2 Unix SMB/CIFS implementation.
4 Winbind daemon - pam auth funcions
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #define DBGC_CLASS DBGC_WINBIND
30 static NTSTATUS
append_info3_as_txt(TALLOC_CTX
*mem_ctx
,
31 struct winbindd_cli_state
*state
,
32 NET_USER_INFO_3
*info3
)
36 state
->response
.data
.auth
.info3
.logon_time
=
37 nt_time_to_unix(info3
->logon_time
);
38 state
->response
.data
.auth
.info3
.logoff_time
=
39 nt_time_to_unix(info3
->logoff_time
);
40 state
->response
.data
.auth
.info3
.kickoff_time
=
41 nt_time_to_unix(info3
->kickoff_time
);
42 state
->response
.data
.auth
.info3
.pass_last_set_time
=
43 nt_time_to_unix(info3
->pass_last_set_time
);
44 state
->response
.data
.auth
.info3
.pass_can_change_time
=
45 nt_time_to_unix(info3
->pass_can_change_time
);
46 state
->response
.data
.auth
.info3
.pass_must_change_time
=
47 nt_time_to_unix(info3
->pass_must_change_time
);
49 state
->response
.data
.auth
.info3
.logon_count
= info3
->logon_count
;
50 state
->response
.data
.auth
.info3
.bad_pw_count
= info3
->bad_pw_count
;
52 state
->response
.data
.auth
.info3
.user_rid
= info3
->user_rid
;
53 state
->response
.data
.auth
.info3
.group_rid
= info3
->group_rid
;
54 sid_to_string(str_sid
, &(info3
->dom_sid
.sid
));
55 fstrcpy(state
->response
.data
.auth
.info3
.dom_sid
, str_sid
);
57 state
->response
.data
.auth
.info3
.num_groups
= info3
->num_groups
;
58 state
->response
.data
.auth
.info3
.user_flgs
= info3
->user_flgs
;
60 state
->response
.data
.auth
.info3
.acct_flags
= info3
->acct_flags
;
61 state
->response
.data
.auth
.info3
.num_other_sids
= info3
->num_other_sids
;
63 unistr2_to_ascii(state
->response
.data
.auth
.info3
.user_name
,
64 &info3
->uni_user_name
,
65 sizeof(state
->response
.data
.auth
.info3
.user_name
));
66 unistr2_to_ascii(state
->response
.data
.auth
.info3
.full_name
,
67 &info3
->uni_full_name
,
68 sizeof(state
->response
.data
.auth
.info3
.full_name
));
69 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_script
,
70 &info3
->uni_logon_script
,
71 sizeof(state
->response
.data
.auth
.info3
.logon_script
));
72 unistr2_to_ascii(state
->response
.data
.auth
.info3
.profile_path
,
73 &info3
->uni_profile_path
,
74 sizeof(state
->response
.data
.auth
.info3
.profile_path
));
75 unistr2_to_ascii(state
->response
.data
.auth
.info3
.home_dir
,
77 sizeof(state
->response
.data
.auth
.info3
.home_dir
));
78 unistr2_to_ascii(state
->response
.data
.auth
.info3
.dir_drive
,
79 &info3
->uni_dir_drive
,
80 sizeof(state
->response
.data
.auth
.info3
.dir_drive
));
82 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_srv
,
83 &info3
->uni_logon_srv
,
84 sizeof(state
->response
.data
.auth
.info3
.logon_srv
));
85 unistr2_to_ascii(state
->response
.data
.auth
.info3
.logon_dom
,
86 &info3
->uni_logon_dom
,
87 sizeof(state
->response
.data
.auth
.info3
.logon_dom
));
92 static NTSTATUS
append_info3_as_ndr(TALLOC_CTX
*mem_ctx
,
93 struct winbindd_cli_state
*state
,
94 NET_USER_INFO_3
*info3
)
98 if (!prs_init(&ps
, 256 /* Random, non-zero number */, mem_ctx
, MARSHALL
)) {
99 return NT_STATUS_NO_MEMORY
;
101 if (!net_io_user_info3("", info3
, &ps
, 1, 3, False
)) {
103 return NT_STATUS_UNSUCCESSFUL
;
106 size
= prs_data_size(&ps
);
107 SAFE_FREE(state
->response
.extra_data
.data
);
108 state
->response
.extra_data
.data
= SMB_MALLOC(size
);
109 if (!state
->response
.extra_data
.data
) {
111 return NT_STATUS_NO_MEMORY
;
113 memset( state
->response
.extra_data
.data
, '\0', size
);
114 prs_copy_all_data_out((char *)state
->response
.extra_data
.data
, &ps
);
115 state
->response
.length
+= size
;
120 static NTSTATUS
append_unix_username(TALLOC_CTX
*mem_ctx
,
121 struct winbindd_cli_state
*state
,
122 const NET_USER_INFO_3
*info3
,
123 const char *name_domain
,
124 const char *name_user
)
126 /* We've been asked to return the unix username, per
127 'winbind use default domain' settings and the like */
129 fstring username_out
;
130 const char *nt_username
, *nt_domain
;
132 if (!(nt_domain
= unistr2_to_ascii_talloc(mem_ctx
,
133 &info3
->uni_logon_dom
))) {
134 /* If the server didn't give us one, just use the one
136 nt_domain
= name_domain
;
139 if (!(nt_username
= unistr2_to_ascii_talloc(mem_ctx
,
140 &info3
->uni_user_name
))) {
141 /* If the server didn't give us one, just use the one
143 nt_username
= name_user
;
146 fill_domain_username(username_out
, nt_domain
, nt_username
,
149 DEBUG(5,("Setting unix username to [%s]\n", username_out
));
151 SAFE_FREE(state
->response
.extra_data
.data
);
152 state
->response
.extra_data
.data
= SMB_STRDUP(username_out
);
153 if (!state
->response
.extra_data
.data
) {
154 return NT_STATUS_NO_MEMORY
;
156 state
->response
.length
+=
157 strlen((const char *)state
->response
.extra_data
.data
)+1;
162 static NTSTATUS
append_afs_token(TALLOC_CTX
*mem_ctx
,
163 struct winbindd_cli_state
*state
,
164 const NET_USER_INFO_3
*info3
,
165 const char *name_domain
,
166 const char *name_user
)
168 char *afsname
= NULL
;
171 afsname
= talloc_strdup(mem_ctx
, lp_afs_username_map());
172 if (afsname
== NULL
) {
173 return NT_STATUS_NO_MEMORY
;
176 afsname
= talloc_string_sub(mem_ctx
,
177 lp_afs_username_map(),
179 afsname
= talloc_string_sub(mem_ctx
, afsname
,
181 afsname
= talloc_string_sub(mem_ctx
, afsname
,
188 sid_copy(&user_sid
, &info3
->dom_sid
.sid
);
189 sid_append_rid(&user_sid
, info3
->user_rid
);
190 sid_to_string(sidstr
, &user_sid
);
191 afsname
= talloc_string_sub(mem_ctx
, afsname
,
195 if (afsname
== NULL
) {
196 return NT_STATUS_NO_MEMORY
;
201 DEBUG(10, ("Generating token for user %s\n", afsname
));
203 cell
= strchr(afsname
, '@');
206 return NT_STATUS_NO_MEMORY
;
212 /* Append an AFS token string */
213 SAFE_FREE(state
->response
.extra_data
.data
);
214 state
->response
.extra_data
.data
=
215 afs_createtoken_str(afsname
, cell
);
217 if (state
->response
.extra_data
.data
!= NULL
) {
218 state
->response
.length
+=
219 strlen((const char *)state
->response
.extra_data
.data
)+1;
225 static NTSTATUS
check_info3_in_group(TALLOC_CTX
*mem_ctx
,
226 NET_USER_INFO_3
*info3
,
227 const char *group_sid
)
229 * Check whether a user belongs to a group or list of groups.
231 * @param mem_ctx talloc memory context.
232 * @param info3 user information, including group membership info.
233 * @param group_sid One or more groups , separated by commas.
235 * @return NT_STATUS_OK on success,
236 * NT_STATUS_LOGON_FAILURE if the user does not belong,
237 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
240 DOM_SID
*require_membership_of_sid
;
241 size_t num_require_membership_of_sid
;
246 struct nt_user_token
*token
;
249 /* Parse the 'required group' SID */
251 if (!group_sid
|| !group_sid
[0]) {
252 /* NO sid supplied, all users may access */
256 if (!(token
= TALLOC_ZERO_P(mem_ctx
, struct nt_user_token
))) {
257 DEBUG(0, ("talloc failed\n"));
258 return NT_STATUS_NO_MEMORY
;
261 num_require_membership_of_sid
= 0;
262 require_membership_of_sid
= NULL
;
266 while (next_token(&p
, req_sid
, ",", sizeof(req_sid
))) {
267 if (!string_to_sid(&sid
, req_sid
)) {
268 DEBUG(0, ("check_info3_in_group: could not parse %s "
269 "as a SID!", req_sid
));
270 return NT_STATUS_INVALID_PARAMETER
;
273 if (!add_sid_to_array(mem_ctx
, &sid
,
274 &require_membership_of_sid
,
275 &num_require_membership_of_sid
)) {
276 DEBUG(0, ("add_sid_to_array failed\n"));
277 return NT_STATUS_NO_MEMORY
;
281 status
= sid_array_from_info3(mem_ctx
, info3
,
285 if (!NT_STATUS_IS_OK(status
)) {
289 if (!NT_STATUS_IS_OK(status
= add_aliases(get_global_sam_sid(),
291 || !NT_STATUS_IS_OK(status
= add_aliases(&global_sid_Builtin
,
293 DEBUG(3, ("could not add aliases: %s\n",
298 debug_nt_user_token(DBGC_CLASS
, 10, token
);
300 for (i
=0; i
<num_require_membership_of_sid
; i
++) {
301 DEBUG(10, ("Checking SID %s\n", sid_string_static(
302 &require_membership_of_sid
[i
])));
303 if (nt_token_check_sid(&require_membership_of_sid
[i
],
305 DEBUG(10, ("Access ok\n"));
310 /* Do not distinguish this error from a wrong username/pw */
312 return NT_STATUS_LOGON_FAILURE
;
315 struct winbindd_domain
*find_auth_domain(struct winbindd_cli_state
*state
,
316 const char *domain_name
)
318 struct winbindd_domain
*domain
;
321 domain
= find_domain_from_name_noinit(domain_name
);
322 if (domain
== NULL
) {
323 DEBUG(3, ("Authentication for domain [%s] refused"
324 "as it is not a trusted domain\n",
330 if (is_myname(domain_name
)) {
331 DEBUG(3, ("Authentication for domain %s (local domain "
332 "to this server) not supported at this "
333 "stage\n", domain_name
));
337 /* we can auth against trusted domains */
338 if (state
->request
.flags
& WBFLAG_PAM_CONTACT_TRUSTDOM
) {
339 domain
= find_domain_from_name_noinit(domain_name
);
340 if (domain
== NULL
) {
341 DEBUG(3, ("Authentication for domain [%s] skipped "
342 "as it is not a trusted domain\n",
349 return find_our_domain();
352 static void set_auth_errors(struct winbindd_response
*resp
, NTSTATUS result
)
354 resp
->data
.auth
.nt_status
= NT_STATUS_V(result
);
355 fstrcpy(resp
->data
.auth
.nt_status_string
, nt_errstr(result
));
357 /* we might have given a more useful error above */
358 if (*resp
->data
.auth
.error_string
== '\0')
359 fstrcpy(resp
->data
.auth
.error_string
,
360 get_friendly_nt_error_msg(result
));
361 resp
->data
.auth
.pam_error
= nt_status_to_pam(result
);
364 static NTSTATUS
fillup_password_policy(struct winbindd_domain
*domain
,
365 struct winbindd_cli_state
*state
)
367 struct winbindd_methods
*methods
;
368 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
369 SAM_UNK_INFO_1 password_policy
;
371 if ( !winbindd_can_contact_domain( domain
) ) {
372 DEBUG(5,("fillup_password_policy: No inbound trust to "
373 "contact domain %s\n", domain
->name
));
374 return NT_STATUS_NOT_SUPPORTED
;
377 methods
= domain
->methods
;
379 status
= methods
->password_policy(domain
, state
->mem_ctx
, &password_policy
);
380 if (NT_STATUS_IS_ERR(status
)) {
384 state
->response
.data
.auth
.policy
.min_length_password
=
385 password_policy
.min_length_password
;
386 state
->response
.data
.auth
.policy
.password_history
=
387 password_policy
.password_history
;
388 state
->response
.data
.auth
.policy
.password_properties
=
389 password_policy
.password_properties
;
390 state
->response
.data
.auth
.policy
.expire
=
391 nt_time_to_unix_abs(&(password_policy
.expire
));
392 state
->response
.data
.auth
.policy
.min_passwordage
=
393 nt_time_to_unix_abs(&(password_policy
.min_passwordage
));
398 static NTSTATUS
get_max_bad_attempts_from_lockout_policy(struct winbindd_domain
*domain
,
400 uint16
*max_allowed_bad_attempts
)
402 struct winbindd_methods
*methods
;
403 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
404 SAM_UNK_INFO_12 lockout_policy
;
406 *max_allowed_bad_attempts
= 0;
408 methods
= domain
->methods
;
410 status
= methods
->lockout_policy(domain
, mem_ctx
, &lockout_policy
);
411 if (NT_STATUS_IS_ERR(status
)) {
415 *max_allowed_bad_attempts
= lockout_policy
.bad_attempt_lockout
;
420 static NTSTATUS
get_pwd_properties(struct winbindd_domain
*domain
,
422 uint32
*password_properties
)
424 struct winbindd_methods
*methods
;
425 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
426 SAM_UNK_INFO_1 password_policy
;
428 *password_properties
= 0;
430 methods
= domain
->methods
;
432 status
= methods
->password_policy(domain
, mem_ctx
, &password_policy
);
433 if (NT_STATUS_IS_ERR(status
)) {
437 *password_properties
= password_policy
.password_properties
;
444 static const char *generate_krb5_ccache(TALLOC_CTX
*mem_ctx
,
447 bool *internal_ccache
)
449 /* accept FILE and WRFILE as krb5_cc_type from the client and then
450 * build the full ccname string based on the user's uid here -
453 const char *gen_cc
= NULL
;
455 *internal_ccache
= True
;
461 if (!type
|| type
[0] == '\0') {
465 if (strequal(type
, "FILE")) {
466 gen_cc
= talloc_asprintf(mem_ctx
, "FILE:/tmp/krb5cc_%d", uid
);
467 } else if (strequal(type
, "WRFILE")) {
468 gen_cc
= talloc_asprintf(mem_ctx
, "WRFILE:/tmp/krb5cc_%d", uid
);
470 DEBUG(10,("we don't allow to set a %s type ccache\n", type
));
474 *internal_ccache
= False
;
478 gen_cc
= talloc_strdup(mem_ctx
, "MEMORY:winbindd_pam_ccache");
481 if (gen_cc
== NULL
) {
482 DEBUG(0,("out of memory\n"));
486 DEBUG(10,("using ccache: %s %s\n", gen_cc
, *internal_ccache
? "(internal)":""));
491 static void setup_return_cc_name(struct winbindd_cli_state
*state
, const char *cc
)
493 const char *type
= state
->request
.data
.auth
.krb5_cc_type
;
495 state
->response
.data
.auth
.krb5ccname
[0] = '\0';
497 if (type
[0] == '\0') {
501 if (!strequal(type
, "FILE") &&
502 !strequal(type
, "WRFILE")) {
503 DEBUG(10,("won't return krbccname for a %s type ccache\n",
508 fstrcpy(state
->response
.data
.auth
.krb5ccname
, cc
);
513 static uid_t
get_uid_from_state(struct winbindd_cli_state
*state
)
517 uid
= state
->request
.data
.auth
.uid
;
520 DEBUG(1,("invalid uid: '%d'\n", uid
));
526 /**********************************************************************
527 Authenticate a user with a clear text password using Kerberos and fill up
529 **********************************************************************/
531 static NTSTATUS
winbindd_raw_kerberos_login(struct winbindd_domain
*domain
,
532 struct winbindd_cli_state
*state
,
533 NET_USER_INFO_3
**info3
)
536 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
537 krb5_error_code krb5_ret
;
538 const char *cc
= NULL
;
539 const char *principal_s
= NULL
;
540 const char *service
= NULL
;
542 fstring name_domain
, name_user
;
543 time_t ticket_lifetime
= 0;
544 time_t renewal_until
= 0;
547 time_t time_offset
= 0;
548 bool internal_ccache
= True
;
555 * prepare a krb5_cc_cache string for the user */
557 uid
= get_uid_from_state(state
);
559 DEBUG(0,("no valid uid\n"));
562 cc
= generate_krb5_ccache(state
->mem_ctx
,
563 state
->request
.data
.auth
.krb5_cc_type
,
564 state
->request
.data
.auth
.uid
,
567 return NT_STATUS_NO_MEMORY
;
572 * get kerberos properties */
574 if (domain
->private_data
) {
575 ads
= (ADS_STRUCT
*)domain
->private_data
;
576 time_offset
= ads
->auth
.time_offset
;
581 * do kerberos auth and setup ccache as the user */
583 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
585 realm
= domain
->alt_name
;
588 principal_s
= talloc_asprintf(state
->mem_ctx
, "%s@%s", name_user
, realm
);
589 if (principal_s
== NULL
) {
590 return NT_STATUS_NO_MEMORY
;
593 service
= talloc_asprintf(state
->mem_ctx
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
);
594 if (service
== NULL
) {
595 return NT_STATUS_NO_MEMORY
;
598 /* if this is a user ccache, we need to act as the user to let the krb5
599 * library handle the chown, etc. */
601 /************************ ENTERING NON-ROOT **********************/
603 if (!internal_ccache
) {
604 set_effective_uid(uid
);
605 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid
));
608 result
= kerberos_return_info3_from_pac(state
->mem_ctx
,
610 state
->request
.data
.auth
.pass
,
617 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
619 if (!internal_ccache
) {
620 gain_root_privilege();
623 /************************ RETURNED TO ROOT **********************/
625 if (!NT_STATUS_IS_OK(result
)) {
629 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
632 /* if we had a user's ccache then return that string for the pam
635 if (!internal_ccache
) {
637 setup_return_cc_name(state
, cc
);
639 result
= add_ccache_to_list(principal_s
,
642 state
->request
.data
.auth
.user
,
650 if (!NT_STATUS_IS_OK(result
)) {
651 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
656 /* need to delete the memory cred cache, it is not used anymore */
658 krb5_ret
= ads_kdestroy(cc
);
660 DEBUG(3,("winbindd_raw_kerberos_login: "
661 "could not destroy krb5 credential cache: "
662 "%s\n", error_message(krb5_ret
)));
671 /* we could have created a new credential cache with a valid tgt in it
672 * but we werent able to get or verify the service ticket for this
673 * local host and therefor didn't get the PAC, we need to remove that
674 * cache entirely now */
676 krb5_ret
= ads_kdestroy(cc
);
678 DEBUG(3,("winbindd_raw_kerberos_login: "
679 "could not destroy krb5 credential cache: "
680 "%s\n", error_message(krb5_ret
)));
683 if (!NT_STATUS_IS_OK(remove_ccache(state
->request
.data
.auth
.user
))) {
684 DEBUG(3,("winbindd_raw_kerberos_login: "
685 "could not remove ccache for user %s\n",
686 state
->request
.data
.auth
.user
));
691 return NT_STATUS_NOT_SUPPORTED
;
692 #endif /* HAVE_KRB5 */
695 /****************************************************************
696 ****************************************************************/
698 static bool check_request_flags(uint32_t flags
)
700 uint32_t flags_edata
= WBFLAG_PAM_AFS_TOKEN
|
701 WBFLAG_PAM_UNIX_NAME
|
702 WBFLAG_PAM_INFO3_NDR
;
704 if ( ( (flags
& flags_edata
) == WBFLAG_PAM_AFS_TOKEN
) ||
705 ( (flags
& flags_edata
) == WBFLAG_PAM_INFO3_NDR
) ||
706 ( (flags
& flags_edata
) == WBFLAG_PAM_UNIX_NAME
) ||
707 !(flags
& flags_edata
) ) {
711 DEBUG(1,("check_request_flags: invalid request flags\n"));
716 /****************************************************************
717 ****************************************************************/
719 static NTSTATUS
append_data(struct winbindd_cli_state
*state
,
720 NET_USER_INFO_3
*info3
,
721 const char *name_domain
,
722 const char *name_user
)
725 uint32_t flags
= state
->request
.flags
;
727 if (flags
& WBFLAG_PAM_USER_SESSION_KEY
) {
728 memcpy(state
->response
.data
.auth
.user_session_key
,
729 info3
->user_sess_key
,
730 sizeof(state
->response
.data
.auth
.user_session_key
)
734 if (flags
& WBFLAG_PAM_LMKEY
) {
735 memcpy(state
->response
.data
.auth
.first_8_lm_hash
,
737 sizeof(state
->response
.data
.auth
.first_8_lm_hash
)
741 if (flags
& WBFLAG_PAM_INFO3_TEXT
) {
742 result
= append_info3_as_txt(state
->mem_ctx
, state
, info3
);
743 if (!NT_STATUS_IS_OK(result
)) {
744 DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
750 /* currently, anything from here on potentially overwrites extra_data. */
752 if (flags
& WBFLAG_PAM_INFO3_NDR
) {
753 result
= append_info3_as_ndr(state
->mem_ctx
, state
, info3
);
754 if (!NT_STATUS_IS_OK(result
)) {
755 DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
761 if (flags
& WBFLAG_PAM_UNIX_NAME
) {
762 result
= append_unix_username(state
->mem_ctx
, state
, info3
,
763 name_domain
, name_user
);
764 if (!NT_STATUS_IS_OK(result
)) {
765 DEBUG(10,("Failed to append Unix Username: %s\n",
771 if (flags
& WBFLAG_PAM_AFS_TOKEN
) {
772 result
= append_afs_token(state
->mem_ctx
, state
, info3
,
773 name_domain
, name_user
);
774 if (!NT_STATUS_IS_OK(result
)) {
775 DEBUG(10,("Failed to append AFS token: %s\n",
784 void winbindd_pam_auth(struct winbindd_cli_state
*state
)
786 struct winbindd_domain
*domain
;
787 fstring name_domain
, name_user
;
790 /* Ensure null termination */
791 state
->request
.data
.auth
.user
792 [sizeof(state
->request
.data
.auth
.user
)-1]='\0';
794 /* Ensure null termination */
795 state
->request
.data
.auth
.pass
796 [sizeof(state
->request
.data
.auth
.pass
)-1]='\0';
798 DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state
->pid
,
799 state
->request
.data
.auth
.user
));
801 if (!check_request_flags(state
->request
.flags
)) {
802 result
= NT_STATUS_INVALID_PARAMETER_MIX
;
806 /* Parse domain and username */
808 ws_name_return( state
->request
.data
.auth
.user
, WB_REPLACE_CHAR
);
810 if (!canonicalize_username(state
->request
.data
.auth
.user
,
811 name_domain
, name_user
)) {
812 result
= NT_STATUS_NO_SUCH_USER
;
816 domain
= find_auth_domain(state
, name_domain
);
818 if (domain
== NULL
) {
819 result
= NT_STATUS_NO_SUCH_USER
;
823 sendto_domain(state
, domain
);
826 set_auth_errors(&state
->response
, result
);
827 DEBUG(5, ("Plain text authentication for %s returned %s "
829 state
->request
.data
.auth
.user
,
830 state
->response
.data
.auth
.nt_status_string
,
831 state
->response
.data
.auth
.pam_error
));
832 request_error(state
);
835 NTSTATUS
winbindd_dual_pam_auth_cached(struct winbindd_domain
*domain
,
836 struct winbindd_cli_state
*state
,
837 NET_USER_INFO_3
**info3
)
839 NTSTATUS result
= NT_STATUS_LOGON_FAILURE
;
840 uint16 max_allowed_bad_attempts
;
841 fstring name_domain
, name_user
;
843 enum lsa_SidType type
;
844 uchar new_nt_pass
[NT_HASH_LEN
];
845 const uint8
*cached_nt_pass
;
846 const uint8
*cached_salt
;
847 NET_USER_INFO_3
*my_info3
;
848 time_t kickoff_time
, must_change_time
;
849 bool password_good
= False
;
851 struct winbindd_tdc_domain
*tdc_domain
= NULL
;
858 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
860 /* Parse domain and username */
862 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
865 if (!lookup_cached_name(state
->mem_ctx
,
870 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
871 return NT_STATUS_NO_SUCH_USER
;
874 if (type
!= SID_NAME_USER
) {
875 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type
)));
876 return NT_STATUS_LOGON_FAILURE
;
879 result
= winbindd_get_creds(domain
,
885 if (!NT_STATUS_IS_OK(result
)) {
886 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result
)));
892 E_md4hash(state
->request
.data
.auth
.pass
, new_nt_pass
);
894 dump_data_pw("new_nt_pass", new_nt_pass
, NT_HASH_LEN
);
895 dump_data_pw("cached_nt_pass", cached_nt_pass
, NT_HASH_LEN
);
897 dump_data_pw("cached_salt", cached_salt
, NT_HASH_LEN
);
901 /* In this case we didn't store the nt_hash itself,
902 but the MD5 combination of salt + nt_hash. */
903 uchar salted_hash
[NT_HASH_LEN
];
904 E_md5hash(cached_salt
, new_nt_pass
, salted_hash
);
906 password_good
= (memcmp(cached_nt_pass
, salted_hash
, NT_HASH_LEN
) == 0) ?
909 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
910 password_good
= (memcmp(cached_nt_pass
, new_nt_pass
, NT_HASH_LEN
) == 0) ?
916 /* User *DOES* know the password, update logon_time and reset
919 my_info3
->user_flgs
|= LOGON_CACHED_ACCOUNT
;
921 if (my_info3
->acct_flags
& ACB_AUTOLOCK
) {
922 return NT_STATUS_ACCOUNT_LOCKED_OUT
;
925 if (my_info3
->acct_flags
& ACB_DISABLED
) {
926 return NT_STATUS_ACCOUNT_DISABLED
;
929 if (my_info3
->acct_flags
& ACB_WSTRUST
) {
930 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
;
933 if (my_info3
->acct_flags
& ACB_SVRTRUST
) {
934 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT
;
937 if (my_info3
->acct_flags
& ACB_DOMTRUST
) {
938 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
;
941 if (!(my_info3
->acct_flags
& ACB_NORMAL
)) {
942 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
943 my_info3
->acct_flags
));
944 return NT_STATUS_LOGON_FAILURE
;
947 kickoff_time
= nt_time_to_unix(my_info3
->kickoff_time
);
948 if (kickoff_time
!= 0 && time(NULL
) > kickoff_time
) {
949 return NT_STATUS_ACCOUNT_EXPIRED
;
952 must_change_time
= nt_time_to_unix(my_info3
->pass_must_change_time
);
953 if (must_change_time
!= 0 && must_change_time
< time(NULL
)) {
954 /* we allow grace logons when the password has expired */
955 my_info3
->user_flgs
|= LOGON_GRACE_LOGON
;
956 /* return NT_STATUS_PASSWORD_EXPIRED; */
961 if ((state
->request
.flags
& WBFLAG_PAM_KRB5
) &&
962 ((tdc_domain
= wcache_tdc_fetch_domain(state
->mem_ctx
, name_domain
)) != NULL
) &&
963 (tdc_domain
->trust_type
& DS_DOMAIN_TRUST_TYPE_UPLEVEL
)) {
966 const char *cc
= NULL
;
968 const char *principal_s
= NULL
;
969 const char *service
= NULL
;
970 bool internal_ccache
= False
;
972 uid
= get_uid_from_state(state
);
974 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
975 return NT_STATUS_INVALID_PARAMETER
;
978 cc
= generate_krb5_ccache(state
->mem_ctx
,
979 state
->request
.data
.auth
.krb5_cc_type
,
980 state
->request
.data
.auth
.uid
,
983 return NT_STATUS_NO_MEMORY
;
986 realm
= domain
->alt_name
;
989 principal_s
= talloc_asprintf(state
->mem_ctx
, "%s@%s", name_user
, realm
);
990 if (principal_s
== NULL
) {
991 return NT_STATUS_NO_MEMORY
;
994 service
= talloc_asprintf(state
->mem_ctx
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
);
995 if (service
== NULL
) {
996 return NT_STATUS_NO_MEMORY
;
999 if (!internal_ccache
) {
1001 setup_return_cc_name(state
, cc
);
1003 result
= add_ccache_to_list(principal_s
,
1006 state
->request
.data
.auth
.user
,
1010 time(NULL
) + lp_winbind_cache_time(),
1011 time(NULL
) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME
,
1014 if (!NT_STATUS_IS_OK(result
)) {
1015 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
1016 "to add ccache to list: %s\n",
1017 nt_errstr(result
)));
1021 #endif /* HAVE_KRB5 */
1023 /* FIXME: we possibly should handle logon hours as well (does xp when
1024 * offline?) see auth/auth_sam.c:sam_account_ok for details */
1026 unix_to_nt_time(&my_info3
->logon_time
, time(NULL
));
1027 my_info3
->bad_pw_count
= 0;
1029 result
= winbindd_update_creds_by_info3(domain
,
1031 state
->request
.data
.auth
.user
,
1032 state
->request
.data
.auth
.pass
,
1034 if (!NT_STATUS_IS_OK(result
)) {
1035 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1036 nt_errstr(result
)));
1040 return NT_STATUS_OK
;
1044 /* User does *NOT* know the correct password, modify info3 accordingly */
1046 /* failure of this is not critical */
1047 result
= get_max_bad_attempts_from_lockout_policy(domain
, state
->mem_ctx
, &max_allowed_bad_attempts
);
1048 if (!NT_STATUS_IS_OK(result
)) {
1049 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1050 "Won't be able to honour account lockout policies\n"));
1053 /* increase counter */
1054 my_info3
->bad_pw_count
++;
1056 if (max_allowed_bad_attempts
== 0) {
1061 if (my_info3
->bad_pw_count
>= max_allowed_bad_attempts
) {
1063 uint32 password_properties
;
1065 result
= get_pwd_properties(domain
, state
->mem_ctx
, &password_properties
);
1066 if (!NT_STATUS_IS_OK(result
)) {
1067 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1070 if ((my_info3
->user_rid
!= DOMAIN_USER_RID_ADMIN
) ||
1071 (password_properties
& DOMAIN_LOCKOUT_ADMINS
)) {
1072 my_info3
->acct_flags
|= ACB_AUTOLOCK
;
1077 result
= winbindd_update_creds_by_info3(domain
,
1079 state
->request
.data
.auth
.user
,
1083 if (!NT_STATUS_IS_OK(result
)) {
1084 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1085 nt_errstr(result
)));
1088 return NT_STATUS_LOGON_FAILURE
;
1091 NTSTATUS
winbindd_dual_pam_auth_kerberos(struct winbindd_domain
*domain
,
1092 struct winbindd_cli_state
*state
,
1093 NET_USER_INFO_3
**info3
)
1095 struct winbindd_domain
*contact_domain
;
1096 fstring name_domain
, name_user
;
1099 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1101 /* Parse domain and username */
1103 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1105 /* what domain should we contact? */
1108 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1109 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1110 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1111 result
= NT_STATUS_NO_SUCH_USER
;
1116 if (is_myname(name_domain
)) {
1117 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1118 result
= NT_STATUS_NO_SUCH_USER
;
1122 contact_domain
= find_domain_from_name(name_domain
);
1123 if (contact_domain
== NULL
) {
1124 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1125 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1127 contact_domain
= find_our_domain();
1131 if (contact_domain
->initialized
&&
1132 contact_domain
->active_directory
) {
1136 if (!contact_domain
->initialized
) {
1137 init_dc_connection(contact_domain
);
1140 if (!contact_domain
->active_directory
) {
1141 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1142 return NT_STATUS_INVALID_LOGON_TYPE
;
1145 result
= winbindd_raw_kerberos_login(contact_domain
, state
, info3
);
1150 NTSTATUS
winbindd_dual_pam_auth_samlogon(struct winbindd_domain
*domain
,
1151 struct winbindd_cli_state
*state
,
1152 NET_USER_INFO_3
**info3
)
1155 struct rpc_pipe_client
*netlogon_pipe
;
1160 unsigned char local_lm_response
[24];
1161 unsigned char local_nt_response
[24];
1162 struct winbindd_domain
*contact_domain
;
1163 fstring name_domain
, name_user
;
1166 NET_USER_INFO_3
*my_info3
;
1168 ZERO_STRUCTP(info3
);
1172 my_info3
= TALLOC_ZERO_P(state
->mem_ctx
, NET_USER_INFO_3
);
1173 if (my_info3
== NULL
) {
1174 return NT_STATUS_NO_MEMORY
;
1178 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1180 /* Parse domain and username */
1182 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1184 /* do password magic */
1187 generate_random_buffer(chal
, 8);
1188 if (lp_client_ntlmv2_auth()) {
1189 DATA_BLOB server_chal
;
1190 DATA_BLOB names_blob
;
1191 DATA_BLOB nt_response
;
1192 DATA_BLOB lm_response
;
1193 server_chal
= data_blob_talloc(state
->mem_ctx
, chal
, 8);
1195 /* note that the 'workgroup' here is a best guess - we don't know
1196 the server's domain at this point. The 'server name' is also
1199 names_blob
= NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1201 if (!SMBNTLMv2encrypt(name_user
, name_domain
,
1202 state
->request
.data
.auth
.pass
,
1205 &lm_response
, &nt_response
, NULL
)) {
1206 data_blob_free(&names_blob
);
1207 data_blob_free(&server_chal
);
1208 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1209 result
= NT_STATUS_NO_MEMORY
;
1212 data_blob_free(&names_blob
);
1213 data_blob_free(&server_chal
);
1214 lm_resp
= data_blob_talloc(state
->mem_ctx
, lm_response
.data
,
1215 lm_response
.length
);
1216 nt_resp
= data_blob_talloc(state
->mem_ctx
, nt_response
.data
,
1217 nt_response
.length
);
1218 data_blob_free(&lm_response
);
1219 data_blob_free(&nt_response
);
1222 if (lp_client_lanman_auth()
1223 && SMBencrypt(state
->request
.data
.auth
.pass
,
1225 local_lm_response
)) {
1226 lm_resp
= data_blob_talloc(state
->mem_ctx
,
1228 sizeof(local_lm_response
));
1230 lm_resp
= data_blob_null
;
1232 SMBNTencrypt(state
->request
.data
.auth
.pass
,
1236 nt_resp
= data_blob_talloc(state
->mem_ctx
,
1238 sizeof(local_nt_response
));
1241 /* what domain should we contact? */
1244 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1245 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1246 state
->request
.data
.auth
.user
, name_domain
, name_user
, name_domain
));
1247 result
= NT_STATUS_NO_SUCH_USER
;
1252 if (is_myname(name_domain
)) {
1253 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1254 result
= NT_STATUS_NO_SUCH_USER
;
1258 contact_domain
= find_our_domain();
1261 /* check authentication loop */
1265 ZERO_STRUCTP(my_info3
);
1268 result
= cm_connect_netlogon(contact_domain
, &netlogon_pipe
);
1270 if (!NT_STATUS_IS_OK(result
)) {
1271 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1275 result
= rpccli_netlogon_sam_network_logon(netlogon_pipe
,
1278 contact_domain
->dcname
, /* server name */
1279 name_user
, /* user name */
1280 name_domain
, /* target domain */
1281 global_myname(), /* workstation */
1288 /* We have to try a second time as cm_connect_netlogon
1289 might not yet have noticed that the DC has killed
1292 if (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)) {
1297 /* if we get access denied, a possible cause was that we had
1298 and open connection to the DC, but someone changed our
1299 machine account password out from underneath us using 'net
1300 rpc changetrustpw' */
1302 if ( NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1303 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1304 "ACCESS_DENIED. Maybe the trust account "
1305 "password was changed and we didn't know it. "
1306 "Killing connections to domain %s\n",
1308 invalidate_cm_connection(&contact_domain
->conn
);
1312 } while ( (attempts
< 2) && retry
);
1314 /* handle the case where a NT4 DC does not fill in the acct_flags in
1315 * the samlogon reply info3. When accurate info3 is required by the
1316 * caller, we look up the account flags ourselve - gd */
1318 if ((state
->request
.flags
& WBFLAG_PAM_INFO3_TEXT
) &&
1319 (my_info3
->acct_flags
== 0) && NT_STATUS_IS_OK(result
)) {
1321 struct rpc_pipe_client
*samr_pipe
;
1322 POLICY_HND samr_domain_handle
, user_pol
;
1323 SAM_USERINFO_CTR
*user_ctr
;
1324 NTSTATUS status_tmp
;
1327 ZERO_STRUCT(user_ctr
);
1329 status_tmp
= cm_connect_sam(contact_domain
, state
->mem_ctx
,
1330 &samr_pipe
, &samr_domain_handle
);
1332 if (!NT_STATUS_IS_OK(status_tmp
)) {
1333 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1334 nt_errstr(status_tmp
)));
1338 status_tmp
= rpccli_samr_open_user(samr_pipe
, state
->mem_ctx
,
1339 &samr_domain_handle
,
1340 MAXIMUM_ALLOWED_ACCESS
,
1341 my_info3
->user_rid
, &user_pol
);
1343 if (!NT_STATUS_IS_OK(status_tmp
)) {
1344 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1345 nt_errstr(status_tmp
)));
1349 status_tmp
= rpccli_samr_query_userinfo(samr_pipe
, state
->mem_ctx
,
1350 &user_pol
, 16, &user_ctr
);
1352 if (!NT_STATUS_IS_OK(status_tmp
)) {
1353 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1354 nt_errstr(status_tmp
)));
1355 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1359 acct_flags
= user_ctr
->info
.id16
->acb_info
;
1361 if (acct_flags
== 0) {
1362 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1366 my_info3
->acct_flags
= acct_flags
;
1368 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags
));
1370 rpccli_samr_close(samr_pipe
, state
->mem_ctx
, &user_pol
);
1378 enum winbindd_result
winbindd_dual_pam_auth(struct winbindd_domain
*domain
,
1379 struct winbindd_cli_state
*state
)
1381 NTSTATUS result
= NT_STATUS_LOGON_FAILURE
;
1382 NTSTATUS krb5_result
= NT_STATUS_OK
;
1383 fstring name_domain
, name_user
;
1384 NET_USER_INFO_3
*info3
= NULL
;
1386 /* Ensure null termination */
1387 state
->request
.data
.auth
.user
[sizeof(state
->request
.data
.auth
.user
)-1]='\0';
1389 /* Ensure null termination */
1390 state
->request
.data
.auth
.pass
[sizeof(state
->request
.data
.auth
.pass
)-1]='\0';
1392 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state
->pid
,
1393 state
->request
.data
.auth
.user
));
1395 if (!check_request_flags(state
->request
.flags
)) {
1396 result
= NT_STATUS_INVALID_PARAMETER_MIX
;
1400 /* Parse domain and username */
1402 ws_name_return( state
->request
.data
.auth
.user
, WB_REPLACE_CHAR
);
1404 parse_domain_user(state
->request
.data
.auth
.user
, name_domain
, name_user
);
1406 if (domain
->online
== False
) {
1407 result
= NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
1408 if (domain
->startup
) {
1409 /* Logons are very important to users. If we're offline and
1410 we get a request within the first 30 seconds of startup,
1411 try very hard to find a DC and go online. */
1413 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1414 "request in startup mode.\n", domain
->name
));
1416 winbindd_flush_negative_conn_cache(domain
);
1417 result
= init_dc_connection(domain
);
1421 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain
->name
, domain
->online
? "online":"offline"));
1423 /* Check for Kerberos authentication */
1424 if (domain
->online
&& (state
->request
.flags
& WBFLAG_PAM_KRB5
)) {
1426 result
= winbindd_dual_pam_auth_kerberos(domain
, state
, &info3
);
1427 /* save for later */
1428 krb5_result
= result
;
1431 if (NT_STATUS_IS_OK(result
)) {
1432 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1433 goto process_result
;
1435 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result
)));
1438 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_LOGON_SERVERS
) ||
1439 NT_STATUS_EQUAL(result
, NT_STATUS_IO_TIMEOUT
) ||
1440 NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
1441 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1442 set_domain_offline( domain
);
1446 /* there are quite some NT_STATUS errors where there is no
1447 * point in retrying with a samlogon, we explictly have to take
1448 * care not to increase the bad logon counter on the DC */
1450 if (NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_DISABLED
) ||
1451 NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_EXPIRED
) ||
1452 NT_STATUS_EQUAL(result
, NT_STATUS_ACCOUNT_LOCKED_OUT
) ||
1453 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_LOGON_HOURS
) ||
1454 NT_STATUS_EQUAL(result
, NT_STATUS_INVALID_WORKSTATION
) ||
1455 NT_STATUS_EQUAL(result
, NT_STATUS_LOGON_FAILURE
) ||
1456 NT_STATUS_EQUAL(result
, NT_STATUS_NO_SUCH_USER
) ||
1457 NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_EXPIRED
) ||
1458 NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_MUST_CHANGE
) ||
1459 NT_STATUS_EQUAL(result
, NT_STATUS_WRONG_PASSWORD
)) {
1460 goto process_result
;
1463 if (state
->request
.flags
& WBFLAG_PAM_FALLBACK_AFTER_KRB5
) {
1464 DEBUG(3,("falling back to samlogon\n"));
1472 /* Check for Samlogon authentication */
1473 if (domain
->online
) {
1474 result
= winbindd_dual_pam_auth_samlogon(domain
, state
, &info3
);
1476 if (NT_STATUS_IS_OK(result
)) {
1477 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1478 /* add the Krb5 err if we have one */
1479 if ( NT_STATUS_EQUAL(krb5_result
, NT_STATUS_TIME_DIFFERENCE_AT_DC
) ) {
1480 info3
->user_flgs
|= LOGON_KRB5_FAIL_CLOCK_SKEW
;
1482 goto process_result
;
1485 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1486 nt_errstr(result
)));
1488 if (NT_STATUS_EQUAL(result
, NT_STATUS_NO_LOGON_SERVERS
) ||
1489 NT_STATUS_EQUAL(result
, NT_STATUS_IO_TIMEOUT
) ||
1490 NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
))
1492 DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1493 set_domain_offline( domain
);
1497 if (domain
->online
) {
1498 /* We're still online - fail. */
1504 /* Check for Cached logons */
1505 if (!domain
->online
&& (state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
) &&
1506 lp_winbind_offline_logon()) {
1508 result
= winbindd_dual_pam_auth_cached(domain
, state
, &info3
);
1510 if (NT_STATUS_IS_OK(result
)) {
1511 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1512 goto process_result
;
1514 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result
)));
1521 if (NT_STATUS_IS_OK(result
)) {
1525 /* In all codepaths where result == NT_STATUS_OK info3 must have
1526 been initialized. */
1528 result
= NT_STATUS_INTERNAL_ERROR
;
1532 netsamlogon_cache_store(name_user
, info3
);
1533 wcache_invalidate_samlogon(find_domain_from_name(name_domain
), info3
);
1535 /* save name_to_sid info as early as possible (only if
1536 this is our primary domain so we don't invalidate
1537 the cache entry by storing the seq_num for the wrong
1539 if ( domain
->primary
) {
1540 sid_compose(&user_sid
, &info3
->dom_sid
.sid
,
1542 cache_name2sid(domain
, name_domain
, name_user
,
1543 SID_NAME_USER
, &user_sid
);
1546 /* Check if the user is in the right group */
1548 if (!NT_STATUS_IS_OK(result
= check_info3_in_group(state
->mem_ctx
, info3
,
1549 state
->request
.data
.auth
.require_membership_of_sid
))) {
1550 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1551 state
->request
.data
.auth
.user
,
1552 state
->request
.data
.auth
.require_membership_of_sid
));
1556 result
= append_data(state
, info3
, name_domain
, name_user
);
1557 if (!NT_STATUS_IS_OK(result
)) {
1561 if ((state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
)) {
1563 /* Store in-memory creds for single-signon using ntlm_auth. */
1564 result
= winbindd_add_memory_creds(state
->request
.data
.auth
.user
,
1565 get_uid_from_state(state
),
1566 state
->request
.data
.auth
.pass
);
1568 if (!NT_STATUS_IS_OK(result
)) {
1569 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result
)));
1573 if (lp_winbind_offline_logon()) {
1574 result
= winbindd_store_creds(domain
,
1576 state
->request
.data
.auth
.user
,
1577 state
->request
.data
.auth
.pass
,
1579 if (!NT_STATUS_IS_OK(result
)) {
1581 /* Release refcount. */
1582 winbindd_delete_memory_creds(state
->request
.data
.auth
.user
);
1584 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result
)));
1590 result
= fillup_password_policy(domain
, state
);
1592 if (!NT_STATUS_IS_OK(result
)
1593 && !NT_STATUS_EQUAL(result
, NT_STATUS_NOT_SUPPORTED
) )
1595 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result
)));
1599 result
= NT_STATUS_OK
;
1603 /* give us a more useful (more correct?) error code */
1604 if ((NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) ||
1605 (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)))) {
1606 result
= NT_STATUS_NO_LOGON_SERVERS
;
1609 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
1610 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
1612 /* we might have given a more useful error above */
1613 if (!*state
->response
.data
.auth
.error_string
)
1614 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
1615 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
1617 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1618 state
->request
.data
.auth
.user
,
1619 state
->response
.data
.auth
.nt_status_string
,
1620 state
->response
.data
.auth
.pam_error
));
1622 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
1626 /**********************************************************************
1627 Challenge Response Authentication Protocol
1628 **********************************************************************/
1630 void winbindd_pam_auth_crap(struct winbindd_cli_state
*state
)
1632 struct winbindd_domain
*domain
= NULL
;
1633 const char *domain_name
= NULL
;
1636 if (!check_request_flags(state
->request
.flags
)) {
1637 result
= NT_STATUS_INVALID_PARAMETER_MIX
;
1641 if (!state
->privileged
) {
1642 char *error_string
= NULL
;
1643 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1645 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1646 "on %s are set correctly.\n",
1647 get_winbind_priv_pipe_dir()));
1648 /* send a better message than ACCESS_DENIED */
1649 error_string
= talloc_asprintf(state
->mem_ctx
,
1650 "winbind client not authorized "
1651 "to use winbindd_pam_auth_crap."
1652 " Ensure permissions on %s "
1653 "are set correctly.",
1654 get_winbind_priv_pipe_dir());
1655 fstrcpy(state
->response
.data
.auth
.error_string
, error_string
);
1656 result
= NT_STATUS_ACCESS_DENIED
;
1660 /* Ensure null termination */
1661 state
->request
.data
.auth_crap
.user
1662 [sizeof(state
->request
.data
.auth_crap
.user
)-1]=0;
1663 state
->request
.data
.auth_crap
.domain
1664 [sizeof(state
->request
.data
.auth_crap
.domain
)-1]=0;
1666 DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1667 (unsigned long)state
->pid
,
1668 state
->request
.data
.auth_crap
.domain
,
1669 state
->request
.data
.auth_crap
.user
));
1671 if (*state
->request
.data
.auth_crap
.domain
!= '\0') {
1672 domain_name
= state
->request
.data
.auth_crap
.domain
;
1673 } else if (lp_winbind_use_default_domain()) {
1674 domain_name
= lp_workgroup();
1677 if (domain_name
!= NULL
)
1678 domain
= find_auth_domain(state
, domain_name
);
1680 if (domain
!= NULL
) {
1681 sendto_domain(state
, domain
);
1685 result
= NT_STATUS_NO_SUCH_USER
;
1688 set_auth_errors(&state
->response
, result
);
1689 DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1690 state
->request
.data
.auth_crap
.domain
,
1691 state
->request
.data
.auth_crap
.user
,
1692 state
->response
.data
.auth
.nt_status_string
,
1693 state
->response
.data
.auth
.pam_error
));
1694 request_error(state
);
1699 enum winbindd_result
winbindd_dual_pam_auth_crap(struct winbindd_domain
*domain
,
1700 struct winbindd_cli_state
*state
)
1703 NET_USER_INFO_3 info3
;
1704 struct rpc_pipe_client
*netlogon_pipe
;
1705 const char *name_user
= NULL
;
1706 const char *name_domain
= NULL
;
1707 const char *workstation
;
1708 struct winbindd_domain
*contact_domain
;
1712 DATA_BLOB lm_resp
, nt_resp
;
1714 /* This is child-only, so no check for privileged access is needed
1717 /* Ensure null termination */
1718 state
->request
.data
.auth_crap
.user
[sizeof(state
->request
.data
.auth_crap
.user
)-1]=0;
1719 state
->request
.data
.auth_crap
.domain
[sizeof(state
->request
.data
.auth_crap
.domain
)-1]=0;
1721 if (!check_request_flags(state
->request
.flags
)) {
1722 result
= NT_STATUS_INVALID_PARAMETER_MIX
;
1726 name_user
= state
->request
.data
.auth_crap
.user
;
1728 if (*state
->request
.data
.auth_crap
.domain
) {
1729 name_domain
= state
->request
.data
.auth_crap
.domain
;
1730 } else if (lp_winbind_use_default_domain()) {
1731 name_domain
= lp_workgroup();
1733 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1735 result
= NT_STATUS_NO_SUCH_USER
;
1739 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state
->pid
,
1740 name_domain
, name_user
));
1742 if (*state
->request
.data
.auth_crap
.workstation
) {
1743 workstation
= state
->request
.data
.auth_crap
.workstation
;
1745 workstation
= global_myname();
1748 if (state
->request
.data
.auth_crap
.lm_resp_len
> sizeof(state
->request
.data
.auth_crap
.lm_resp
)
1749 || state
->request
.data
.auth_crap
.nt_resp_len
> sizeof(state
->request
.data
.auth_crap
.nt_resp
)) {
1750 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1751 state
->request
.data
.auth_crap
.lm_resp_len
,
1752 state
->request
.data
.auth_crap
.nt_resp_len
));
1753 result
= NT_STATUS_INVALID_PARAMETER
;
1757 lm_resp
= data_blob_talloc(state
->mem_ctx
, state
->request
.data
.auth_crap
.lm_resp
,
1758 state
->request
.data
.auth_crap
.lm_resp_len
);
1759 nt_resp
= data_blob_talloc(state
->mem_ctx
, state
->request
.data
.auth_crap
.nt_resp
,
1760 state
->request
.data
.auth_crap
.nt_resp_len
);
1762 /* what domain should we contact? */
1765 if (!(contact_domain
= find_domain_from_name(name_domain
))) {
1766 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1767 state
->request
.data
.auth_crap
.user
, name_domain
, name_user
, name_domain
));
1768 result
= NT_STATUS_NO_SUCH_USER
;
1772 if (is_myname(name_domain
)) {
1773 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain
));
1774 result
= NT_STATUS_NO_SUCH_USER
;
1777 contact_domain
= find_our_domain();
1784 netlogon_pipe
= NULL
;
1785 result
= cm_connect_netlogon(contact_domain
, &netlogon_pipe
);
1787 if (!NT_STATUS_IS_OK(result
)) {
1788 DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1789 nt_errstr(result
)));
1793 result
= rpccli_netlogon_sam_network_logon(netlogon_pipe
,
1795 state
->request
.data
.auth_crap
.logon_parameters
,
1796 contact_domain
->dcname
,
1799 /* Bug #3248 - found by Stefan Burkei. */
1800 workstation
, /* We carefully set this above so use it... */
1801 state
->request
.data
.auth_crap
.chal
,
1808 /* We have to try a second time as cm_connect_netlogon
1809 might not yet have noticed that the DC has killed
1812 if (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)) {
1817 /* if we get access denied, a possible cause was that we had and open
1818 connection to the DC, but someone changed our machine account password
1819 out from underneath us using 'net rpc changetrustpw' */
1821 if ( NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
) ) {
1822 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1823 "ACCESS_DENIED. Maybe the trust account "
1824 "password was changed and we didn't know it. "
1825 "Killing connections to domain %s\n",
1827 invalidate_cm_connection(&contact_domain
->conn
);
1831 } while ( (attempts
< 2) && retry
);
1833 if (NT_STATUS_IS_OK(result
)) {
1835 netsamlogon_cache_store(name_user
, &info3
);
1836 wcache_invalidate_samlogon(find_domain_from_name(name_domain
), &info3
);
1838 /* Check if the user is in the right group */
1840 if (!NT_STATUS_IS_OK(result
= check_info3_in_group(state
->mem_ctx
, &info3
,
1841 state
->request
.data
.auth_crap
.require_membership_of_sid
))) {
1842 DEBUG(3, ("User %s is not in the required group (%s), so "
1843 "crap authentication is rejected\n",
1844 state
->request
.data
.auth_crap
.user
,
1845 state
->request
.data
.auth_crap
.require_membership_of_sid
));
1849 result
= append_data(state
, &info3
, name_domain
, name_user
);
1850 if (!NT_STATUS_IS_OK(result
)) {
1857 /* give us a more useful (more correct?) error code */
1858 if ((NT_STATUS_EQUAL(result
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
) ||
1859 (NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
)))) {
1860 result
= NT_STATUS_NO_LOGON_SERVERS
;
1863 if (state
->request
.flags
& WBFLAG_PAM_NT_STATUS_SQUASH
) {
1864 result
= nt_status_squash(result
);
1867 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
1868 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
1870 /* we might have given a more useful error above */
1871 if (!*state
->response
.data
.auth
.error_string
) {
1872 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
1874 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
1876 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
1877 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1880 state
->response
.data
.auth
.nt_status_string
,
1881 state
->response
.data
.auth
.pam_error
));
1883 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
1886 /* Change a user password */
1888 void winbindd_pam_chauthtok(struct winbindd_cli_state
*state
)
1890 fstring domain
, user
;
1891 struct winbindd_domain
*contact_domain
;
1893 DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state
->pid
,
1894 state
->request
.data
.chauthtok
.user
));
1898 ws_name_return( state
->request
.data
.auth
.user
, WB_REPLACE_CHAR
);
1900 if (!canonicalize_username(state
->request
.data
.chauthtok
.user
, domain
, user
)) {
1901 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
1902 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
1904 state
->request
.data
.auth
.user
,
1905 state
->response
.data
.auth
.nt_status_string
,
1906 state
->response
.data
.auth
.pam_error
));
1907 request_error(state
);
1911 contact_domain
= find_domain_from_name(domain
);
1912 if (!contact_domain
) {
1913 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
1914 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
1915 state
->request
.data
.chauthtok
.user
, domain
, user
, domain
));
1916 request_error(state
);
1920 sendto_domain(state
, contact_domain
);
1923 enum winbindd_result
winbindd_dual_pam_chauthtok(struct winbindd_domain
*contact_domain
,
1924 struct winbindd_cli_state
*state
)
1927 char *newpass
= NULL
;
1929 struct rpc_pipe_client
*cli
;
1930 bool got_info
= False
;
1931 SAM_UNK_INFO_1 info
;
1932 SAMR_CHANGE_REJECT reject
;
1933 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
1934 fstring domain
, user
;
1936 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state
->pid
,
1937 state
->request
.data
.auth
.user
));
1939 if (!parse_domain_user(state
->request
.data
.chauthtok
.user
, domain
, user
)) {
1943 /* Change password */
1945 oldpass
= state
->request
.data
.chauthtok
.oldpass
;
1946 newpass
= state
->request
.data
.chauthtok
.newpass
;
1948 /* Initialize reject reason */
1949 state
->response
.data
.auth
.reject_reason
= Undefined
;
1951 /* Get sam handle */
1953 result
= cm_connect_sam(contact_domain
, state
->mem_ctx
, &cli
,
1955 if (!NT_STATUS_IS_OK(result
)) {
1956 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain
));
1960 result
= rpccli_samr_chgpasswd3(cli
, state
->mem_ctx
, user
, newpass
, oldpass
, &info
, &reject
);
1962 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
1964 if (NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_RESTRICTION
) ) {
1965 state
->response
.data
.auth
.policy
.min_length_password
=
1966 info
.min_length_password
;
1967 state
->response
.data
.auth
.policy
.password_history
=
1968 info
.password_history
;
1969 state
->response
.data
.auth
.policy
.password_properties
=
1970 info
.password_properties
;
1971 state
->response
.data
.auth
.policy
.expire
=
1972 nt_time_to_unix_abs(&info
.expire
);
1973 state
->response
.data
.auth
.policy
.min_passwordage
=
1974 nt_time_to_unix_abs(&info
.min_passwordage
);
1976 state
->response
.data
.auth
.reject_reason
=
1977 reject
.reject_reason
;
1982 /* only fallback when the chgpasswd3 call is not supported */
1983 if ((NT_STATUS_EQUAL(result
, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR
))) ||
1984 (NT_STATUS_EQUAL(result
, NT_STATUS_NOT_SUPPORTED
)) ||
1985 (NT_STATUS_EQUAL(result
, NT_STATUS_NOT_IMPLEMENTED
))) {
1987 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
1988 nt_errstr(result
)));
1990 result
= rpccli_samr_chgpasswd_user(cli
, state
->mem_ctx
, user
, newpass
, oldpass
);
1992 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
1993 Map to the same status code as Windows 2003. */
1995 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION
, result
) ) {
1996 result
= NT_STATUS_PASSWORD_RESTRICTION
;
2002 if (NT_STATUS_IS_OK(result
) && (state
->request
.flags
& WBFLAG_PAM_CACHED_LOGIN
)) {
2004 /* Update the single sign-on memory creds. */
2005 result
= winbindd_replace_memory_creds(state
->request
.data
.chauthtok
.user
,
2008 if (!NT_STATUS_IS_OK(result
)) {
2009 DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result
)));
2010 goto process_result
;
2013 if (lp_winbind_offline_logon()) {
2014 result
= winbindd_update_creds_by_name(contact_domain
,
2015 state
->mem_ctx
, user
,
2017 if (!NT_STATUS_IS_OK(result
)) {
2018 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result
)));
2019 goto process_result
;
2024 if (!NT_STATUS_IS_OK(result
) && !got_info
&& contact_domain
) {
2026 NTSTATUS policy_ret
;
2028 policy_ret
= fillup_password_policy(contact_domain
, state
);
2030 /* failure of this is non critical, it will just provide no
2031 * additional information to the client why the change has
2032 * failed - Guenther */
2034 if (!NT_STATUS_IS_OK(policy_ret
)) {
2035 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret
)));
2036 goto process_result
;
2042 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2043 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2044 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
2045 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2047 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
2048 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2051 state
->response
.data
.auth
.nt_status_string
,
2052 state
->response
.data
.auth
.pam_error
));
2054 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2057 void winbindd_pam_logoff(struct winbindd_cli_state
*state
)
2059 struct winbindd_domain
*domain
;
2060 fstring name_domain
, user
;
2061 uid_t caller_uid
= (uid_t
)-1;
2062 uid_t request_uid
= state
->request
.data
.logoff
.uid
;
2064 DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state
->pid
,
2065 state
->request
.data
.logoff
.user
));
2067 /* Ensure null termination */
2068 state
->request
.data
.logoff
.user
2069 [sizeof(state
->request
.data
.logoff
.user
)-1]='\0';
2071 state
->request
.data
.logoff
.krb5ccname
2072 [sizeof(state
->request
.data
.logoff
.krb5ccname
)-1]='\0';
2074 if (request_uid
== (gid_t
)-1) {
2078 if (!canonicalize_username(state
->request
.data
.logoff
.user
, name_domain
, user
)) {
2082 if ((domain
= find_auth_domain(state
, name_domain
)) == NULL
) {
2086 if ((sys_getpeereid(state
->sock
, &caller_uid
)) != 0) {
2087 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2092 switch (caller_uid
) {
2096 /* root must be able to logoff any user - gd */
2097 state
->request
.data
.logoff
.uid
= request_uid
;
2100 if (caller_uid
!= request_uid
) {
2101 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2104 state
->request
.data
.logoff
.uid
= caller_uid
;
2108 sendto_domain(state
, domain
);
2112 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
2113 DEBUG(5, ("Pam Logoff for %s returned %s "
2115 state
->request
.data
.logoff
.user
,
2116 state
->response
.data
.auth
.nt_status_string
,
2117 state
->response
.data
.auth
.pam_error
));
2118 request_error(state
);
2122 enum winbindd_result
winbindd_dual_pam_logoff(struct winbindd_domain
*domain
,
2123 struct winbindd_cli_state
*state
)
2125 NTSTATUS result
= NT_STATUS_NOT_SUPPORTED
;
2127 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state
->pid
,
2128 state
->request
.data
.logoff
.user
));
2130 if (!(state
->request
.flags
& WBFLAG_PAM_KRB5
)) {
2131 result
= NT_STATUS_OK
;
2132 goto process_result
;
2135 if (state
->request
.data
.logoff
.krb5ccname
[0] == '\0') {
2136 result
= NT_STATUS_OK
;
2137 goto process_result
;
2142 if (state
->request
.data
.logoff
.uid
< 0) {
2143 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2144 goto process_result
;
2147 /* what we need here is to find the corresponding krb5 ccache name *we*
2148 * created for a given username and destroy it */
2150 if (!ccache_entry_exists(state
->request
.data
.logoff
.user
)) {
2151 result
= NT_STATUS_OK
;
2152 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2153 goto process_result
;
2156 if (!ccache_entry_identical(state
->request
.data
.logoff
.user
,
2157 state
->request
.data
.logoff
.uid
,
2158 state
->request
.data
.logoff
.krb5ccname
)) {
2159 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2160 goto process_result
;
2163 result
= remove_ccache(state
->request
.data
.logoff
.user
);
2164 if (!NT_STATUS_IS_OK(result
)) {
2165 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2166 nt_errstr(result
)));
2167 goto process_result
;
2171 result
= NT_STATUS_NOT_SUPPORTED
;
2176 winbindd_delete_memory_creds(state
->request
.data
.logoff
.user
);
2178 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2179 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2180 fstrcpy(state
->response
.data
.auth
.error_string
, get_friendly_nt_error_msg(result
));
2181 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2183 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;
2186 /* Change user password with auth crap*/
2188 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state
*state
)
2190 struct winbindd_domain
*domain
= NULL
;
2191 const char *domain_name
= NULL
;
2193 /* Ensure null termination */
2194 state
->request
.data
.chng_pswd_auth_crap
.user
[
2195 sizeof(state
->request
.data
.chng_pswd_auth_crap
.user
)-1]=0;
2196 state
->request
.data
.chng_pswd_auth_crap
.domain
[
2197 sizeof(state
->request
.data
.chng_pswd_auth_crap
.domain
)-1]=0;
2199 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2200 (unsigned long)state
->pid
,
2201 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2202 state
->request
.data
.chng_pswd_auth_crap
.user
));
2204 if (*state
->request
.data
.chng_pswd_auth_crap
.domain
!= '\0') {
2205 domain_name
= state
->request
.data
.chng_pswd_auth_crap
.domain
;
2206 } else if (lp_winbind_use_default_domain()) {
2207 domain_name
= lp_workgroup();
2210 if (domain_name
!= NULL
)
2211 domain
= find_domain_from_name(domain_name
);
2213 if (domain
!= NULL
) {
2214 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2215 "%s\n", (unsigned long)state
->pid
,domain
->name
));
2216 sendto_domain(state
, domain
);
2220 set_auth_errors(&state
->response
, NT_STATUS_NO_SUCH_USER
);
2221 DEBUG(5, ("CRAP change password for %s\\%s returned %s (PAM: %d)\n",
2222 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2223 state
->request
.data
.chng_pswd_auth_crap
.user
,
2224 state
->response
.data
.auth
.nt_status_string
,
2225 state
->response
.data
.auth
.pam_error
));
2226 request_error(state
);
2230 enum winbindd_result
winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain
*domainSt
, struct winbindd_cli_state
*state
)
2233 DATA_BLOB new_nt_password
;
2234 DATA_BLOB old_nt_hash_enc
;
2235 DATA_BLOB new_lm_password
;
2236 DATA_BLOB old_lm_hash_enc
;
2237 fstring domain
,user
;
2239 struct winbindd_domain
*contact_domain
= domainSt
;
2240 struct rpc_pipe_client
*cli
;
2242 /* Ensure null termination */
2243 state
->request
.data
.chng_pswd_auth_crap
.user
[
2244 sizeof(state
->request
.data
.chng_pswd_auth_crap
.user
)-1]=0;
2245 state
->request
.data
.chng_pswd_auth_crap
.domain
[
2246 sizeof(state
->request
.data
.chng_pswd_auth_crap
.domain
)-1]=0;
2250 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2251 (unsigned long)state
->pid
,
2252 state
->request
.data
.chng_pswd_auth_crap
.domain
,
2253 state
->request
.data
.chng_pswd_auth_crap
.user
));
2255 if (lp_winbind_offline_logon()) {
2256 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2257 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2258 result
= NT_STATUS_ACCESS_DENIED
;
2262 if (*state
->request
.data
.chng_pswd_auth_crap
.domain
) {
2263 fstrcpy(domain
,state
->request
.data
.chng_pswd_auth_crap
.domain
);
2265 parse_domain_user(state
->request
.data
.chng_pswd_auth_crap
.user
,
2269 DEBUG(3,("no domain specified with username (%s) - "
2271 state
->request
.data
.chng_pswd_auth_crap
.user
));
2272 result
= NT_STATUS_NO_SUCH_USER
;
2277 if (!*domain
&& lp_winbind_use_default_domain()) {
2278 fstrcpy(domain
,(char *)lp_workgroup());
2282 fstrcpy(user
, state
->request
.data
.chng_pswd_auth_crap
.user
);
2285 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2286 (unsigned long)state
->pid
, domain
, user
));
2288 /* Change password */
2289 new_nt_password
= data_blob_talloc(
2291 state
->request
.data
.chng_pswd_auth_crap
.new_nt_pswd
,
2292 state
->request
.data
.chng_pswd_auth_crap
.new_nt_pswd_len
);
2294 old_nt_hash_enc
= data_blob_talloc(
2296 state
->request
.data
.chng_pswd_auth_crap
.old_nt_hash_enc
,
2297 state
->request
.data
.chng_pswd_auth_crap
.old_nt_hash_enc_len
);
2299 if(state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd_len
> 0) {
2300 new_lm_password
= data_blob_talloc(
2302 state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd
,
2303 state
->request
.data
.chng_pswd_auth_crap
.new_lm_pswd_len
);
2305 old_lm_hash_enc
= data_blob_talloc(
2307 state
->request
.data
.chng_pswd_auth_crap
.old_lm_hash_enc
,
2308 state
->request
.data
.chng_pswd_auth_crap
.old_lm_hash_enc_len
);
2310 new_lm_password
.length
= 0;
2311 old_lm_hash_enc
.length
= 0;
2314 /* Get sam handle */
2316 result
= cm_connect_sam(contact_domain
, state
->mem_ctx
, &cli
, &dom_pol
);
2317 if (!NT_STATUS_IS_OK(result
)) {
2318 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain
));
2322 result
= rpccli_samr_chng_pswd_auth_crap(
2323 cli
, state
->mem_ctx
, user
, new_nt_password
, old_nt_hash_enc
,
2324 new_lm_password
, old_lm_hash_enc
);
2327 state
->response
.data
.auth
.nt_status
= NT_STATUS_V(result
);
2328 fstrcpy(state
->response
.data
.auth
.nt_status_string
, nt_errstr(result
));
2329 fstrcpy(state
->response
.data
.auth
.error_string
,
2330 get_friendly_nt_error_msg(result
));
2331 state
->response
.data
.auth
.pam_error
= nt_status_to_pam(result
);
2333 DEBUG(NT_STATUS_IS_OK(result
) ? 5 : 2,
2334 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2336 state
->response
.data
.auth
.nt_status_string
,
2337 state
->response
.data
.auth
.pam_error
));
2339 return NT_STATUS_IS_OK(result
) ? WINBINDD_OK
: WINBINDD_ERROR
;