4 Copyright (c) 2010, Simo Sorce <idra@samba.org>
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "param/param.h"
22 #include "dsdb/samdb/samdb.h"
23 #include "auth/auth.h"
24 #include "auth/credentials/credentials.h"
25 #include "system/kerberos.h"
27 #include "mit_samba_interface.h"
28 #include "auth/kerberos/kerberos.h"
29 #include "kdc/samba_kdc.h"
30 #include "kdc/pac-glue.h"
31 #include "kdc/db-glue.h"
33 const int mit_samba_interface_version
= MIT_SAMBA_INTERFACE_VERSION
;
35 struct mit_samba_context
{
36 struct auth_session_info
*session_info
;
38 /* for compat with hdb plugin common code */
40 struct samba_kdc_db_context
*db_ctx
;
43 static void mit_samba_context_free(struct mit_samba_context
*ctx
)
45 /* free heimdal's krb5_context */
47 krb5_free_context(ctx
->context
);
50 /* then free everything else */
54 static int mit_samba_context_init(struct mit_samba_context
**_ctx
)
57 struct mit_samba_context
*ctx
;
58 const char *s4_conf_file
;
60 struct samba_kdc_base_context base_ctx
;
62 ctx
= talloc(NULL
, struct mit_samba_context
);
68 base_ctx
.ev_ctx
= tevent_context_init(ctx
);
69 if (!base_ctx
.ev_ctx
) {
73 base_ctx
.lp_ctx
= loadparm_init(ctx
);
74 if (!base_ctx
.lp_ctx
) {
78 /* init s4 configuration */
79 s4_conf_file
= lpcfg_configfile(base_ctx
.lp_ctx
);
81 lpcfg_load(base_ctx
.lp_ctx
, s4_conf_file
);
83 lpcfg_load_default(base_ctx
.lp_ctx
);
86 status
= samba_kdc_setup_db_ctx(ctx
, &base_ctx
, &ctx
->db_ctx
);
87 if (!NT_STATUS_IS_OK(status
)) {
92 /* init heimdal's krb_context and log facilities */
93 ret
= smb_krb5_init_context_basic(ctx
,
104 mit_samba_context_free(ctx
);
112 static int mit_samba_get_principal(struct mit_samba_context
*ctx
,
113 char *principal_string
,
115 hdb_entry_ex
**_hentry
)
117 krb5_principal principal
;
118 hdb_entry_ex
*hentry
;
121 hentry
= talloc(ctx
, hdb_entry_ex
);
126 ret
= krb5_parse_name(ctx
->context
, principal_string
, &principal
);
131 ret
= samba_kdc_fetch(ctx
->context
, ctx
->db_ctx
,
132 principal
, flags
, 0, hentry
);
134 krb5_free_principal(ctx
->context
, principal
);
140 talloc_steal(hentry
->ctx
, hentry
);
146 static int mit_samba_get_firstkey(struct mit_samba_context
*ctx
,
147 hdb_entry_ex
**_hentry
)
149 hdb_entry_ex
*hentry
;
152 hentry
= talloc(ctx
, hdb_entry_ex
);
157 ret
= samba_kdc_firstkey(ctx
->context
, ctx
->db_ctx
, hentry
);
162 talloc_steal(hentry
->ctx
, hentry
);
168 static int mit_samba_get_nextkey(struct mit_samba_context
*ctx
,
169 hdb_entry_ex
**_hentry
)
171 hdb_entry_ex
*hentry
;
174 hentry
= talloc(ctx
, hdb_entry_ex
);
179 ret
= samba_kdc_nextkey(ctx
->context
, ctx
->db_ctx
, hentry
);
184 talloc_steal(hentry
->ctx
, hentry
);
190 static int mit_samba_get_pac_data(struct mit_samba_context
*ctx
,
191 hdb_entry_ex
*client
,
198 tmp_ctx
= talloc_named(ctx
, 0, "mit_samba_get_pac_data context");
203 nt_status
= samba_kdc_get_pac_blob(tmp_ctx
, client
, &pac_blob
);
204 if (!NT_STATUS_IS_OK(nt_status
)) {
205 talloc_free(tmp_ctx
);
209 data
->data
= (uint8_t *)malloc(pac_blob
->length
);
211 talloc_free(tmp_ctx
);
214 memcpy(data
->data
, pac_blob
->data
, pac_blob
->length
);
215 data
->length
= pac_blob
->length
;
217 talloc_free(tmp_ctx
);
221 static int mit_samba_update_pac_data(struct mit_samba_context
*ctx
,
222 hdb_entry_ex
*client
,
224 DATA_BLOB
*logon_data
)
227 DATA_BLOB
*logon_blob
;
228 krb5_error_code code
;
233 /* The user account may be set not to want the PAC */
234 if (client
&& !samba_princ_needs_pac(client
)) {
238 tmp_ctx
= talloc_named(ctx
, 0, "mit_samba_update_pac_data context");
243 logon_blob
= talloc_zero(tmp_ctx
, DATA_BLOB
);
249 code
= krb5_pac_parse(ctx
->context
,
250 pac_data
->data
, pac_data
->length
, &pac
);
256 nt_status
= samba_kdc_update_pac_blob(tmp_ctx
, ctx
->context
,
258 if (!NT_STATUS_IS_OK(nt_status
)) {
259 DEBUG(0, ("Building PAC failed: %s\n",
260 nt_errstr(nt_status
)));
265 logon_data
->data
= (uint8_t *)malloc(logon_blob
->length
);
266 if (!logon_data
->data
) {
270 memcpy(logon_data
->data
, logon_blob
->data
, logon_blob
->length
);
271 logon_data
->length
= logon_blob
->length
;
276 if (pac
) krb5_pac_free(ctx
->context
, pac
);
277 talloc_free(tmp_ctx
);
281 static int mit_samba_check_client_access(struct mit_samba_context
*ctx
,
282 hdb_entry_ex
*client
,
283 const char *client_name
,
284 hdb_entry_ex
*server
,
285 const char *server_name
,
286 const char *netbios_name
,
287 bool password_change
,
290 struct samba_kdc_entry
*kdc_entry
;
293 kdc_entry
= talloc_get_type(client
->ctx
, struct samba_kdc_entry
);
295 nt_status
= samba_kdc_check_client_access(kdc_entry
,
300 if (!NT_STATUS_IS_OK(nt_status
)) {
301 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_MEMORY
)) {
305 samba_kdc_build_edata_reply(nt_status
, e_data
);
307 return samba_kdc_map_policy_err(nt_status
);
313 static int mit_samba_check_s4u2proxy(struct mit_samba_context
*ctx
,
315 const char *target_name
,
316 bool is_nt_enterprise_name
)
318 krb5_principal target_principal
;
322 if (is_nt_enterprise_name
) {
323 flags
= KRB5_PRINCIPAL_PARSE_ENTERPRISE
;
326 ret
= krb5_parse_name_flags(ctx
->context
, target_name
,
327 flags
, &target_principal
);
332 ret
= samba_kdc_check_identical_client_and_server(ctx
->context
,
337 krb5_free_principal(ctx
->context
, target_principal
);
342 struct mit_samba_function_table mit_samba_function_table
= {
343 mit_samba_context_init
,
344 mit_samba_context_free
,
345 mit_samba_get_principal
,
346 mit_samba_get_firstkey
,
347 mit_samba_get_nextkey
,
348 mit_samba_get_pac_data
,
349 mit_samba_update_pac_data
,
350 mit_samba_check_client_access
,
351 mit_samba_check_s4u2proxy