4 Copyright (c) 2010, Simo Sorce <idra@samba.org>
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "param/param.h"
22 #include "dsdb/samdb/samdb.h"
23 #include "auth/auth.h"
24 #include "auth/credentials/credentials.h"
25 #include "system/kerberos.h"
27 #include "mit_samba_interface.h"
28 #include "auth/kerberos/kerberos.h"
29 #include "kdc/samba_kdc.h"
30 #include "kdc/pac-glue.h"
31 #include "kdc/db-glue.h"
33 const int mit_samba_interface_version
= MIT_SAMBA_INTERFACE_VERSION
;
35 struct mit_samba_context
{
36 struct auth_session_info
*session_info
;
38 /* for compat with hdb plugin common code */
40 struct samba_kdc_db_context
*db_ctx
;
43 static void mit_samba_context_free(struct mit_samba_context
*ctx
)
45 /* free heimdal's krb5_context */
47 krb5_free_context(ctx
->context
);
50 /* then free everything else */
54 static int mit_samba_context_init(struct mit_samba_context
**_ctx
)
56 struct mit_samba_context
*ctx
;
57 const char *s4_conf_file
;
61 ctx
= talloc(NULL
, struct mit_samba_context
);
67 ctx
->db_ctx
= talloc_zero(ctx
, struct samba_kdc_db_context
);
73 ctx
->db_ctx
->ev_ctx
= tevent_context_init(ctx
);
74 if (!ctx
->db_ctx
->ev_ctx
) {
78 ctx
->db_ctx
->lp_ctx
= loadparm_init(ctx
);
79 if (!ctx
->db_ctx
->lp_ctx
) {
84 /* init s4 configuration */
85 s4_conf_file
= lpcfg_configfile(ctx
->db_ctx
->lp_ctx
);
87 lpcfg_load(ctx
->db_ctx
->lp_ctx
, s4_conf_file
);
89 lpcfg_load_default(ctx
->db_ctx
->lp_ctx
);
92 ctx
->session_info
= system_session(ctx
->db_ctx
->lp_ctx
);
93 if (!ctx
->session_info
) {
98 cli_credentials_set_kerberos_state(ctx
->session_info
->credentials
,
99 CRED_DONT_USE_KERBEROS
);
101 ctx
->db_ctx
->samdb
= samdb_connect(ctx
->db_ctx
,
105 if (!ctx
->db_ctx
->samdb
) {
110 /* init heimdal's krb_context and log facilities */
111 ret
= smb_krb5_init_context_basic(ctx
,
123 mit_samba_context_free(ctx
);
131 static int mit_samba_get_principal(struct mit_samba_context
*ctx
,
132 char *principal_string
,
134 hdb_entry_ex
**_hentry
)
136 krb5_principal principal
;
137 hdb_entry_ex
*hentry
;
140 hentry
= talloc(ctx
, hdb_entry_ex
);
145 ret
= krb5_parse_name(ctx
->context
, principal_string
, &principal
);
150 ret
= samba_kdc_fetch(ctx
->context
, ctx
->db_ctx
,
151 principal
, flags
, hentry
);
153 krb5_free_principal(ctx
->context
, principal
);
159 talloc_steal(hentry
->ctx
, hentry
);
165 static int mit_samba_get_firstkey(struct mit_samba_context
*ctx
,
166 hdb_entry_ex
**_hentry
)
168 hdb_entry_ex
*hentry
;
171 hentry
= talloc(ctx
, hdb_entry_ex
);
176 ret
= samba_kdc_firstkey(ctx
->context
, ctx
->db_ctx
, hentry
);
181 talloc_steal(hentry
->ctx
, hentry
);
187 static int mit_samba_get_nextkey(struct mit_samba_context
*ctx
,
188 hdb_entry_ex
**_hentry
)
190 hdb_entry_ex
*hentry
;
193 hentry
= talloc(ctx
, hdb_entry_ex
);
198 ret
= samba_kdc_nextkey(ctx
->context
, ctx
->db_ctx
, hentry
);
203 talloc_steal(hentry
->ctx
, hentry
);
209 static int mit_samba_get_pac_data(struct mit_samba_context
*ctx
,
210 hdb_entry_ex
*client
,
217 tmp_ctx
= talloc_named(ctx
, 0, "mit_samba_get_pac_data context");
222 nt_status
= samba_kdc_get_pac_blob(tmp_ctx
, client
, &pac_blob
);
223 if (!NT_STATUS_IS_OK(nt_status
)) {
224 talloc_free(tmp_ctx
);
228 data
->data
= (uint8_t *)malloc(pac_blob
->length
);
230 talloc_free(tmp_ctx
);
233 memcpy(data
->data
, pac_blob
->data
, pac_blob
->length
);
234 data
->length
= pac_blob
->length
;
236 talloc_free(tmp_ctx
);
240 static int mit_samba_update_pac_data(struct mit_samba_context
*ctx
,
241 hdb_entry_ex
*client
,
243 DATA_BLOB
*logon_data
)
246 DATA_BLOB
*logon_blob
;
247 krb5_error_code code
;
252 /* The user account may be set not to want the PAC */
253 if (client
&& !samba_princ_needs_pac(client
)) {
257 tmp_ctx
= talloc_named(ctx
, 0, "mit_samba_update_pac_data context");
262 logon_blob
= talloc_zero(tmp_ctx
, DATA_BLOB
);
268 code
= krb5_pac_parse(ctx
->context
,
269 pac_data
->data
, pac_data
->length
, &pac
);
275 nt_status
= samba_kdc_update_pac_blob(tmp_ctx
, ctx
->context
,
277 if (!NT_STATUS_IS_OK(nt_status
)) {
278 DEBUG(0, ("Building PAC failed: %s\n",
279 nt_errstr(nt_status
)));
284 logon_data
->data
= (uint8_t *)malloc(logon_blob
->length
);
285 if (!logon_data
->data
) {
289 memcpy(logon_data
->data
, logon_blob
->data
, logon_blob
->length
);
290 logon_data
->length
= logon_blob
->length
;
295 if (pac
) krb5_pac_free(ctx
->context
, pac
);
296 talloc_free(tmp_ctx
);
300 static int mit_samba_check_client_access(struct mit_samba_context
*ctx
,
301 hdb_entry_ex
*client
,
302 const char *client_name
,
303 hdb_entry_ex
*server
,
304 const char *server_name
,
305 const char *netbios_name
,
306 bool password_change
,
309 struct samba_kdc_entry
*kdc_entry
;
312 kdc_entry
= talloc_get_type(client
->ctx
, struct samba_kdc_entry
);
314 nt_status
= samba_kdc_check_client_access(kdc_entry
,
319 if (!NT_STATUS_IS_OK(nt_status
)) {
320 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_MEMORY
)) {
324 samba_kdc_build_edata_reply(nt_status
, e_data
);
326 return samba_kdc_map_policy_err(nt_status
);
332 static int mit_samba_check_s4u2proxy(struct mit_samba_context
*ctx
,
334 const char *target_name
,
335 bool is_nt_enterprise_name
)
337 krb5_principal target_principal
;
341 if (is_nt_enterprise_name
) {
342 flags
= KRB5_PRINCIPAL_PARSE_ENTERPRISE
;
345 ret
= krb5_parse_name_flags(ctx
->context
, target_name
,
346 flags
, &target_principal
);
351 ret
= samba_kdc_check_identical_client_and_server(ctx
->context
,
356 krb5_free_principal(ctx
->context
, target_principal
);
361 struct mit_samba_function_table mit_samba_function_table
= {
362 mit_samba_context_init
,
363 mit_samba_context_free
,
364 mit_samba_get_principal
,
365 mit_samba_get_firstkey
,
366 mit_samba_get_nextkey
,
367 mit_samba_get_pac_data
,
368 mit_samba_update_pac_data
,
369 mit_samba_check_client_access
,
370 mit_samba_check_s4u2proxy