?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r21144: Create more accurate warning message when the pam_winbind chauthtok has
[Samba/nascimento.git] / source / nsswitch / pam_winbind.c
bloba8344db3387016ba7453ae523e39cf3df31a3bc8
1 /* pam_winbind module
2
3 Copyright Andrew Tridgell <tridge@samba.org> 2000
4 Copyright Tim Potter <tpot@samba.org> 2000
5 Copyright Andrew Bartlett <abartlet@samba.org> 2002
6 Copyright Guenther Deschner <gd@samba.org> 2005-2007
7
8 largely based on pam_userdb by Cristian Gafton <gafton@redhat.com>
9 also contains large slabs of code from pam_unix by Elliot Lee <sopwith@redhat.com>
10 (see copyright below for full details)
11 */
12
13 #include "pam_winbind.h"
14
15 #define _PAM_LOG_FUNCTION_ENTER(function, pamh, ctrl, flags) \
16 do { \
17 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "[pamh: 0x%08x] ENTER: " function " (flags: 0x%04x)", (uint32) pamh, flags); \
18 _pam_log_state(pamh, ctrl); \
19 } while (0)
20
21 #define _PAM_LOG_FUNCTION_LEAVE(function, pamh, ctrl, retval) \
22 do { \
23 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "[pamh: 0x%08x] LEAVE: " function " returning %d", (uint32) pamh, retval); \
24 _pam_log_state(pamh, ctrl); \
25 } while (0)
26
27 /* data tokens */
28
29 #define MAX_PASSWD_TRIES 3
30
31 /*
32 * Work around the pam API that has functions with void ** as parameters.
33 * These lead to strict aliasing warnings with gcc.
34 */
35 static int _pam_get_item(const pam_handle_t *pamh, int item_type,
36 const void *_item)
37 {
38 const void **item = (const void **)_item;
39 return pam_get_item(pamh, item_type, item);
40 }
41 static int _pam_get_data(const pam_handle_t *pamh,
42 const char *module_data_name, const void *_data)
43 {
44 const void **data = (const void **)_data;
45 return pam_get_data(pamh, module_data_name, data);
46 }
47
48 /* some syslogging */
49
50 #ifdef HAVE_PAM_VSYSLOG
51 static void _pam_log_int(const pam_handle_t *pamh, int err, const char *format, va_list args)
52 {
53 pam_vsyslog(pamh, err, format, args);
54 }
55 #else
56 static void _pam_log_int(const pam_handle_t *pamh, int err, const char *format, va_list args)
57 {
58 char *format2 = NULL;
59 const char *service;
60
61 _pam_get_item(pamh, PAM_SERVICE, &service);
62
63 format2 = malloc(strlen(MODULE_NAME)+strlen(format)+strlen(service)+5);
64 if (format2 == NULL) {
65 /* what else todo ? */
66 vsyslog(err, format, args);
67 return;
68 }
69
70 sprintf(format2, "%s(%s): %s", MODULE_NAME, service, format);
71 vsyslog(err, format2, args);
72 SAFE_FREE(format2);
73 }
74 #endif /* HAVE_PAM_VSYSLOG */
75
76 static BOOL _pam_log_is_silent(int ctrl)
77 {
78 return on(ctrl, WINBIND_SILENT);
79 }
80
81 static void _pam_log(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...)
82 {
83 va_list args;
84
85 if (_pam_log_is_silent(ctrl)) {
86 return;
87 }
88
89 va_start(args, format);
90 _pam_log_int(pamh, err, format, args);
91 va_end(args);
92 }
93
94 static BOOL _pam_log_is_debug_enabled(int ctrl)
95 {
96 if (ctrl == -1) {
97 return False;
98 }
99
100 if (_pam_log_is_silent(ctrl)) {
101 return False;
102 }
103
104 if (!(ctrl & WINBIND_DEBUG_ARG)) {
105 return False;
106 }
107
108 return True;
109 }
110
111 static BOOL _pam_log_is_debug_state_enabled(int ctrl)
112 {
113 if (!(ctrl & WINBIND_DEBUG_STATE)) {
114 return False;
115 }
116
117 return _pam_log_is_debug_enabled(ctrl);
118 }
119
120 static void _pam_log_debug(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...)
121 {
122 va_list args;
123
124 if (!_pam_log_is_debug_enabled(ctrl)) {
125 return;
126 }
127
128 va_start(args, format);
129 _pam_log_int(pamh, err, format, args);
130 va_end(args);
131 }
132
133 static void _pam_log_state_datum(const pam_handle_t *pamh, int ctrl, int item_type, const char *key, int is_string)
134 {
135 const void *data = NULL;
136 if (item_type != 0) {
137 pam_get_item(pamh, item_type, &data);
138 } else {
139 pam_get_data(pamh, key, &data);
140 }
141 if (data != NULL) {
142 const char *type = (item_type != 0) ? "ITEM" : "DATA";
143 if (is_string != 0) {
144 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "[pamh: 0x%08x] STATE: %s(%s) = \"%s\" (0x%08x)", (uint32) pamh, type, key, (const char *) data, (uint32) data);
145 } else {
146 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "[pamh: 0x%08x] STATE: %s(%s) = 0x%08x", (uint32) pamh, type, key, (uint32) data);
147 }
148 }
149 }
150
151 #define _PAM_LOG_STATE_DATA_POINTER(pamh, ctrl, module_data_name) \
152 _pam_log_state_datum(pamh, ctrl, 0, module_data_name, 0)
153
154 #define _PAM_LOG_STATE_DATA_STRING(pamh, ctrl, module_data_name) \
155 _pam_log_state_datum(pamh, ctrl, 0, module_data_name, 1)
156
157 #define _PAM_LOG_STATE_ITEM_POINTER(pamh, ctrl, item_type) \
158 _pam_log_state_datum(pamh, ctrl, item_type, #item_type, 0)
159
160 #define _PAM_LOG_STATE_ITEM_STRING(pamh, ctrl, item_type) \
161 _pam_log_state_datum(pamh, ctrl, item_type, #item_type, 1)
162
163 #ifdef DEBUG_PASSWORD
164 #define _LOG_PASSWORD_AS_STRING 1
165 #else
166 #define _LOG_PASSWORD_AS_STRING 0
167 #endif
168
169 #define _PAM_LOG_STATE_ITEM_PASSWORD(pamh, ctrl, item_type) \
170 _pam_log_state_datum(pamh, ctrl, item_type, #item_type, _LOG_PASSWORD_AS_STRING)
171
172 static void _pam_log_state(const pam_handle_t *pamh, int ctrl)
173 {
174 if (!_pam_log_is_debug_state_enabled(ctrl)) {
175 return;
176 }
177
178 _PAM_LOG_STATE_ITEM_STRING(pamh, ctrl, PAM_SERVICE);
179 _PAM_LOG_STATE_ITEM_STRING(pamh, ctrl, PAM_USER);
180 _PAM_LOG_STATE_ITEM_STRING(pamh, ctrl, PAM_TTY);
181 _PAM_LOG_STATE_ITEM_STRING(pamh, ctrl, PAM_RHOST);
182 _PAM_LOG_STATE_ITEM_STRING(pamh, ctrl, PAM_RUSER);
183 _PAM_LOG_STATE_ITEM_PASSWORD(pamh, ctrl, PAM_OLDAUTHTOK);
184 _PAM_LOG_STATE_ITEM_PASSWORD(pamh, ctrl, PAM_AUTHTOK);
185 _PAM_LOG_STATE_ITEM_STRING(pamh, ctrl, PAM_USER_PROMPT);
186 _PAM_LOG_STATE_ITEM_POINTER(pamh, ctrl, PAM_CONV);
187 #ifdef PAM_FAIL_DELAY
188 _PAM_LOG_STATE_ITEM_POINTER(pamh, ctrl, PAM_FAIL_DELAY);
189 #endif
190 #ifdef PAM_REPOSITORY
191 _PAM_LOG_STATE_ITEM_POINTER(pamh, ctrl, PAM_REPOSITORY);
192 #endif
193
194 _PAM_LOG_STATE_DATA_STRING(pamh, ctrl, PAM_WINBIND_HOMEDIR);
195 _PAM_LOG_STATE_DATA_STRING(pamh, ctrl, PAM_WINBIND_LOGONSCRIPT);
196 _PAM_LOG_STATE_DATA_STRING(pamh, ctrl, PAM_WINBIND_PROFILEPATH);
197 _PAM_LOG_STATE_DATA_STRING(pamh, ctrl, PAM_WINBIND_NEW_AUTHTOK_REQD); /* Use atoi to get PAM result code */
198 _PAM_LOG_STATE_DATA_POINTER(pamh, ctrl, PAM_WINBIND_PWD_LAST_SET);
199 }
200
201 static int _pam_parse(const pam_handle_t *pamh, int flags, int argc, const char **argv, dictionary **result_d)
202 {
203 int ctrl = 0;
204 const char *config_file = NULL;
205 int i;
206 const char **v;
207 dictionary *d = NULL;
208
209 if (flags & PAM_SILENT) {
210 ctrl |= WINBIND_SILENT;
211 }
212
213 for (i=argc,v=argv; i-- > 0; ++v) {
214 if (!strncasecmp(*v, "config", strlen("config"))) {
215 ctrl |= WINBIND_CONFIG_FILE;
216 config_file = v[i];
217 break;
218 }
219 }
220
221 if (config_file == NULL) {
222 config_file = PAM_WINBIND_CONFIG_FILE;
223 }
224
225 d = iniparser_load(config_file);
226 if (d == NULL) {
227 goto config_from_pam;
228 }
229
230 if (iniparser_getboolean(d, "global:debug", False)) {
231 ctrl |= WINBIND_DEBUG_ARG;
232 }
233
234 if (iniparser_getboolean(d, "global:debug_state", False)) {
235 ctrl |= WINBIND_DEBUG_STATE;
236 }
237
238 if (iniparser_getboolean(d, "global:cached_login", False)) {
239 ctrl |= WINBIND_CACHED_LOGIN;
240 }
241
242 if (iniparser_getboolean(d, "global:krb5_auth", False)) {
243 ctrl |= WINBIND_KRB5_AUTH;
244 }
245
246 if (iniparser_getboolean(d, "global:silent", False)) {
247 ctrl |= WINBIND_SILENT;
248 }
249
250 if (iniparser_getstr(d, "global:krb5_ccache_type") != NULL) {
251 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
252 }
253
254 if ((iniparser_getstr(d, "global:require-membership-of") != NULL) ||
255 (iniparser_getstr(d, "global:require_membership_of") != NULL)) {
256 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
257 }
258
259 if (iniparser_getboolean(d, "global:try_first_pass", False)) {
260 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
261 }
262
263 config_from_pam:
264 /* step through arguments */
265 for (i=argc,v=argv; i-- > 0; ++v) {
266
267 /* generic options */
268 if (!strcmp(*v,"debug"))
269 ctrl |= WINBIND_DEBUG_ARG;
270 else if (!strcasecmp(*v, "debug_state"))
271 ctrl |= WINBIND_DEBUG_STATE;
272 else if (!strcasecmp(*v, "use_authtok"))
273 ctrl |= WINBIND_USE_AUTHTOK_ARG;
274 else if (!strcasecmp(*v, "use_first_pass"))
275 ctrl |= WINBIND_USE_FIRST_PASS_ARG;
276 else if (!strcasecmp(*v, "try_first_pass"))
277 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
278 else if (!strcasecmp(*v, "unknown_ok"))
279 ctrl |= WINBIND_UNKNOWN_OK_ARG;
280 else if (!strncasecmp(*v, "require_membership_of", strlen("require_membership_of")))
281 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
282 else if (!strncasecmp(*v, "require-membership-of", strlen("require-membership-of")))
283 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
284 else if (!strcasecmp(*v, "krb5_auth"))
285 ctrl |= WINBIND_KRB5_AUTH;
286 else if (!strncasecmp(*v, "krb5_ccache_type", strlen("krb5_ccache_type")))
287 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
288 else if (!strcasecmp(*v, "cached_login"))
289 ctrl |= WINBIND_CACHED_LOGIN;
290 else {
291 _pam_log(pamh, ctrl, LOG_ERR, "pam_parse: unknown option: %s", *v);
292 return -1;
293 }
294
295 }
296
297 if (result_d) {
298 *result_d = d;
299 } else {
300 if (d) {
301 iniparser_freedict(d);
302 }
303 }
304
305 return ctrl;
306 };
307
308 static void _pam_winbind_cleanup_func(pam_handle_t *pamh, void *data, int error_status)
309 {
310 int ctrl = _pam_parse(pamh, 0, 0, NULL, NULL);
311 if (_pam_log_is_debug_state_enabled(ctrl)) {
312 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "[pamh: 0x%08x] CLEAN: cleaning up PAM data 0x%08x (error_status = %d)", (uint32) pamh, (uint32) data, error_status);
313 }
314 SAFE_FREE(data);
315 }
316
317
318 static const struct ntstatus_errors {
319 const char *ntstatus_string;
320 const char *error_string;
321 } ntstatus_errors[] = {
322 {"NT_STATUS_OK", "Success"},
323 {"NT_STATUS_BACKUP_CONTROLLER", "No primary Domain Controler available"},
324 {"NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND", "No domain controllers found"},
325 {"NT_STATUS_NO_LOGON_SERVERS", "No logon servers"},
326 {"NT_STATUS_PWD_TOO_SHORT", "Password too short"},
327 {"NT_STATUS_PWD_TOO_RECENT", "The password of this user is too recent to change"},
328 {"NT_STATUS_PWD_HISTORY_CONFLICT", "Password is already in password history"},
329 {"NT_STATUS_PASSWORD_EXPIRED", "Your password has expired"},
330 {"NT_STATUS_PASSWORD_MUST_CHANGE", "You need to change your password now"},
331 {"NT_STATUS_INVALID_WORKSTATION", "You are not allowed to logon from this workstation"},
332 {"NT_STATUS_INVALID_LOGON_HOURS", "You are not allowed to logon at this time"},
333 {"NT_STATUS_ACCOUNT_EXPIRED", "Your account has expired. Please contact your System administrator"}, /* SCNR */
334 {"NT_STATUS_ACCOUNT_DISABLED", "Your account is disabled. Please contact your System administrator"}, /* SCNR */
335 {"NT_STATUS_ACCOUNT_LOCKED_OUT", "Your account has been locked. Please contact your System administrator"}, /* SCNR */
336 {"NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT", "Invalid Trust Account"},
337 {"NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT", "Invalid Trust Account"},
338 {"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT", "Invalid Trust Account"},
339 {"NT_STATUS_ACCESS_DENIED", "Access is denied"},
340 {NULL, NULL}
341 };
342
343 const char *_get_ntstatus_error_string(const char *nt_status_string)
344 {
345 int i;
346 for (i=0; ntstatus_errors[i].ntstatus_string != NULL; i++) {
347 if (!strcasecmp(ntstatus_errors[i].ntstatus_string, nt_status_string)) {
348 return ntstatus_errors[i].error_string;
349 }
350 }
351 return NULL;
352 }
353
354 /* --- authentication management functions --- */
355
356 /* Attempt a conversation */
357
358 static int converse(pam_handle_t *pamh, int nargs,
359 struct pam_message **message,
360 struct pam_response **response)
361 {
362 int retval;
363 struct pam_conv *conv;
364
365 retval = _pam_get_item(pamh, PAM_CONV, &conv );
366 if (retval == PAM_SUCCESS) {
367 retval = conv->conv(nargs, (const struct pam_message **)message,
368 response, conv->appdata_ptr);
369 }
370
371 return retval; /* propagate error status */
372 }
373
374
375 static int _make_remark(pam_handle_t * pamh, int type, const char *text)
376 {
377 int retval = PAM_SUCCESS;
378
379 struct pam_message *pmsg[1], msg[1];
380 struct pam_response *resp;
381
382 pmsg[0] = &msg[0];
383 msg[0].msg = CONST_DISCARD(char *, text);
384 msg[0].msg_style = type;
385
386 resp = NULL;
387 retval = converse(pamh, 1, pmsg, &resp);
388
389 if (resp) {
390 _pam_drop_reply(resp, 1);
391 }
392 return retval;
393 }
394
395 static int _make_remark_v(pam_handle_t * pamh, int type, const char *format, va_list args)
396 {
397 char *var;
398 int ret;
399
400 ret = vasprintf(&var, format, args);
401 if (ret < 0) {
402 _pam_log(pamh, 0, LOG_ERR, "memory allocation failure");
403 return ret;
404 }
405
406 ret = _make_remark(pamh, type, var);
407 SAFE_FREE(var);
408 return ret;
409 }
410
411 static int _make_remark_format(pam_handle_t * pamh, int type, const char *format, ...)
412 {
413 int ret;
414 va_list args;
415
416 va_start(args, format);
417 ret = _make_remark_v(pamh, type, format, args);
418 va_end(args);
419 return ret;
420 }
421
422 static int pam_winbind_request(pam_handle_t * pamh, int ctrl,
423 enum winbindd_cmd req_type,
424 struct winbindd_request *request,
425 struct winbindd_response *response)
426 {
427 /* Fill in request and send down pipe */
428 init_request(request, req_type);
429
430 if (write_sock(request, sizeof(*request), 0) == -1) {
431 _pam_log(pamh, ctrl, LOG_ERR, "pam_winbind_request: write to socket failed!");
432 close_sock();
433 return PAM_SERVICE_ERR;
434 }
435
436 /* Wait for reply */
437 if (read_reply(response) == -1) {
438 _pam_log(pamh, ctrl, LOG_ERR, "pam_winbind_request: read from socket failed!");
439 close_sock();
440 return PAM_SERVICE_ERR;
441 }
442
443 /* We are done with the socket - close it and avoid mischeif */
444 close_sock();
445
446 /* Copy reply data from socket */
447 if (response->result == WINBINDD_OK) {
448 return PAM_SUCCESS;
449 }
450
451 /* no need to check for pam_error codes for getpwnam() */
452 switch (req_type) {
453
454 case WINBINDD_GETPWNAM:
455 case WINBINDD_LOOKUPNAME:
456 _pam_log(pamh, ctrl, LOG_ERR, "request failed: %s, NT error was %s",
457 response->data.auth.nt_status_string);
458 return PAM_USER_UNKNOWN;
459 default:
460 break;
461 }
462
463 if (response->data.auth.pam_error != PAM_SUCCESS) {
464 _pam_log(pamh, ctrl, LOG_ERR, "request failed: %s, PAM error was %s (%d), NT error was %s",
465 response->data.auth.error_string,
466 pam_strerror(pamh, response->data.auth.pam_error),
467 response->data.auth.pam_error,
468 response->data.auth.nt_status_string);
469 return response->data.auth.pam_error;
470 }
471
472 _pam_log(pamh, ctrl, LOG_ERR, "request failed, but PAM error 0!");
473
474 return PAM_SERVICE_ERR;
475 }
476
477 static int pam_winbind_request_log(pam_handle_t * pamh,
478 int ctrl,
479 enum winbindd_cmd req_type,
480 struct winbindd_request *request,
481 struct winbindd_response *response,
482 const char *user)
483 {
484 int retval;
485
486 retval = pam_winbind_request(pamh, ctrl, req_type, request, response);
487
488 switch (retval) {
489 case PAM_AUTH_ERR:
490 /* incorrect password */
491 _pam_log(pamh, ctrl, LOG_WARNING, "user '%s' denied access (incorrect password or invalid membership)", user);
492 return retval;
493 case PAM_ACCT_EXPIRED:
494 /* account expired */
495 _pam_log(pamh, ctrl, LOG_WARNING, "user '%s' account expired", user);
496 return retval;
497 case PAM_AUTHTOK_EXPIRED:
498 /* password expired */
499 _pam_log(pamh, ctrl, LOG_WARNING, "user '%s' password expired", user);
500 return retval;
501 case PAM_NEW_AUTHTOK_REQD:
502 /* new password required */
503 _pam_log(pamh, ctrl, LOG_WARNING, "user '%s' new password required", user);
504 return retval;
505 case PAM_USER_UNKNOWN:
506 /* the user does not exist */
507 _pam_log_debug(pamh, ctrl, LOG_NOTICE, "user '%s' not found", user);
508 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
509 return PAM_IGNORE;
510 }
511 return retval;
512 case PAM_SUCCESS:
513 if (req_type == WINBINDD_PAM_AUTH) {
514 /* Otherwise, the authentication looked good */
515 _pam_log(pamh, ctrl, LOG_NOTICE, "user '%s' granted access", user);
516 } else if (req_type == WINBINDD_PAM_CHAUTHTOK) {
517 /* Otherwise, the authentication looked good */
518 _pam_log(pamh, ctrl, LOG_NOTICE, "user '%s' password changed", user);
519 } else {
520 /* Otherwise, the authentication looked good */
521 _pam_log(pamh, ctrl, LOG_NOTICE, "user '%s' OK", user);
522 }
523
524 return retval;
525 default:
526 /* we don't know anything about this return value */
527 _pam_log(pamh, ctrl, LOG_ERR, "internal module error (retval = %d, user = '%s')",
528 retval, user);
529 return retval;
530 }
531 }
532
533 static BOOL _pam_send_password_expiry_message(pam_handle_t *pamh, time_t next_change, time_t now)
534 {
535 int days = 0;
536 struct tm tm_now, tm_next_change;
537
538 if ((next_change < 0) ||
539 (next_change < now) ||
540 (next_change > now + DAYS_TO_WARN_BEFORE_PWD_EXPIRES * SECONDS_PER_DAY)) {
541 return False;
542 }
543
544 if ((localtime_r(&now, &tm_now) == NULL) ||
545 (localtime_r(&next_change, &tm_next_change) == NULL)) {
546 return False;
547 }
548
549 days = (tm_next_change.tm_yday+tm_next_change.tm_year*365) - (tm_now.tm_yday+tm_now.tm_year*365);
550
551 if (days == 0) {
552 _make_remark(pamh, PAM_TEXT_INFO, "Your password expires today");
553 return True;
554 }
555
556 if (days > 0 && days < DAYS_TO_WARN_BEFORE_PWD_EXPIRES) {
557 _make_remark_format(pamh, PAM_TEXT_INFO, "Your password will expire in %d %s",
558 days, (days > 1) ? "days":"day");
559 return True;
560 }
561
562 return False;
563 }
564
565 static void _pam_warn_password_expires_in_future(pam_handle_t *pamh, struct winbindd_response *response)
566 {
567 time_t now = time(NULL);
568 time_t next_change = 0;
569
570 /* accounts with ACB_PWNOEXP set never receive a warning */
571 if (response->data.auth.info3.acct_flags & ACB_PWNOEXP) {
572 return;
573 }
574
575 /* no point in sending a warning if this is a grace logon */
576 if (PAM_WB_GRACE_LOGON(response->data.auth.info3.user_flgs)) {
577 return;
578 }
579
580 /* check if the info3 must change timestamp has been set */
581 next_change = response->data.auth.info3.pass_must_change_time;
582
583 if (_pam_send_password_expiry_message(pamh, next_change, now)) {
584 return;
585 }
586
587 /* now check for the global password policy */
588 if (response->data.auth.policy.expire <= 0) {
589 return;
590 }
591
592 next_change = response->data.auth.info3.pass_last_set_time +
593 response->data.auth.policy.expire;
594
595 if (_pam_send_password_expiry_message(pamh, next_change, now)) {
596 return;
597 }
598
599 /* no warning sent */
600 }
601
602 #define IS_SID_STRING(name) (strncmp("S-", name, 2) == 0)
603
604 int safe_append_string(char *dest,
605 const char *src,
606 int dest_buffer_size)
607 /**
608 * Append a string, making sure not to overflow and to always return a NULL-terminated
609 * string.
610 *
611 * @param dest Destination string buffer (must already be NULL-terminated).
612 * @param src Source string buffer.
613 * @param dest_buffer_size Size of dest buffer in bytes.
614 *
615 * @return 0 if dest buffer is not big enough (no bytes copied), non-zero on success.
616 */
617 {
618 int dest_length = strlen(dest);
619 int src_length = strlen(src);
620
621 if ( dest_length + src_length + 1 > dest_buffer_size ) {
622 return 0;
623 }
624
625 memcpy(dest + dest_length, src, src_length + 1);
626 return 1;
627 }
628
629 static int winbind_name_to_sid_string(pam_handle_t *pamh,
630 int ctrl,
631 const char *user,
632 const char *name,
633 char *sid_list_buffer,
634 int sid_list_buffer_size)
635 /**
636 * Convert a names into a SID string, appending it to a buffer.
637 *
638 * @param pamh PAM handle
639 * @param ctrl PAM winbind options.
640 * @param user User in PAM request.
641 * @param name Name to convert.
642 * @param sid_list_buffer Where to append the string sid.
643 * @param sid_list_buffer Size of sid_list_buffer (in bytes).
644 *
645 * @return 0 on failure, non-zero on success.
646 */
647 {
648 const char* sid_string;
649 struct winbindd_response sid_response;
650
651 /* lookup name? */
652 if (IS_SID_STRING(name)) {
653 sid_string = name;
654 } else {
655 struct winbindd_request sid_request;
656
657 ZERO_STRUCT(sid_request);
658 ZERO_STRUCT(sid_response);
659
660 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "no sid given, looking up: %s\n", name);
661
662 /* fortunatly winbindd can handle non-separated names */
663 strncpy(sid_request.data.name.name, name,
664 sizeof(sid_request.data.name.name) - 1);
665
666 if (pam_winbind_request_log(pamh, ctrl, WINBINDD_LOOKUPNAME, &sid_request, &sid_response, user)) {
667 _pam_log(pamh, ctrl, LOG_INFO, "could not lookup name: %s\n", name);
668 return 0;
669 }
670
671 sid_string = sid_response.data.sid.sid;
672 }
673
674 if (!safe_append_string(sid_list_buffer, sid_string, sid_list_buffer_size)) {
675 return 0;
676 }
677
678 return 1;
679 }
680
681 static int winbind_name_list_to_sid_string_list(pam_handle_t *pamh,
682 int ctrl,
683 const char *user,
684 const char *name_list,
685 char *sid_list_buffer,
686 int sid_list_buffer_size)
687 /**
688 * Convert a list of names into a list of sids.
689 *
690 * @param pamh PAM handle
691 * @param ctrl PAM winbind options.
692 * @param user User in PAM request.
693 * @param name_list List of names or string sids, separated by commas.
694 * @param sid_list_buffer Where to put the list of string sids.
695 * @param sid_list_buffer Size of sid_list_buffer (in bytes).
696 *
697 * @return 0 on failure, non-zero on success.
698 */
699 {
700 int result = 0;
701 char *current_name = NULL;
702 const char *search_location;
703 const char *comma;
704
705 if ( sid_list_buffer_size > 0 ) {
706 sid_list_buffer[0] = 0;
707 }
708
709 search_location = name_list;
710 while ( (comma = strstr(search_location, ",")) != NULL ) {
711 current_name = strndup(search_location, comma - search_location);
712 if (NULL == current_name) {
713 goto out;
714 }
715
716 if (!winbind_name_to_sid_string(pamh, ctrl, user, current_name, sid_list_buffer, sid_list_buffer_size)) {
717 goto out;
718 }
719
720 SAFE_FREE(current_name);
721
722 if (!safe_append_string(sid_list_buffer, ",", sid_list_buffer_size)) {
723 goto out;
724 }
725
726 search_location = comma + 1;
727 }
728
729 if (!winbind_name_to_sid_string(pamh, ctrl, user, search_location, sid_list_buffer, sid_list_buffer_size)) {
730 goto out;
731 }
732
733 result = 1;
734
735 out:
736 SAFE_FREE(current_name);
737 return result;
738 }
739
740 /**
741 * Compose Password Restriction String for a PAM_ERROR_MSG conversation.
742 *
743 * @param response The struct winbindd_response.
744 *
745 * @return string (caller needs to free).
746 */
747
748 static char *_pam_compose_pwd_restriction_string(struct winbindd_response *response)
749 {
750 char *str = NULL;
751 size_t offset = 0, ret = 0, str_size = 1024;
752
753 str = (char *)malloc(str_size);
754 if (!str) {
755 return NULL;
756 }
757
758 memset(str, '\0', str_size);
759
760 offset = snprintf(str, str_size, "Your password ");
761 if (offset == -1) {
762 goto failed;
763 }
764
765 if (response->data.auth.policy.min_length_password > 0) {
766 ret = snprintf(str+offset, str_size-offset,
767 "must be at least %d characters; ",
768 response->data.auth.policy.min_length_password);
769 if (ret == -1) {
770 goto failed;
771 }
772 offset += ret;
773 }
774
775 if (response->data.auth.policy.password_history > 0) {
776 ret = snprintf(str+offset, str_size-offset,
777 "cannot repeat any of your previous %d passwords; ",
778 response->data.auth.policy.password_history);
779 if (ret == -1) {
780 goto failed;
781 }
782 offset += ret;
783 }
784
785 if (response->data.auth.policy.password_properties & DOMAIN_PASSWORD_COMPLEX) {
786 ret = snprintf(str+offset, str_size-offset,
787 "must contain capitals, numerals or punctuation; "
788 "and cannot contain your account or full name; ");
789 if (ret == -1) {
790 goto failed;
791 }
792 offset += ret;
793 }
794
795 ret = snprintf(str+offset, str_size-offset,
796 "Please type a different password. "
797 "Type a password which meets these requirements in both text boxes.");
798 if (ret == -1) {
799 goto failed;
800 }
801
802 return str;
803
804 failed:
805 SAFE_FREE(str);
806 return NULL;
807 }
808
809 /* talk to winbindd */
810 static int winbind_auth_request(pam_handle_t * pamh,
811 int ctrl,
812 const char *user,
813 const char *pass,
814 const char *member,
815 const char *cctype,
816 struct winbindd_response *p_response,
817 time_t *pwd_last_set,
818 char **user_ret)
819 {
820 struct winbindd_request request;
821 struct winbindd_response response;
822 int ret;
823
824 ZERO_STRUCT(request);
825 ZERO_STRUCT(response);
826
827 if (pwd_last_set) {
828 *pwd_last_set = 0;
829 }
830
831 strncpy(request.data.auth.user, user,
832 sizeof(request.data.auth.user)-1);
833
834 strncpy(request.data.auth.pass, pass,
835 sizeof(request.data.auth.pass)-1);
836
837 request.data.auth.krb5_cc_type[0] = '\0';
838 request.data.auth.uid = -1;
839
840 request.flags = WBFLAG_PAM_INFO3_TEXT | WBFLAG_PAM_CONTACT_TRUSTDOM;
841
842 if (ctrl & WINBIND_KRB5_AUTH) {
843
844 struct passwd *pwd = NULL;
845
846 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "enabling krb5 login flag\n");
847
848 request.flags |= WBFLAG_PAM_KRB5 | WBFLAG_PAM_FALLBACK_AFTER_KRB5;
849
850 pwd = getpwnam(user);
851 if (pwd == NULL) {
852 return PAM_USER_UNKNOWN;
853 }
854 request.data.auth.uid = pwd->pw_uid;
855 }
856
857 if (ctrl & WINBIND_CACHED_LOGIN) {
858 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "enabling cached login flag\n");
859 request.flags |= WBFLAG_PAM_CACHED_LOGIN;
860 }
861
862 if (user_ret) {
863 *user_ret = NULL;
864 request.flags |= WBFLAG_PAM_UNIX_NAME;
865 }
866
867 if (cctype != NULL) {
868 strncpy(request.data.auth.krb5_cc_type, cctype,
869 sizeof(request.data.auth.krb5_cc_type) - 1);
870 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "enabling request for a %s krb5 ccache\n", cctype);
871 }
872
873 request.data.auth.require_membership_of_sid[0] = '\0';
874
875 if (member != NULL) {
876
877 if (!winbind_name_list_to_sid_string_list(pamh, ctrl, user, member,
878 request.data.auth.require_membership_of_sid,
879 sizeof(request.data.auth.require_membership_of_sid))) {
880
881 _pam_log_debug(pamh, ctrl, LOG_ERR, "failed to serialize membership of sid \"%s\"\n", member);
882 return PAM_AUTH_ERR;
883 }
884 }
885
886 ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_AUTH, &request, &response, user);
887
888 if (pwd_last_set) {
889 *pwd_last_set = response.data.auth.info3.pass_last_set_time;
890 }
891
892 if ((ctrl & WINBIND_KRB5_AUTH) &&
893 response.data.auth.krb5ccname[0] != '\0') {
894
895 char var[PATH_MAX];
896
897 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "request returned KRB5CCNAME: %s",
898 response.data.auth.krb5ccname);
899
900 snprintf(var, sizeof(var), "KRB5CCNAME=%s", response.data.auth.krb5ccname);
901
902 ret = pam_putenv(pamh, var);
903 if (ret != PAM_SUCCESS) {
904 _pam_log(pamh, ctrl, LOG_ERR, "failed to set KRB5CCNAME to %s", var);
905 return ret;
906 }
907 }
908
909 if (p_response) {
910 /* We want to process the response in the caller. */
911 *p_response = response;
912 return ret;
913 }
914
915 if (ret) {
916 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PASSWORD_EXPIRED");
917 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PASSWORD_MUST_CHANGE");
918 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_INVALID_WORKSTATION");
919 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_INVALID_LOGON_HOURS");
920 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_EXPIRED");
921 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_DISABLED");
922 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_LOCKED_OUT");
923 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT");
924 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT");
925 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT");
926 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
927 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NO_LOGON_SERVERS");
928 }
929
930 /* handle the case where the auth was ok, but the password must expire right now */
931 /* good catch from Ralf Haferkamp: an expiry of "never" is translated to -1 */
932 if ( ! (response.data.auth.info3.acct_flags & ACB_PWNOEXP) &&
933 ! (PAM_WB_GRACE_LOGON(response.data.auth.info3.user_flgs)) &&
934 (response.data.auth.policy.expire > 0) &&
935 (response.data.auth.info3.pass_last_set_time + response.data.auth.policy.expire < time(NULL))) {
936
937 ret = PAM_AUTHTOK_EXPIRED;
938
939 _pam_log_debug(pamh, ctrl, LOG_DEBUG,"Password has expired (Password was last set: %d, "
940 "the policy says it should expire here %d (now it's: %d)\n",
941 response.data.auth.info3.pass_last_set_time,
942 response.data.auth.info3.pass_last_set_time + response.data.auth.policy.expire,
943 time(NULL));
944
945 PAM_WB_REMARK_DIRECT_RET(pamh, "NT_STATUS_PASSWORD_EXPIRED");
946
947 }
948
949 /* warn a user if the password is about to expire soon */
950 _pam_warn_password_expires_in_future(pamh, &response);
951
952 /* inform about logon type */
953 if (PAM_WB_GRACE_LOGON(response.data.auth.info3.user_flgs)) {
954
955 _make_remark(pamh, PAM_ERROR_MSG,
956 "Grace login. Please change your password as soon you're online again");
957 _pam_log_debug(pamh, ctrl, LOG_DEBUG,
958 "User %s logged on using grace logon\n", user);
959
960 } else if (PAM_WB_CACHED_LOGON(response.data.auth.info3.user_flgs)) {
961
962 _make_remark(pamh, PAM_ERROR_MSG,
963 "Logging on using cached account. Network resources can be unavailable");
964 _pam_log_debug(pamh, ctrl, LOG_DEBUG,
965 "User %s logged on using cached account\n", user);
966 }
967
968 /* save the CIFS homedir for pam_cifs / pam_mount */
969 if (response.data.auth.info3.home_dir[0] != '\0') {
970
971 int ret2 = pam_set_data(pamh, PAM_WINBIND_HOMEDIR,
972 (void *) strdup(response.data.auth.info3.home_dir),
973 _pam_winbind_cleanup_func);
974 if (ret2) {
975 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "Could not set data: %s",
976 pam_strerror(pamh, ret2));
977 }
978
979 }
980
981 /* save the logon script path for other PAM modules */
982 if (response.data.auth.info3.logon_script[0] != '\0') {
983
984 int ret2 = pam_set_data(pamh, PAM_WINBIND_LOGONSCRIPT,
985 (void *) strdup(response.data.auth.info3.logon_script),
986 _pam_winbind_cleanup_func);
987 if (ret2) {
988 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "Could not set data: %s",
989 pam_strerror(pamh, ret2));
990 }
991 }
992
993 /* save the profile path for other PAM modules */
994 if (response.data.auth.info3.profile_path[0] != '\0') {
995
996 int ret2 = pam_set_data(pamh, PAM_WINBIND_PROFILEPATH,
997 (void *) strdup(response.data.auth.info3.profile_path),
998 _pam_winbind_cleanup_func);
999 if (ret2) {
1000 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "Could not set data: %s",
1001 pam_strerror(pamh, ret2));
1002 }
1003 }
1004
1005 /* If winbindd returned a username, return the pointer to it here. */
1006 if (user_ret && response.extra_data.data) {
1007 /* We have to trust it's a null terminated string. */
1008 *user_ret = (char *)response.extra_data.data;
1009 }
1010
1011 return ret;
1012 }
1013
1014 /* talk to winbindd */
1015 static int winbind_chauthtok_request(pam_handle_t * pamh,
1016 int ctrl,
1017 const char *user,
1018 const char *oldpass,
1019 const char *newpass,
1020 time_t pwd_last_set)
1021 {
1022 struct winbindd_request request;
1023 struct winbindd_response response;
1024 int ret;
1025
1026 ZERO_STRUCT(request);
1027 ZERO_STRUCT(response);
1028
1029 if (request.data.chauthtok.user == NULL) return -2;
1030
1031 strncpy(request.data.chauthtok.user, user,
1032 sizeof(request.data.chauthtok.user) - 1);
1033
1034 if (oldpass != NULL) {
1035 strncpy(request.data.chauthtok.oldpass, oldpass,
1036 sizeof(request.data.chauthtok.oldpass) - 1);
1037 } else {
1038 request.data.chauthtok.oldpass[0] = '\0';
1039 }
1040
1041 if (newpass != NULL) {
1042 strncpy(request.data.chauthtok.newpass, newpass,
1043 sizeof(request.data.chauthtok.newpass) - 1);
1044 } else {
1045 request.data.chauthtok.newpass[0] = '\0';
1046 }
1047
1048 if (ctrl & WINBIND_KRB5_AUTH) {
1049 request.flags = WBFLAG_PAM_KRB5 | WBFLAG_PAM_CONTACT_TRUSTDOM;
1050 }
1051
1052 ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_CHAUTHTOK, &request, &response, user);
1053
1054 if (ret == PAM_SUCCESS) {
1055 return ret;
1056 }
1057
1058 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_BACKUP_CONTROLLER");
1059 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
1060 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NO_LOGON_SERVERS");
1061 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCESS_DENIED");
1062
1063 /* TODO: tell the min pwd length ? */
1064 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_TOO_SHORT");
1065
1066 /* TODO: tell the minage ? */
1067 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_TOO_RECENT");
1068
1069 /* TODO: tell the history length ? */
1070 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_HISTORY_CONFLICT");
1071
1072 if (!strcasecmp(response.data.auth.nt_status_string, "NT_STATUS_PASSWORD_RESTRICTION")) {
1073
1074 char *pwd_restriction_string = NULL;
1075
1076 /* FIXME: avoid to send multiple PAM messages after another */
1077 switch (response.data.auth.reject_reason) {
1078 case -1:
1079 break;
1080 case REJECT_REASON_OTHER:
1081 if ((response.data.auth.policy.min_passwordage > 0) &&
1082 (pwd_last_set + response.data.auth.policy.min_passwordage > time(NULL))) {
1083 PAM_WB_REMARK_DIRECT(pamh, "NT_STATUS_PWD_TOO_RECENT");
1084 }
1085 break;
1086 case REJECT_REASON_TOO_SHORT:
1087 PAM_WB_REMARK_DIRECT(pamh, "NT_STATUS_PWD_TOO_SHORT");
1088 break;
1089 case REJECT_REASON_IN_HISTORY:
1090 PAM_WB_REMARK_DIRECT(pamh, "NT_STATUS_PWD_HISTORY_CONFLICT");
1091 break;
1092 case REJECT_REASON_NOT_COMPLEX:
1093 _make_remark(pamh, PAM_ERROR_MSG, "Password does not meet complexity requirements");
1094 break;
1095 default:
1096 _pam_log_debug(pamh, ctrl, LOG_DEBUG,
1097 "unknown password change reject reason: %d",
1098 response.data.auth.reject_reason);
1099 break;
1100 }
1101
1102 pwd_restriction_string = _pam_compose_pwd_restriction_string(&response);
1103 if (pwd_restriction_string) {
1104 _make_remark(pamh, PAM_ERROR_MSG, pwd_restriction_string);
1105 SAFE_FREE(pwd_restriction_string);
1106 }
1107 }
1108
1109 return ret;
1110 }
1111
1112 /*
1113 * Checks if a user has an account
1114 *
1115 * return values:
1116 * 1 = User not found
1117 * 0 = OK
1118 * -1 = System error
1119 */
1120 static int valid_user(pam_handle_t *pamh, int ctrl, const char *user)
1121 {
1122 /* check not only if the user is available over NSS calls, also make
1123 * sure it's really a winbind user, this is important when stacking PAM
1124 * modules in the 'account' or 'password' facility. */
1125
1126 struct passwd *pwd = NULL;
1127 struct winbindd_request request;
1128 struct winbindd_response response;
1129 int ret;
1130
1131 ZERO_STRUCT(request);
1132 ZERO_STRUCT(response);
1133
1134 pwd = getpwnam(user);
1135 if (pwd == NULL) {
1136 return 1;
1137 }
1138
1139 strncpy(request.data.username, user,
1140 sizeof(request.data.username) - 1);
1141
1142 ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_GETPWNAM, &request, &response, user);
1143
1144 switch (ret) {
1145 case PAM_USER_UNKNOWN:
1146 return 1;
1147 case PAM_SUCCESS:
1148 return 0;
1149 default:
1150 break;
1151 }
1152 return -1;
1153 }
1154
1155 static char *_pam_delete(register char *xx)
1156 {
1157 _pam_overwrite(xx);
1158 _pam_drop(xx);
1159 return NULL;
1160 }
1161
1162 /*
1163 * obtain a password from the user
1164 */
1165
1166 static int _winbind_read_password(pam_handle_t * pamh,
1167 unsigned int ctrl,
1168 const char *comment,
1169 const char *prompt1,
1170 const char *prompt2,
1171 const char **pass)
1172 {
1173 int authtok_flag;
1174 int retval;
1175 const char *item;
1176 char *token;
1177
1178 _pam_log(pamh, ctrl, LOG_DEBUG, "getting password (0x%08x)", ctrl);
1179
1180 /*
1181 * make sure nothing inappropriate gets returned
1182 */
1183
1184 *pass = token = NULL;
1185
1186 /*
1187 * which authentication token are we getting?
1188 */
1189
1190 authtok_flag = on(WINBIND__OLD_PASSWORD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
1191
1192 /*
1193 * should we obtain the password from a PAM item ?
1194 */
1195
1196 if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) || on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
1197 retval = _pam_get_item(pamh, authtok_flag, &item);
1198 if (retval != PAM_SUCCESS) {
1199 /* very strange. */
1200 _pam_log(pamh, ctrl, LOG_ALERT,
1201 "pam_get_item returned error to unix-read-password"
1202 );
1203 return retval;
1204 } else if (item != NULL) { /* we have a password! */
1205 *pass = item;
1206 item = NULL;
1207 _pam_log(pamh, ctrl, LOG_DEBUG,
1208 "pam_get_item returned a password");
1209 return PAM_SUCCESS;
1210 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
1211 return PAM_AUTHTOK_RECOVER_ERR; /* didn't work */
1212 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
1213 && off(WINBIND__OLD_PASSWORD, ctrl)) {
1214 return PAM_AUTHTOK_RECOVER_ERR;
1215 }
1216 }
1217 /*
1218 * getting here implies we will have to get the password from the
1219 * user directly.
1220 */
1221
1222 {
1223 struct pam_message msg[3], *pmsg[3];
1224 struct pam_response *resp;
1225 int i, replies;
1226
1227 /* prepare to converse */
1228
1229 if (comment != NULL) {
1230 pmsg[0] = &msg[0];
1231 msg[0].msg_style = PAM_TEXT_INFO;
1232 msg[0].msg = CONST_DISCARD(char *, comment);
1233 i = 1;
1234 } else {
1235 i = 0;
1236 }
1237
1238 pmsg[i] = &msg[i];
1239 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
1240 msg[i++].msg = CONST_DISCARD(char *, prompt1);
1241 replies = 1;
1242
1243 if (prompt2 != NULL) {
1244 pmsg[i] = &msg[i];
1245 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
1246 msg[i++].msg = CONST_DISCARD(char *, prompt2);
1247 ++replies;
1248 }
1249 /* so call the conversation expecting i responses */
1250 resp = NULL;
1251 retval = converse(pamh, i, pmsg, &resp);
1252
1253 if (resp != NULL) {
1254
1255 /* interpret the response */
1256
1257 if (retval == PAM_SUCCESS) { /* a good conversation */
1258
1259 token = x_strdup(resp[i - replies].resp);
1260 if (token != NULL) {
1261 if (replies == 2) {
1262 /* verify that password entered correctly */
1263 if (!resp[i - 1].resp
1264 || strcmp(token, resp[i - 1].resp)) {
1265 _pam_delete(token); /* mistyped */
1266 retval = PAM_AUTHTOK_RECOVER_ERR;
1267 _make_remark(pamh, PAM_ERROR_MSG, MISTYPED_PASS);
1268 }
1269 }
1270 } else {
1271 _pam_log(pamh, ctrl, LOG_NOTICE, "could not recover authentication token");
1272 retval = PAM_AUTHTOK_RECOVER_ERR;
1273 }
1274
1275 }
1276 /*
1277 * tidy up the conversation (resp_retcode) is ignored
1278 * -- what is it for anyway? AGM
1279 */
1280
1281 _pam_drop_reply(resp, i);
1282
1283 } else {
1284 retval = (retval == PAM_SUCCESS)
1285 ? PAM_AUTHTOK_RECOVER_ERR : retval;
1286 }
1287 }
1288
1289 if (retval != PAM_SUCCESS) {
1290 _pam_log_debug(pamh, ctrl, LOG_DEBUG,
1291 "unable to obtain a password");
1292 return retval;
1293 }
1294 /* 'token' is the entered password */
1295
1296 /* we store this password as an item */
1297
1298 retval = pam_set_item(pamh, authtok_flag, token);
1299 _pam_delete(token); /* clean it up */
1300 if (retval != PAM_SUCCESS ||
1301 (retval = _pam_get_item(pamh, authtok_flag, &item)) != PAM_SUCCESS) {
1302
1303 _pam_log(pamh, ctrl, LOG_CRIT, "error manipulating password");
1304 return retval;
1305
1306 }
1307
1308 *pass = item;
1309 item = NULL; /* break link to password */
1310
1311 return PAM_SUCCESS;
1312 }
1313
1314 const char *get_conf_item_string(const pam_handle_t *pamh,
1315 int argc,
1316 const char **argv,
1317 int ctrl,
1318 dictionary *d,
1319 const char *item,
1320 int config_flag)
1321 {
1322 int i = 0;
1323 const char *parm_opt = NULL;
1324 char *key = NULL;
1325
1326 if (!(ctrl & config_flag)) {
1327 goto out;
1328 }
1329
1330 /* let the pam opt take precedence over the pam_winbind.conf option */
1331
1332 if (d != NULL) {
1333
1334 if (!asprintf(&key, "global:%s", item)) {
1335 goto out;
1336 }
1337
1338 parm_opt = iniparser_getstr(d, key);
1339 SAFE_FREE(key);
1340 }
1341
1342 for ( i=0; i<argc; i++ ) {
1343
1344 if ((strncmp(argv[i], item, strlen(item)) == 0)) {
1345 char *p;
1346
1347 if ( (p = strchr( argv[i], '=' )) == NULL) {
1348 _pam_log(pamh, ctrl, LOG_INFO, "no \"=\" delimiter for \"%s\" found\n", item);
1349 goto out;
1350 }
1351 _pam_log_debug(pamh, ctrl, LOG_INFO, "PAM config: %s '%s'\n", item, p+1);
1352 return p + 1;
1353 }
1354 }
1355
1356 if (d != NULL) {
1357 _pam_log_debug(pamh, ctrl, LOG_INFO, "CONFIG file: %s '%s'\n", item, parm_opt);
1358 }
1359 out:
1360 return parm_opt;
1361 }
1362
1363 const char *get_krb5_cc_type_from_config(const pam_handle_t *pamh, int argc, const char **argv, int ctrl, dictionary *d)
1364 {
1365 return get_conf_item_string(pamh, argc, argv, ctrl, d, "krb5_ccache_type", WINBIND_KRB5_CCACHE_TYPE);
1366 }
1367
1368 const char *get_member_from_config(const pam_handle_t *pamh, int argc, const char **argv, int ctrl, dictionary *d)
1369 {
1370 const char *ret = NULL;
1371 ret = get_conf_item_string(pamh, argc, argv, ctrl, d, "require_membership_of", WINBIND_REQUIRED_MEMBERSHIP);
1372 if (ret) {
1373 return ret;
1374 }
1375 return get_conf_item_string(pamh, argc, argv, ctrl, d, "require-membership-of", WINBIND_REQUIRED_MEMBERSHIP);
1376 }
1377
1378 PAM_EXTERN
1379 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
1380 int argc, const char **argv)
1381 {
1382 const char *username;
1383 const char *password;
1384 const char *member = NULL;
1385 const char *cctype = NULL;
1386 int retval = PAM_AUTH_ERR;
1387 dictionary *d = NULL;
1388 char *username_ret = NULL;
1389 char *new_authtok_required = NULL;
1390
1391 /* parse arguments */
1392 int ctrl = _pam_parse(pamh, flags, argc, argv, &d);
1393 if (ctrl == -1) {
1394 retval = PAM_SYSTEM_ERR;
1395 goto out;
1396 }
1397
1398 _PAM_LOG_FUNCTION_ENTER("pam_sm_authenticate", pamh, ctrl, flags);
1399
1400 /* Get the username */
1401 retval = pam_get_user(pamh, &username, NULL);
1402 if ((retval != PAM_SUCCESS) || (!username)) {
1403 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "can not get the username");
1404 retval = PAM_SERVICE_ERR;
1405 goto out;
1406 }
1407
1408 retval = _winbind_read_password(pamh, ctrl, NULL,
1409 "Password: ", NULL,
1410 &password);
1411
1412 if (retval != PAM_SUCCESS) {
1413 _pam_log(pamh, ctrl, LOG_ERR, "Could not retrieve user's password");
1414 retval = PAM_AUTHTOK_ERR;
1415 goto out;
1416 }
1417
1418 /* Let's not give too much away in the log file */
1419
1420 #ifdef DEBUG_PASSWORD
1421 _pam_log_debug(pamh, ctrl, LOG_INFO, "Verify user '%s' with password '%s'",
1422 username, password);
1423 #else
1424 _pam_log_debug(pamh, ctrl, LOG_INFO, "Verify user '%s'", username);
1425 #endif
1426
1427 member = get_member_from_config(pamh, argc, argv, ctrl, d);
1428
1429 cctype = get_krb5_cc_type_from_config(pamh, argc, argv, ctrl, d);
1430
1431 /* Now use the username to look up password */
1432 retval = winbind_auth_request(pamh, ctrl, username, password, member,
1433 cctype, NULL, NULL, &username_ret);
1434
1435 if (retval == PAM_NEW_AUTHTOK_REQD ||
1436 retval == PAM_AUTHTOK_EXPIRED) {
1437
1438 if (!asprintf(&new_authtok_required, "%d", retval)) {
1439 retval = PAM_BUF_ERR;
1440 goto out;
1441 }
1442
1443 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, new_authtok_required, _pam_winbind_cleanup_func);
1444
1445 retval = PAM_SUCCESS;
1446 goto out;
1447 }
1448
1449 out:
1450 if (username_ret) {
1451 pam_set_item (pamh, PAM_USER, username_ret);
1452 _pam_log_debug(pamh, ctrl, LOG_INFO, "Returned user was '%s'", username_ret);
1453 free(username_ret);
1454 }
1455
1456 if (d) {
1457 iniparser_freedict(d);
1458 }
1459
1460 if (!new_authtok_required) {
1461 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, NULL, NULL);
1462 }
1463
1464 _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", pamh, ctrl, retval);
1465
1466 return retval;
1467 }
1468
1469 PAM_EXTERN
1470 int pam_sm_setcred(pam_handle_t *pamh, int flags,
1471 int argc, const char **argv)
1472 {
1473 int ret = PAM_SYSTEM_ERR;
1474 dictionary *d = NULL;
1475
1476 /* parse arguments */
1477 int ctrl = _pam_parse(pamh, flags, argc, argv, &d);
1478 if (ctrl == -1) {
1479 ret = PAM_SYSTEM_ERR;
1480 goto out;
1481 }
1482
1483 _PAM_LOG_FUNCTION_ENTER("pam_sm_setcred", pamh, ctrl, flags);
1484
1485 switch (flags & ~PAM_SILENT) {
1486
1487 case PAM_DELETE_CRED:
1488 ret = pam_sm_close_session(pamh, flags, argc, argv);
1489 break;
1490 case PAM_REFRESH_CRED:
1491 _pam_log_debug(pamh, ctrl, LOG_WARNING, "PAM_REFRESH_CRED not implemented");
1492 ret = PAM_SUCCESS;
1493 break;
1494 case PAM_REINITIALIZE_CRED:
1495 _pam_log_debug(pamh, ctrl, LOG_WARNING, "PAM_REINITIALIZE_CRED not implemented");
1496 ret = PAM_SUCCESS;
1497 break;
1498 case PAM_ESTABLISH_CRED:
1499 _pam_log_debug(pamh, ctrl, LOG_WARNING, "PAM_ESTABLISH_CRED not implemented");
1500 ret = PAM_SUCCESS;
1501 break;
1502 default:
1503 ret = PAM_SYSTEM_ERR;
1504 break;
1505 }
1506
1507 out:
1508 if (d) {
1509 iniparser_freedict(d);
1510 }
1511
1512 _PAM_LOG_FUNCTION_LEAVE("pam_sm_setcred", pamh, ctrl, ret);
1513
1514 return ret;
1515 }
1516
1517 /*
1518 * Account management. We want to verify that the account exists
1519 * before returning PAM_SUCCESS
1520 */
1521 PAM_EXTERN
1522 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
1523 int argc, const char **argv)
1524 {
1525 const char *username;
1526 int ret = PAM_USER_UNKNOWN;
1527 void *tmp = NULL;
1528 dictionary *d = NULL;
1529
1530 /* parse arguments */
1531 int ctrl = _pam_parse(pamh, flags, argc, argv, &d);
1532 if (ctrl == -1) {
1533 return PAM_SYSTEM_ERR;
1534 }
1535
1536 _PAM_LOG_FUNCTION_ENTER("pam_sm_acct_mgmt", pamh, ctrl, flags);
1537
1538
1539 /* Get the username */
1540 ret = pam_get_user(pamh, &username, NULL);
1541 if ((ret != PAM_SUCCESS) || (!username)) {
1542 _pam_log_debug(pamh, ctrl, LOG_DEBUG,"can not get the username");
1543 ret = PAM_SERVICE_ERR;
1544 goto out;
1545 }
1546
1547 /* Verify the username */
1548 ret = valid_user(pamh, ctrl, username);
1549 switch (ret) {
1550 case -1:
1551 /* some sort of system error. The log was already printed */
1552 ret = PAM_SERVICE_ERR;
1553 goto out;
1554 case 1:
1555 /* the user does not exist */
1556 _pam_log_debug(pamh, ctrl, LOG_NOTICE, "user '%s' not found", username);
1557 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
1558 ret = PAM_IGNORE;
1559 goto out;
1560 }
1561 ret = PAM_USER_UNKNOWN;
1562 goto out;
1563 case 0:
1564 pam_get_data( pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, (const void **)&tmp);
1565 if (tmp != NULL) {
1566 ret = atoi((const char *)tmp);
1567 switch (ret) {
1568 case PAM_AUTHTOK_EXPIRED:
1569 /* fall through, since new token is required in this case */
1570 case PAM_NEW_AUTHTOK_REQD:
1571 _pam_log(pamh, ctrl, LOG_WARNING, "pam_sm_acct_mgmt success but %s is set",
1572 PAM_WINBIND_NEW_AUTHTOK_REQD);
1573 _pam_log(pamh, ctrl, LOG_NOTICE, "user '%s' needs new password", username);
1574 /* PAM_AUTHTOKEN_REQD does not exist, but is documented in the manpage */
1575 ret = PAM_NEW_AUTHTOK_REQD;
1576 goto out;
1577 default:
1578 _pam_log(pamh, ctrl, LOG_WARNING, "pam_sm_acct_mgmt success");
1579 _pam_log(pamh, ctrl, LOG_NOTICE, "user '%s' granted access", username);
1580 ret = PAM_SUCCESS;
1581 goto out;
1582 }
1583 }
1584
1585 /* Otherwise, the authentication looked good */
1586 _pam_log(pamh, ctrl, LOG_NOTICE, "user '%s' granted access", username);
1587 ret = PAM_SUCCESS;
1588 goto out;
1589 default:
1590 /* we don't know anything about this return value */
1591 _pam_log(pamh, ctrl, LOG_ERR, "internal module error (ret = %d, user = '%s')",
1592 ret, username);
1593 ret = PAM_SERVICE_ERR;
1594 goto out;
1595 }
1596
1597 /* should not be reached */
1598 ret = PAM_IGNORE;
1599
1600 out:
1601
1602 if (d) {
1603 iniparser_freedict(d);
1604 }
1605
1606 _PAM_LOG_FUNCTION_LEAVE("pam_sm_acct_mgmt", pamh, ctrl, ret);
1607
1608 return ret;
1609 }
1610
1611 PAM_EXTERN
1612 int pam_sm_open_session(pam_handle_t *pamh, int flags,
1613 int argc, const char **argv)
1614 {
1615 int ret = PAM_SYSTEM_ERR;
1616 dictionary *d = NULL;
1617
1618 /* parse arguments */
1619 int ctrl = _pam_parse(pamh, flags, argc, argv, &d);
1620 if (ctrl == -1) {
1621 ret = PAM_SYSTEM_ERR;
1622 goto out;
1623 }
1624
1625 _PAM_LOG_FUNCTION_ENTER("pam_sm_open_session", pamh, ctrl, flags);
1626
1627 ret = PAM_SUCCESS;
1628
1629 out:
1630 if (d) {
1631 iniparser_freedict(d);
1632 }
1633
1634 _PAM_LOG_FUNCTION_LEAVE("pam_sm_open_session", pamh, ctrl, ret);
1635
1636 return ret;
1637 }
1638
1639 PAM_EXTERN
1640 int pam_sm_close_session(pam_handle_t *pamh, int flags,
1641 int argc, const char **argv)
1642 {
1643 dictionary *d = NULL;
1644 int retval = PAM_SUCCESS;
1645
1646 /* parse arguments */
1647 int ctrl = _pam_parse(pamh, flags, argc, argv, &d);
1648 if (ctrl == -1) {
1649 retval = PAM_SYSTEM_ERR;
1650 goto out;
1651 }
1652
1653 _PAM_LOG_FUNCTION_ENTER("pam_sm_close_session", pamh, ctrl, flags);
1654
1655 if (!(flags & PAM_DELETE_CRED)) {
1656 retval = PAM_SUCCESS;
1657 goto out;
1658 }
1659
1660 if (ctrl & WINBIND_KRB5_AUTH) {
1661
1662 /* destroy the ccache here */
1663 struct winbindd_request request;
1664 struct winbindd_response response;
1665 const char *user;
1666 const char *ccname = NULL;
1667 struct passwd *pwd = NULL;
1668
1669 ZERO_STRUCT(request);
1670 ZERO_STRUCT(response);
1671
1672 retval = pam_get_user(pamh, &user, "Username: ");
1673 if (retval) {
1674 _pam_log(pamh, ctrl, LOG_ERR, "could not identify user");
1675 goto out;
1676 }
1677
1678 if (user == NULL) {
1679 _pam_log(pamh, ctrl, LOG_ERR, "username was NULL!");
1680 retval = PAM_USER_UNKNOWN;
1681 goto out;
1682 }
1683
1684 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "username [%s] obtained", user);
1685
1686 ccname = pam_getenv(pamh, "KRB5CCNAME");
1687 if (ccname == NULL) {
1688 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "user has no KRB5CCNAME environment");
1689 }
1690
1691 strncpy(request.data.logoff.user, user,
1692 sizeof(request.data.logoff.user) - 1);
1693
1694 if (ccname) {
1695 strncpy(request.data.logoff.krb5ccname, ccname,
1696 sizeof(request.data.logoff.krb5ccname) - 1);
1697 }
1698
1699 pwd = getpwnam(user);
1700 if (pwd == NULL) {
1701 retval = PAM_USER_UNKNOWN;
1702 goto out;
1703 }
1704 request.data.logoff.uid = pwd->pw_uid;
1705
1706 request.flags = WBFLAG_PAM_KRB5 | WBFLAG_PAM_CONTACT_TRUSTDOM;
1707
1708 retval = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_LOGOFF, &request, &response, user);
1709 }
1710
1711 out:
1712 if (d) {
1713 iniparser_freedict(d);
1714 }
1715
1716 _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", pamh, ctrl, retval);
1717
1718 return retval;
1719 }
1720
1721
1722
1723 PAM_EXTERN
1724 int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
1725 int argc, const char **argv)
1726 {
1727 unsigned int lctrl;
1728 int ret;
1729 unsigned int ctrl;
1730
1731 /* <DO NOT free() THESE> */
1732 const char *user;
1733 char *pass_old, *pass_new;
1734 /* </DO NOT free() THESE> */
1735
1736 char *Announce;
1737
1738 int retry = 0;
1739 dictionary *d = NULL;
1740
1741 ctrl = _pam_parse(pamh, flags, argc, argv, &d);
1742 if (ctrl == -1) {
1743 ret = PAM_SYSTEM_ERR;
1744 goto out;
1745 }
1746
1747 _PAM_LOG_FUNCTION_ENTER("pam_sm_chauthtok", pamh, ctrl, flags);
1748
1749 /* clearing offline bit for the auth in the password change */
1750 ctrl &= ~WINBIND_CACHED_LOGIN;
1751
1752 /*
1753 * First get the name of a user
1754 */
1755 ret = pam_get_user(pamh, &user, "Username: ");
1756 if (ret) {
1757 _pam_log(pamh, ctrl, LOG_ERR,
1758 "password - could not identify user");
1759 goto out;
1760 }
1761
1762 if (user == NULL) {
1763 _pam_log(pamh, ctrl, LOG_ERR, "username was NULL!");
1764 ret = PAM_USER_UNKNOWN;
1765 goto out;
1766 }
1767
1768 _pam_log_debug(pamh, ctrl, LOG_DEBUG, "username [%s] obtained", user);
1769
1770 /* check if this is really a user in winbindd, not only in NSS */
1771 ret = valid_user(pamh, ctrl, user);
1772 switch (ret) {
1773 case 1:
1774 ret = PAM_USER_UNKNOWN;
1775 goto out;
1776 case -1:
1777 ret = PAM_SYSTEM_ERR;
1778 goto out;
1779 default:
1780 break;
1781 }
1782
1783 /*
1784 * obtain and verify the current password (OLDAUTHTOK) for
1785 * the user.
1786 */
1787
1788 if (flags & PAM_PRELIM_CHECK) {
1789 struct winbindd_response response;
1790 time_t pwdlastset_prelim = 0;
1791
1792 /* instruct user what is happening */
1793 #define greeting "Changing password for "
1794 Announce = (char *) malloc(sizeof(greeting) + strlen(user));
1795 if (Announce == NULL) {
1796 _pam_log(pamh, ctrl, LOG_CRIT, "password - out of memory");
1797 ret = PAM_BUF_ERR;
1798 goto out;
1799 }
1800 (void) strcpy(Announce, greeting);
1801 (void) strcpy(Announce + sizeof(greeting) - 1, user);
1802 #undef greeting
1803
1804 lctrl = ctrl | WINBIND__OLD_PASSWORD;
1805 ret = _winbind_read_password(pamh, lctrl,
1806 Announce,
1807 "(current) NT password: ",
1808 NULL,
1809 (const char **) &pass_old);
1810 if (ret != PAM_SUCCESS) {
1811 _pam_log(pamh, ctrl, LOG_NOTICE, "password - (old) token not obtained");
1812 goto out;
1813 }
1814
1815 /* We don't need krb5 env set for password change test. */
1816 ctrl &= ~WINBIND_KRB5_AUTH;
1817
1818 /* verify that this is the password for this user */
1819
1820 ret = winbind_auth_request(pamh, ctrl, user, pass_old,
1821 NULL, NULL, &response, &pwdlastset_prelim, NULL);
1822
1823 if (ret != PAM_ACCT_EXPIRED &&
1824 ret != PAM_AUTHTOK_EXPIRED &&
1825 ret != PAM_NEW_AUTHTOK_REQD &&
1826 ret != PAM_SUCCESS) {
1827 pass_old = NULL;
1828 if (d) {
1829 iniparser_freedict(d);
1830 }
1831 /* Deal with offline errors. */
1832 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh,
1833 response,
1834 "NT_STATUS_NO_LOGON_SERVERS");
1835 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh,
1836 response,
1837 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
1838 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh,
1839 response,
1840 "NT_STATUS_ACCESS_DENIED");
1841 return ret;
1842 }
1843
1844 pam_set_data(pamh, PAM_WINBIND_PWD_LAST_SET, (void *)pwdlastset_prelim, NULL);
1845
1846 ret = pam_set_item(pamh, PAM_OLDAUTHTOK, (const void *) pass_old);
1847 pass_old = NULL;
1848 if (ret != PAM_SUCCESS) {
1849 _pam_log(pamh, ctrl, LOG_CRIT, "failed to set PAM_OLDAUTHTOK");
1850 }
1851 } else if (flags & PAM_UPDATE_AUTHTOK) {
1852
1853 time_t pwdlastset_update = 0;
1854
1855 /*
1856 * obtain the proposed password
1857 */
1858
1859 /*
1860 * get the old token back.
1861 */
1862
1863 ret = _pam_get_item(pamh, PAM_OLDAUTHTOK, &pass_old);
1864
1865 if (ret != PAM_SUCCESS) {
1866 _pam_log(pamh, ctrl, LOG_NOTICE, "user not authenticated");
1867 goto out;
1868 }
1869
1870 lctrl = ctrl & ~WINBIND_TRY_FIRST_PASS_ARG;
1871
1872 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
1873 lctrl |= WINBIND_USE_FIRST_PASS_ARG;
1874 }
1875 retry = 0;
1876 ret = PAM_AUTHTOK_ERR;
1877 while ((ret != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
1878 /*
1879 * use_authtok is to force the use of a previously entered
1880 * password -- needed for pluggable password strength checking
1881 */
1882
1883 ret = _winbind_read_password(pamh, lctrl,
1884 NULL,
1885 "Enter new NT password: ",
1886 "Retype new NT password: ",
1887 (const char **) &pass_new);
1888
1889 if (ret != PAM_SUCCESS) {
1890 _pam_log_debug(pamh, ctrl, LOG_ALERT
1891 ,"password - new password not obtained");
1892 pass_old = NULL;/* tidy up */
1893 goto out;
1894 }
1895
1896 /*
1897 * At this point we know who the user is and what they
1898 * propose as their new password. Verify that the new
1899 * password is acceptable.
1900 */
1901
1902 if (pass_new[0] == '\0') {/* "\0" password = NULL */
1903 pass_new = NULL;
1904 }
1905 }
1906
1907 /*
1908 * By reaching here we have approved the passwords and must now
1909 * rebuild the password database file.
1910 */
1911 _pam_get_data( pamh, PAM_WINBIND_PWD_LAST_SET,
1912 &pwdlastset_update);
1913
1914 ret = winbind_chauthtok_request(pamh, ctrl, user, pass_old, pass_new, pwdlastset_update);
1915 if (ret) {
1916 _pam_overwrite(pass_new);
1917 _pam_overwrite(pass_old);
1918 pass_old = pass_new = NULL;
1919 goto out;
1920 }
1921
1922 /* just in case we need krb5 creds after a password change over msrpc */
1923
1924 if (ctrl & WINBIND_KRB5_AUTH) {
1925 struct winbindd_response response;
1926
1927 const char *member = get_member_from_config(pamh, argc, argv, ctrl, d);
1928 const char *cctype = get_krb5_cc_type_from_config(pamh, argc, argv, ctrl, d);
1929
1930 ret = winbind_auth_request(pamh, ctrl, user, pass_new,
1931 member, cctype, &response, NULL, NULL);
1932 _pam_overwrite(pass_new);
1933 _pam_overwrite(pass_old);
1934 pass_old = pass_new = NULL;
1935 if (d) {
1936 iniparser_freedict(d);
1937 }
1938 /* Deal with offline errors. */
1939 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh,
1940 response,
1941 "NT_STATUS_NO_LOGON_SERVERS");
1942 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh,
1943 response,
1944 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND");
1945 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh,
1946 response,
1947 "NT_STATUS_ACCESS_DENIED");
1948 return ret;
1949 }
1950 } else {
1951 ret = PAM_SERVICE_ERR;
1952 }
1953
1954 out:
1955 if (d) {
1956 iniparser_freedict(d);
1957 }
1958
1959 _PAM_LOG_FUNCTION_LEAVE("pam_sm_chauthtok", pamh, ctrl, ret);
1960
1961 return ret;
1962 }
1963
1964 #ifdef PAM_STATIC
1965
1966 /* static module data */
1967
1968 struct pam_module _pam_winbind_modstruct = {
1969 MODULE_NAME,
1970 pam_sm_authenticate,
1971 pam_sm_setcred,
1972 pam_sm_acct_mgmt,
1973 pam_sm_open_session,
1974 pam_sm_close_session,
1975 pam_sm_chauthtok
1976 };
1977
1978 #endif
1979
1980 /*
1981 * Copyright (c) Andrew Tridgell <tridge@samba.org> 2000
1982 * Copyright (c) Tim Potter <tpot@samba.org> 2000
1983 * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
1984 * Copyright (c) Guenther Deschner <gd@samba.org> 2005-2007
1985 * Copyright (c) Jan Rêkorajski 1999.
1986 * Copyright (c) Andrew G. Morgan 1996-8.
1987 * Copyright (c) Alex O. Yuriev, 1996.
1988 * Copyright (c) Cristian Gafton 1996.
1989 * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
1990 *
1991 * Redistribution and use in source and binary forms, with or without
1992 * modification, are permitted provided that the following conditions
1993 * are met:
1994 * 1. Redistributions of source code must retain the above copyright
1995 * notice, and the entire permission notice in its entirety,
1996 * including the disclaimer of warranties.
1997 * 2. Redistributions in binary form must reproduce the above copyright
1998 * notice, this list of conditions and the following disclaimer in the
1999 * documentation and/or other materials provided with the distribution.
2000 * 3. The name of the author may not be used to endorse or promote
2001 * products derived from this software without specific prior
2002 * written permission.
2003 *
2004 * ALTERNATIVELY, this product may be distributed under the terms of
2005 * the GNU Public License, in which case the provisions of the GPL are
2006 * required INSTEAD OF the above restrictions. (This clause is
2007 * necessary due to a potential bad interaction between the GPL and
2008 * the restrictions contained in a BSD-style copyright.)
2009 *
2010 * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
2011 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
2012 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
2013 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
2014 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
2015 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
2016 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2017 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
2018 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
2019 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
2020 * OF THE POSSIBILITY OF SUCH DAMAGE.
2021 */