2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_AUTH
29 extern DOM_SID global_sid_World
;
30 extern DOM_SID global_sid_Network
;
31 extern DOM_SID global_sid_Builtin_Guests
;
32 extern DOM_SID global_sid_Authenticated_Users
;
35 /****************************************************************************
36 Create a UNIX user on demand.
37 ****************************************************************************/
39 static int smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
44 pstrcpy(add_script
, lp_adduser_script());
47 all_string_sub(add_script
, "%u", unix_username
, sizeof(pstring
));
49 all_string_sub(add_script
, "%D", domain
, sizeof(pstring
));
51 all_string_sub(add_script
, "%H", homedir
, sizeof(pstring
));
52 ret
= smbrun(add_script
,NULL
);
53 DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script
,ret
));
57 /****************************************************************************
58 Add and Delete UNIX users on demand, based on NTSTATUS codes.
59 ****************************************************************************/
61 void auth_add_user_script(const char *domain
, const char *username
)
63 struct passwd
*pwd
=NULL
;
66 * User validated ok against Domain controller.
67 * If the admin wants us to try and create a UNIX
68 * user on the fly, do so.
71 if(lp_adduser_script() && !(pwd
= Get_Pwnam(username
))) {
72 smb_create_user(domain
, username
, NULL
);
76 /****************************************************************************
77 Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
79 ****************************************************************************/
81 NTSTATUS
auth_get_sam_account(const char *user
, SAM_ACCOUNT
**account
)
85 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(account
))) {
90 pdb_ret
= pdb_getsampwnam(*account
, user
);
95 struct passwd
*pass
= Get_Pwnam(user
);
97 return NT_STATUS_NO_SUCH_USER
;
99 if (!NT_STATUS_IS_OK(nt_status
= pdb_fill_sam_pw(*account
, pass
))) {
106 /****************************************************************************
107 Create an auth_usersupplied_data structure
108 ****************************************************************************/
110 static NTSTATUS
make_user_info(auth_usersupplied_info
**user_info
,
111 const char *smb_name
,
112 const char *internal_username
,
113 const char *client_domain
,
115 const char *wksta_name
,
116 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
118 uint32 auth_flags
, BOOL encrypted
)
121 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username
, smb_name
));
123 *user_info
= malloc(sizeof(**user_info
));
125 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info
)));
126 return NT_STATUS_NO_MEMORY
;
129 ZERO_STRUCTP(*user_info
);
131 DEBUG(5,("making strings for %s's user_info struct\n", internal_username
));
133 (*user_info
)->smb_name
.str
= strdup(smb_name
);
134 if ((*user_info
)->smb_name
.str
) {
135 (*user_info
)->smb_name
.len
= strlen(smb_name
);
137 free_user_info(user_info
);
138 return NT_STATUS_NO_MEMORY
;
141 (*user_info
)->internal_username
.str
= strdup(internal_username
);
142 if ((*user_info
)->internal_username
.str
) {
143 (*user_info
)->internal_username
.len
= strlen(internal_username
);
145 free_user_info(user_info
);
146 return NT_STATUS_NO_MEMORY
;
149 (*user_info
)->domain
.str
= strdup(domain
);
150 if ((*user_info
)->domain
.str
) {
151 (*user_info
)->domain
.len
= strlen(domain
);
153 free_user_info(user_info
);
154 return NT_STATUS_NO_MEMORY
;
157 (*user_info
)->client_domain
.str
= strdup(client_domain
);
158 if ((*user_info
)->client_domain
.str
) {
159 (*user_info
)->client_domain
.len
= strlen(client_domain
);
161 free_user_info(user_info
);
162 return NT_STATUS_NO_MEMORY
;
165 (*user_info
)->wksta_name
.str
= strdup(wksta_name
);
166 if ((*user_info
)->wksta_name
.str
) {
167 (*user_info
)->wksta_name
.len
= strlen(wksta_name
);
169 free_user_info(user_info
);
170 return NT_STATUS_NO_MEMORY
;
173 DEBUG(5,("making blobs for %s's user_info struct\n", internal_username
));
175 (*user_info
)->lm_resp
= data_blob(lm_pwd
.data
, lm_pwd
.length
);
176 (*user_info
)->nt_resp
= data_blob(nt_pwd
.data
, nt_pwd
.length
);
177 (*user_info
)->plaintext_password
= data_blob(plaintext
.data
, plaintext
.length
);
179 (*user_info
)->encrypted
= encrypted
;
180 (*user_info
)->auth_flags
= auth_flags
;
182 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted
? "":"un" , internal_username
, smb_name
));
187 /****************************************************************************
188 Create an auth_usersupplied_data structure after appropriate mapping.
189 ****************************************************************************/
191 NTSTATUS
make_user_info_map(auth_usersupplied_info
**user_info
,
192 const char *smb_name
,
193 const char *client_domain
,
194 const char *wksta_name
,
195 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
197 uint32 ntlmssp_flags
, BOOL encrypted
)
200 fstring internal_username
;
201 fstrcpy(internal_username
, smb_name
);
202 map_username(internal_username
);
204 DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
205 client_domain
, smb_name
, wksta_name
));
207 if (lp_allow_trusted_domains() && *client_domain
) {
209 /* the client could have given us a workstation name
210 or other crap for the workgroup - we really need a
211 way of telling if this domain name is one of our
214 Also don't allow "" as a domain, fixes a Win9X bug
215 where it doens't supply a domain for logon script
218 Finally, we do this by looking up a cache of trusted domains!
221 domain
= client_domain
;
223 if (is_trusted_domain(domain
)) {
224 return make_user_info(user_info
, smb_name
, internal_username
,
225 client_domain
, domain
, wksta_name
,
226 lm_pwd
, nt_pwd
, plaintext
, ntlmssp_flags
,
231 domain
= lp_workgroup();
234 return make_user_info(user_info
,
235 smb_name
, internal_username
,
236 client_domain
, domain
,
240 ntlmssp_flags
, encrypted
);
244 /****************************************************************************
245 Create an auth_usersupplied_data, making the DATA_BLOBs here.
246 Decrypt and encrypt the passwords.
247 ****************************************************************************/
249 BOOL
make_user_info_netlogon_network(auth_usersupplied_info
**user_info
,
250 const char *smb_name
,
251 const char *client_domain
,
252 const char *wksta_name
,
253 const uchar
*lm_network_pwd
, int lm_pwd_len
,
254 const uchar
*nt_network_pwd
, int nt_pwd_len
)
258 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
259 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
260 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
261 uint32 auth_flags
= AUTH_FLAG_NONE
;
264 auth_flags
|= AUTH_FLAG_LM_RESP
;
265 if (nt_pwd_len
== 24) {
266 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
267 } else if (nt_pwd_len
!= 0) {
268 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
271 nt_status
= make_user_info_map(user_info
,
272 smb_name
, client_domain
,
278 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
280 data_blob_free(&lm_blob
);
281 data_blob_free(&nt_blob
);
285 /****************************************************************************
286 Create an auth_usersupplied_data, making the DATA_BLOBs here.
287 Decrypt and encrypt the passwords.
288 ****************************************************************************/
290 BOOL
make_user_info_netlogon_interactive(auth_usersupplied_info
**user_info
,
291 const char *smb_name
,
292 const char *client_domain
,
293 const char *wksta_name
,
295 const uchar lm_interactive_pwd
[16],
296 const uchar nt_interactive_pwd
[16],
297 const uchar
*dc_sess_key
)
301 unsigned char local_lm_response
[24];
302 unsigned char local_nt_response
[24];
303 unsigned char key
[16];
304 uint32 auth_flags
= AUTH_FLAG_NONE
;
307 memcpy(key
, dc_sess_key
, 8);
309 if (lm_interactive_pwd
) memcpy(lm_pwd
, lm_interactive_pwd
, sizeof(lm_pwd
));
310 if (nt_interactive_pwd
) memcpy(nt_pwd
, nt_interactive_pwd
, sizeof(nt_pwd
));
312 #ifdef DEBUG_PASSWORD
314 dump_data(100, (char *)key
, sizeof(key
));
316 DEBUG(100,("lm owf password:"));
317 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
319 DEBUG(100,("nt owf password:"));
320 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
323 SamOEMhash((uchar
*)lm_pwd
, key
, sizeof(lm_pwd
));
324 SamOEMhash((uchar
*)nt_pwd
, key
, sizeof(nt_pwd
));
326 #ifdef DEBUG_PASSWORD
327 DEBUG(100,("decrypt of lm owf password:"));
328 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
330 DEBUG(100,("decrypt of nt owf password:"));
331 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
334 SMBOWFencrypt((const unsigned char *)lm_pwd
, chal
, local_lm_response
);
335 SMBOWFencrypt((const unsigned char *)nt_pwd
, chal
, local_nt_response
);
337 /* Password info paranoia */
345 DATA_BLOB local_lm_blob
= data_blob(local_lm_response
, sizeof(local_lm_response
));
346 DATA_BLOB local_nt_blob
= data_blob(local_nt_response
, sizeof(local_nt_response
));
347 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
349 if (lm_interactive_pwd
)
350 auth_flags
|= AUTH_FLAG_LM_RESP
;
351 if (nt_interactive_pwd
)
352 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
354 nt_status
= make_user_info_map(user_info
,
355 smb_name
, client_domain
,
362 ret
= NT_STATUS_IS_OK(nt_status
) ? True
: False
;
363 data_blob_free(&local_lm_blob
);
364 data_blob_free(&local_nt_blob
);
370 /****************************************************************************
371 Create an auth_usersupplied_data structure
372 ****************************************************************************/
374 BOOL
make_user_info_for_reply(auth_usersupplied_info
**user_info
,
375 const char *smb_name
,
376 const char *client_domain
,
378 DATA_BLOB plaintext_password
)
381 DATA_BLOB local_lm_blob
;
382 DATA_BLOB local_nt_blob
;
383 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
384 uint32 auth_flags
= AUTH_FLAG_NONE
;
387 * Not encrypted - do so.
390 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
392 if (plaintext_password
.data
) {
393 unsigned char local_lm_response
[24];
395 #ifdef DEBUG_PASSWORD
396 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password
.length
));
397 dump_data(100, plaintext_password
.data
, plaintext_password
.length
);
400 SMBencrypt( (const uchar
*)plaintext_password
.data
, (const uchar
*)chal
, local_lm_response
);
401 local_lm_blob
= data_blob(local_lm_response
, 24);
403 /* We can't do an NT hash here, as the password needs to be
405 local_nt_blob
= data_blob(NULL
, 0);
407 auth_flags
= (AUTH_FLAG_PLAINTEXT
| AUTH_FLAG_LM_RESP
);
409 local_lm_blob
= data_blob(NULL
, 0);
410 local_nt_blob
= data_blob(NULL
, 0);
413 ret
= make_user_info_map(user_info
, smb_name
,
415 get_remote_machine_name(),
421 data_blob_free(&local_lm_blob
);
422 return NT_STATUS_IS_OK(ret
) ? True
: False
;
425 /****************************************************************************
426 Create an auth_usersupplied_data structure
427 ****************************************************************************/
429 NTSTATUS
make_user_info_for_reply_enc(auth_usersupplied_info
**user_info
,
430 const char *smb_name
,
431 const char *client_domain
,
432 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
434 uint32 auth_flags
= AUTH_FLAG_NONE
;
436 DATA_BLOB no_plaintext_blob
= data_blob(NULL
, 0);
438 if (lm_resp
.length
== 24) {
439 auth_flags
|= AUTH_FLAG_LM_RESP
;
441 if (nt_resp
.length
== 0) {
442 } else if (nt_resp
.length
== 24) {
443 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
445 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
448 return make_user_info_map(user_info
, smb_name
,
450 get_remote_machine_name(),
457 /****************************************************************************
458 Create a guest user_info blob, for anonymous authenticaion.
459 ****************************************************************************/
461 BOOL
make_user_info_guest(auth_usersupplied_info
**user_info
)
463 DATA_BLOB lm_blob
= data_blob(NULL
, 0);
464 DATA_BLOB nt_blob
= data_blob(NULL
, 0);
465 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
466 uint32 auth_flags
= AUTH_FLAG_NONE
;
469 nt_status
= make_user_info(user_info
,
477 return NT_STATUS_IS_OK(nt_status
) ? True
: False
;
480 /****************************************************************************
481 prints a NT_USER_TOKEN to debug output.
482 ****************************************************************************/
484 void debug_nt_user_token(int dbg_class
, int dbg_lev
, NT_USER_TOKEN
*token
)
490 DEBUGC(dbg_class
, dbg_lev
, ("NT user token: (NULL)\n"));
494 DEBUGC(dbg_class
, dbg_lev
, ("NT user token of user %s\n",
495 sid_to_string(sid_str
, &token
->user_sids
[0]) ));
496 DEBUGADDC(dbg_class
, dbg_lev
, ("contains %i SIDs\n", token
->num_sids
));
497 for (i
= 0; i
< token
->num_sids
; i
++)
498 DEBUGADDC(dbg_class
, dbg_lev
, ("SID[%3i]: %s\n", i
,
499 sid_to_string(sid_str
, &token
->user_sids
[i
])));
502 /****************************************************************************
503 prints a UNIX 'token' to debug output.
504 ****************************************************************************/
506 void debug_unix_user_token(int dbg_class
, int dbg_lev
, uid_t uid
, gid_t gid
, int n_groups
, gid_t
*groups
)
509 DEBUGC(dbg_class
, dbg_lev
, ("UNIX token of user %ld\n", (long int)uid
));
511 DEBUGADDC(dbg_class
, dbg_lev
, ("Primary group is %ld and contains %i supplementary groups\n", (long int)gid
, n_groups
));
512 for (i
= 0; i
< n_groups
; i
++)
513 DEBUGADDC(dbg_class
, dbg_lev
, ("Group[%3i]: %ld\n", i
,
514 (long int)groups
[i
]));
517 /****************************************************************************
518 Create the SID list for this user.
519 ****************************************************************************/
521 static NTSTATUS
create_nt_user_token(const DOM_SID
*user_sid
, const DOM_SID
*group_sid
,
522 int n_groupSIDs
, DOM_SID
*groupSIDs
,
523 BOOL is_guest
, NT_USER_TOKEN
**token
)
525 NTSTATUS nt_status
= NT_STATUS_OK
;
526 NT_USER_TOKEN
*ptoken
;
530 if ((ptoken
= malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
) {
531 DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
532 nt_status
= NT_STATUS_NO_MEMORY
;
536 ZERO_STRUCTP(ptoken
);
538 ptoken
->num_sids
= n_groupSIDs
+ 5;
540 if ((ptoken
->user_sids
= (DOM_SID
*)malloc( sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
541 DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
542 nt_status
= NT_STATUS_NO_MEMORY
;
546 memset((char*)ptoken
->user_sids
,0,sizeof(DOM_SID
) * ptoken
->num_sids
);
549 * Note - user SID *MUST* be first in token !
550 * se_access_check depends on this.
552 * Primary group SID is second in token. Convention.
555 sid_copy(&ptoken
->user_sids
[PRIMARY_USER_SID_INDEX
], user_sid
);
557 sid_copy(&ptoken
->user_sids
[PRIMARY_GROUP_SID_INDEX
], group_sid
);
560 * Finally add the "standard" SIDs.
561 * The only difference between guest and "anonymous" (which we
562 * don't really support) is the addition of Authenticated_Users.
565 sid_copy(&ptoken
->user_sids
[2], &global_sid_World
);
566 sid_copy(&ptoken
->user_sids
[3], &global_sid_Network
);
569 sid_copy(&ptoken
->user_sids
[4], &global_sid_Builtin_Guests
);
571 sid_copy(&ptoken
->user_sids
[4], &global_sid_Authenticated_Users
);
573 sid_ndx
= 5; /* next available spot */
575 for (i
= 0; i
< n_groupSIDs
; i
++) {
576 size_t check_sid_idx
;
577 for (check_sid_idx
= 1; check_sid_idx
< ptoken
->num_sids
; check_sid_idx
++) {
578 if (sid_equal(&ptoken
->user_sids
[check_sid_idx
],
584 if (check_sid_idx
>= ptoken
->num_sids
) /* Not found already */ {
585 sid_copy(&ptoken
->user_sids
[sid_ndx
++], &groupSIDs
[i
]);
591 debug_nt_user_token(DBGC_AUTH
, 10, ptoken
);
598 /****************************************************************************
599 Create the SID list for this user.
600 ****************************************************************************/
602 NT_USER_TOKEN
*create_nt_token(uid_t uid
, gid_t gid
, int ngroups
, gid_t
*groups
, BOOL is_guest
)
607 NT_USER_TOKEN
*token
;
610 if (!NT_STATUS_IS_OK(uid_to_sid(&user_sid
, uid
))) {
613 if (!NT_STATUS_IS_OK(gid_to_sid(&group_sid
, gid
))) {
617 group_sids
= malloc(sizeof(DOM_SID
) * ngroups
);
619 DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
623 for (i
= 0; i
< ngroups
; i
++) {
624 if (!NT_STATUS_IS_OK(gid_to_sid(&(group_sids
)[i
], (groups
)[i
]))) {
625 DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups
[i
]));
626 SAFE_FREE(group_sids
);
631 if (!NT_STATUS_IS_OK(create_nt_user_token(&user_sid
, &group_sid
,
632 ngroups
, group_sids
, is_guest
, &token
))) {
633 SAFE_FREE(group_sids
);
637 SAFE_FREE(group_sids
);
642 /******************************************************************************
643 * this function returns the groups (SIDs) of the local SAM the user is in.
644 * If this samba server is a DC of the domain the user belongs to, it returns
645 * both domain groups and local / builtin groups. If the user is in a trusted
646 * domain, or samba is a member server of a domain, then this function returns
647 * local and builtin groups the user is a member of.
649 * currently this is a hack, as there is no sam implementation that is capable
651 ******************************************************************************/
653 static NTSTATUS
get_user_groups_from_local_sam(const char *username
, uid_t uid
, gid_t gid
,
654 int *n_groups
, DOM_SID
**groups
, gid_t
**unix_groups
)
662 n_unix_groups
= groups_max();
663 if ((*unix_groups
= malloc( sizeof(gid_t
) * n_unix_groups
) ) == NULL
) {
664 DEBUG(0, ("get_user_groups_from_local_sam: Out of memory allocating unix group list\n"));
665 return NT_STATUS_NO_MEMORY
;
668 if (sys_getgrouplist(username
, gid
, *unix_groups
, &n_unix_groups
) == -1) {
670 groups_tmp
= Realloc(*unix_groups
, sizeof(gid_t
) * n_unix_groups
);
672 SAFE_FREE(*unix_groups
);
673 return NT_STATUS_NO_MEMORY
;
675 *unix_groups
= groups_tmp
;
677 if (sys_getgrouplist(username
, gid
, *unix_groups
, &n_unix_groups
) == -1) {
678 DEBUG(0, ("get_user_groups_from_local_sam: failed to get the unix group list\n"));
679 SAFE_FREE(*unix_groups
);
680 return NT_STATUS_NO_SUCH_USER
; /* what should this return value be? */
684 debug_unix_user_token(DBGC_CLASS
, 5, uid
, gid
, n_unix_groups
, *unix_groups
);
686 if (n_unix_groups
> 0) {
687 *groups
= malloc(sizeof(DOM_SID
) * n_unix_groups
);
689 DEBUG(0, ("get_user_group_from_local_sam: malloc() failed for DOM_SID list!\n"));
690 SAFE_FREE(*unix_groups
);
691 return NT_STATUS_NO_MEMORY
;
695 *n_groups
= n_unix_groups
;
697 for (i
= 0; i
< *n_groups
; i
++) {
698 if (!NT_STATUS_IS_OK(gid_to_sid(&(*groups
)[i
], (*unix_groups
)[i
]))) {
699 DEBUG(1, ("get_user_groups_from_local_sam: failed to convert gid %ld to a sid!\n", (long int)(*unix_groups
)[i
+1]));
701 SAFE_FREE(*unix_groups
);
702 return NT_STATUS_NO_SUCH_USER
;
709 /***************************************************************************
710 Make a user_info struct
711 ***************************************************************************/
713 static NTSTATUS
make_server_info(auth_serversupplied_info
**server_info
)
715 *server_info
= malloc(sizeof(**server_info
));
717 DEBUG(0,("make_server_info: malloc failed!\n"));
718 return NT_STATUS_NO_MEMORY
;
720 ZERO_STRUCTP(*server_info
);
724 /***************************************************************************
725 Fill a server_info struct from a SAM_ACCOUNT with their groups
726 ***************************************************************************/
728 static NTSTATUS
add_user_groups(auth_serversupplied_info
**server_info
,
729 SAM_ACCOUNT
*sampass
,
730 uid_t uid
, gid_t gid
)
733 const DOM_SID
*user_sid
= pdb_get_user_sid(sampass
);
734 const DOM_SID
*group_sid
= pdb_get_group_sid(sampass
);
736 DOM_SID
*groupSIDs
= NULL
;
737 gid_t
*unix_groups
= NULL
;
738 NT_USER_TOKEN
*token
;
742 nt_status
= get_user_groups_from_local_sam(pdb_get_username(sampass
),
744 &n_groupSIDs
, &groupSIDs
,
746 if (!NT_STATUS_IS_OK(nt_status
)) {
747 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
748 free_server_info(server_info
);
752 is_guest
= (sid_peek_rid(user_sid
, &rid
) && rid
== DOMAIN_USER_RID_GUEST
);
754 if (!NT_STATUS_IS_OK(nt_status
= create_nt_user_token(user_sid
, group_sid
,
755 n_groupSIDs
, groupSIDs
, is_guest
,
758 DEBUG(4,("create_nt_user_token failed\n"));
759 SAFE_FREE(groupSIDs
);
760 SAFE_FREE(unix_groups
);
761 free_server_info(server_info
);
765 SAFE_FREE(groupSIDs
);
767 (*server_info
)->n_groups
= n_groupSIDs
;
768 (*server_info
)->groups
= unix_groups
;
769 (*server_info
)->ptok
= token
;
774 /***************************************************************************
775 Make (and fill) a user_info struct from a SAM_ACCOUNT
776 ***************************************************************************/
778 NTSTATUS
make_server_info_sam(auth_serversupplied_info
**server_info
,
779 SAM_ACCOUNT
*sampass
)
783 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
)))
786 (*server_info
)->sam_account
= sampass
;
788 if (!NT_STATUS_IS_OK(nt_status
= sid_to_uid(pdb_get_user_sid(sampass
), &((*server_info
)->uid
))))
791 if (!NT_STATUS_IS_OK(nt_status
= sid_to_gid(pdb_get_group_sid(sampass
), &((*server_info
)->gid
))))
794 if (!NT_STATUS_IS_OK(nt_status
= add_user_groups(server_info
, sampass
,
795 (*server_info
)->uid
, (*server_info
)->gid
)))
798 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
799 DEBUG(5,("make_server_info_sam: made server info for user %s\n",
800 pdb_get_username((*server_info
)->sam_account
)));
805 /***************************************************************************
806 Make (and fill) a user_info struct from a 'struct passwd' by conversion
808 ***************************************************************************/
810 NTSTATUS
make_server_info_pw(auth_serversupplied_info
**server_info
, const struct passwd
*pwd
)
813 SAM_ACCOUNT
*sampass
= NULL
;
814 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam_pw(&sampass
, pwd
))) {
817 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
))) {
821 (*server_info
)->sam_account
= sampass
;
823 if (!NT_STATUS_IS_OK(nt_status
= add_user_groups(server_info
, sampass
, pwd
->pw_uid
, pwd
->pw_gid
))) {
827 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
828 (*server_info
)->uid
= pwd
->pw_uid
;
829 (*server_info
)->gid
= pwd
->pw_gid
;
833 /***************************************************************************
834 Make (and fill) a user_info struct for a guest login.
835 ***************************************************************************/
837 NTSTATUS
make_server_info_guest(auth_serversupplied_info
**server_info
)
840 SAM_ACCOUNT
*sampass
= NULL
;
843 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(&sampass
))) {
847 sid_copy(&guest_sid
, get_global_sam_sid());
848 sid_append_rid(&guest_sid
, DOMAIN_USER_RID_GUEST
);
851 if (!pdb_getsampwsid(sampass
, &guest_sid
)) {
853 return NT_STATUS_NO_SUCH_USER
;
857 nt_status
= make_server_info_sam(server_info
, sampass
);
859 if (NT_STATUS_IS_OK(nt_status
)) {
860 (*server_info
)->guest
= True
;
866 /***************************************************************************
867 Purely internal function for make_server_info_info3
868 Fill the sam account from getpwnam
869 ***************************************************************************/
870 static NTSTATUS
fill_sam_account(const char *domain
,
871 const char *username
,
872 uid_t
*uid
, gid_t
*gid
,
873 SAM_ACCOUNT
**sam_account
)
876 struct passwd
*passwd
;
878 fstr_sprintf(dom_user
, "%s%s%s",
879 domain
, lp_winbind_separator(), username
);
881 passwd
= Get_Pwnam(dom_user
);
883 if ( (passwd
== NULL
) && is_myworkgroup(domain
) ) {
884 /* For our own domain also try unqualified */
885 passwd
= Get_Pwnam(username
);
889 return NT_STATUS_NO_SUCH_USER
;
891 *uid
= passwd
->pw_uid
;
892 *gid
= passwd
->pw_gid
;
894 return pdb_init_sam_pw(sam_account
, passwd
);
897 /***************************************************************************
898 Make a server_info struct from the info3 returned by a domain logon
899 ***************************************************************************/
901 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
902 const char *internal_username
,
903 const char *sent_nt_username
,
905 auth_serversupplied_info
**server_info
,
906 NET_USER_INFO_3
*info3
)
908 NTSTATUS nt_status
= NT_STATUS_OK
;
910 const char *nt_domain
;
911 const char *nt_username
;
913 SAM_ACCOUNT
*sam_account
= NULL
;
917 struct passwd
*passwd
;
925 DOM_SID
*lgroupSIDs
= NULL
;
927 gid_t
*unix_groups
= NULL
;
928 NT_USER_TOKEN
*token
;
930 DOM_SID
*all_group_SIDs
;
934 Here is where we should check the list of
935 trusted domains, and verify that the SID
939 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
940 if (!sid_append_rid(&user_sid
, info3
->user_rid
)) {
941 return NT_STATUS_INVALID_PARAMETER
;
944 sid_copy(&group_sid
, &info3
->dom_sid
.sid
);
945 if (!sid_append_rid(&group_sid
, info3
->group_rid
)) {
946 return NT_STATUS_INVALID_PARAMETER
;
949 if (!(nt_username
= unistr2_tdup(mem_ctx
, &(info3
->uni_user_name
)))) {
950 /* If the server didn't give us one, just use the one we sent them */
951 nt_username
= sent_nt_username
;
954 if (!(nt_domain
= unistr2_tdup(mem_ctx
, &(info3
->uni_logon_dom
)))) {
955 /* If the server didn't give us one, just use the one we sent them */
962 /* we are trying to check that idmap isn't stuffing us over - does this
963 user actually exist? */
964 if (NT_STATUS_IS_OK(idmap_get_id_from_sid(&u_id
, &u_type
, &user_sid
))
965 && NT_STATUS_IS_OK(idmap_get_id_from_sid(&g_id
, &g_type
, &group_sid
))
966 && ((passwd
= getpwuid_alloc(u_id
.uid
)))) {
968 nt_status
= pdb_init_sam_pw(&sam_account
, passwd
);
970 uid
= passwd
->pw_uid
;
971 gid
= passwd
->pw_gid
;
973 /* we should check this is the same name */
975 passwd_free(&passwd
);
978 /* User not from winbind - try and find them by getpwnam() */
979 nt_status
= fill_sam_account(nt_domain
,
984 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
)) {
985 DEBUG(3,("User %s does not exist, trying to add it\n",
987 auth_add_user_script(nt_domain
, internal_username
);
988 nt_status
= fill_sam_account(nt_domain
,
995 if (!NT_STATUS_IS_OK(nt_status
)) {
996 DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
1000 if (!pdb_set_user_sid(sam_account
, &user_sid
, PDB_CHANGED
)) {
1001 pdb_free_sam(&sam_account
);
1002 return NT_STATUS_UNSUCCESSFUL
;
1005 if (!pdb_set_group_sid(sam_account
, &group_sid
, PDB_CHANGED
)) {
1006 pdb_free_sam(&sam_account
);
1007 return NT_STATUS_UNSUCCESSFUL
;
1010 if (!pdb_set_nt_username(sam_account
, nt_username
, PDB_CHANGED
)) {
1011 pdb_free_sam(&sam_account
);
1012 return NT_STATUS_NO_MEMORY
;
1015 if (!pdb_set_domain(sam_account
, nt_domain
, PDB_CHANGED
)) {
1016 pdb_free_sam(&sam_account
);
1017 return NT_STATUS_NO_MEMORY
;
1020 if (!pdb_set_fullname(sam_account
, unistr2_static(&(info3
->uni_full_name
)), PDB_CHANGED
)) {
1021 pdb_free_sam(&sam_account
);
1022 return NT_STATUS_NO_MEMORY
;
1025 if (!pdb_set_logon_script(sam_account
, unistr2_static(&(info3
->uni_logon_script
)), PDB_CHANGED
)) {
1026 pdb_free_sam(&sam_account
);
1027 return NT_STATUS_NO_MEMORY
;
1030 if (!pdb_set_profile_path(sam_account
, unistr2_static(&(info3
->uni_profile_path
)), PDB_CHANGED
)) {
1031 pdb_free_sam(&sam_account
);
1032 return NT_STATUS_NO_MEMORY
;
1035 if (!pdb_set_homedir(sam_account
, unistr2_static(&(info3
->uni_home_dir
)), PDB_CHANGED
)) {
1036 pdb_free_sam(&sam_account
);
1037 return NT_STATUS_NO_MEMORY
;
1040 if (!pdb_set_dir_drive(sam_account
, unistr2_static(&(info3
->uni_dir_drive
)), PDB_CHANGED
)) {
1041 pdb_free_sam(&sam_account
);
1042 return NT_STATUS_NO_MEMORY
;
1045 /* now that we have a SAM_ACCOUNT that looks real, make a server_info
1046 to wrap it in, and use pass it on down */
1048 if (!NT_STATUS_IS_OK(nt_status
= make_server_info(server_info
))) {
1049 DEBUG(4, ("make_server_info failed!\n"));
1050 pdb_free_sam(&sam_account
);
1054 /* Fill in the unix info we found on the way */
1056 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
1057 (*server_info
)->uid
= uid
;
1058 (*server_info
)->gid
= gid
;
1060 /* Store the user group information in the server_info
1061 returned to the caller. */
1063 if (!NT_STATUS_IS_OK(nt_status
1064 = get_user_groups_from_local_sam(pdb_get_username(sam_account
),
1070 DEBUG(4,("get_user_groups_from_local_sam failed\n"));
1074 (*server_info
)->groups
= unix_groups
;
1075 (*server_info
)->n_groups
= n_lgroupSIDs
;
1077 /* Create a 'combined' list of all SIDs we might want in the SD */
1078 all_group_SIDs
= malloc(sizeof(DOM_SID
) *
1079 (n_lgroupSIDs
+ info3
->num_groups2
+
1080 info3
->num_other_sids
));
1081 if (!all_group_SIDs
) {
1082 DEBUG(0, ("malloc() failed for DOM_SID list!\n"));
1083 SAFE_FREE(lgroupSIDs
);
1084 return NT_STATUS_NO_MEMORY
;
1087 /* Copy the 'local' sids */
1088 memcpy(all_group_SIDs
, lgroupSIDs
, sizeof(DOM_SID
) * n_lgroupSIDs
);
1089 SAFE_FREE(lgroupSIDs
);
1091 /* and create (by appending rids) the 'domain' sids */
1092 for (i
= 0; i
< info3
->num_groups2
; i
++) {
1093 sid_copy(&all_group_SIDs
[i
+n_lgroupSIDs
], &(info3
->dom_sid
.sid
));
1094 if (!sid_append_rid(&all_group_SIDs
[i
+n_lgroupSIDs
], info3
->gids
[i
].g_rid
)) {
1095 nt_status
= NT_STATUS_INVALID_PARAMETER
;
1096 DEBUG(3,("could not append additional group rid 0x%x\n",
1097 info3
->gids
[i
].g_rid
));
1098 SAFE_FREE(lgroupSIDs
);
1103 /* Copy 'other' sids. We need to do sid filtering here to
1104 prevent possible elevation of privileges. See:
1106 http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
1109 for (i
= 0; i
< info3
->num_other_sids
; i
++)
1110 sid_copy(&all_group_SIDs
[
1111 n_lgroupSIDs
+ info3
->num_groups2
+ i
],
1112 &info3
->other_sids
[i
].sid
);
1114 /* Where are the 'global' sids... */
1116 /* can the user be guest? if yes, where is it stored? */
1117 if (!NT_STATUS_IS_OK(
1118 nt_status
= create_nt_user_token(
1119 &user_sid
, &group_sid
,
1120 n_lgroupSIDs
+ info3
->num_groups2
+ info3
->num_other_sids
,
1121 all_group_SIDs
, False
, &token
))) {
1122 DEBUG(4,("create_nt_user_token failed\n"));
1123 SAFE_FREE(all_group_SIDs
);
1127 (*server_info
)->ptok
= token
;
1129 SAFE_FREE(all_group_SIDs
);
1131 memcpy((*server_info
)->session_key
, info3
->user_sess_key
, sizeof((*server_info
)->session_key
)/* 16 */);
1132 memcpy((*server_info
)->first_8_lm_hash
, info3
->padding
, 8);
1134 return NT_STATUS_OK
;
1137 /***************************************************************************
1138 Free a user_info struct
1139 ***************************************************************************/
1141 void free_user_info(auth_usersupplied_info
**user_info
)
1143 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
1144 if (*user_info
!= NULL
) {
1145 if ((*user_info
)->smb_name
.str
) {
1146 DEBUG(10,("structure was created for %s\n", (*user_info
)->smb_name
.str
));
1148 SAFE_FREE((*user_info
)->smb_name
.str
);
1149 SAFE_FREE((*user_info
)->internal_username
.str
);
1150 SAFE_FREE((*user_info
)->client_domain
.str
);
1151 SAFE_FREE((*user_info
)->domain
.str
);
1152 SAFE_FREE((*user_info
)->wksta_name
.str
);
1153 data_blob_free(&(*user_info
)->lm_resp
);
1154 data_blob_free(&(*user_info
)->nt_resp
);
1155 SAFE_FREE((*user_info
)->interactive_password
);
1156 data_blob_clear_free(&(*user_info
)->plaintext_password
);
1157 ZERO_STRUCT(**user_info
);
1159 SAFE_FREE(*user_info
);
1162 /***************************************************************************
1163 Clear out a server_info struct that has been allocated
1164 ***************************************************************************/
1166 void free_server_info(auth_serversupplied_info
**server_info
)
1168 DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
1169 if (*server_info
!= NULL
) {
1170 pdb_free_sam(&(*server_info
)->sam_account
);
1172 /* call pam_end here, unless we know we are keeping it */
1173 delete_nt_token( &(*server_info
)->ptok
);
1174 SAFE_FREE((*server_info
)->groups
);
1175 ZERO_STRUCT(**server_info
);
1177 SAFE_FREE(*server_info
);
1180 /***************************************************************************
1181 Make an auth_methods struct
1182 ***************************************************************************/
1184 BOOL
make_auth_methods(struct auth_context
*auth_context
, auth_methods
**auth_method
)
1186 if (!auth_context
) {
1187 smb_panic("no auth_context supplied to make_auth_methods()!\n");
1191 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
1194 *auth_method
= talloc(auth_context
->mem_ctx
, sizeof(**auth_method
));
1195 if (!*auth_method
) {
1196 DEBUG(0,("make_auth_method: malloc failed!\n"));
1199 ZERO_STRUCTP(*auth_method
);
1204 /****************************************************************************
1206 ****************************************************************************/
1208 void delete_nt_token(NT_USER_TOKEN
**pptoken
)
1211 NT_USER_TOKEN
*ptoken
= *pptoken
;
1212 SAFE_FREE( ptoken
->user_sids
);
1213 ZERO_STRUCTP(ptoken
);
1215 SAFE_FREE(*pptoken
);
1218 /****************************************************************************
1219 Duplicate a SID token.
1220 ****************************************************************************/
1222 NT_USER_TOKEN
*dup_nt_token(NT_USER_TOKEN
*ptoken
)
1224 NT_USER_TOKEN
*token
;
1229 if ((token
= (NT_USER_TOKEN
*)malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
)
1232 ZERO_STRUCTP(token
);
1234 if ((token
->user_sids
= (DOM_SID
*)memdup( ptoken
->user_sids
, sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
1239 token
->num_sids
= ptoken
->num_sids
;
1245 * Squash an NT_STATUS in line with security requirements.
1246 * In an attempt to avoid giving the whole game away when users
1247 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
1248 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
1249 * (session setups in particular).
1251 * @param nt_status NTSTATUS input for squashing.
1252 * @return the 'squashed' nt_status
1255 NTSTATUS
nt_status_squash(NTSTATUS nt_status
)
1257 if NT_STATUS_IS_OK(nt_status
) {
1259 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
) {
1260 /* Match WinXP and don't give the game away */
1261 return NT_STATUS_LOGON_FAILURE
;
1263 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_WRONG_PASSWORD
) {
1264 /* Match WinXP and don't give the game away */
1265 return NT_STATUS_LOGON_FAILURE
;