2 Unix SMB/CIFS implementation.
3 struct samu access routines
4 Copyright (C) Jeremy Allison 1996-2001
5 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6 Copyright (C) Gerald (Jerry) Carter 2000-2006
7 Copyright (C) Andrew Bartlett 2001-2002
8 Copyright (C) Stefan (metze) Metzmacher 2002
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../libcli/auth/libcli_auth.h"
28 #define DBGC_CLASS DBGC_PASSDB
31 * @todo Redefine this to NULL, but this changes the API because
32 * much of samba assumes that the pdb_get...() funtions
33 * return strings. (ie not null-pointers).
34 * See also pdb_fill_default_sam().
37 #define PDB_NOT_QUITE_NULL ""
39 /*********************************************************************
40 Collection of get...() functions for struct samu.
41 ********************************************************************/
43 uint32
pdb_get_acct_ctrl(const struct samu
*sampass
)
45 return sampass
->acct_ctrl
;
48 time_t pdb_get_logon_time(const struct samu
*sampass
)
50 return sampass
->logon_time
;
53 time_t pdb_get_logoff_time(const struct samu
*sampass
)
55 return sampass
->logoff_time
;
58 time_t pdb_get_kickoff_time(const struct samu
*sampass
)
60 return sampass
->kickoff_time
;
63 time_t pdb_get_bad_password_time(const struct samu
*sampass
)
65 return sampass
->bad_password_time
;
68 time_t pdb_get_pass_last_set_time(const struct samu
*sampass
)
70 return sampass
->pass_last_set_time
;
73 time_t pdb_get_pass_can_change_time(const struct samu
*sampass
)
77 /* if the last set time is zero, it means the user cannot
78 change their password, and this time must be zero. jmcd
80 if (sampass
->pass_last_set_time
== 0)
83 /* if the time is max, and the field has been changed,
84 we're trying to update this real value from the sampass
85 to indicate that the user cannot change their password. jmcd
87 if (sampass
->pass_can_change_time
== get_time_t_max() &&
88 pdb_get_init_flags(sampass
, PDB_CANCHANGETIME
) == PDB_CHANGED
)
89 return sampass
->pass_can_change_time
;
91 if (!pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE
, &allow
))
94 /* in normal cases, just calculate it from policy */
95 return sampass
->pass_last_set_time
+ allow
;
98 /* we need this for loading from the backend, so that we don't overwrite
99 non-changed max times, otherwise the pass_can_change checking won't work */
100 time_t pdb_get_pass_can_change_time_noncalc(const struct samu
*sampass
)
102 return sampass
->pass_can_change_time
;
105 time_t pdb_get_pass_must_change_time(const struct samu
*sampass
)
109 if (sampass
->pass_last_set_time
== 0)
112 if (sampass
->acct_ctrl
& ACB_PWNOEXP
)
113 return get_time_t_max();
115 if (!pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE
, &expire
)
116 || expire
== (uint32
)-1 || expire
== 0)
117 return get_time_t_max();
119 return sampass
->pass_last_set_time
+ expire
;
122 bool pdb_get_pass_can_change(const struct samu
*sampass
)
124 if (sampass
->pass_can_change_time
== get_time_t_max() &&
125 sampass
->pass_last_set_time
!= 0)
130 uint16
pdb_get_logon_divs(const struct samu
*sampass
)
132 return sampass
->logon_divs
;
135 uint32
pdb_get_hours_len(const struct samu
*sampass
)
137 return sampass
->hours_len
;
140 const uint8
*pdb_get_hours(const struct samu
*sampass
)
142 return (sampass
->hours
);
145 const uint8
*pdb_get_nt_passwd(const struct samu
*sampass
)
147 SMB_ASSERT((!sampass
->nt_pw
.data
)
148 || sampass
->nt_pw
.length
== NT_HASH_LEN
);
149 return (uint8
*)sampass
->nt_pw
.data
;
152 const uint8
*pdb_get_lanman_passwd(const struct samu
*sampass
)
154 SMB_ASSERT((!sampass
->lm_pw
.data
)
155 || sampass
->lm_pw
.length
== LM_HASH_LEN
);
156 return (uint8
*)sampass
->lm_pw
.data
;
159 const uint8
*pdb_get_pw_history(const struct samu
*sampass
, uint32
*current_hist_len
)
161 SMB_ASSERT((!sampass
->nt_pw_his
.data
)
162 || ((sampass
->nt_pw_his
.length
% PW_HISTORY_ENTRY_LEN
) == 0));
163 *current_hist_len
= sampass
->nt_pw_his
.length
/ PW_HISTORY_ENTRY_LEN
;
164 return (uint8
*)sampass
->nt_pw_his
.data
;
167 /* Return the plaintext password if known. Most of the time
168 it isn't, so don't assume anything magic about this function.
170 Used to pass the plaintext to passdb backends that might
171 want to store more than just the NTLM hashes.
173 const char *pdb_get_plaintext_passwd(const struct samu
*sampass
)
175 return sampass
->plaintext_pw
;
178 const DOM_SID
*pdb_get_user_sid(const struct samu
*sampass
)
180 return &sampass
->user_sid
;
183 const DOM_SID
*pdb_get_group_sid(struct samu
*sampass
)
188 /* Return the cached group SID if we have that */
189 if ( sampass
->group_sid
) {
190 return sampass
->group_sid
;
193 /* generate the group SID from the user's primary Unix group */
195 if ( !(gsid
= TALLOC_P( sampass
, DOM_SID
)) ) {
199 /* No algorithmic mapping, meaning that we have to figure out the
200 primary group SID according to group mapping and the user SID must
201 be a newly allocated one. We rely on the user's Unix primary gid.
202 We have no choice but to fail if we can't find it. */
204 if ( sampass
->unix_pw
) {
205 pwd
= sampass
->unix_pw
;
207 pwd
= Get_Pwnam_alloc( sampass
, pdb_get_username(sampass
) );
211 DEBUG(0,("pdb_get_group_sid: Failed to find Unix account for %s\n", pdb_get_username(sampass
) ));
215 if ( pdb_gid_to_sid(pwd
->pw_gid
, gsid
) ) {
216 enum lsa_SidType type
= SID_NAME_UNKNOWN
;
217 TALLOC_CTX
*mem_ctx
= talloc_init("pdb_get_group_sid");
224 /* Now check that it's actually a domain group and not something else */
226 lookup_ret
= lookup_sid(mem_ctx
, gsid
, NULL
, NULL
, &type
);
228 TALLOC_FREE( mem_ctx
);
230 if ( lookup_ret
&& (type
== SID_NAME_DOM_GRP
) ) {
231 sampass
->group_sid
= gsid
;
232 return sampass
->group_sid
;
235 DEBUG(3, ("Primary group for user %s is a %s and not a domain group\n",
236 pwd
->pw_name
, sid_type_lookup(type
)));
239 /* Just set it to the 'Domain Users' RID of 512 which will
240 always resolve to a name */
242 sid_copy( gsid
, get_global_sam_sid() );
243 sid_append_rid( gsid
, DOMAIN_GROUP_RID_USERS
);
245 sampass
->group_sid
= gsid
;
247 return sampass
->group_sid
;
251 * Get flags showing what is initalised in the struct samu
252 * @param sampass the struct samu in question
253 * @return the flags indicating the members initialised in the struct.
256 enum pdb_value_state
pdb_get_init_flags(const struct samu
*sampass
, enum pdb_elements element
)
258 enum pdb_value_state ret
= PDB_DEFAULT
;
260 if (!sampass
->change_flags
|| !sampass
->set_flags
)
263 if (bitmap_query(sampass
->set_flags
, element
)) {
264 DEBUG(11, ("element %d: SET\n", element
));
268 if (bitmap_query(sampass
->change_flags
, element
)) {
269 DEBUG(11, ("element %d: CHANGED\n", element
));
273 if (ret
== PDB_DEFAULT
) {
274 DEBUG(11, ("element %d: DEFAULT\n", element
));
280 const char *pdb_get_username(const struct samu
*sampass
)
282 return sampass
->username
;
285 const char *pdb_get_domain(const struct samu
*sampass
)
287 return sampass
->domain
;
290 const char *pdb_get_nt_username(const struct samu
*sampass
)
292 return sampass
->nt_username
;
295 const char *pdb_get_fullname(const struct samu
*sampass
)
297 return sampass
->full_name
;
300 const char *pdb_get_homedir(const struct samu
*sampass
)
302 return sampass
->home_dir
;
305 const char *pdb_get_dir_drive(const struct samu
*sampass
)
307 return sampass
->dir_drive
;
310 const char *pdb_get_logon_script(const struct samu
*sampass
)
312 return sampass
->logon_script
;
315 const char *pdb_get_profile_path(const struct samu
*sampass
)
317 return sampass
->profile_path
;
320 const char *pdb_get_acct_desc(const struct samu
*sampass
)
322 return sampass
->acct_desc
;
325 const char *pdb_get_workstations(const struct samu
*sampass
)
327 return sampass
->workstations
;
330 const char *pdb_get_comment(const struct samu
*sampass
)
332 return sampass
->comment
;
335 const char *pdb_get_munged_dial(const struct samu
*sampass
)
337 return sampass
->munged_dial
;
340 uint16
pdb_get_bad_password_count(const struct samu
*sampass
)
342 return sampass
->bad_password_count
;
345 uint16
pdb_get_logon_count(const struct samu
*sampass
)
347 return sampass
->logon_count
;
350 uint32
pdb_get_unknown_6(const struct samu
*sampass
)
352 return sampass
->unknown_6
;
355 void *pdb_get_backend_private_data(const struct samu
*sampass
, const struct pdb_methods
*my_methods
)
357 if (my_methods
== sampass
->backend_private_methods
) {
358 return sampass
->backend_private_data
;
364 /*********************************************************************
365 Collection of set...() functions for struct samu.
366 ********************************************************************/
368 bool pdb_set_acct_ctrl(struct samu
*sampass
, uint32 acct_ctrl
, enum pdb_value_state flag
)
370 sampass
->acct_ctrl
= acct_ctrl
;
371 return pdb_set_init_flags(sampass
, PDB_ACCTCTRL
, flag
);
374 bool pdb_set_logon_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
376 sampass
->logon_time
= mytime
;
377 return pdb_set_init_flags(sampass
, PDB_LOGONTIME
, flag
);
380 bool pdb_set_logoff_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
382 sampass
->logoff_time
= mytime
;
383 return pdb_set_init_flags(sampass
, PDB_LOGOFFTIME
, flag
);
386 bool pdb_set_kickoff_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
388 sampass
->kickoff_time
= mytime
;
389 return pdb_set_init_flags(sampass
, PDB_KICKOFFTIME
, flag
);
392 bool pdb_set_bad_password_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
394 sampass
->bad_password_time
= mytime
;
395 return pdb_set_init_flags(sampass
, PDB_BAD_PASSWORD_TIME
, flag
);
398 bool pdb_set_pass_can_change_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
400 sampass
->pass_can_change_time
= mytime
;
401 return pdb_set_init_flags(sampass
, PDB_CANCHANGETIME
, flag
);
404 bool pdb_set_pass_must_change_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
406 sampass
->pass_must_change_time
= mytime
;
407 return pdb_set_init_flags(sampass
, PDB_MUSTCHANGETIME
, flag
);
410 bool pdb_set_pass_last_set_time(struct samu
*sampass
, time_t mytime
, enum pdb_value_state flag
)
412 sampass
->pass_last_set_time
= mytime
;
413 return pdb_set_init_flags(sampass
, PDB_PASSLASTSET
, flag
);
416 bool pdb_set_hours_len(struct samu
*sampass
, uint32 len
, enum pdb_value_state flag
)
418 sampass
->hours_len
= len
;
419 return pdb_set_init_flags(sampass
, PDB_HOURSLEN
, flag
);
422 bool pdb_set_logon_divs(struct samu
*sampass
, uint16 hours
, enum pdb_value_state flag
)
424 sampass
->logon_divs
= hours
;
425 return pdb_set_init_flags(sampass
, PDB_LOGONDIVS
, flag
);
429 * Set flags showing what is initalised in the struct samu
430 * @param sampass the struct samu in question
431 * @param flag The *new* flag to be set. Old flags preserved
432 * this flag is only added.
435 bool pdb_set_init_flags(struct samu
*sampass
, enum pdb_elements element
, enum pdb_value_state value_flag
)
437 if (!sampass
->set_flags
) {
438 if ((sampass
->set_flags
=
439 bitmap_talloc(sampass
,
441 DEBUG(0,("bitmap_talloc failed\n"));
445 if (!sampass
->change_flags
) {
446 if ((sampass
->change_flags
=
447 bitmap_talloc(sampass
,
449 DEBUG(0,("bitmap_talloc failed\n"));
456 if (!bitmap_set(sampass
->change_flags
, element
)) {
457 DEBUG(0,("Can't set flag: %d in change_flags.\n",element
));
460 if (!bitmap_set(sampass
->set_flags
, element
)) {
461 DEBUG(0,("Can't set flag: %d in set_flags.\n",element
));
464 DEBUG(11, ("element %d -> now CHANGED\n", element
));
467 if (!bitmap_clear(sampass
->change_flags
, element
)) {
468 DEBUG(0,("Can't set flag: %d in change_flags.\n",element
));
471 if (!bitmap_set(sampass
->set_flags
, element
)) {
472 DEBUG(0,("Can't set flag: %d in set_flags.\n",element
));
475 DEBUG(11, ("element %d -> now SET\n", element
));
479 if (!bitmap_clear(sampass
->change_flags
, element
)) {
480 DEBUG(0,("Can't set flag: %d in change_flags.\n",element
));
483 if (!bitmap_clear(sampass
->set_flags
, element
)) {
484 DEBUG(0,("Can't set flag: %d in set_flags.\n",element
));
487 DEBUG(11, ("element %d -> now DEFAULT\n", element
));
494 bool pdb_set_user_sid(struct samu
*sampass
, const DOM_SID
*u_sid
, enum pdb_value_state flag
)
499 sid_copy(&sampass
->user_sid
, u_sid
);
501 DEBUG(10, ("pdb_set_user_sid: setting user sid %s\n",
502 sid_string_dbg(&sampass
->user_sid
)));
504 return pdb_set_init_flags(sampass
, PDB_USERSID
, flag
);
507 bool pdb_set_user_sid_from_string(struct samu
*sampass
, fstring u_sid
, enum pdb_value_state flag
)
514 DEBUG(10, ("pdb_set_user_sid_from_string: setting user sid %s\n",
517 if (!string_to_sid(&new_sid
, u_sid
)) {
518 DEBUG(1, ("pdb_set_user_sid_from_string: %s isn't a valid SID!\n", u_sid
));
522 if (!pdb_set_user_sid(sampass
, &new_sid
, flag
)) {
523 DEBUG(1, ("pdb_set_user_sid_from_string: could not set sid %s on struct samu!\n", u_sid
));
530 /********************************************************************
531 We never fill this in from a passdb backend but rather set is
532 based on the user's primary group membership. However, the
533 struct samu* is overloaded and reused in domain memship code
534 as well and built from the netr_SamInfo3 or PAC so we
535 have to allow the explicitly setting of a group SID here.
536 ********************************************************************/
538 bool pdb_set_group_sid(struct samu
*sampass
, const DOM_SID
*g_sid
, enum pdb_value_state flag
)
545 if ( !(sampass
->group_sid
= TALLOC_P( sampass
, DOM_SID
)) ) {
549 /* if we cannot resolve the SID to gid, then just ignore it and
550 store DOMAIN_USERS as the primary groupSID */
552 if ( sid_to_gid( g_sid
, &gid
) ) {
553 sid_copy(sampass
->group_sid
, g_sid
);
555 sid_copy( sampass
->group_sid
, get_global_sam_sid() );
556 sid_append_rid( sampass
->group_sid
, DOMAIN_GROUP_RID_USERS
);
559 DEBUG(10, ("pdb_set_group_sid: setting group sid %s\n",
560 sid_string_dbg(sampass
->group_sid
)));
562 return pdb_set_init_flags(sampass
, PDB_GROUPSID
, flag
);
565 /*********************************************************************
566 Set the user's UNIX name.
567 ********************************************************************/
569 bool pdb_set_username(struct samu
*sampass
, const char *username
, enum pdb_value_state flag
)
572 DEBUG(10, ("pdb_set_username: setting username %s, was %s\n", username
,
573 (sampass
->username
)?(sampass
->username
):"NULL"));
575 sampass
->username
= talloc_strdup(sampass
, username
);
577 if (!sampass
->username
) {
578 DEBUG(0, ("pdb_set_username: talloc_strdup() failed!\n"));
582 sampass
->username
= PDB_NOT_QUITE_NULL
;
585 return pdb_set_init_flags(sampass
, PDB_USERNAME
, flag
);
588 /*********************************************************************
590 ********************************************************************/
592 bool pdb_set_domain(struct samu
*sampass
, const char *domain
, enum pdb_value_state flag
)
595 DEBUG(10, ("pdb_set_domain: setting domain %s, was %s\n", domain
,
596 (sampass
->domain
)?(sampass
->domain
):"NULL"));
598 sampass
->domain
= talloc_strdup(sampass
, domain
);
600 if (!sampass
->domain
) {
601 DEBUG(0, ("pdb_set_domain: talloc_strdup() failed!\n"));
605 sampass
->domain
= PDB_NOT_QUITE_NULL
;
608 return pdb_set_init_flags(sampass
, PDB_DOMAIN
, flag
);
611 /*********************************************************************
612 Set the user's NT name.
613 ********************************************************************/
615 bool pdb_set_nt_username(struct samu
*sampass
, const char *nt_username
, enum pdb_value_state flag
)
618 DEBUG(10, ("pdb_set_nt_username: setting nt username %s, was %s\n", nt_username
,
619 (sampass
->nt_username
)?(sampass
->nt_username
):"NULL"));
621 sampass
->nt_username
= talloc_strdup(sampass
, nt_username
);
623 if (!sampass
->nt_username
) {
624 DEBUG(0, ("pdb_set_nt_username: talloc_strdup() failed!\n"));
628 sampass
->nt_username
= PDB_NOT_QUITE_NULL
;
631 return pdb_set_init_flags(sampass
, PDB_NTUSERNAME
, flag
);
634 /*********************************************************************
635 Set the user's full name.
636 ********************************************************************/
638 bool pdb_set_fullname(struct samu
*sampass
, const char *full_name
, enum pdb_value_state flag
)
641 DEBUG(10, ("pdb_set_full_name: setting full name %s, was %s\n", full_name
,
642 (sampass
->full_name
)?(sampass
->full_name
):"NULL"));
644 sampass
->full_name
= talloc_strdup(sampass
, full_name
);
646 if (!sampass
->full_name
) {
647 DEBUG(0, ("pdb_set_fullname: talloc_strdup() failed!\n"));
651 sampass
->full_name
= PDB_NOT_QUITE_NULL
;
654 return pdb_set_init_flags(sampass
, PDB_FULLNAME
, flag
);
657 /*********************************************************************
658 Set the user's logon script.
659 ********************************************************************/
661 bool pdb_set_logon_script(struct samu
*sampass
, const char *logon_script
, enum pdb_value_state flag
)
664 DEBUG(10, ("pdb_set_logon_script: setting logon script %s, was %s\n", logon_script
,
665 (sampass
->logon_script
)?(sampass
->logon_script
):"NULL"));
667 sampass
->logon_script
= talloc_strdup(sampass
, logon_script
);
669 if (!sampass
->logon_script
) {
670 DEBUG(0, ("pdb_set_logon_script: talloc_strdup() failed!\n"));
674 sampass
->logon_script
= PDB_NOT_QUITE_NULL
;
677 return pdb_set_init_flags(sampass
, PDB_LOGONSCRIPT
, flag
);
680 /*********************************************************************
681 Set the user's profile path.
682 ********************************************************************/
684 bool pdb_set_profile_path(struct samu
*sampass
, const char *profile_path
, enum pdb_value_state flag
)
687 DEBUG(10, ("pdb_set_profile_path: setting profile path %s, was %s\n", profile_path
,
688 (sampass
->profile_path
)?(sampass
->profile_path
):"NULL"));
690 sampass
->profile_path
= talloc_strdup(sampass
, profile_path
);
692 if (!sampass
->profile_path
) {
693 DEBUG(0, ("pdb_set_profile_path: talloc_strdup() failed!\n"));
697 sampass
->profile_path
= PDB_NOT_QUITE_NULL
;
700 return pdb_set_init_flags(sampass
, PDB_PROFILE
, flag
);
703 /*********************************************************************
704 Set the user's directory drive.
705 ********************************************************************/
707 bool pdb_set_dir_drive(struct samu
*sampass
, const char *dir_drive
, enum pdb_value_state flag
)
710 DEBUG(10, ("pdb_set_dir_drive: setting dir drive %s, was %s\n", dir_drive
,
711 (sampass
->dir_drive
)?(sampass
->dir_drive
):"NULL"));
713 sampass
->dir_drive
= talloc_strdup(sampass
, dir_drive
);
715 if (!sampass
->dir_drive
) {
716 DEBUG(0, ("pdb_set_dir_drive: talloc_strdup() failed!\n"));
721 sampass
->dir_drive
= PDB_NOT_QUITE_NULL
;
724 return pdb_set_init_flags(sampass
, PDB_DRIVE
, flag
);
727 /*********************************************************************
728 Set the user's home directory.
729 ********************************************************************/
731 bool pdb_set_homedir(struct samu
*sampass
, const char *home_dir
, enum pdb_value_state flag
)
734 DEBUG(10, ("pdb_set_homedir: setting home dir %s, was %s\n", home_dir
,
735 (sampass
->home_dir
)?(sampass
->home_dir
):"NULL"));
737 sampass
->home_dir
= talloc_strdup(sampass
, home_dir
);
739 if (!sampass
->home_dir
) {
740 DEBUG(0, ("pdb_set_home_dir: talloc_strdup() failed!\n"));
744 sampass
->home_dir
= PDB_NOT_QUITE_NULL
;
747 return pdb_set_init_flags(sampass
, PDB_SMBHOME
, flag
);
750 /*********************************************************************
751 Set the user's account description.
752 ********************************************************************/
754 bool pdb_set_acct_desc(struct samu
*sampass
, const char *acct_desc
, enum pdb_value_state flag
)
757 sampass
->acct_desc
= talloc_strdup(sampass
, acct_desc
);
759 if (!sampass
->acct_desc
) {
760 DEBUG(0, ("pdb_set_acct_desc: talloc_strdup() failed!\n"));
764 sampass
->acct_desc
= PDB_NOT_QUITE_NULL
;
767 return pdb_set_init_flags(sampass
, PDB_ACCTDESC
, flag
);
770 /*********************************************************************
771 Set the user's workstation allowed list.
772 ********************************************************************/
774 bool pdb_set_workstations(struct samu
*sampass
, const char *workstations
, enum pdb_value_state flag
)
777 DEBUG(10, ("pdb_set_workstations: setting workstations %s, was %s\n", workstations
,
778 (sampass
->workstations
)?(sampass
->workstations
):"NULL"));
780 sampass
->workstations
= talloc_strdup(sampass
, workstations
);
782 if (!sampass
->workstations
) {
783 DEBUG(0, ("pdb_set_workstations: talloc_strdup() failed!\n"));
787 sampass
->workstations
= PDB_NOT_QUITE_NULL
;
790 return pdb_set_init_flags(sampass
, PDB_WORKSTATIONS
, flag
);
793 /*********************************************************************
794 ********************************************************************/
796 bool pdb_set_comment(struct samu
*sampass
, const char *comment
, enum pdb_value_state flag
)
799 sampass
->comment
= talloc_strdup(sampass
, comment
);
801 if (!sampass
->comment
) {
802 DEBUG(0, ("pdb_set_comment: talloc_strdup() failed!\n"));
806 sampass
->comment
= PDB_NOT_QUITE_NULL
;
809 return pdb_set_init_flags(sampass
, PDB_COMMENT
, flag
);
812 /*********************************************************************
813 Set the user's dial string.
814 ********************************************************************/
816 bool pdb_set_munged_dial(struct samu
*sampass
, const char *munged_dial
, enum pdb_value_state flag
)
819 sampass
->munged_dial
= talloc_strdup(sampass
, munged_dial
);
821 if (!sampass
->munged_dial
) {
822 DEBUG(0, ("pdb_set_munged_dial: talloc_strdup() failed!\n"));
826 sampass
->munged_dial
= PDB_NOT_QUITE_NULL
;
829 return pdb_set_init_flags(sampass
, PDB_MUNGEDDIAL
, flag
);
832 /*********************************************************************
833 Set the user's NT hash.
834 ********************************************************************/
836 bool pdb_set_nt_passwd(struct samu
*sampass
, const uint8 pwd
[NT_HASH_LEN
], enum pdb_value_state flag
)
838 data_blob_clear_free(&sampass
->nt_pw
);
842 data_blob_talloc(sampass
, pwd
, NT_HASH_LEN
);
844 sampass
->nt_pw
= data_blob_null
;
847 return pdb_set_init_flags(sampass
, PDB_NTPASSWD
, flag
);
850 /*********************************************************************
851 Set the user's LM hash.
852 ********************************************************************/
854 bool pdb_set_lanman_passwd(struct samu
*sampass
, const uint8 pwd
[LM_HASH_LEN
], enum pdb_value_state flag
)
856 data_blob_clear_free(&sampass
->lm_pw
);
858 /* on keep the password if we are allowing LANMAN authentication */
860 if (pwd
&& lp_lanman_auth() ) {
861 sampass
->lm_pw
= data_blob_talloc(sampass
, pwd
, LM_HASH_LEN
);
863 sampass
->lm_pw
= data_blob_null
;
866 return pdb_set_init_flags(sampass
, PDB_LMPASSWD
, flag
);
869 /*********************************************************************
870 Set the user's password history hash. historyLen is the number of
871 PW_HISTORY_SALT_LEN+SALTED_MD5_HASH_LEN length
872 entries to store in the history - this must match the size of the uint8 array
874 ********************************************************************/
876 bool pdb_set_pw_history(struct samu
*sampass
, const uint8
*pwd
, uint32 historyLen
, enum pdb_value_state flag
)
878 if (historyLen
&& pwd
){
879 data_blob_free(&(sampass
->nt_pw_his
));
880 sampass
->nt_pw_his
= data_blob_talloc(sampass
,
881 pwd
, historyLen
*PW_HISTORY_ENTRY_LEN
);
882 if (!sampass
->nt_pw_his
.length
) {
883 DEBUG(0, ("pdb_set_pw_history: data_blob_talloc() failed!\n"));
887 sampass
->nt_pw_his
= data_blob_talloc(sampass
, NULL
, 0);
890 return pdb_set_init_flags(sampass
, PDB_PWHISTORY
, flag
);
893 /*********************************************************************
894 Set the user's plaintext password only (base procedure, see helper
896 ********************************************************************/
898 bool pdb_set_plaintext_pw_only(struct samu
*sampass
, const char *password
, enum pdb_value_state flag
)
901 if (sampass
->plaintext_pw
!=NULL
)
902 memset(sampass
->plaintext_pw
,'\0',strlen(sampass
->plaintext_pw
)+1);
904 sampass
->plaintext_pw
= talloc_strdup(sampass
, password
);
906 if (!sampass
->plaintext_pw
) {
907 DEBUG(0, ("pdb_set_unknown_str: talloc_strdup() failed!\n"));
911 sampass
->plaintext_pw
= NULL
;
914 return pdb_set_init_flags(sampass
, PDB_PLAINTEXT_PW
, flag
);
917 bool pdb_set_bad_password_count(struct samu
*sampass
, uint16 bad_password_count
, enum pdb_value_state flag
)
919 sampass
->bad_password_count
= bad_password_count
;
920 return pdb_set_init_flags(sampass
, PDB_BAD_PASSWORD_COUNT
, flag
);
923 bool pdb_set_logon_count(struct samu
*sampass
, uint16 logon_count
, enum pdb_value_state flag
)
925 sampass
->logon_count
= logon_count
;
926 return pdb_set_init_flags(sampass
, PDB_LOGON_COUNT
, flag
);
929 bool pdb_set_unknown_6(struct samu
*sampass
, uint32 unkn
, enum pdb_value_state flag
)
931 sampass
->unknown_6
= unkn
;
932 return pdb_set_init_flags(sampass
, PDB_UNKNOWN6
, flag
);
935 bool pdb_set_hours(struct samu
*sampass
, const uint8
*hours
, enum pdb_value_state flag
)
938 memset ((char *)sampass
->hours
, 0, MAX_HOURS_LEN
);
940 memcpy (sampass
->hours
, hours
, MAX_HOURS_LEN
);
943 return pdb_set_init_flags(sampass
, PDB_HOURS
, flag
);
946 bool pdb_set_backend_private_data(struct samu
*sampass
, void *private_data
,
947 void (*free_fn
)(void **),
948 const struct pdb_methods
*my_methods
,
949 enum pdb_value_state flag
)
951 if (sampass
->backend_private_data
&&
952 sampass
->backend_private_data_free_fn
) {
953 sampass
->backend_private_data_free_fn(
954 &sampass
->backend_private_data
);
957 sampass
->backend_private_data
= private_data
;
958 sampass
->backend_private_data_free_fn
= free_fn
;
959 sampass
->backend_private_methods
= my_methods
;
961 return pdb_set_init_flags(sampass
, PDB_BACKEND_PRIVATE_DATA
, flag
);
965 /* Helpful interfaces to the above */
967 bool pdb_set_pass_can_change(struct samu
*sampass
, bool canchange
)
969 return pdb_set_pass_can_change_time(sampass
,
970 canchange
? 0 : get_time_t_max(),
975 /*********************************************************************
976 Set the user's PLAINTEXT password. Used as an interface to the above.
977 Also sets the last change time to NOW.
978 ********************************************************************/
980 bool pdb_set_plaintext_passwd(struct samu
*sampass
, const char *plaintext
)
982 uchar new_lanman_p16
[LM_HASH_LEN
];
983 uchar new_nt_p16
[NT_HASH_LEN
];
990 /* Calculate the MD4 hash (NT compatible) of the password */
991 E_md4hash(plaintext
, new_nt_p16
);
993 if (!pdb_set_nt_passwd (sampass
, new_nt_p16
, PDB_CHANGED
))
996 if (!E_deshash(plaintext
, new_lanman_p16
)) {
997 /* E_deshash returns false for 'long' passwords (> 14
998 DOS chars). This allows us to match Win2k, which
999 does not store a LM hash for these passwords (which
1000 would reduce the effective password length to 14 */
1002 if (!pdb_set_lanman_passwd (sampass
, NULL
, PDB_CHANGED
))
1005 if (!pdb_set_lanman_passwd (sampass
, new_lanman_p16
, PDB_CHANGED
))
1009 if (!pdb_set_plaintext_pw_only (sampass
, plaintext
, PDB_CHANGED
))
1012 if (!pdb_set_pass_last_set_time (sampass
, time(NULL
), PDB_CHANGED
))
1015 if ((pdb_get_acct_ctrl(sampass
) & ACB_NORMAL
) == 0) {
1017 * No password history for non-user accounts
1022 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY
, &pwHistLen
);
1023 if (pwHistLen
!= 0){
1024 uint32 current_history_len
;
1026 * We need to make sure we don't have a race condition
1027 * here - the account policy history length can change
1028 * between when the pw_history was first loaded into
1029 * the struct samu struct and now.... JRA.
1031 pwhistory
= (uchar
*)pdb_get_pw_history(sampass
,
1032 ¤t_history_len
);
1034 if (current_history_len
!= pwHistLen
) {
1036 * After closing and reopening struct samu the history
1037 * values will sync up. We can't do this here.
1041 * current_history_len > pwHistLen is not a
1042 * problem - we have more history than we
1046 if (current_history_len
< pwHistLen
) {
1048 * Ensure we have space for the needed history.
1050 uchar
*new_history
= (uchar
*)TALLOC(
1052 pwHistLen
*PW_HISTORY_ENTRY_LEN
);
1057 /* And copy it into the new buffer. */
1058 if (current_history_len
) {
1059 memcpy(new_history
, pwhistory
,
1060 current_history_len
*PW_HISTORY_ENTRY_LEN
);
1062 /* Clearing out any extra space. */
1063 memset(&new_history
[current_history_len
*PW_HISTORY_ENTRY_LEN
],
1064 '\0', (pwHistLen
-current_history_len
)*PW_HISTORY_ENTRY_LEN
);
1065 /* Finally replace it. */
1066 pwhistory
= new_history
;
1069 if (pwhistory
&& pwHistLen
){
1071 * Make room for the new password in the
1074 if (pwHistLen
> 1) {
1075 memmove(&pwhistory
[PW_HISTORY_ENTRY_LEN
],
1076 pwhistory
, (pwHistLen
-1)*PW_HISTORY_ENTRY_LEN
);
1079 * Create the new salt as the first part of
1080 * the history entry.
1082 generate_random_buffer(pwhistory
, PW_HISTORY_SALT_LEN
);
1085 * Generate the md5 hash of the salt+new
1086 * password as the second part of the history
1090 E_md5hash(pwhistory
, new_nt_p16
,
1091 &pwhistory
[PW_HISTORY_SALT_LEN
]);
1092 pdb_set_pw_history(sampass
, pwhistory
, pwHistLen
,
1095 DEBUG (10,("pdb_get_set.c: pdb_set_plaintext_passwd: "
1096 "pwhistory was NULL!\n"));
1099 /* Set the history length to zero. */
1100 pdb_set_pw_history(sampass
, NULL
, 0, PDB_CHANGED
);
1105 /* check for any PDB_SET/CHANGED field and fill the appropriate mask bit */
1106 uint32
pdb_build_fields_present(struct samu
*sampass
)
1108 /* value set to all for testing */