2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2011
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006-2008
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
28 #include "rpc_client/init_lsa.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/util_pw.h"
31 #include "lib/winbind_util.h"
33 #include "../librpc/gen_ndr/ndr_auth.h"
34 #include "../auth/auth_sam_reply.h"
35 #include "../librpc/gen_ndr/idmap.h"
38 #define DBGC_CLASS DBGC_AUTH
40 /****************************************************************************
41 Create a UNIX user on demand.
42 ****************************************************************************/
44 static int _smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
46 TALLOC_CTX
*ctx
= talloc_tos();
50 add_script
= talloc_strdup(ctx
, lp_adduser_script());
51 if (!add_script
|| !*add_script
) {
54 add_script
= talloc_all_string_sub(ctx
,
62 add_script
= talloc_all_string_sub(ctx
,
71 add_script
= talloc_all_string_sub(ctx
,
79 ret
= smbrun(add_script
,NULL
);
82 ("smb_create_user: Running the command `%s' gave %d\n",
87 /****************************************************************************
88 Create an auth_usersupplied_data structure after appropriate mapping.
89 ****************************************************************************/
91 NTSTATUS
make_user_info_map(struct auth_usersupplied_info
**user_info
,
93 const char *client_domain
,
94 const char *workstation_name
,
95 const struct tsocket_address
*remote_address
,
96 const DATA_BLOB
*lm_pwd
,
97 const DATA_BLOB
*nt_pwd
,
98 const struct samr_Password
*lm_interactive_pwd
,
99 const struct samr_Password
*nt_interactive_pwd
,
100 const char *plaintext
,
101 enum auth_password_state password_state
)
106 char *internal_username
= NULL
;
108 was_mapped
= map_username(talloc_tos(), smb_name
, &internal_username
);
109 if (!internal_username
) {
110 return NT_STATUS_NO_MEMORY
;
113 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
114 client_domain
, smb_name
, workstation_name
));
116 domain
= client_domain
;
118 /* If you connect to a Windows domain member using a bogus domain name,
119 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
120 * the Windows box is a DC the name will become DOMAIN\user and be
121 * authenticated against AD, if the Windows box is a member server but
122 * not a DC the name will become WORKSTATION\user. A standalone
123 * non-domain member box will also map to WORKSTATION\user.
124 * This also deals with the client passing in a "" domain */
126 if (!is_trusted_domain(domain
) &&
127 !strequal(domain
, my_sam_name()))
129 if (lp_map_untrusted_to_domain())
130 domain
= my_sam_name();
132 domain
= get_global_sam_name();
133 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
134 "workstation [%s]\n",
135 client_domain
, domain
, smb_name
, workstation_name
));
138 /* We know that the given domain is trusted (and we are allowing them),
139 * it is our global SAM name, or for legacy behavior it is our
140 * primary domain name */
142 result
= make_user_info(user_info
, smb_name
, internal_username
,
143 client_domain
, domain
, workstation_name
,
144 remote_address
, lm_pwd
, nt_pwd
,
145 lm_interactive_pwd
, nt_interactive_pwd
,
146 plaintext
, password_state
);
147 if (NT_STATUS_IS_OK(result
)) {
148 /* We have tried mapping */
149 (*user_info
)->mapped_state
= true;
150 /* did we actually map the user to a different name? */
151 (*user_info
)->was_mapped
= was_mapped
;
156 /****************************************************************************
157 Create an auth_usersupplied_data, making the DATA_BLOBs here.
158 Decrypt and encrypt the passwords.
159 ****************************************************************************/
161 bool make_user_info_netlogon_network(struct auth_usersupplied_info
**user_info
,
162 const char *smb_name
,
163 const char *client_domain
,
164 const char *workstation_name
,
165 const struct tsocket_address
*remote_address
,
166 uint32 logon_parameters
,
167 const uchar
*lm_network_pwd
,
169 const uchar
*nt_network_pwd
,
174 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
175 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
177 status
= make_user_info_map(user_info
,
178 smb_name
, client_domain
,
181 lm_pwd_len
? &lm_blob
: NULL
,
182 nt_pwd_len
? &nt_blob
: NULL
,
184 AUTH_PASSWORD_RESPONSE
);
186 if (NT_STATUS_IS_OK(status
)) {
187 (*user_info
)->logon_parameters
= logon_parameters
;
189 ret
= NT_STATUS_IS_OK(status
) ? true : false;
191 data_blob_free(&lm_blob
);
192 data_blob_free(&nt_blob
);
196 /****************************************************************************
197 Create an auth_usersupplied_data, making the DATA_BLOBs here.
198 Decrypt and encrypt the passwords.
199 ****************************************************************************/
201 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info
**user_info
,
202 const char *smb_name
,
203 const char *client_domain
,
204 const char *workstation_name
,
205 const struct tsocket_address
*remote_address
,
206 uint32 logon_parameters
,
208 const uchar lm_interactive_pwd
[16],
209 const uchar nt_interactive_pwd
[16],
210 const uchar
*dc_sess_key
)
212 struct samr_Password lm_pwd
;
213 struct samr_Password nt_pwd
;
214 unsigned char local_lm_response
[24];
215 unsigned char local_nt_response
[24];
216 unsigned char key
[16];
218 memcpy(key
, dc_sess_key
, 16);
220 if (lm_interactive_pwd
)
221 memcpy(lm_pwd
.hash
, lm_interactive_pwd
, sizeof(lm_pwd
.hash
));
223 if (nt_interactive_pwd
)
224 memcpy(nt_pwd
.hash
, nt_interactive_pwd
, sizeof(nt_pwd
.hash
));
226 #ifdef DEBUG_PASSWORD
228 dump_data(100, key
, sizeof(key
));
230 DEBUG(100,("lm owf password:"));
231 dump_data(100, lm_pwd
.hash
, sizeof(lm_pwd
.hash
));
233 DEBUG(100,("nt owf password:"));
234 dump_data(100, nt_pwd
.hash
, sizeof(nt_pwd
.hash
));
237 if (lm_interactive_pwd
)
238 arcfour_crypt(lm_pwd
.hash
, key
, sizeof(lm_pwd
.hash
));
240 if (nt_interactive_pwd
)
241 arcfour_crypt(nt_pwd
.hash
, key
, sizeof(nt_pwd
.hash
));
243 #ifdef DEBUG_PASSWORD
244 DEBUG(100,("decrypt of lm owf password:"));
245 dump_data(100, lm_pwd
.hash
, sizeof(lm_pwd
));
247 DEBUG(100,("decrypt of nt owf password:"));
248 dump_data(100, nt_pwd
.hash
, sizeof(nt_pwd
));
251 if (lm_interactive_pwd
)
252 SMBOWFencrypt(lm_pwd
.hash
, chal
,
255 if (nt_interactive_pwd
)
256 SMBOWFencrypt(nt_pwd
.hash
, chal
,
259 /* Password info paranoia */
265 DATA_BLOB local_lm_blob
;
266 DATA_BLOB local_nt_blob
;
268 if (lm_interactive_pwd
) {
269 local_lm_blob
= data_blob(local_lm_response
,
270 sizeof(local_lm_response
));
273 if (nt_interactive_pwd
) {
274 local_nt_blob
= data_blob(local_nt_response
,
275 sizeof(local_nt_response
));
278 nt_status
= make_user_info_map(
280 smb_name
, client_domain
, workstation_name
,
282 lm_interactive_pwd
? &local_lm_blob
: NULL
,
283 nt_interactive_pwd
? &local_nt_blob
: NULL
,
284 lm_interactive_pwd
? &lm_pwd
: NULL
,
285 nt_interactive_pwd
? &nt_pwd
: NULL
,
286 NULL
, AUTH_PASSWORD_HASH
);
288 if (NT_STATUS_IS_OK(nt_status
)) {
289 (*user_info
)->logon_parameters
= logon_parameters
;
292 ret
= NT_STATUS_IS_OK(nt_status
) ? true : false;
293 data_blob_free(&local_lm_blob
);
294 data_blob_free(&local_nt_blob
);
300 /****************************************************************************
301 Create an auth_usersupplied_data structure
302 ****************************************************************************/
304 bool make_user_info_for_reply(struct auth_usersupplied_info
**user_info
,
305 const char *smb_name
,
306 const char *client_domain
,
307 const struct tsocket_address
*remote_address
,
309 DATA_BLOB plaintext_password
)
312 DATA_BLOB local_lm_blob
;
313 DATA_BLOB local_nt_blob
;
314 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
315 char *plaintext_password_string
;
317 * Not encrypted - do so.
320 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
322 if (plaintext_password
.data
&& plaintext_password
.length
) {
323 unsigned char local_lm_response
[24];
325 #ifdef DEBUG_PASSWORD
326 DEBUG(10,("Unencrypted password (len %d):\n",
327 (int)plaintext_password
.length
));
328 dump_data(100, plaintext_password
.data
,
329 plaintext_password
.length
);
332 SMBencrypt( (const char *)plaintext_password
.data
,
333 (const uchar
*)chal
, local_lm_response
);
334 local_lm_blob
= data_blob(local_lm_response
, 24);
336 /* We can't do an NT hash here, as the password needs to be
338 local_nt_blob
= data_blob_null
;
340 local_lm_blob
= data_blob_null
;
341 local_nt_blob
= data_blob_null
;
344 plaintext_password_string
= talloc_strndup(talloc_tos(),
345 (const char *)plaintext_password
.data
,
346 plaintext_password
.length
);
347 if (!plaintext_password_string
) {
351 ret
= make_user_info(
352 user_info
, smb_name
, smb_name
, client_domain
, client_domain
,
353 get_remote_machine_name(),
355 local_lm_blob
.data
? &local_lm_blob
: NULL
,
356 local_nt_blob
.data
? &local_nt_blob
: NULL
,
358 plaintext_password_string
,
359 AUTH_PASSWORD_PLAIN
);
361 if (plaintext_password_string
) {
362 memset(plaintext_password_string
, '\0', strlen(plaintext_password_string
));
363 talloc_free(plaintext_password_string
);
366 data_blob_free(&local_lm_blob
);
367 return NT_STATUS_IS_OK(ret
) ? true : false;
370 /****************************************************************************
371 Create an auth_usersupplied_data structure
372 ****************************************************************************/
374 NTSTATUS
make_user_info_for_reply_enc(struct auth_usersupplied_info
**user_info
,
375 const char *smb_name
,
376 const char *client_domain
,
377 const struct tsocket_address
*remote_address
,
378 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
380 return make_user_info(user_info
, smb_name
, smb_name
,
381 client_domain
, client_domain
,
382 get_remote_machine_name(),
384 lm_resp
.data
&& (lm_resp
.length
> 0) ? &lm_resp
: NULL
,
385 nt_resp
.data
&& (nt_resp
.length
> 0) ? &nt_resp
: NULL
,
387 AUTH_PASSWORD_RESPONSE
);
390 /****************************************************************************
391 Create a guest user_info blob, for anonymous authentication.
392 ****************************************************************************/
394 bool make_user_info_guest(const struct tsocket_address
*remote_address
,
395 struct auth_usersupplied_info
**user_info
)
399 nt_status
= make_user_info(user_info
,
407 AUTH_PASSWORD_RESPONSE
);
409 return NT_STATUS_IS_OK(nt_status
) ? true : false;
412 static NTSTATUS
log_nt_token(struct security_token
*token
)
414 TALLOC_CTX
*frame
= talloc_stackframe();
419 if ((lp_log_nt_token_command() == NULL
) ||
420 (strlen(lp_log_nt_token_command()) == 0)) {
425 group_sidstr
= talloc_strdup(frame
, "");
426 for (i
=1; i
<token
->num_sids
; i
++) {
427 group_sidstr
= talloc_asprintf(
428 frame
, "%s %s", group_sidstr
,
429 sid_string_talloc(frame
, &token
->sids
[i
]));
432 command
= talloc_string_sub(
433 frame
, lp_log_nt_token_command(),
434 "%s", sid_string_talloc(frame
, &token
->sids
[0]));
435 command
= talloc_string_sub(frame
, command
, "%t", group_sidstr
);
437 if (command
== NULL
) {
439 return NT_STATUS_NO_MEMORY
;
442 DEBUG(8, ("running command: [%s]\n", command
));
443 if (smbrun(command
, NULL
) != 0) {
444 DEBUG(0, ("Could not log NT token\n"));
446 return NT_STATUS_ACCESS_DENIED
;
454 * Create the token to use from server_info->info3 and
455 * server_info->sids (the info3/sam groups). Find the unix gids.
458 NTSTATUS
create_local_token(TALLOC_CTX
*mem_ctx
,
459 const struct auth_serversupplied_info
*server_info
,
460 DATA_BLOB
*session_key
,
461 const char *smb_username
, /* for ->sanitized_username, for %U subs */
462 struct auth_session_info
**session_info_out
)
464 struct security_token
*t
;
467 struct dom_sid tmp_sid
;
468 struct auth_session_info
*session_info
;
472 /* Ensure we can't possible take a code path leading to a
475 return NT_STATUS_LOGON_FAILURE
;
478 session_info
= talloc_zero(mem_ctx
, struct auth_session_info
);
480 return NT_STATUS_NO_MEMORY
;
483 session_info
->unix_token
= talloc_zero(session_info
, struct security_unix_token
);
484 if (!session_info
->unix_token
) {
485 TALLOC_FREE(session_info
);
486 return NT_STATUS_NO_MEMORY
;
489 session_info
->unix_token
->uid
= server_info
->utok
.uid
;
490 session_info
->unix_token
->gid
= server_info
->utok
.gid
;
492 session_info
->unix_info
= talloc_zero(session_info
, struct auth_user_info_unix
);
493 if (!session_info
->unix_info
) {
494 TALLOC_FREE(session_info
);
495 return NT_STATUS_NO_MEMORY
;
498 session_info
->unix_info
->unix_name
= talloc_strdup(session_info
, server_info
->unix_name
);
499 if (!session_info
->unix_info
->unix_name
) {
500 TALLOC_FREE(session_info
);
501 return NT_STATUS_NO_MEMORY
;
504 /* This is a potentially untrusted username for use in %U */
505 alpha_strcpy(tmp
, smb_username
, ". _-$", sizeof(tmp
));
506 session_info
->unix_info
->sanitized_username
=
507 talloc_strdup(session_info
->unix_info
, tmp
);
509 session_info
->unix_info
->system
= server_info
->system
;
512 data_blob_free(&session_info
->session_key
);
513 session_info
->session_key
= data_blob_talloc(session_info
,
515 session_key
->length
);
516 if (!session_info
->session_key
.data
&& session_key
->length
) {
517 return NT_STATUS_NO_MEMORY
;
520 session_info
->session_key
= data_blob_talloc( session_info
, server_info
->session_key
.data
,
521 server_info
->session_key
.length
);
524 /* We need to populate session_info->info with the information found in server_info->info3 */
525 status
= make_user_info_SamBaseInfo(session_info
, "", &server_info
->info3
->base
,
526 server_info
->guest
== false,
527 &session_info
->info
);
528 if (!NT_STATUS_IS_OK(status
)) {
529 DEBUG(0, ("conversion of info3 into auth_user_info failed!\n"));
530 TALLOC_FREE(session_info
);
534 if (server_info
->security_token
) {
535 /* Just copy the token, it has already been finalised
536 * (nasty hack to support a cached guest session_info,
537 * and a possible strategy for auth_samba4 to pass in
538 * a finalised session) */
540 session_info
->security_token
= dup_nt_token(session_info
, server_info
->security_token
);
541 if (!session_info
->security_token
) {
542 TALLOC_FREE(session_info
);
543 return NT_STATUS_NO_MEMORY
;
546 session_info
->unix_token
->ngroups
= server_info
->utok
.ngroups
;
547 if (server_info
->utok
.ngroups
!= 0) {
548 session_info
->unix_token
->groups
= (gid_t
*)talloc_memdup(
549 session_info
->unix_token
, server_info
->utok
.groups
,
550 sizeof(gid_t
)*session_info
->unix_token
->ngroups
);
552 session_info
->unix_token
->groups
= NULL
;
555 *session_info_out
= session_info
;
560 * If winbind is not around, we can not make much use of the SIDs the
561 * domain controller provided us with. Likewise if the user name was
562 * mapped to some local unix user.
565 if (((lp_server_role() == ROLE_DOMAIN_MEMBER
) && !winbind_ping()) ||
566 (server_info
->nss_token
)) {
567 char *found_username
= NULL
;
568 status
= create_token_from_username(session_info
,
569 server_info
->unix_name
,
571 &session_info
->unix_token
->uid
,
572 &session_info
->unix_token
->gid
,
574 &session_info
->security_token
);
575 if (NT_STATUS_IS_OK(status
)) {
576 session_info
->unix_info
->unix_name
= found_username
;
579 status
= create_local_nt_token_from_info3(session_info
,
583 &session_info
->security_token
);
586 if (!NT_STATUS_IS_OK(status
)) {
590 /* Convert the SIDs to gids. */
592 session_info
->unix_token
->ngroups
= 0;
593 session_info
->unix_token
->groups
= NULL
;
595 t
= session_info
->security_token
;
597 ids
= talloc_array(talloc_tos(), struct unixid
,
600 return NT_STATUS_NO_MEMORY
;
603 if (!sids_to_unixids(t
->sids
, t
->num_sids
, ids
)) {
605 return NT_STATUS_NO_MEMORY
;
608 for (i
=0; i
<t
->num_sids
; i
++) {
610 if (i
== 0 && ids
[i
].type
!= ID_TYPE_BOTH
) {
614 if (ids
[i
].type
!= ID_TYPE_GID
&&
615 ids
[i
].type
!= ID_TYPE_BOTH
) {
616 DEBUG(10, ("Could not convert SID %s to gid, "
618 sid_string_dbg(&t
->sids
[i
])));
621 if (!add_gid_to_array_unique(session_info
, ids
[i
].id
,
622 &session_info
->unix_token
->groups
,
623 &session_info
->unix_token
->ngroups
)) {
624 return NT_STATUS_NO_MEMORY
;
629 * Add the "Unix Group" SID for each gid to catch mapped groups
630 * and their Unix equivalent. This is to solve the backwards
631 * compatibility problem of 'valid users = +ntadmin' where
632 * ntadmin has been paired with "Domain Admins" in the group
633 * mapping table. Otherwise smb.conf would need to be changed
634 * to 'valid user = "Domain Admins"'. --jerry
636 * For consistency we also add the "Unix User" SID,
637 * so that the complete unix token is represented within
641 uid_to_unix_users_sid(session_info
->unix_token
->uid
, &tmp_sid
);
643 add_sid_to_array_unique(session_info
->security_token
, &tmp_sid
,
644 &session_info
->security_token
->sids
,
645 &session_info
->security_token
->num_sids
);
647 for ( i
=0; i
<session_info
->unix_token
->ngroups
; i
++ ) {
648 gid_to_unix_groups_sid(session_info
->unix_token
->groups
[i
], &tmp_sid
);
649 add_sid_to_array_unique(session_info
->security_token
, &tmp_sid
,
650 &session_info
->security_token
->sids
,
651 &session_info
->security_token
->num_sids
);
654 security_token_debug(DBGC_AUTH
, 10, session_info
->security_token
);
655 debug_unix_user_token(DBGC_AUTH
, 10,
656 session_info
->unix_token
->uid
,
657 session_info
->unix_token
->gid
,
658 session_info
->unix_token
->ngroups
,
659 session_info
->unix_token
->groups
);
661 status
= log_nt_token(session_info
->security_token
);
662 if (!NT_STATUS_IS_OK(status
)) {
666 *session_info_out
= session_info
;
670 /***************************************************************************
671 Make (and fill) a server_info struct from a 'struct passwd' by conversion
673 ***************************************************************************/
675 NTSTATUS
make_server_info_pw(struct auth_serversupplied_info
**server_info
,
680 struct samu
*sampass
= NULL
;
681 char *qualified_name
= NULL
;
682 TALLOC_CTX
*mem_ctx
= NULL
;
683 struct dom_sid u_sid
;
684 enum lsa_SidType type
;
685 struct auth_serversupplied_info
*result
;
688 * The SID returned in server_info->sam_account is based
689 * on our SAM sid even though for a pure UNIX account this should
690 * not be the case as it doesn't really exist in the SAM db.
691 * This causes lookups on "[in]valid users" to fail as they
692 * will lookup this name as a "Unix User" SID to check against
693 * the user token. Fix this by adding the "Unix User"\unix_username
694 * SID to the sid array. The correct fix should probably be
695 * changing the server_info->sam_account user SID to be a
696 * S-1-22 Unix SID, but this might break old configs where
697 * plaintext passwords were used with no SAM backend.
700 mem_ctx
= talloc_init("make_server_info_pw_tmp");
702 return NT_STATUS_NO_MEMORY
;
705 qualified_name
= talloc_asprintf(mem_ctx
, "%s\\%s",
706 unix_users_domain_name(),
708 if (!qualified_name
) {
709 TALLOC_FREE(mem_ctx
);
710 return NT_STATUS_NO_MEMORY
;
713 if (!lookup_name(mem_ctx
, qualified_name
, LOOKUP_NAME_ALL
,
716 TALLOC_FREE(mem_ctx
);
717 return NT_STATUS_NO_SUCH_USER
;
720 TALLOC_FREE(mem_ctx
);
722 if (type
!= SID_NAME_USER
) {
723 return NT_STATUS_NO_SUCH_USER
;
726 if ( !(sampass
= samu_new( NULL
)) ) {
727 return NT_STATUS_NO_MEMORY
;
730 status
= samu_set_unix( sampass
, pwd
);
731 if (!NT_STATUS_IS_OK(status
)) {
735 /* In pathological cases the above call can set the account
736 * name to the DOMAIN\username form. Reset the account name
737 * using unix_username */
738 pdb_set_username(sampass
, unix_username
, PDB_SET
);
740 /* set the user sid to be the calculated u_sid */
741 pdb_set_user_sid(sampass
, &u_sid
, PDB_SET
);
743 result
= make_server_info(NULL
);
744 if (result
== NULL
) {
745 TALLOC_FREE(sampass
);
746 return NT_STATUS_NO_MEMORY
;
749 status
= samu_to_SamInfo3(result
, sampass
, lp_netbios_name(),
750 &result
->info3
, &result
->extra
);
751 TALLOC_FREE(sampass
);
752 if (!NT_STATUS_IS_OK(status
)) {
753 DEBUG(10, ("Failed to convert samu to info3: %s\n",
759 result
->unix_name
= talloc_strdup(result
, unix_username
);
761 if (result
->unix_name
== NULL
) {
763 return NT_STATUS_NO_MEMORY
;
766 result
->utok
.uid
= pwd
->pw_uid
;
767 result
->utok
.gid
= pwd
->pw_gid
;
769 *server_info
= result
;
774 static NTSTATUS
get_system_info3(TALLOC_CTX
*mem_ctx
,
776 struct netr_SamInfo3
*info3
)
778 struct dom_sid domain_sid
;
781 /* Set account name */
782 tmp
= talloc_strdup(mem_ctx
, pwd
->pw_name
);
784 return NT_STATUS_NO_MEMORY
;
786 init_lsa_String(&info3
->base
.account_name
, tmp
);
788 /* Set domain name */
789 tmp
= talloc_strdup(mem_ctx
, get_global_sam_name());
791 return NT_STATUS_NO_MEMORY
;
793 init_lsa_StringLarge(&info3
->base
.logon_domain
, tmp
);
796 sid_copy(&domain_sid
, get_global_sam_sid());
798 info3
->base
.domain_sid
= dom_sid_dup(mem_ctx
, &domain_sid
);
799 if (info3
->base
.domain_sid
== NULL
) {
800 return NT_STATUS_NO_MEMORY
;
804 info3
->base
.rid
= DOMAIN_RID_ADMINISTRATOR
;
807 info3
->base
.primary_gid
= dom_sid_parse_talloc(mem_ctx
, SID_NT_SYSTEM
);
812 static NTSTATUS
get_guest_info3(TALLOC_CTX
*mem_ctx
,
813 struct netr_SamInfo3
*info3
)
815 const char *guest_account
= lp_guestaccount();
816 struct dom_sid domain_sid
;
820 pwd
= Get_Pwnam_alloc(mem_ctx
, guest_account
);
822 DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
823 "account [%s]!\n", guest_account
));
824 return NT_STATUS_NO_SUCH_USER
;
827 /* Set account name */
828 tmp
= talloc_strdup(mem_ctx
, pwd
->pw_name
);
830 return NT_STATUS_NO_MEMORY
;
832 init_lsa_String(&info3
->base
.account_name
, tmp
);
834 /* Set domain name */
835 tmp
= talloc_strdup(mem_ctx
, get_global_sam_name());
837 return NT_STATUS_NO_MEMORY
;
839 init_lsa_StringLarge(&info3
->base
.logon_domain
, tmp
);
842 sid_copy(&domain_sid
, get_global_sam_sid());
844 info3
->base
.domain_sid
= dom_sid_dup(mem_ctx
, &domain_sid
);
845 if (info3
->base
.domain_sid
== NULL
) {
846 return NT_STATUS_NO_MEMORY
;
850 info3
->base
.rid
= DOMAIN_RID_GUEST
;
853 info3
->base
.primary_gid
= BUILTIN_RID_GUESTS
;
856 info3
->base
.user_flags
= NETLOGON_GUEST
;
862 /***************************************************************************
863 Make (and fill) a user_info struct for a guest login.
864 This *must* succeed for smbd to start. If there is no mapping entry for
865 the guest gid, then create one.
867 The resulting structure is a 'session_info' because
868 create_local_token() has already been called on it. This is quite
869 nasty, as the auth subsystem isn't expect this, but the behavior is
871 ***************************************************************************/
873 static NTSTATUS
make_new_session_info_guest(struct auth_session_info
**session_info
, struct auth_serversupplied_info
**server_info
)
875 static const char zeros
[16] = {0};
876 const char *guest_account
= lp_guestaccount();
877 const char *domain
= lp_netbios_name();
878 struct netr_SamInfo3 info3
;
882 tmp_ctx
= talloc_stackframe();
883 if (tmp_ctx
== NULL
) {
884 return NT_STATUS_NO_MEMORY
;
889 status
= get_guest_info3(tmp_ctx
, &info3
);
890 if (!NT_STATUS_IS_OK(status
)) {
891 DEBUG(0, ("get_guest_info3 failed with %s\n",
896 status
= make_server_info_info3(tmp_ctx
,
901 if (!NT_STATUS_IS_OK(status
)) {
902 DEBUG(0, ("make_server_info_info3 failed with %s\n",
907 (*server_info
)->guest
= true;
909 /* This should not be done here (we should produce a server
910 * info, and later construct a session info from it), but for
911 * now this does not change the previous behavior */
912 status
= create_local_token(tmp_ctx
, *server_info
, NULL
,
913 (*server_info
)->info3
->base
.account_name
.string
,
915 if (!NT_STATUS_IS_OK(status
)) {
916 DEBUG(0, ("create_local_token failed: %s\n",
920 talloc_steal(NULL
, *session_info
);
921 talloc_steal(NULL
, *server_info
);
923 /* annoying, but the Guest really does have a session key, and it is
925 (*session_info
)->session_key
= data_blob(zeros
, sizeof(zeros
));
927 status
= NT_STATUS_OK
;
929 TALLOC_FREE(tmp_ctx
);
933 /****************************************************************************
934 Fake a auth_session_info just from a username (as a
935 session_info structure, with create_local_token() already called on
937 ****************************************************************************/
939 static NTSTATUS
make_system_session_info_from_pw(TALLOC_CTX
*mem_ctx
,
941 struct auth_session_info
**session_info
)
943 struct auth_serversupplied_info
*server_info
;
944 const char *domain
= lp_netbios_name();
945 struct netr_SamInfo3 info3
;
949 tmp_ctx
= talloc_stackframe();
950 if (tmp_ctx
== NULL
) {
951 return NT_STATUS_NO_MEMORY
;
956 status
= get_system_info3(tmp_ctx
, pwd
, &info3
);
957 if (!NT_STATUS_IS_OK(status
)) {
958 DEBUG(0, ("Failed creating system info3 with %s\n",
963 status
= make_server_info_info3(tmp_ctx
,
968 if (!NT_STATUS_IS_OK(status
)) {
969 DEBUG(0, ("make_server_info_info3 failed with %s\n",
974 server_info
->nss_token
= true;
976 /* Now turn the server_info into a session_info with the full token etc */
977 status
= create_local_token(mem_ctx
, server_info
, NULL
, pwd
->pw_name
, session_info
);
978 if (!NT_STATUS_IS_OK(status
)) {
979 DEBUG(0, ("create_local_token failed: %s\n",
984 talloc_free(server_info
);
985 talloc_steal(mem_ctx
, *session_info
);
987 status
= NT_STATUS_OK
;
989 TALLOC_FREE(tmp_ctx
);
993 static NTSTATUS
make_session_info_from_pw(TALLOC_CTX
*mem_ctx
,
996 struct auth_session_info
**session_info
)
998 struct auth_serversupplied_info
*result
;
1001 status
= make_server_info_pw(&result
, pwd
->pw_name
, pwd
);
1003 if (!NT_STATUS_IS_OK(status
)) {
1007 result
->nss_token
= true;
1008 result
->guest
= is_guest
;
1010 /* Now turn the server_info into a session_info with the full token etc */
1011 status
= create_local_token(mem_ctx
, result
, NULL
, pwd
->pw_name
, session_info
);
1012 talloc_free(result
);
1016 /***************************************************************************
1017 Make (and fill) a auth_session_info struct for a system user login.
1018 This *must* succeed for smbd to start.
1019 ***************************************************************************/
1021 static NTSTATUS
make_new_session_info_system(TALLOC_CTX
*mem_ctx
,
1022 struct auth_session_info
**session_info
)
1027 pwd
= getpwuid_alloc(mem_ctx
, sec_initial_uid());
1029 return NT_STATUS_NO_SUCH_USER
;
1032 status
= make_system_session_info_from_pw(mem_ctx
,
1036 if (!NT_STATUS_IS_OK(status
)) {
1040 (*session_info
)->unix_info
->system
= true;
1042 status
= add_sid_to_array_unique((*session_info
)->security_token
->sids
,
1044 &(*session_info
)->security_token
->sids
,
1045 &(*session_info
)->security_token
->num_sids
);
1046 if (!NT_STATUS_IS_OK(status
)) {
1047 TALLOC_FREE((*session_info
));
1051 return NT_STATUS_OK
;
1054 /****************************************************************************
1055 Fake a auth_session_info just from a username (as a
1056 session_info structure, with create_local_token() already called on
1058 ****************************************************************************/
1060 NTSTATUS
make_session_info_from_username(TALLOC_CTX
*mem_ctx
,
1061 const char *username
,
1063 struct auth_session_info
**session_info
)
1068 pwd
= Get_Pwnam_alloc(talloc_tos(), username
);
1070 return NT_STATUS_NO_SUCH_USER
;
1073 status
= make_session_info_from_pw(mem_ctx
, pwd
, is_guest
, session_info
);
1075 if (!NT_STATUS_IS_OK(status
)) {
1084 /* This function MUST only used to create the cached server_info for
1087 * This is a lossy conversion. Variables known to be lost so far
1090 * - nss_token (not needed because the only read doesn't happen
1091 * for the GUEST user, as this routine populates ->security_token
1093 * - extra (not needed because the guest account must have valid RIDs per the output of get_guest_info3())
1095 * - The 'server_info' parameter allows the missing 'info3' to be copied across.
1097 static struct auth_serversupplied_info
*copy_session_info_serverinfo_guest(TALLOC_CTX
*mem_ctx
,
1098 const struct auth_session_info
*src
,
1099 struct auth_serversupplied_info
*server_info
)
1101 struct auth_serversupplied_info
*dst
;
1103 dst
= make_server_info(mem_ctx
);
1108 /* This element must be provided to convert back to an auth_serversupplied_info */
1109 SMB_ASSERT(src
->unix_info
);
1112 dst
->system
= false;
1114 /* This element must be provided to convert back to an
1115 * auth_serversupplied_info. This needs to be from the
1116 * auth_session_info because the group values in particular
1117 * may change during create_local_token() processing */
1118 SMB_ASSERT(src
->unix_token
);
1119 dst
->utok
.uid
= src
->unix_token
->uid
;
1120 dst
->utok
.gid
= src
->unix_token
->gid
;
1121 dst
->utok
.ngroups
= src
->unix_token
->ngroups
;
1122 if (src
->unix_token
->ngroups
!= 0) {
1123 dst
->utok
.groups
= (gid_t
*)talloc_memdup(
1124 dst
, src
->unix_token
->groups
,
1125 sizeof(gid_t
)*dst
->utok
.ngroups
);
1127 dst
->utok
.groups
= NULL
;
1130 /* We must have a security_token as otherwise the lossy
1131 * conversion without nss_token would cause create_local_token
1132 * to take the wrong path */
1133 SMB_ASSERT(src
->security_token
);
1135 dst
->security_token
= dup_nt_token(dst
, src
->security_token
);
1136 if (!dst
->security_token
) {
1141 dst
->session_key
= data_blob_talloc( dst
, src
->session_key
.data
,
1142 src
->session_key
.length
);
1144 /* This is OK because this functions is only used for the
1145 * GUEST account, which has all-zero keys for both values */
1146 dst
->lm_session_key
= data_blob_talloc(dst
, src
->session_key
.data
,
1147 src
->session_key
.length
);
1149 dst
->info3
= copy_netr_SamInfo3(dst
, server_info
->info3
);
1155 dst
->unix_name
= talloc_strdup(dst
, src
->unix_info
->unix_name
);
1156 if (!dst
->unix_name
) {
1164 struct auth_session_info
*copy_session_info(TALLOC_CTX
*mem_ctx
,
1165 const struct auth_session_info
*src
)
1167 struct auth_session_info
*dst
;
1169 enum ndr_err_code ndr_err
;
1171 ndr_err
= ndr_push_struct_blob(
1172 &blob
, talloc_tos(), src
,
1173 (ndr_push_flags_fn_t
)ndr_push_auth_session_info
);
1174 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1175 DEBUG(0, ("copy_session_info(): ndr_push_auth_session_info failed: "
1176 "%s\n", ndr_errstr(ndr_err
)));
1180 dst
= talloc(mem_ctx
, struct auth_session_info
);
1182 DEBUG(0, ("talloc failed\n"));
1183 TALLOC_FREE(blob
.data
);
1187 ndr_err
= ndr_pull_struct_blob(
1189 (ndr_pull_flags_fn_t
)ndr_pull_auth_session_info
);
1190 TALLOC_FREE(blob
.data
);
1192 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1193 DEBUG(0, ("copy_session_info(): ndr_pull_auth_session_info failed: "
1194 "%s\n", ndr_errstr(ndr_err
)));
1203 * Set a new session key. Used in the rpc server where we have to override the
1204 * SMB level session key with SystemLibraryDTC
1207 bool session_info_set_session_key(struct auth_session_info
*info
,
1208 DATA_BLOB session_key
)
1210 TALLOC_FREE(info
->session_key
.data
);
1212 info
->session_key
= data_blob_talloc(
1213 info
, session_key
.data
, session_key
.length
);
1215 return (info
->session_key
.data
!= NULL
);
1218 static struct auth_session_info
*guest_info
= NULL
;
1220 static struct auth_serversupplied_info
*guest_server_info
= NULL
;
1222 bool init_guest_info(void)
1224 if (guest_info
!= NULL
)
1227 return NT_STATUS_IS_OK(make_new_session_info_guest(&guest_info
, &guest_server_info
));
1230 NTSTATUS
make_server_info_guest(TALLOC_CTX
*mem_ctx
,
1231 struct auth_serversupplied_info
**server_info
)
1233 /* This is trickier than it would appear to need to be because
1234 * we are trying to avoid certain costly operations when the
1235 * structure is converted to a 'auth_session_info' again in
1236 * create_local_token() */
1237 *server_info
= copy_session_info_serverinfo_guest(mem_ctx
, guest_info
, guest_server_info
);
1238 return (*server_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1241 NTSTATUS
make_session_info_guest(TALLOC_CTX
*mem_ctx
,
1242 struct auth_session_info
**session_info
)
1244 *session_info
= copy_session_info(mem_ctx
, guest_info
);
1245 return (*session_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1248 static struct auth_session_info
*system_info
= NULL
;
1250 NTSTATUS
init_system_session_info(void)
1252 if (system_info
!= NULL
)
1253 return NT_STATUS_OK
;
1255 return make_new_session_info_system(NULL
, &system_info
);
1258 NTSTATUS
make_session_info_system(TALLOC_CTX
*mem_ctx
,
1259 struct auth_session_info
**session_info
)
1261 if (system_info
== NULL
) return NT_STATUS_UNSUCCESSFUL
;
1262 *session_info
= copy_session_info(mem_ctx
, system_info
);
1263 return (*session_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1266 const struct auth_session_info
*get_session_info_system(void)
1271 /***************************************************************************
1272 Purely internal function for make_server_info_info3
1273 ***************************************************************************/
1275 static NTSTATUS
check_account(TALLOC_CTX
*mem_ctx
, const char *domain
,
1276 const char *username
, char **found_username
,
1277 struct passwd
**pwd
,
1278 bool *username_was_mapped
)
1280 char *orig_dom_user
= NULL
;
1281 char *dom_user
= NULL
;
1282 char *lower_username
= NULL
;
1283 char *real_username
= NULL
;
1284 struct passwd
*passwd
;
1286 lower_username
= talloc_strdup(mem_ctx
, username
);
1287 if (!lower_username
) {
1288 return NT_STATUS_NO_MEMORY
;
1290 strlower_m( lower_username
);
1292 orig_dom_user
= talloc_asprintf(mem_ctx
,
1295 *lp_winbind_separator(),
1297 if (!orig_dom_user
) {
1298 return NT_STATUS_NO_MEMORY
;
1301 /* Get the passwd struct. Try to create the account if necessary. */
1303 *username_was_mapped
= map_username(mem_ctx
, orig_dom_user
, &dom_user
);
1305 return NT_STATUS_NO_MEMORY
;
1308 passwd
= smb_getpwnam(mem_ctx
, dom_user
, &real_username
, true );
1310 DEBUG(3, ("Failed to find authenticated user %s via "
1311 "getpwnam(), denying access.\n", dom_user
));
1312 return NT_STATUS_NO_SUCH_USER
;
1315 if (!real_username
) {
1316 return NT_STATUS_NO_MEMORY
;
1321 /* This is pointless -- there is no support for differing
1322 unix and windows names. Make sure to always store the
1323 one we actually looked up and succeeded. Have I mentioned
1324 why I hate the 'winbind use default domain' parameter?
1327 *found_username
= talloc_strdup( mem_ctx
, real_username
);
1329 return NT_STATUS_OK
;
1332 /****************************************************************************
1333 Wrapper to allow the getpwnam() call to strip the domain name and
1334 try again in case a local UNIX user is already there. Also run through
1335 the username if we fallback to the username only.
1336 ****************************************************************************/
1338 struct passwd
*smb_getpwnam( TALLOC_CTX
*mem_ctx
, const char *domuser
,
1339 char **p_save_username
, bool create
)
1341 struct passwd
*pw
= NULL
;
1343 char *username
= NULL
;
1345 /* we only save a copy of the username it has been mangled
1346 by winbindd use default domain */
1347 *p_save_username
= NULL
;
1349 /* don't call map_username() here since it has to be done higher
1350 up the stack so we don't call it multiple times */
1352 username
= talloc_strdup(mem_ctx
, domuser
);
1357 p
= strchr_m( username
, *lp_winbind_separator() );
1359 /* code for a DOMAIN\user string */
1362 pw
= Get_Pwnam_alloc( mem_ctx
, domuser
);
1364 /* make sure we get the case of the username correct */
1365 /* work around 'winbind use default domain = yes' */
1367 if ( !strchr_m( pw
->pw_name
, *lp_winbind_separator() ) ) {
1370 /* split the domain and username into 2 strings */
1374 *p_save_username
= talloc_asprintf(mem_ctx
,
1377 *lp_winbind_separator(),
1379 if (!*p_save_username
) {
1384 *p_save_username
= talloc_strdup(mem_ctx
, pw
->pw_name
);
1391 /* setup for lookup of just the username */
1392 /* remember that p and username are overlapping memory */
1395 username
= talloc_strdup(mem_ctx
, p
);
1401 /* just lookup a plain username */
1403 pw
= Get_Pwnam_alloc(mem_ctx
, username
);
1405 /* Create local user if requested but only if winbindd
1406 is not running. We need to protect against cases
1407 where winbindd is failing and then prematurely
1408 creating users in /etc/passwd */
1410 if ( !pw
&& create
&& !winbind_ping() ) {
1411 /* Don't add a machine account. */
1412 if (username
[strlen(username
)-1] == '$')
1415 _smb_create_user(NULL
, username
, NULL
);
1416 pw
= Get_Pwnam_alloc(mem_ctx
, username
);
1419 /* one last check for a valid passwd struct */
1422 *p_save_username
= talloc_strdup(mem_ctx
, pw
->pw_name
);
1427 /***************************************************************************
1428 Make a server_info struct from the info3 returned by a domain logon
1429 ***************************************************************************/
1431 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
1432 const char *sent_nt_username
,
1434 struct auth_serversupplied_info
**server_info
,
1435 struct netr_SamInfo3
*info3
)
1437 static const char zeros
[16] = {0, };
1439 NTSTATUS nt_status
= NT_STATUS_OK
;
1440 char *found_username
= NULL
;
1441 const char *nt_domain
;
1442 const char *nt_username
;
1443 bool username_was_mapped
;
1445 struct auth_serversupplied_info
*result
;
1446 struct dom_sid
*group_sid
;
1447 struct netr_SamInfo3
*i3
;
1450 Here is where we should check the list of
1451 trusted domains, and verify that the SID
1455 nt_username
= talloc_strdup(mem_ctx
, info3
->base
.account_name
.string
);
1457 /* If the server didn't give us one, just use the one we sent
1459 nt_username
= sent_nt_username
;
1462 nt_domain
= talloc_strdup(mem_ctx
, info3
->base
.logon_domain
.string
);
1464 /* If the server didn't give us one, just use the one we sent
1469 /* If getpwnam() fails try the add user script (2.2.x behavior).
1471 We use the _unmapped_ username here in an attempt to provide
1472 consistent username mapping behavior between kerberos and NTLM[SSP]
1473 authentication in domain mode security. I.E. Username mapping
1474 should be applied to the fully qualified username
1475 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1476 called map_username() unnecessarily in make_user_info_map() but
1477 that is how the current code is designed. Making the change here
1478 is the least disruptive place. -- jerry */
1480 /* this call will try to create the user if necessary */
1482 nt_status
= check_account(mem_ctx
, nt_domain
, sent_nt_username
,
1483 &found_username
, &pwd
,
1484 &username_was_mapped
);
1486 if (!NT_STATUS_IS_OK(nt_status
)) {
1490 result
= make_server_info(NULL
);
1491 if (result
== NULL
) {
1492 DEBUG(4, ("make_server_info failed!\n"));
1493 return NT_STATUS_NO_MEMORY
;
1496 result
->unix_name
= talloc_strdup(result
, found_username
);
1498 /* copy in the info3 */
1499 result
->info3
= i3
= copy_netr_SamInfo3(result
, info3
);
1500 if (result
->info3
== NULL
) {
1501 TALLOC_FREE(result
);
1502 return NT_STATUS_NO_MEMORY
;
1505 /* Fill in the unix info we found on the way */
1506 result
->utok
.uid
= pwd
->pw_uid
;
1507 result
->utok
.gid
= pwd
->pw_gid
;
1509 /* We can't just trust that the primary group sid sent us is something
1510 * we can really use. Obtain the usable sid, and store the original
1511 * one as an additional group if it had to be replaced */
1512 nt_status
= get_primary_group_sid(mem_ctx
, found_username
,
1514 if (!NT_STATUS_IS_OK(nt_status
)) {
1515 TALLOC_FREE(result
);
1519 /* store and check if it is the same we got originally */
1520 sid_peek_rid(group_sid
, &i3
->base
.primary_gid
);
1521 if (i3
->base
.primary_gid
!= info3
->base
.primary_gid
) {
1522 uint32_t n
= i3
->base
.groups
.count
;
1523 /* not the same, store the original as an additional group */
1524 i3
->base
.groups
.rids
=
1525 talloc_realloc(i3
, i3
->base
.groups
.rids
,
1526 struct samr_RidWithAttribute
, n
+ 1);
1527 if (i3
->base
.groups
.rids
== NULL
) {
1528 TALLOC_FREE(result
);
1529 return NT_STATUS_NO_MEMORY
;
1531 i3
->base
.groups
.rids
[n
].rid
= info3
->base
.primary_gid
;
1532 i3
->base
.groups
.rids
[n
].attributes
= SE_GROUP_ENABLED
;
1533 i3
->base
.groups
.count
= n
+ 1;
1536 /* ensure we are never given NULL session keys */
1538 if (memcmp(info3
->base
.key
.key
, zeros
, sizeof(zeros
)) == 0) {
1539 result
->session_key
= data_blob_null
;
1541 result
->session_key
= data_blob_talloc(
1542 result
, info3
->base
.key
.key
,
1543 sizeof(info3
->base
.key
.key
));
1546 if (memcmp(info3
->base
.LMSessKey
.key
, zeros
, 8) == 0) {
1547 result
->lm_session_key
= data_blob_null
;
1549 result
->lm_session_key
= data_blob_talloc(
1550 result
, info3
->base
.LMSessKey
.key
,
1551 sizeof(info3
->base
.LMSessKey
.key
));
1554 result
->nss_token
|= username_was_mapped
;
1556 result
->guest
= (info3
->base
.user_flags
& NETLOGON_GUEST
);
1558 *server_info
= result
;
1560 return NT_STATUS_OK
;
1563 /*****************************************************************************
1564 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1565 ******************************************************************************/
1567 NTSTATUS
make_server_info_wbcAuthUserInfo(TALLOC_CTX
*mem_ctx
,
1568 const char *sent_nt_username
,
1570 const struct wbcAuthUserInfo
*info
,
1571 struct auth_serversupplied_info
**server_info
)
1573 struct netr_SamInfo3
*info3
;
1575 info3
= wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx
, info
);
1577 return NT_STATUS_NO_MEMORY
;
1580 return make_server_info_info3(mem_ctx
,
1581 sent_nt_username
, domain
,
1582 server_info
, info3
);
1586 * Verify whether or not given domain is trusted.
1588 * @param domain_name name of the domain to be verified
1589 * @return true if domain is one of the trusted ones or
1590 * false if otherwise
1593 bool is_trusted_domain(const char* dom_name
)
1595 struct dom_sid trustdom_sid
;
1598 /* no trusted domains for a standalone server */
1600 if ( lp_server_role() == ROLE_STANDALONE
)
1603 if (dom_name
== NULL
|| dom_name
[0] == '\0') {
1607 if (strequal(dom_name
, get_global_sam_name())) {
1611 /* if we are a DC, then check for a direct trust relationships */
1615 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1616 "[%s]\n", dom_name
));
1617 ret
= pdb_get_trusteddom_pw(dom_name
, NULL
, NULL
, NULL
);
1625 /* If winbind is around, ask it */
1627 result
= wb_is_trusted_domain(dom_name
);
1629 if (result
== WBC_ERR_SUCCESS
) {
1633 if (result
== WBC_ERR_DOMAIN_NOT_FOUND
) {
1634 /* winbind could not find the domain */
1638 /* The only other possible result is that winbind is not up
1639 and running. We need to update the trustdom_cache
1642 update_trustdom_cache();
1645 /* now the trustdom cache should be available a DC could still
1646 * have a transitive trust so fall back to the cache of trusted
1647 * domains (like a domain member would use */
1649 if ( trustdom_cache_fetch(dom_name
, &trustdom_sid
) ) {
1659 on a logon error possibly map the error to success if "map to guest"
1662 NTSTATUS
do_map_to_guest_server_info(NTSTATUS status
,
1663 struct auth_serversupplied_info
**server_info
,
1664 const char *user
, const char *domain
)
1666 user
= user
? user
: "";
1667 domain
= domain
? domain
: "";
1669 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)) {
1670 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER
) ||
1671 (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD
)) {
1672 DEBUG(3,("No such user %s [%s] - using guest account\n",
1674 return make_server_info_guest(NULL
, server_info
);
1676 } else if (NT_STATUS_EQUAL(status
, NT_STATUS_WRONG_PASSWORD
)) {
1677 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD
) {
1678 DEBUG(3,("Registered username %s for guest access\n",
1680 return make_server_info_guest(NULL
, server_info
);
1688 Extract session key from a session info and return it in a blob
1689 if intent is KEY_USE_16BYTES, truncate it to 16 bytes
1691 See sections 3.2.4.15 and 3.3.4.2 of MS-SMB
1692 Also see https://lists.samba.org/archive/cifs-protocol/2012-January/002265.html for details
1694 Note that returned session_key is referencing the original key, it is supposed to be
1695 short-lived. If original session_info->session_key is gone, the reference will be broken.
1697 NTSTATUS
session_extract_session_key(const struct auth_session_info
*session_info
, DATA_BLOB
*session_key
, enum session_key_use_intent intent
)
1700 if (session_key
== NULL
|| session_info
== NULL
) {
1701 return NT_STATUS_INVALID_PARAMETER
;
1704 if (session_info
->session_key
.length
== 0) {
1705 return NT_STATUS_NO_USER_SESSION_KEY
;
1708 *session_key
= session_info
->session_key
;
1709 if (intent
== KEY_USE_16BYTES
) {
1710 session_key
->length
= MIN(session_info
->session_key
.length
, 16);
1712 return NT_STATUS_OK
;