.domain_name)-1);
546 }
547
548 /* Send request */
549
550 wbc_status = wbcRequestResponse(WINBINDD_CHANGE_MACHACC,
551 &request,
552 &response);
553 if (response.data.auth.nt_status != 0) {
554 if (error) {
555 wbc_status = wbc_create_error_info(&response,
556 error);
557 BAIL_ON_WBC_ERROR(wbc_status);
558 }
559
560 wbc_status = WBC_ERR_AUTH_ERROR;
561 BAIL_ON_WBC_ERROR(wbc_status);
562 }
563 BAIL_ON_WBC_ERROR(wbc_status);
564
565 done:
566 return wbc_status;
567 }
568
569 /*
570 * Trigger a no-op NETLOGON call. Lightweight version of
571 * wbcCheckTrustCredentials
572 */
573 wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
574 {
575 struct winbindd_request request;
576 struct winbindd_response response;
577 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
578
579 if (domain) {
580 /*
581 * the current protocol doesn't support
582 * specifying a domain
583 */
584 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
585 BAIL_ON_WBC_ERROR(wbc_status);
586 }
587
588 ZERO_STRUCT(request);
589 ZERO_STRUCT(response);
590
591 /* Send request */
592
593 wbc_status = wbcRequestResponse(WINBINDD_PING_DC,
594 &request,
595 &response);
596 if (response.data.auth.nt_status != 0) {
597 if (error) {
598 wbc_status = wbc_create_error_info(&response,
599 error);
600 BAIL_ON_WBC_ERROR(wbc_status);
601 }
602
603 wbc_status = WBC_ERR_AUTH_ERROR;
604 BAIL_ON_WBC_ERROR(wbc_status);
605 }
606 BAIL_ON_WBC_ERROR(wbc_status);
607
608 done:
609 return wbc_status;
610 }
611
612 /* Trigger an extended logoff notification to Winbind for a specific user */
613 wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
614 struct wbcAuthErrorInfo **error)
615 {
616 struct winbindd_request request;
617 struct winbindd_response response;
618 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
619 int i;
620
621 /* validate input */
622
623 if (!params || !params->username) {
624 wbc_status = WBC_ERR_INVALID_PARAM;
625 BAIL_ON_WBC_ERROR(wbc_status);
626 }
627
628 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
629 wbc_status = WBC_ERR_INVALID_PARAM;
630 BAIL_ON_WBC_ERROR(wbc_status);
631 }
632 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
633 wbc_status = WBC_ERR_INVALID_PARAM;
634 BAIL_ON_WBC_ERROR(wbc_status);
635 }
636
637 ZERO_STRUCT(request);
638 ZERO_STRUCT(response);
639
640 strncpy(request.data.logoff.user, params->username,
641 sizeof(request.data.logoff.user)-1);
642
643 for (i=0; i<params->num_blobs; i++) {
644
645 if (strcasecmp(params->blobs[i].name, "ccfilename") == 0) {
646 if (params->blobs[i].blob.data) {
647 strncpy(request.data.logoff.krb5ccname,
648 (const char *)params->blobs[i].blob.data,
649 sizeof(request.data.logoff.krb5ccname) - 1);
650 }
651 continue;
652 }
653
654 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
655 if (params->blobs[i].blob.data) {
656 memcpy(&request.data.logoff.uid,
657 params->blobs[i].blob.data,
658 MIN(params->blobs[i].blob.length,
659 sizeof(request.data.logoff.uid)));
660 }
661 continue;
662 }
663
664 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
665 if (params->blobs[i].blob.data) {
666 memcpy(&request.flags,
667 params->blobs[i].blob.data,
668 MIN(params->blobs[i].blob.length,
669 sizeof(request.flags)));
670 }
671 continue;
672 }
673 }
674
675 /* Send request */
676
677 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
678 &request,
679 &response);
680
681 /* Take the response above and return it to the caller */
682 if (response.data.auth.nt_status != 0) {
683 if (error) {
684 wbc_status = wbc_create_error_info(&response,
685 error);
686 BAIL_ON_WBC_ERROR(wbc_status);
687 }
688
689 wbc_status = WBC_ERR_AUTH_ERROR;
690 BAIL_ON_WBC_ERROR(wbc_status);
691 }
692 BAIL_ON_WBC_ERROR(wbc_status);
693
694 done:
695 return wbc_status;
696 }
697
698 /* Trigger a logoff notification to Winbind for a specific user */
699 wbcErr wbcLogoffUser(const char *username,
700 uid_t uid,
701 const char *ccfilename)
702 {
703 struct winbindd_request request;
704 struct winbindd_response response;
705 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
706
707 /* validate input */
708
709 if (!username) {
710 wbc_status = WBC_ERR_INVALID_PARAM;
711 BAIL_ON_WBC_ERROR(wbc_status);
712 }
713
714 ZERO_STRUCT(request);
715 ZERO_STRUCT(response);
716
717 strncpy(request.data.logoff.user, username,
718 sizeof(request.data.logoff.user)-1);
719 request.data.logoff.uid = uid;
720
721 if (ccfilename) {
722 strncpy(request.data.logoff.krb5ccname, ccfilename,
723 sizeof(request.data.logoff.krb5ccname)-1);
724 }
725
726 /* Send request */
727
728 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
729 &request,
730 &response);
731
732 /* Take the response above and return it to the caller */
733
734 done:
735 return wbc_status;
736 }
737
738 /* Change a password for a user with more detailed information upon failure */
739 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
740 struct wbcAuthErrorInfo **error,
741 enum wbcPasswordChangeRejectReason *reject_reason,
742 struct wbcUserPasswordPolicyInfo **policy)
743 {
744 struct winbindd_request request;
745 struct winbindd_response response;
746 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
747 int cmd = 0;
748
749 /* validate input */
750
751 if (!params->account_name) {
752 wbc_status = WBC_ERR_INVALID_PARAM;
753 BAIL_ON_WBC_ERROR(wbc_status);
754 }
755
756 if (error) {
757 *error = NULL;
758 }
759
760 if (policy) {
761 *policy = NULL;
762 }
763
764 if (reject_reason) {
765 *reject_reason = -1;
766 }
767
768 ZERO_STRUCT(request);
769 ZERO_STRUCT(response);
770
771 switch (params->level) {
772 case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
773 cmd = WINBINDD_PAM_CHAUTHTOK;
774
775 if (!params->account_name) {
776 wbc_status = WBC_ERR_INVALID_PARAM;
777 BAIL_ON_WBC_ERROR(wbc_status);
778 }
779
780 strncpy(request.data.chauthtok.user, params->account_name,
781 sizeof(request.data.chauthtok.user) - 1);
782
783 if (params->old_password.plaintext) {
784 strncpy(request.data.chauthtok.oldpass,
785 params->old_password.plaintext,
786 sizeof(request.data.chauthtok.oldpass) - 1);
787 }
788
789 if (params->new_password.plaintext) {
790 strncpy(request.data.chauthtok.newpass,
791 params->new_password.plaintext,
792 sizeof(request.data.chauthtok.newpass) - 1);
793 }
794 break;
795
796 case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
797 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
798
799 if (!params->account_name || !params->domain_name) {
800 wbc_status = WBC_ERR_INVALID_PARAM;
801 BAIL_ON_WBC_ERROR(wbc_status);
802 }
803
804 if (params->old_password.response.old_lm_hash_enc_length &&
805 !params->old_password.response.old_lm_hash_enc_data) {
806 wbc_status = WBC_ERR_INVALID_PARAM;
807 BAIL_ON_WBC_ERROR(wbc_status);
808 }
809
810 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
811 params->old_password.response.old_lm_hash_enc_data) {
812 wbc_status = WBC_ERR_INVALID_PARAM;
813 BAIL_ON_WBC_ERROR(wbc_status);
814 }
815
816 if (params->old_password.response.old_nt_hash_enc_length &&
817 !params->old_password.response.old_nt_hash_enc_data) {
818 wbc_status = WBC_ERR_INVALID_PARAM;
819 BAIL_ON_WBC_ERROR(wbc_status);
820 }
821
822 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
823 params->old_password.response.old_nt_hash_enc_data) {
824 wbc_status = WBC_ERR_INVALID_PARAM;
825 BAIL_ON_WBC_ERROR(wbc_status);
826 }
827
828 if (params->new_password.response.lm_length &&
829 !params->new_password.response.lm_data) {
830 wbc_status = WBC_ERR_INVALID_PARAM;
831 BAIL_ON_WBC_ERROR(wbc_status);
832 }
833
834 if (params->new_password.response.lm_length == 0 &&
835 params->new_password.response.lm_data) {
836 wbc_status = WBC_ERR_INVALID_PARAM;
837 BAIL_ON_WBC_ERROR(wbc_status);
838 }
839
840 if (params->new_password.response.nt_length &&
841 !params->new_password.response.nt_data) {
842 wbc_status = WBC_ERR_INVALID_PARAM;
843 BAIL_ON_WBC_ERROR(wbc_status);
844 }
845
846 if (params->new_password.response.nt_length == 0 &&
847 params->new_password.response.nt_data) {
848 wbc_status = WBC_ERR_INVALID_PARAM;
849 BAIL_ON_WBC_ERROR(wbc_status);
850 }
851
852 strncpy(request.data.chng_pswd_auth_crap.user,
853 params->account_name,
854 sizeof(request.data.chng_pswd_auth_crap.user) - 1);
855
856 strncpy(request.data.chng_pswd_auth_crap.domain,
857 params->domain_name,
858 sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
859
860 if (params->new_password.response.nt_data) {
861 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
862 params->new_password.response.nt_data,
863 request.data.chng_pswd_auth_crap.new_nt_pswd_len);
864 request.data.chng_pswd_auth_crap.new_nt_pswd_len =
865 params->new_password.response.nt_length;
866 }
867
868 if (params->new_password.response.lm_data) {
869 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
870 params->new_password.response.lm_data,
871 request.data.chng_pswd_auth_crap.new_lm_pswd_len);
872 request.data.chng_pswd_auth_crap.new_lm_pswd_len =
873 params->new_password.response.lm_length;
874 }
875
876 if (params->old_password.response.old_nt_hash_enc_data) {
877 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
878 params->old_password.response.old_nt_hash_enc_data,
879 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
880 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
881 params->old_password.response.old_nt_hash_enc_length;
882 }
883
884 if (params->old_password.response.old_lm_hash_enc_data) {
885 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
886 params->old_password.response.old_lm_hash_enc_data,
887 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
888 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
889 params->old_password.response.old_lm_hash_enc_length;
890 }
891
892 break;
893 default:
894 wbc_status = WBC_ERR_INVALID_PARAM;
895 BAIL_ON_WBC_ERROR(wbc_status);
896 break;
897 }
898
899 /* Send request */
900
901 wbc_status = wbcRequestResponse(cmd,
902 &request,
903 &response);
904 if (WBC_ERROR_IS_OK(wbc_status)) {
905 goto done;
906 }
907
908 /* Take the response above and return it to the caller */
909
910 if (response.data.auth.nt_status != 0) {
911 if (error) {
912 wbc_status = wbc_create_error_info(&response,
913 error);
914 BAIL_ON_WBC_ERROR(wbc_status);
915 }
916
917 }
918
919 if (policy) {
920 wbc_status = wbc_create_password_policy_info(&response,
921 policy);
922 BAIL_ON_WBC_ERROR(wbc_status);
923 }
924
925 if (reject_reason) {
926 *reject_reason = response.data.auth.reject_reason;
927 }
928
929 wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
930 BAIL_ON_WBC_ERROR(wbc_status);
931
932 done:
933 return wbc_status;
934 }
935
936 /* Change a password for a user */
937 wbcErr wbcChangeUserPassword(const char *username,
938 const char *old_password,
939 const char *new_password)
940 {
941 wbcErr wbc_status = WBC_ERR_SUCCESS;
942 struct wbcChangePasswordParams params;
943
944 ZERO_STRUCT(params);
945
946 params.account_name = username;
947 params.level = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
948 params.old_password.plaintext = old_password;
949 params.new_password.plaintext = new_password;
950
951 wbc_status = wbcChangeUserPasswordEx(&params,
952 NULL,
953 NULL,
954 NULL);
955 BAIL_ON_WBC_ERROR(wbc_status);
956
957 done:
958 return wbc_status;
959 }
960
961 /* Logon a User */
962 wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
963 struct wbcLogonUserInfo **info,
964 struct wbcAuthErrorInfo **error,
965 struct wbcUserPasswordPolicyInfo **policy)
966 {
967 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
968 int cmd = 0;
969 struct winbindd_request request;
970 struct winbindd_response response;
971 uint32_t i;
972
973 ZERO_STRUCT(request);
974 ZERO_STRUCT(response);
975
976 if (info) {
977 *info = NULL;
978 }
979 if (error) {
980 *error = NULL;
981 }
982 if (policy) {
983 *policy = NULL;
984 }
985
986 if (!params) {
987 wbc_status = WBC_ERR_INVALID_PARAM;
988 BAIL_ON_WBC_ERROR(wbc_status);
989 }
990
991 if (!params->username) {
992 wbc_status = WBC_ERR_INVALID_PARAM;
993 BAIL_ON_WBC_ERROR(wbc_status);
994 }
995
996 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
997 wbc_status = WBC_ERR_INVALID_PARAM;
998 BAIL_ON_WBC_ERROR(wbc_status);
999 }
1000 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
1001 wbc_status = WBC_ERR_INVALID_PARAM;
1002 BAIL_ON_WBC_ERROR(wbc_status);
1003 }
1004
1005 /* Initialize request */
1006
1007 cmd = WINBINDD_PAM_AUTH;
1008 request.flags = WBFLAG_PAM_INFO3_TEXT |
1009 WBFLAG_PAM_USER_SESSION_KEY |
1010 WBFLAG_PAM_LMKEY;
1011
1012 if (!params->password) {
1013 wbc_status = WBC_ERR_INVALID_PARAM;
1014 BAIL_ON_WBC_ERROR(wbc_status);
1015 }
1016
1017 strncpy(request.data.auth.user,
1018 params->username,
1019 sizeof(request.data.auth.user)-1);
1020
1021 strncpy(request.data.auth.pass,
1022 params->password,
1023 sizeof(request.data.auth.pass)-1);
1024
1025 for (i=0; i<params->num_blobs; i++) {
1026
1027 if (strcasecmp(params->blobs[i].name, "krb5_cc_type") == 0) {
1028 if (params->blobs[i].blob.data) {
1029 strncpy(request.data.auth.krb5_cc_type,
1030 (const char *)params->blobs[i].blob.data,
1031 sizeof(request.data.auth.krb5_cc_type) - 1);
1032 }
1033 continue;
1034 }
1035
1036 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
1037 if (params->blobs[i].blob.data) {
1038 memcpy(&request.data.auth.uid,
1039 params->blobs[i].blob.data,
1040 MIN(sizeof(request.data.auth.uid),
1041 params->blobs[i].blob.length));
1042 }
1043 continue;
1044 }
1045
1046 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
1047 if (params->blobs[i].blob.data) {
1048 uint32_t flags;
1049 memcpy(&flags,
1050 params->blobs[i].blob.data,
1051 MIN(sizeof(flags),
1052 params->blobs[i].blob.length));
1053 request.flags |= flags;
1054 }
1055 continue;
1056 }
1057
1058 if (strcasecmp(params->blobs[i].name, "membership_of") == 0) {
1059 if (params->blobs[i].blob.data &&
1060 params->blobs[i].blob.data[0] > 0) {
1061 strncpy(request.data.auth.require_membership_of_sid,
1062 (const char *)params->blobs[i].blob.data,
1063 sizeof(request.data.auth.require_membership_of_sid) - 1);
1064 }
1065 continue;
1066 }
1067 }
1068
1069 wbc_status = wbcRequestResponse(cmd,
1070 &request,
1071 &response);
1072
1073 if (response.data.auth.nt_status != 0) {
1074 if (error) {
1075 wbc_status = wbc_create_error_info(&response,
1076 error);
1077 BAIL_ON_WBC_ERROR(wbc_status);
1078 }
1079
1080 wbc_status = WBC_ERR_AUTH_ERROR;
1081 BAIL_ON_WBC_ERROR(wbc_status);
1082 }
1083 BAIL_ON_WBC_ERROR(wbc_status);
1084
1085 if (info) {
1086 wbc_status = wbc_create_logon_info(&response,
1087 info);
1088 BAIL_ON_WBC_ERROR(wbc_status);
1089 }
1090
1091 if (policy) {
1092 wbc_status = wbc_create_password_policy_info(&response,
1093 policy);
1094 BAIL_ON_WBC_ERROR(wbc_status);
1095 }
1096
1097 done:
1098 winbindd_free_response(&response);
1099
1100 return wbc_status;
1101 }
1102
1103 /* Authenticate a user with cached credentials */
1104 wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
1105 struct wbcCredentialCacheInfo **info,
1106 struct wbcAuthErrorInfo **error)
1107 {
1108 wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
1109 struct wbcCredentialCacheInfo *result = NULL;
1110 struct winbindd_request request;
1111 struct winbindd_response response;
1112 struct wbcNamedBlob *initial_blob = NULL;
1113 struct wbcNamedBlob *challenge_blob = NULL;
1114 int i;
1115
1116 ZERO_STRUCT(request);
1117 ZERO_STRUCT(response);
1118
1119 if (info != NULL) {
1120 *info = NULL;
1121 }
1122 if (error != NULL) {
1123 *error = NULL;
1124 }
1125 if ((params == NULL)
1126 || (params->account_name == NULL)
1127 || (params->level != WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP)) {
1128 status = WBC_ERR_INVALID_PARAM;
1129 goto fail;
1130 }
1131
1132 if (params->domain_name != NULL) {
1133 status = wbcRequestResponse(WINBINDD_INFO, NULL, &response);
1134 if (!WBC_ERROR_IS_OK(status)) {
1135 goto fail;
1136 }
1137 snprintf(request.data.ccache_ntlm_auth.user,
1138 sizeof(request.data.ccache_ntlm_auth.user)-1,
1139 "%s%c%s", params->domain_name,
1140 response.data.info.winbind_separator,
1141 params->account_name);
1142 } else {
1143 strncpy(request.data.ccache_ntlm_auth.user,
1144 params->account_name,
1145 sizeof(request.data.ccache_ntlm_auth.user)-1);
1146 }
1147 request.data.ccache_ntlm_auth.uid = getuid();
1148
1149 for (i=0; i<params->num_blobs; i++) {
1150 if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) {
1151 initial_blob = &params->blobs[i];
1152 break;
1153 }
1154 if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
1155 challenge_blob = &params->blobs[i];
1156 break;
1157 }
1158 }
1159
1160 request.data.ccache_ntlm_auth.initial_blob_len = 0;
1161 request.data.ccache_ntlm_auth.challenge_blob_len = 0;
1162 request.extra_len = 0;
1163
1164 if (initial_blob != NULL) {
1165 request.data.ccache_ntlm_auth.initial_blob_len =
1166 initial_blob->blob.length;
1167 request.extra_len += initial_blob->blob.length;
1168 }
1169 if (challenge_blob != NULL) {
1170 request.data.ccache_ntlm_auth.challenge_blob_len =
1171 challenge_blob->blob.length;
1172 request.extra_len += challenge_blob->blob.length;
1173 }
1174
1175 if (request.extra_len != 0) {
1176 request.extra_data.data = talloc_array(
1177 NULL, char, request.extra_len);
1178 if (request.extra_data.data == NULL) {
1179 status = WBC_ERR_NO_MEMORY;
1180 goto fail;
1181 }
1182 }
1183 if (initial_blob != NULL) {
1184 memcpy(request.extra_data.data,
1185 initial_blob->blob.data, initial_blob->blob.length);
1186 }
1187 if (challenge_blob != NULL) {
1188 memcpy(request.extra_data.data
1189 + request.data.ccache_ntlm_auth.initial_blob_len,
1190 challenge_blob->blob.data,
1191 challenge_blob->blob.length);
1192 }
1193
1194 status = wbcRequestResponse(WINBINDD_CCACHE_NTLMAUTH, &request,
1195 &response);
1196 if (!WBC_ERROR_IS_OK(status)) {
1197 goto fail;
1198 }
1199
1200 result = talloc(NULL, struct wbcCredentialCacheInfo);
1201 if (result == NULL) {
1202 status = WBC_ERR_NO_MEMORY;
1203 goto fail;
1204 }
1205 result->num_blobs = 0;
1206 result->blobs = talloc(result, struct wbcNamedBlob);
1207 if (result->blobs == NULL) {
1208 status = WBC_ERR_NO_MEMORY;
1209 goto fail;
1210 }
1211 status = wbcAddNamedBlob(&result->num_blobs, &result->blobs,
1212 "auth_blob", 0,
1213 (uint8_t *)response.extra_data.data,
1214 response.data.ccache_ntlm_auth.auth_blob_len);
1215 if (!WBC_ERROR_IS_OK(status)) {
1216 goto fail;
1217 }
1218 status = wbcAddNamedBlob(
1219 &result->num_blobs, &result->blobs, "session_key", 0,
1220 response.data.ccache_ntlm_auth.session_key,
1221 sizeof(response.data.ccache_ntlm_auth.session_key));
1222 if (!WBC_ERROR_IS_OK(status)) {
1223 goto fail;
1224 }
1225
1226 winbindd_free_response(&response);
1227 *info = result;
1228 return WBC_ERR_SUCCESS;
1229
1230 fail:
1231 TALLOC_FREE(request.extra_data.data);
1232 winbindd_free_response(&response);
1233 talloc_free(result);
1234 return status;
1235 }
1236
1237 /* Authenticate a user with cached credentials */
1238 wbcErr wbcCredentialSave(const char *user, const char *password)
1239 {
1240 struct winbindd_request request;
1241 struct winbindd_response response;
1242
1243 ZERO_STRUCT(request);
1244 ZERO_STRUCT(response);
1245
1246 strncpy(request.data.ccache_save.user, user,
1247 sizeof(request.data.ccache_save.user)-1);
1248 strncpy(request.data.ccache_save.pass, password,
1249 sizeof(request.data.ccache_save.pass)-1);
1250 request.data.ccache_save.uid = getuid();
1251
1252 return wbcRequestResponse(WINBINDD_CCACHE_SAVE, &request, &response);
1253 }
reg import