2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_AUTH
29 extern DOM_SID global_sid_World
;
30 extern DOM_SID global_sid_Network
;
31 extern DOM_SID global_sid_Builtin_Guests
;
32 extern DOM_SID global_sid_Authenticated_Users
;
35 /****************************************************************************
36 Create a UNIX user on demand.
37 ****************************************************************************/
39 static int smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
44 pstrcpy(add_script
, lp_adduser_script());
47 all_string_sub(add_script
, "%u", unix_username
, sizeof(pstring
));
49 all_string_sub(add_script
, "%D", domain
, sizeof(pstring
));
51 all_string_sub(add_script
, "%H", homedir
, sizeof(pstring
));
52 ret
= smbrun(add_script
,NULL
);
53 DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script
,ret
));
57 /****************************************************************************
58 Add and Delete UNIX users on demand, based on NTSTATUS codes.
59 We don't care about RID's here so ignore.
60 ****************************************************************************/
62 void auth_add_user_script(const char *domain
, const char *username
)
66 * User validated ok against Domain controller.
67 * If the admin wants us to try and create a UNIX
68 * user on the fly, do so.
71 if ( *lp_adduser_script() )
72 smb_create_user(domain
, username
, NULL
);
74 DEBUG(10,("auth_add_user_script: no 'add user script'. Asking winbindd\n"));
76 /* should never get here is we a re a domain member running winbindd
77 However, a host set for 'security = server' might run winbindd for
80 if ( !winbind_create_user(username
, NULL
) ) {
81 DEBUG(5,("auth_add_user_script: winbindd_create_user() failed\n"));
87 /****************************************************************************
88 Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
90 ****************************************************************************/
92 NTSTATUS
auth_get_sam_account(const char *user
, SAM_ACCOUNT
**account
)
96 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(account
))) {
101 pdb_ret
= pdb_getsampwnam(*account
, user
);
106 struct passwd
*pass
= Get_Pwnam(user
);
108 return NT_STATUS_NO_SUCH_USER
;
110 if (!NT_STATUS_IS_OK(nt_status
= pdb_fill_sam_pw(*account
, pass
))) {
117 /****************************************************************************
118 Create an auth_usersupplied_data structure
119 ****************************************************************************/
121 static NTSTATUS
make_user_info(auth_usersupplied_info
**user_info
,
122 const char *smb_name
,
123 const char *internal_username
,
124 const char *client_domain
,
126 const char *wksta_name
,
127 DATA_BLOB
*lm_pwd
, DATA_BLOB
*nt_pwd
,
128 DATA_BLOB
*lm_interactive_pwd
, DATA_BLOB
*nt_interactive_pwd
,
129 DATA_BLOB
*plaintext
,
133 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username
, smb_name
));
135 *user_info
= malloc(sizeof(**user_info
));
137 DEBUG(0,("malloc failed for user_info (size %lu)\n", (unsigned long)sizeof(*user_info
)));
138 return NT_STATUS_NO_MEMORY
;
141 ZERO_STRUCTP(*user_info
);
143 DEBUG(5,("making strings for %s's user_info struct\n", internal_username
));
145 (*user_info
)->smb_name
.str
= strdup(smb_name
);
146 if ((*user_info
)->smb_name
.str
) {
147 (*user_info
)->smb_name
.len
= strlen(smb_name
);
149 free_user_info(user_info
);
150 return NT_STATUS_NO_MEMORY
;
153 (*user_info
)->internal_username
.str
= strdup(internal_username
);
154 if ((*user_info
)->internal_username
.str
) {
155 (*user_info
)->internal_username
.len
= strlen(internal_username
);
157 free_user_info(user_info
);
158 return NT_STATUS_NO_MEMORY
;
161 (*user_info
)->domain
.str
= strdup(domain
);
162 if ((*user_info
)->domain
.str
) {
163 (*user_info
)->domain
.len
= strlen(domain
);
165 free_user_info(user_info
);
166 return NT_STATUS_NO_MEMORY
;
169 (*user_info
)->client_domain
.str
= strdup(client_domain
);
170 if ((*user_info
)->client_domain
.str
) {
171 (*user_info
)->client_domain
.len
= strlen(client_domain
);
173 free_user_info(user_info
);
174 return NT_STATUS_NO_MEMORY
;
177 (*user_info
)->wksta_name
.str
= strdup(wksta_name
);
178 if ((*user_info
)->wksta_name
.str
) {
179 (*user_info
)->wksta_name
.len
= strlen(wksta_name
);
181 free_user_info(user_info
);
182 return NT_STATUS_NO_MEMORY
;
185 DEBUG(5,("making blobs for %s's user_info struct\n", internal_username
));
188 (*user_info
)->lm_resp
= data_blob(lm_pwd
->data
, lm_pwd
->length
);
190 (*user_info
)->nt_resp
= data_blob(nt_pwd
->data
, nt_pwd
->length
);
191 if (lm_interactive_pwd
)
192 (*user_info
)->lm_interactive_pwd
= data_blob(lm_interactive_pwd
->data
, lm_interactive_pwd
->length
);
193 if (nt_interactive_pwd
)
194 (*user_info
)->nt_interactive_pwd
= data_blob(nt_interactive_pwd
->data
, nt_interactive_pwd
->length
);
197 (*user_info
)->plaintext_password
= data_blob(plaintext
->data
, plaintext
->length
);
199 (*user_info
)->encrypted
= encrypted
;
201 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted
? "":"un" , internal_username
, smb_name
));
206 /****************************************************************************
207 Create an auth_usersupplied_data structure after appropriate mapping.
208 ****************************************************************************/
210 NTSTATUS
make_user_info_map(auth_usersupplied_info
**user_info
,
211 const char *smb_name
,
212 const char *client_domain
,
213 const char *wksta_name
,
214 DATA_BLOB
*lm_pwd
, DATA_BLOB
*nt_pwd
,
215 DATA_BLOB
*lm_interactive_pwd
, DATA_BLOB
*nt_interactive_pwd
,
216 DATA_BLOB
*plaintext
,
220 fstring internal_username
;
221 fstrcpy(internal_username
, smb_name
);
222 map_username(internal_username
);
224 DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
225 client_domain
, smb_name
, wksta_name
));
227 /* don't allow "" as a domain, fixes a Win9X bug
228 where it doens't supply a domain for logon script
229 'net use' commands. */
231 if ( *client_domain
)
232 domain
= client_domain
;
234 domain
= lp_workgroup();
236 /* do what win2k does. Always map unknown domains to our own
237 and let the "passdb backend" handle unknown users. */
239 if ( !is_trusted_domain(domain
) && !strequal(domain
, get_global_sam_name()) )
240 domain
= get_default_sam_name();
242 /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
244 return make_user_info(user_info
, smb_name
, internal_username
,
245 client_domain
, domain
, wksta_name
,
247 lm_interactive_pwd
, nt_interactive_pwd
,
248 plaintext
, encrypted
);
251 /****************************************************************************
252 Create an auth_usersupplied_data, making the DATA_BLOBs here.
253 Decrypt and encrypt the passwords.
254 ****************************************************************************/
256 BOOL
make_user_info_netlogon_network(auth_usersupplied_info
**user_info
,
257 const char *smb_name
,
258 const char *client_domain
,
259 const char *wksta_name
,
260 const uchar
*lm_network_pwd
, int lm_pwd_len
,
261 const uchar
*nt_network_pwd
, int nt_pwd_len
)
265 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
266 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
268 nt_status
= make_user_info_map(user_info
,
269 smb_name
, client_domain
,
271 lm_pwd_len
? &lm_blob
: NULL
,
272 nt_pwd_len
? &nt_blob
: NULL
,
276 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
278 data_blob_free(&lm_blob
);
279 data_blob_free(&nt_blob
);
283 /****************************************************************************
284 Create an auth_usersupplied_data, making the DATA_BLOBs here.
285 Decrypt and encrypt the passwords.
286 ****************************************************************************/
288 BOOL
make_user_info_netlogon_interactive(auth_usersupplied_info
**user_info
,
289 const char *smb_name
,
290 const char *client_domain
,
291 const char *wksta_name
,
293 const uchar lm_interactive_pwd
[16],
294 const uchar nt_interactive_pwd
[16],
295 const uchar
*dc_sess_key
)
299 unsigned char local_lm_response
[24];
300 unsigned char local_nt_response
[24];
301 unsigned char key
[16];
304 memcpy(key
, dc_sess_key
, 8);
306 if (lm_interactive_pwd
) memcpy(lm_pwd
, lm_interactive_pwd
, sizeof(lm_pwd
));
307 if (nt_interactive_pwd
) memcpy(nt_pwd
, nt_interactive_pwd
, sizeof(nt_pwd
));
309 #ifdef DEBUG_PASSWORD
311 dump_data(100, (char *)key
, sizeof(key
));
313 DEBUG(100,("lm owf password:"));
314 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
316 DEBUG(100,("nt owf password:"));
317 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
320 if (lm_interactive_pwd
)
321 SamOEMhash((uchar
*)lm_pwd
, key
, sizeof(lm_pwd
));
323 if (nt_interactive_pwd
)
324 SamOEMhash((uchar
*)nt_pwd
, key
, sizeof(nt_pwd
));
326 #ifdef DEBUG_PASSWORD
327 DEBUG(100,("decrypt of lm owf password:"));
328 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
330 DEBUG(100,("decrypt of nt owf password:"));
331 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
334 if (lm_interactive_pwd
)
335 SMBOWFencrypt((const unsigned char *)lm_pwd
, chal
, local_lm_response
);
337 if (nt_interactive_pwd
)
338 SMBOWFencrypt((const unsigned char *)nt_pwd
, chal
, local_nt_response
);
340 /* Password info paranoia */
346 DATA_BLOB local_lm_blob
;
347 DATA_BLOB local_nt_blob
;
349 DATA_BLOB lm_interactive_blob
;
350 DATA_BLOB nt_interactive_blob
;
352 if (lm_interactive_pwd
) {
353 local_lm_blob
= data_blob(local_lm_response
, sizeof(local_lm_response
));
354 lm_interactive_blob
= data_blob(lm_pwd
, sizeof(lm_pwd
));
358 if (nt_interactive_pwd
) {
359 local_nt_blob
= data_blob(local_nt_response
, sizeof(local_nt_response
));
360 nt_interactive_blob
= data_blob(nt_pwd
, sizeof(nt_pwd
));
364 nt_status
= make_user_info_map(user_info
,
365 smb_name
, client_domain
,
367 lm_interactive_pwd
? &local_lm_blob
: NULL
,
368 nt_interactive_pwd
? &local_nt_blob
: NULL
,
369 lm_interactive_pwd
? &lm_interactive_blob
: NULL
,
370 nt_interactive_pwd
? &nt_interactive_blob
: NULL
,
374 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
375 data_blob_free(&local_lm_blob
);
376 data_blob_free(&local_nt_blob
);
377 data_blob_free(&lm_interactive_blob
);
378 data_blob_free(&nt_interactive_blob
);
384 /****************************************************************************
385 Create an auth_usersupplied_data structure
386 ****************************************************************************/
388 BOOL
make_user_info_for_reply(auth_usersupplied_info
**user_info
,
389 const char *smb_name
,
390 const char *client_domain
,
392 DATA_BLOB plaintext_password
)
395 DATA_BLOB local_lm_blob
;
396 DATA_BLOB local_nt_blob
;
397 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
400 * Not encrypted - do so.
403 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
405 if (plaintext_password
.data
) {
406 unsigned char local_lm_response
[24];
408 #ifdef DEBUG_PASSWORD
409 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password
.length
));
410 dump_data(100, plaintext_password
.data
, plaintext_password
.length
);
413 SMBencrypt( (const char *)plaintext_password
.data
, (const uchar
*)chal
, local_lm_response
);
414 local_lm_blob
= data_blob(local_lm_response
, 24);
416 /* We can't do an NT hash here, as the password needs to be
418 local_nt_blob
= data_blob(NULL
, 0);
421 local_lm_blob
= data_blob(NULL
, 0);
422 local_nt_blob
= data_blob(NULL
, 0);
425 ret
= make_user_info_map(user_info
, smb_name
,
427 get_remote_machine_name(),
428 local_lm_blob
.data
? &local_lm_blob
: NULL
,
429 local_nt_blob
.data
? &local_nt_blob
: NULL
,
431 plaintext_password
.data
? &plaintext_password
: NULL
,
434 data_blob_free(&local_lm_blob
);
435 return NT_STATUS_IS_OK(ret
) ? True
: False
;
438 /****************************************************************************
439 Create an auth_usersupplied_data structure
440 ****************************************************************************/
442 NTSTATUS
make_user_info_for_reply_enc(auth_usersupplied_info
**user_info
,
443 const char *smb_name
,
444 const char *client_domain
,
445 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
447 return make_user_info_map(user_info
, smb_name
,
449 get_remote_machine_name(),
450 lm_resp
.data
? &lm_resp
: NULL
,
451 nt_resp
.data
? &nt_resp
: NULL
,
456 /****************************************************************************
457 Create a guest user_info blob, for anonymous authenticaion.
458 ****************************************************************************/
460 BOOL
make_user_info_guest(auth_usersupplied_info
**user_info
)
464 nt_status
= make_user_info(user_info
,
473 return NT_STATUS_IS_OK(nt_status
) ? True
: False
;
476 /****************************************************************************
477 prints a NT_USER_TOKEN to debug output.
478 ****************************************************************************/
480 void debug_nt_user_token(int dbg_class
, int dbg_lev
, NT_USER_TOKEN
*token
)
486 DEBUGC(dbg_class
, dbg_lev
, ("NT user token: (NULL)\n"));
490 DEBUGC(dbg_class
, dbg_lev
, ("NT user token of user %s\n",
491 sid_to_string(sid_str
, &token
->user_sids
[0]) ));
492 DEBUGADDC(dbg_class
, dbg_lev
, ("contains %lu SIDs\n", (unsigned long)token
->num_sids
));
493 for (i
= 0; i
< token
->num_sids
; i
++)
494 DEBUGADDC(dbg_class
, dbg_lev
, ("SID[%3lu]: %s\n", (unsigned long)i
,
495 sid_to_string(sid_str
, &token
->user_sids
[i
])));
498 /****************************************************************************
499 prints a UNIX 'token' to debug output.
500 ****************************************************************************/
502 void debug_unix_user_token(int dbg_class
, int dbg_lev
, uid_t uid
, gid_t gid
, int n_groups
, gid_t
*groups
)
505 DEBUGC(dbg_class
, dbg_lev
, ("UNIX token of user %ld\n", (long int)uid
));
507 DEBUGADDC(dbg_class
, dbg_lev
, ("Primary group is %ld and contains %i supplementary groups\n", (long int)gid
, n_groups
));
508 for (i
= 0; i
< n_groups
; i
++)
509 DEBUGADDC(dbg_class
, dbg_lev
, ("Group[%3i]: %ld\n", i
,
510 (long int)groups
[i
]));
513 /****************************************************************************
514 Create the SID list for this user.
515 ****************************************************************************/
517 static NTSTATUS
create_nt_user_token(const DOM_SID
*user_sid
, const DOM_SID
*group_sid
,
518 int n_groupSIDs
, DOM_SID
*groupSIDs
,
519 BOOL is_guest
, NT_USER_TOKEN
**token
)
521 NTSTATUS nt_status
= NT_STATUS_OK
;
522 NT_USER_TOKEN
*ptoken
;
526 if ((ptoken
= malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
) {
527 DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
528 nt_status
= NT_STATUS_NO_MEMORY
;
532 ZERO_STRUCTP(ptoken
);
534 ptoken
->num_sids
= n_groupSIDs
+ 5;
536 if ((ptoken
->user_sids
= (DOM_SID
*)malloc( sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
537 DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
538 nt_status
= NT_STATUS_NO_MEMORY
;
542 memset((char*)ptoken
->user_sids
,0,sizeof(DOM_SID
) * ptoken
->num_sids
);
545 * Note - user SID *MUST* be first in token !
546 * se_access_check depends on this.
548 * Primary group SID is second in token. Convention.
551 sid_copy(&ptoken
->user_sids
[PRIMARY_USER_SID_INDEX
], user_sid
);
553 sid_copy(&ptoken
->user_sids
[PRIMARY_GROUP_SID_INDEX
], group_sid
);
556 * Finally add the "standard" SIDs.
557 * The only difference between guest and "anonymous" (which we
558 * don't really support) is the addition of Authenticated_Users.
561 sid_copy(&ptoken
->user_sids
[2], &global_sid_World
);
562 sid_copy(&ptoken
->user_sids
[3], &global_sid_Network
);
565 sid_copy(&ptoken
->user_sids
[4], &global_sid_Builtin_Guests
);
567 sid_copy(&ptoken
->user_sids
[4], &global_sid_Authenticated_Users
);
569 sid_ndx
= 5; /* next available spot */
571 for (i
= 0; i
< n_groupSIDs
; i
++) {
572 size_t check_sid_idx
;
573 for (check_sid_idx
= 1; check_sid_idx
< ptoken
->num_sids
; check_sid_idx
++) {
574 if (sid_equal(&ptoken
->user_sids
[check_sid_idx
],
580 if (check_sid_idx
>= ptoken
->num_sids
) /* Not found already */ {
581 sid_copy(&ptoken
->user_sids
[sid_ndx
++], &groupSIDs
[i
]);
587 debug_nt_user_token(DBGC_AUTH
, 10, ptoken
);
594 /****************************************************************************
595 Create the SID list for this user.
596 ****************************************************************************/
598 NT_USER_TOKEN
*create_nt_token(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
, BOOL is_guest
)
603 NT_USER_TOKEN
*token
;
606 if (!NT_STATUS_IS_OK(uid_to_sid(&user_sid
, uid
))) {
609 if (!NT_STATUS_IS_OK(gid_to_sid(&group_sid
, gid
))) {
613 group_sids
= malloc(sizeof(DOM_SID
) * ngroups
);
615 DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
619 for (i
= 0; i
< ngroups
; i
++) {
620 if (!NT_STATUS_IS_OK(gid_to_sid(&(group_sids
)[i
], (groups
)[i
]))) {
621 DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups
[i
]));
622 SAFE_FREE(group_sids
);
627 if (!NT_STATUS_IS_OK(create_nt_user_token(&user_sid
, &group_sid
,
628 ngroups
, group_sids
, is_guest
, &token
))) {
629 SAFE_FREE(group_sids
);
633 SAFE_FREE(group_sids
);
638 /******************************************************************************
639 * this function returns the groups (SIDs) of the local SAM the user is in.
640 * If this samba server is a DC of the domain the user belongs to, it returns
641 * both domain groups and local / builtin groups. If the user is in a trusted
642 * domain, or samba is a member server of a domain, then this function returns
643 * local and builtin groups the user is a member of.
645 * currently this is a hack, as there is no sam implementation that is capable
648 * NOTE!! This function will fail if you pass in a winbind user without
650 ******************************************************************************/
652 static NTSTATUS
get_user_groups(const char *username
, uid_t uid
, gid_t gid
,
653 int *n_groups
, DOM_SID
**groups
, gid_t
**unix_groups
)
661 /* Try winbind first */
663 if ( strchr(username
, *lp_winbind_separator()) ) {
664 n_unix_groups
= winbind_getgroups( username
, unix_groups
);
666 DEBUG(10,("get_user_groups: winbind_getgroups(%s): result = %s\n", username
,
667 n_unix_groups
== -1 ? "FAIL" : "SUCCESS"));
669 if ( n_unix_groups
== -1 )
670 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
673 /* fallback to getgrouplist() */
675 n_unix_groups
= groups_max();
677 if ((*unix_groups
= malloc( sizeof(gid_t
) * n_unix_groups
) ) == NULL
) {
678 DEBUG(0, ("get_user_groups: Out of memory allocating unix group list\n"));
679 return NT_STATUS_NO_MEMORY
;
682 if (sys_getgrouplist(username
, gid
, *unix_groups
, &n_unix_groups
) == -1) {
686 groups_tmp
= Realloc(*unix_groups
, sizeof(gid_t
) * n_unix_groups
);
689 SAFE_FREE(*unix_groups
);
690 return NT_STATUS_NO_MEMORY
;
692 *unix_groups
= groups_tmp
;
694 if (sys_getgrouplist(username
, gid
, *unix_groups
, &n_unix_groups
) == -1) {
695 DEBUG(0, ("get_user_groups: failed to get the unix group list\n"));
696 SAFE_FREE(*unix_groups
);
697 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
702 debug_unix_user_token(DBGC_CLASS
, 5, uid
, gid
, n_unix_groups
, *unix_groups
);
704 /* now setup the space for storing the SIDS */
706 if (n_unix_groups
> 0) {
708 *groups
= malloc(sizeof(DOM_SID
) * n_unix_groups
);
711 DEBUG(0, ("get_user_group: malloc() failed for DOM_SID list!\n"));
712 SAFE_FREE(*unix_groups
);
713 return NT_STATUS_NO_MEMORY
;
717 *n_groups
= n_unix_groups
;
719 for (i
= 0; i
< *n_groups
; i
++) {
720 if (!NT_STATUS_IS_OK(gid_to_sid(&(*groups
)[i
], (*unix_groups
)[i
]))) {
721 DEBUG(1, ("get_user_groups: failed to convert gid %ld to a sid!\n",
722 (long int)(*unix_groups
)[i
+1]));
724 SAFE_FREE(*unix_groups
);
725 return NT_STATUS_NO_SUCH_USER
;
732 /***************************************************************************
733 Make a user_info struct
734 ***************************************************************************/
736 static NTSTATUS
make_server_info(auth_serversupplied_info
**server_info
)
738 *server_info
= malloc(sizeof(**server_info
));
740 DEBUG(0,("make_server_info: malloc failed!\n"));
741 return NT_STATUS_NO_MEMORY
;
743 ZERO_STRUCTP(*server_info
);
745 /* Initialise the uid and gid values to something non-zero
746 which may save us from giving away root access if there
747 is a bug in allocating these fields. */
749 (*server_info
)->uid
= -1;
750 (*server_info
)->gid
= -1;
755 /***************************************************************************
756 Fill a server_info struct from a SAM_ACCOUNT with their groups
757 ***************************************************************************/
759 static NTSTATUS
add_user_groups(auth_serversupplied_info
**server_info
,
760 const char * unix_username
,
761 SAM_ACCOUNT
*sampass
,
762 uid_t uid
, gid_t gid
)
765 const DOM_SID
*user_sid
= pdb_get_user_sid(sampass
);
766 const DOM_SID
*group_sid
= pdb_get_group_sid(sampass
);
768 DOM_SID
*groupSIDs
= NULL
;
769 gid_t
*unix_groups
= NULL
;
770 NT_USER_TOKEN
*token
;
774 nt_status
= get_user_groups(unix_username
, uid
, gid
,
775 &n_groupSIDs
, &groupSIDs
, &unix_groups
);
777 if (!NT_STATUS_IS_OK(nt_status
)) {
778 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
779 free_server_info(server_info
);
783 is_guest
= (sid_peek_rid(user_sid
, &rid
) && rid
== DOMAIN_USER_RID_GUEST
);
785 if (!NT_STATUS_IS_OK(nt_status
= create_nt_user_token(user_sid
, group_sid
,
786 n_groupSIDs
, groupSIDs
, is_guest
,
789 DEBUG(4,("create_nt_user_token failed\n"));
790 SAFE_FREE(groupSIDs
);
791 SAFE_FREE(unix_groups
);
792 free_server_info(server_info
);
796 SAFE_FREE(groupSIDs
);
798 (*server_info
)->n_groups
= n_groupSIDs
;
799 (*server_info
)->groups
= unix_groups
;
800 (*server_info
)->ptok
= token
;
805 /***************************************************************************
806 Make (and fill) a user_info struct from a SAM_ACCOUNT
807 ***************************************************************************/
809 NTSTATUS
make_server_info_sam(auth_serversupplied_info
**server_info
,
810 SAM_ACCOUNT
*sampass
)
815 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
)))
818 (*server_info
)->sam_account
= sampass
;
820 if ( !(pwd
= getpwnam_alloc(pdb_get_username(sampass
))) ) {
821 DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
822 pdb_get_username(sampass
)));
823 free_server_info(server_info
);
824 return NT_STATUS_NO_SUCH_USER
;
826 (*server_info
)->unix_name
= smb_xstrdup(pwd
->pw_name
);
827 (*server_info
)->gid
= pwd
->pw_gid
;
828 (*server_info
)->uid
= pwd
->pw_uid
;
832 if (!NT_STATUS_IS_OK(nt_status
= add_user_groups(server_info
, pdb_get_username(sampass
),
835 (*server_info
)->gid
)))
837 free_server_info(server_info
);
841 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
842 DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
843 pdb_get_username(sampass
),
844 (*server_info
)->unix_name
));
849 /***************************************************************************
850 Make (and fill) a user_info struct from a 'struct passwd' by conversion
852 ***************************************************************************/
854 NTSTATUS
make_server_info_pw(auth_serversupplied_info
**server_info
,
859 SAM_ACCOUNT
*sampass
= NULL
;
860 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam_pw(&sampass
, pwd
))) {
863 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
))) {
867 (*server_info
)->sam_account
= sampass
;
869 if (!NT_STATUS_IS_OK(nt_status
= add_user_groups(server_info
, unix_username
,
870 sampass
, pwd
->pw_uid
, pwd
->pw_gid
)))
875 (*server_info
)->unix_name
= smb_xstrdup(unix_username
);
877 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
878 (*server_info
)->uid
= pwd
->pw_uid
;
879 (*server_info
)->gid
= pwd
->pw_gid
;
883 /***************************************************************************
884 Make (and fill) a user_info struct for a guest login.
885 ***************************************************************************/
887 NTSTATUS
make_server_info_guest(auth_serversupplied_info
**server_info
)
890 SAM_ACCOUNT
*sampass
= NULL
;
893 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(&sampass
))) {
897 sid_copy(&guest_sid
, get_global_sam_sid());
898 sid_append_rid(&guest_sid
, DOMAIN_USER_RID_GUEST
);
901 if (!pdb_getsampwsid(sampass
, &guest_sid
)) {
903 return NT_STATUS_NO_SUCH_USER
;
907 nt_status
= make_server_info_sam(server_info
, sampass
);
909 if (NT_STATUS_IS_OK(nt_status
)) {
910 static const char zeros
[16];
911 (*server_info
)->guest
= True
;
913 /* annoying, but the Guest really does have a session key,
914 and it is all zeros! */
915 (*server_info
)->user_session_key
= data_blob(zeros
, sizeof(zeros
));
916 (*server_info
)->lm_session_key
= data_blob(zeros
, sizeof(zeros
));
922 /***************************************************************************
923 Purely internal function for make_server_info_info3
924 Fill the sam account from getpwnam
925 ***************************************************************************/
926 static NTSTATUS
fill_sam_account(TALLOC_CTX
*mem_ctx
,
928 const char *username
,
929 char **found_username
,
930 uid_t
*uid
, gid_t
*gid
,
931 SAM_ACCOUNT
**sam_account
)
934 fstring real_username
;
935 struct passwd
*passwd
;
937 fstr_sprintf(dom_user
, "%s%s%s", domain
, lp_winbind_separator(),
940 /* get the passwd struct but don't create the user if he/she
941 does not exist. We were explicitly called from a following
942 a winbindd authentication request so we should assume that
943 nss_winbindd is working */
945 if ( !(passwd
= smb_getpwnam( dom_user
, real_username
, True
)) )
946 return NT_STATUS_NO_SUCH_USER
;
948 *uid
= passwd
->pw_uid
;
949 *gid
= passwd
->pw_gid
;
951 /* This is pointless -- there is no suport for differing
952 unix and windows names. Make sure to always store the
953 one we actually looked up and succeeded. Have I mentioned
954 why I hate the 'winbind use default domain' parameter?
957 *found_username
= talloc_strdup( mem_ctx
, real_username
);
959 DEBUG(5,("fill_sam_account: located username was [%s]\n",
962 return pdb_init_sam_pw(sam_account
, passwd
);
965 /****************************************************************************
966 Wrapper to allow the getpwnam() call to strip the domain name and
967 try again in case a local UNIX user is already there. Also run through
968 the username if we fallback to the username only.
969 ****************************************************************************/
971 struct passwd
*smb_getpwnam( char *domuser
, fstring save_username
, BOOL create
)
973 struct passwd
*pw
= NULL
;
975 fstring mapped_username
;
976 fstring strip_username
;
978 /* we only save a copy of the username it has been mangled
979 by winbindd use default domain */
981 save_username
[0] = '\0';
983 /* save a local copy of the username and run it through the
986 fstrcpy( mapped_username
, domuser
);
987 map_username( mapped_username
);
989 p
= strchr_m( mapped_username
, *lp_winbind_separator() );
991 /* code for a DOMAIN\user string */
994 pw
= Get_Pwnam( domuser
);
996 /* make sure we get the case of the username correct */
997 /* work around 'winbind use default domain = yes' */
999 if ( !strchr_m( pw
->pw_name
, *lp_winbind_separator() ) ) {
1002 domain
= mapped_username
;
1004 fstr_sprintf(save_username
, "%s%c%s", domain
, *lp_winbind_separator(), pw
->pw_name
);
1007 fstrcpy( save_username
, pw
->pw_name
);
1013 /* setup for lookup of just the username */
1014 /* remember that p and mapped_username are overlapping memory */
1017 fstrcpy( strip_username
, p
);
1018 fstrcpy( mapped_username
, strip_username
);
1021 /* just lookup a plain username */
1023 pw
= Get_Pwnam(mapped_username
);
1025 /* Create local user if requested. */
1027 if ( !pw
&& create
) {
1028 /* Don't add a machine account. */
1029 if (mapped_username
[strlen(mapped_username
)-1] == '$')
1032 auth_add_user_script(NULL
, mapped_username
);
1033 pw
= Get_Pwnam(mapped_username
);
1036 /* one last check for a valid passwd struct */
1039 fstrcpy( save_username
, pw
->pw_name
);
1044 /***************************************************************************
1045 Make a server_info struct from the info3 returned by a domain logon
1046 ***************************************************************************/
1048 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
1049 const char *internal_username
,
1050 const char *sent_nt_username
,
1052 auth_serversupplied_info
**server_info
,
1053 NET_USER_INFO_3
*info3
)
1055 static const char zeros
[16];
1057 NTSTATUS nt_status
= NT_STATUS_OK
;
1058 char *found_username
;
1059 const char *nt_domain
;
1060 const char *nt_username
;
1062 SAM_ACCOUNT
*sam_account
= NULL
;
1070 DOM_SID
*lgroupSIDs
= NULL
;
1072 gid_t
*unix_groups
= NULL
;
1073 NT_USER_TOKEN
*token
;
1075 DOM_SID
*all_group_SIDs
;
1079 Here is where we should check the list of
1080 trusted domains, and verify that the SID
1084 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
1085 if (!sid_append_rid(&user_sid
, info3
->user_rid
)) {
1086 return NT_STATUS_INVALID_PARAMETER
;
1089 sid_copy(&group_sid
, &info3
->dom_sid
.sid
);
1090 if (!sid_append_rid(&group_sid
, info3
->group_rid
)) {
1091 return NT_STATUS_INVALID_PARAMETER
;
1094 if (!(nt_username
= unistr2_tdup(mem_ctx
, &(info3
->uni_user_name
)))) {
1095 /* If the server didn't give us one, just use the one we sent them */
1096 nt_username
= sent_nt_username
;
1099 if (!(nt_domain
= unistr2_tdup(mem_ctx
, &(info3
->uni_logon_dom
)))) {
1100 /* If the server didn't give us one, just use the one we sent them */
1104 /* try to fill the SAM account.. If getpwnam() fails, then try the
1105 add user script (2.2.x behavior) */
1107 nt_status
= fill_sam_account(mem_ctx
, nt_domain
, internal_username
,
1108 &found_username
, &uid
, &gid
, &sam_account
);
1110 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
)) {
1111 DEBUG(3,("User %s does not exist, trying to add it\n",
1112 internal_username
));
1113 auth_add_user_script(nt_domain
, internal_username
);
1114 nt_status
= fill_sam_account(mem_ctx
, nt_domain
,
1115 internal_username
, &found_username
,
1116 &uid
, &gid
, &sam_account
);
1119 if (!NT_STATUS_IS_OK(nt_status
)) {
1120 DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
1124 if (!pdb_set_nt_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1125 pdb_free_sam(&sam_account
);
1126 return NT_STATUS_NO_MEMORY
;
1129 if (!pdb_set_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1130 pdb_free_sam(&sam_account
);
1131 return NT_STATUS_NO_MEMORY
;
1134 if (!pdb_set_domain(sam_account
, nt_domain
, PDB_CHANGED
)) {
1135 pdb_free_sam(&sam_account
);
1136 return NT_STATUS_NO_MEMORY
;
1139 if (!pdb_set_user_sid(sam_account
, &user_sid
, PDB_CHANGED
)) {
1140 pdb_free_sam(&sam_account
);
1141 return NT_STATUS_UNSUCCESSFUL
;
1144 if (!pdb_set_group_sid(sam_account
, &group_sid
, PDB_CHANGED
)) {
1145 pdb_free_sam(&sam_account
);
1146 return NT_STATUS_UNSUCCESSFUL
;
1149 if (!pdb_set_fullname(sam_account
, unistr2_static(&(info3
->uni_full_name
)),
1151 pdb_free_sam(&sam_account
);
1152 return NT_STATUS_NO_MEMORY
;
1155 if (!pdb_set_logon_script(sam_account
, unistr2_static(&(info3
->uni_logon_script
)), PDB_CHANGED
)) {
1156 pdb_free_sam(&sam_account
);
1157 return NT_STATUS_NO_MEMORY
;
1160 if (!pdb_set_profile_path(sam_account
, unistr2_static(&(info3
->uni_profile_path
)), PDB_CHANGED
)) {
1161 pdb_free_sam(&sam_account
);
1162 return NT_STATUS_NO_MEMORY
;
1165 if (!pdb_set_homedir(sam_account
, unistr2_static(&(info3
->uni_home_dir
)), PDB_CHANGED
)) {
1166 pdb_free_sam(&sam_account
);
1167 return NT_STATUS_NO_MEMORY
;
1170 if (!pdb_set_dir_drive(sam_account
, unistr2_static(&(info3
->uni_dir_drive
)), PDB_CHANGED
)) {
1171 pdb_free_sam(&sam_account
);
1172 return NT_STATUS_NO_MEMORY
;
1175 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
))) {
1176 DEBUG(4, ("make_server_info failed!\n"));
1177 pdb_free_sam(&sam_account
);
1181 /* save this here to _net_sam_logon() doesn't fail (it assumes a
1182 valid SAM_ACCOUNT) */
1184 (*server_info
)->sam_account
= sam_account
;
1186 (*server_info
)->unix_name
= smb_xstrdup(found_username
);
1188 /* Fill in the unix info we found on the way */
1190 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
1191 (*server_info
)->uid
= uid
;
1192 (*server_info
)->gid
= gid
;
1194 /* Store the user group information in the server_info
1195 returned to the caller. */
1197 nt_status
= get_user_groups((*server_info
)->unix_name
,
1198 uid
, gid
, &n_lgroupSIDs
, &lgroupSIDs
, &unix_groups
);
1200 if ( !NT_STATUS_IS_OK(nt_status
) ) {
1201 DEBUG(4,("get_user_groups failed\n"));
1205 (*server_info
)->groups
= unix_groups
;
1206 (*server_info
)->n_groups
= n_lgroupSIDs
;
1208 /* Create a 'combined' list of all SIDs we might want in the SD */
1210 all_group_SIDs
= malloc(sizeof(DOM_SID
) * (info3
->num_groups2
+info3
->num_other_sids
));
1212 if (!all_group_SIDs
) {
1213 DEBUG(0, ("malloc() failed for DOM_SID list!\n"));
1214 SAFE_FREE(lgroupSIDs
);
1215 free_server_info(server_info
);
1216 return NT_STATUS_NO_MEMORY
;
1219 #if 0 /* JERRY -- no such thing as local groups in current code */
1220 /* Copy the 'local' sids */
1221 memcpy(all_group_SIDs
, lgroupSIDs
, sizeof(DOM_SID
) * n_lgroupSIDs
);
1222 SAFE_FREE(lgroupSIDs
);
1225 /* and create (by appending rids) the 'domain' sids */
1227 for (i
= 0; i
< info3
->num_groups2
; i
++) {
1229 sid_copy(&all_group_SIDs
[i
], &(info3
->dom_sid
.sid
));
1231 if (!sid_append_rid(&all_group_SIDs
[i
], info3
->gids
[i
].g_rid
)) {
1233 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1235 DEBUG(3,("could not append additional group rid 0x%x\n",
1236 info3
->gids
[i
].g_rid
));
1238 SAFE_FREE(lgroupSIDs
);
1239 free_server_info(server_info
);
1246 /* Copy 'other' sids. We need to do sid filtering here to
1247 prevent possible elevation of privileges. See:
1249 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
1252 for (i
= 0; i
< info3
->num_other_sids
; i
++) {
1253 sid_copy(&all_group_SIDs
[info3
->num_groups2
+ i
],
1254 &info3
->other_sids
[i
].sid
);
1257 /* Where are the 'global' sids... */
1259 /* can the user be guest? if yes, where is it stored? */
1261 nt_status
= create_nt_user_token(&user_sid
, &group_sid
,
1262 info3
->num_groups2
+ info3
->num_other_sids
,
1263 all_group_SIDs
, False
, &token
);
1265 if ( !NT_STATUS_IS_OK(nt_status
) ) {
1266 DEBUG(4,("create_nt_user_token failed\n"));
1267 SAFE_FREE(all_group_SIDs
);
1268 free_server_info(server_info
);
1272 (*server_info
)->ptok
= token
;
1274 SAFE_FREE(all_group_SIDs
);
1276 /* ensure we are never given NULL session keys */
1278 if (memcmp(info3
->user_sess_key
, zeros
, sizeof(zeros
)) == 0) {
1279 (*server_info
)->user_session_key
= data_blob(NULL
, 0);
1281 (*server_info
)->user_session_key
= data_blob(info3
->user_sess_key
, sizeof(info3
->user_sess_key
));
1284 if (memcmp(info3
->padding
, zeros
, sizeof(zeros
)) == 0) {
1285 (*server_info
)->lm_session_key
= data_blob(NULL
, 0);
1287 (*server_info
)->lm_session_key
= data_blob(info3
->padding
, 16);
1289 return NT_STATUS_OK
;
1292 /***************************************************************************
1293 Free a user_info struct
1294 ***************************************************************************/
1296 void free_user_info(auth_usersupplied_info
**user_info
)
1298 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
1299 if (*user_info
!= NULL
) {
1300 if ((*user_info
)->smb_name
.str
) {
1301 DEBUG(10,("structure was created for %s\n", (*user_info
)->smb_name
.str
));
1303 SAFE_FREE((*user_info
)->smb_name
.str
);
1304 SAFE_FREE((*user_info
)->internal_username
.str
);
1305 SAFE_FREE((*user_info
)->client_domain
.str
);
1306 SAFE_FREE((*user_info
)->domain
.str
);
1307 SAFE_FREE((*user_info
)->wksta_name
.str
);
1308 data_blob_free(&(*user_info
)->lm_resp
);
1309 data_blob_free(&(*user_info
)->nt_resp
);
1310 data_blob_clear_free(&(*user_info
)->lm_interactive_pwd
);
1311 data_blob_clear_free(&(*user_info
)->nt_interactive_pwd
);
1312 data_blob_clear_free(&(*user_info
)->plaintext_password
);
1313 ZERO_STRUCT(**user_info
);
1315 SAFE_FREE(*user_info
);
1318 /***************************************************************************
1319 Clear out a server_info struct that has been allocated
1320 ***************************************************************************/
1322 void free_server_info(auth_serversupplied_info
**server_info
)
1324 DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
1325 if (*server_info
!= NULL
) {
1326 pdb_free_sam(&(*server_info
)->sam_account
);
1328 /* call pam_end here, unless we know we are keeping it */
1329 delete_nt_token( &(*server_info
)->ptok
);
1330 SAFE_FREE((*server_info
)->groups
);
1331 SAFE_FREE((*server_info
)->unix_name
);
1332 data_blob_free(&(*server_info
)->lm_session_key
);
1333 data_blob_free(&(*server_info
)->user_session_key
);
1334 ZERO_STRUCT(**server_info
);
1336 SAFE_FREE(*server_info
);
1339 /***************************************************************************
1340 Make an auth_methods struct
1341 ***************************************************************************/
1343 BOOL
make_auth_methods(struct auth_context
*auth_context
, auth_methods
**auth_method
)
1345 if (!auth_context
) {
1346 smb_panic("no auth_context supplied to make_auth_methods()!\n");
1350 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
1353 *auth_method
= talloc(auth_context
->mem_ctx
, sizeof(**auth_method
));
1354 if (!*auth_method
) {
1355 DEBUG(0,("make_auth_method: malloc failed!\n"));
1358 ZERO_STRUCTP(*auth_method
);
1363 /****************************************************************************
1365 ****************************************************************************/
1367 void delete_nt_token(NT_USER_TOKEN
**pptoken
)
1370 NT_USER_TOKEN
*ptoken
= *pptoken
;
1371 SAFE_FREE( ptoken
->user_sids
);
1372 ZERO_STRUCTP(ptoken
);
1374 SAFE_FREE(*pptoken
);
1377 /****************************************************************************
1378 Duplicate a SID token.
1379 ****************************************************************************/
1381 NT_USER_TOKEN
*dup_nt_token(NT_USER_TOKEN
*ptoken
)
1383 NT_USER_TOKEN
*token
;
1388 if ((token
= (NT_USER_TOKEN
*)malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
)
1391 ZERO_STRUCTP(token
);
1393 if ((token
->user_sids
= (DOM_SID
*)memdup( ptoken
->user_sids
, sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
1398 token
->num_sids
= ptoken
->num_sids
;
1404 * Squash an NT_STATUS in line with security requirements.
1405 * In an attempt to avoid giving the whole game away when users
1406 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
1407 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
1408 * (session setups in particular).
1410 * @param nt_status NTSTATUS input for squashing.
1411 * @return the 'squashed' nt_status
1414 NTSTATUS
nt_status_squash(NTSTATUS nt_status
)
1416 if NT_STATUS_IS_OK(nt_status
) {
1418 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
) {
1419 /* Match WinXP and don't give the game away */
1420 return NT_STATUS_LOGON_FAILURE
;
1422 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_WRONG_PASSWORD
) {
1423 /* Match WinXP and don't give the game away */
1424 return NT_STATUS_LOGON_FAILURE
;
1432 * Verify whether or not given domain is trusted.
1434 * @param domain_name name of the domain to be verified
1435 * @return true if domain is one of the trusted once or
1436 * false if otherwise
1439 BOOL
is_trusted_domain(const char* dom_name
)
1441 DOM_SID trustdom_sid
;
1446 /* no trusted domains for a standalone server */
1448 if ( lp_server_role() == ROLE_STANDALONE
)
1451 /* if we are a DC, then check for a direct trust relationships */
1453 if (lp_server_role() == ROLE_DOMAIN_BDC
|| lp_server_role() == ROLE_DOMAIN_PDC
) {
1455 ret
= secrets_fetch_trusted_domain_password(dom_name
, &pass
, &trustdom_sid
, &lct
);
1462 /* if winbindd is not up and we are a domain member) then we need to update the
1463 trustdom_cache ourselves */
1465 if ( !winbind_ping() )
1466 update_trustdom_cache();
1469 /* now the trustdom cache should be available a DC could still
1470 * have a transitive trust so fall back to the cache of trusted
1471 * domains (like a domain member would use */
1473 if ( trustdom_cache_fetch(dom_name
, &trustdom_sid
) ) {