2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2011
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006-2008
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
28 #include "rpc_client/init_lsa.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/util_pw.h"
31 #include "lib/winbind_util.h"
33 #include "../librpc/gen_ndr/ndr_auth.h"
34 #include "../auth/auth_sam_reply.h"
35 #include "../librpc/gen_ndr/idmap.h"
38 #define DBGC_CLASS DBGC_AUTH
40 /****************************************************************************
41 Create a UNIX user on demand.
42 ****************************************************************************/
44 static int _smb_create_user(const char *domain
, const char *unix_username
, const char *homedir
)
46 TALLOC_CTX
*ctx
= talloc_tos();
50 add_script
= talloc_strdup(ctx
, lp_adduser_script());
51 if (!add_script
|| !*add_script
) {
54 add_script
= talloc_all_string_sub(ctx
,
62 add_script
= talloc_all_string_sub(ctx
,
71 add_script
= talloc_all_string_sub(ctx
,
79 ret
= smbrun(add_script
,NULL
);
82 ("smb_create_user: Running the command `%s' gave %d\n",
87 /****************************************************************************
88 Create an auth_usersupplied_data structure after appropriate mapping.
89 ****************************************************************************/
91 NTSTATUS
make_user_info_map(struct auth_usersupplied_info
**user_info
,
93 const char *client_domain
,
94 const char *workstation_name
,
95 const struct tsocket_address
*remote_address
,
96 const DATA_BLOB
*lm_pwd
,
97 const DATA_BLOB
*nt_pwd
,
98 const struct samr_Password
*lm_interactive_pwd
,
99 const struct samr_Password
*nt_interactive_pwd
,
100 const char *plaintext
,
101 enum auth_password_state password_state
)
106 char *internal_username
= NULL
;
108 was_mapped
= map_username(talloc_tos(), smb_name
, &internal_username
);
109 if (!internal_username
) {
110 return NT_STATUS_NO_MEMORY
;
113 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
114 client_domain
, smb_name
, workstation_name
));
116 domain
= client_domain
;
118 /* If you connect to a Windows domain member using a bogus domain name,
119 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
120 * the Windows box is a DC the name will become DOMAIN\user and be
121 * authenticated against AD, if the Windows box is a member server but
122 * not a DC the name will become WORKSTATION\user. A standalone
123 * non-domain member box will also map to WORKSTATION\user.
124 * This also deals with the client passing in a "" domain */
126 if (!is_trusted_domain(domain
) &&
127 !strequal(domain
, my_sam_name()))
129 if (lp_map_untrusted_to_domain())
130 domain
= my_sam_name();
132 domain
= get_global_sam_name();
133 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
134 "workstation [%s]\n",
135 client_domain
, domain
, smb_name
, workstation_name
));
138 /* We know that the given domain is trusted (and we are allowing them),
139 * it is our global SAM name, or for legacy behavior it is our
140 * primary domain name */
142 result
= make_user_info(user_info
, smb_name
, internal_username
,
143 client_domain
, domain
, workstation_name
,
144 remote_address
, lm_pwd
, nt_pwd
,
145 lm_interactive_pwd
, nt_interactive_pwd
,
146 plaintext
, password_state
);
147 if (NT_STATUS_IS_OK(result
)) {
148 /* We have tried mapping */
149 (*user_info
)->mapped_state
= true;
150 /* did we actually map the user to a different name? */
151 (*user_info
)->was_mapped
= was_mapped
;
156 /****************************************************************************
157 Create an auth_usersupplied_data, making the DATA_BLOBs here.
158 Decrypt and encrypt the passwords.
159 ****************************************************************************/
161 bool make_user_info_netlogon_network(struct auth_usersupplied_info
**user_info
,
162 const char *smb_name
,
163 const char *client_domain
,
164 const char *workstation_name
,
165 const struct tsocket_address
*remote_address
,
166 uint32 logon_parameters
,
167 const uchar
*lm_network_pwd
,
169 const uchar
*nt_network_pwd
,
174 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
175 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
177 status
= make_user_info_map(user_info
,
178 smb_name
, client_domain
,
181 lm_pwd_len
? &lm_blob
: NULL
,
182 nt_pwd_len
? &nt_blob
: NULL
,
184 AUTH_PASSWORD_RESPONSE
);
186 if (NT_STATUS_IS_OK(status
)) {
187 (*user_info
)->logon_parameters
= logon_parameters
;
189 ret
= NT_STATUS_IS_OK(status
) ? true : false;
191 data_blob_free(&lm_blob
);
192 data_blob_free(&nt_blob
);
196 /****************************************************************************
197 Create an auth_usersupplied_data, making the DATA_BLOBs here.
198 Decrypt and encrypt the passwords.
199 ****************************************************************************/
201 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info
**user_info
,
202 const char *smb_name
,
203 const char *client_domain
,
204 const char *workstation_name
,
205 const struct tsocket_address
*remote_address
,
206 uint32 logon_parameters
,
208 const uchar lm_interactive_pwd
[16],
209 const uchar nt_interactive_pwd
[16],
210 const uchar
*dc_sess_key
)
212 struct samr_Password lm_pwd
;
213 struct samr_Password nt_pwd
;
214 unsigned char local_lm_response
[24];
215 unsigned char local_nt_response
[24];
216 unsigned char key
[16];
218 memcpy(key
, dc_sess_key
, 16);
220 if (lm_interactive_pwd
)
221 memcpy(lm_pwd
.hash
, lm_interactive_pwd
, sizeof(lm_pwd
.hash
));
223 if (nt_interactive_pwd
)
224 memcpy(nt_pwd
.hash
, nt_interactive_pwd
, sizeof(nt_pwd
.hash
));
226 #ifdef DEBUG_PASSWORD
228 dump_data(100, key
, sizeof(key
));
230 DEBUG(100,("lm owf password:"));
231 dump_data(100, lm_pwd
.hash
, sizeof(lm_pwd
.hash
));
233 DEBUG(100,("nt owf password:"));
234 dump_data(100, nt_pwd
.hash
, sizeof(nt_pwd
.hash
));
237 if (lm_interactive_pwd
)
238 arcfour_crypt(lm_pwd
.hash
, key
, sizeof(lm_pwd
.hash
));
240 if (nt_interactive_pwd
)
241 arcfour_crypt(nt_pwd
.hash
, key
, sizeof(nt_pwd
.hash
));
243 #ifdef DEBUG_PASSWORD
244 DEBUG(100,("decrypt of lm owf password:"));
245 dump_data(100, lm_pwd
.hash
, sizeof(lm_pwd
));
247 DEBUG(100,("decrypt of nt owf password:"));
248 dump_data(100, nt_pwd
.hash
, sizeof(nt_pwd
));
251 if (lm_interactive_pwd
)
252 SMBOWFencrypt(lm_pwd
.hash
, chal
,
255 if (nt_interactive_pwd
)
256 SMBOWFencrypt(nt_pwd
.hash
, chal
,
259 /* Password info paranoia */
265 DATA_BLOB local_lm_blob
;
266 DATA_BLOB local_nt_blob
;
268 if (lm_interactive_pwd
) {
269 local_lm_blob
= data_blob(local_lm_response
,
270 sizeof(local_lm_response
));
273 if (nt_interactive_pwd
) {
274 local_nt_blob
= data_blob(local_nt_response
,
275 sizeof(local_nt_response
));
278 nt_status
= make_user_info_map(
280 smb_name
, client_domain
, workstation_name
,
282 lm_interactive_pwd
? &local_lm_blob
: NULL
,
283 nt_interactive_pwd
? &local_nt_blob
: NULL
,
284 lm_interactive_pwd
? &lm_pwd
: NULL
,
285 nt_interactive_pwd
? &nt_pwd
: NULL
,
286 NULL
, AUTH_PASSWORD_HASH
);
288 if (NT_STATUS_IS_OK(nt_status
)) {
289 (*user_info
)->logon_parameters
= logon_parameters
;
292 ret
= NT_STATUS_IS_OK(nt_status
) ? true : false;
293 data_blob_free(&local_lm_blob
);
294 data_blob_free(&local_nt_blob
);
300 /****************************************************************************
301 Create an auth_usersupplied_data structure
302 ****************************************************************************/
304 bool make_user_info_for_reply(struct auth_usersupplied_info
**user_info
,
305 const char *smb_name
,
306 const char *client_domain
,
307 const struct tsocket_address
*remote_address
,
309 DATA_BLOB plaintext_password
)
312 DATA_BLOB local_lm_blob
;
313 DATA_BLOB local_nt_blob
;
314 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
315 char *plaintext_password_string
;
317 * Not encrypted - do so.
320 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
322 if (plaintext_password
.data
&& plaintext_password
.length
) {
323 unsigned char local_lm_response
[24];
325 #ifdef DEBUG_PASSWORD
326 DEBUG(10,("Unencrypted password (len %d):\n",
327 (int)plaintext_password
.length
));
328 dump_data(100, plaintext_password
.data
,
329 plaintext_password
.length
);
332 SMBencrypt( (const char *)plaintext_password
.data
,
333 (const uchar
*)chal
, local_lm_response
);
334 local_lm_blob
= data_blob(local_lm_response
, 24);
336 /* We can't do an NT hash here, as the password needs to be
338 local_nt_blob
= data_blob_null
;
340 local_lm_blob
= data_blob_null
;
341 local_nt_blob
= data_blob_null
;
344 plaintext_password_string
= talloc_strndup(talloc_tos(),
345 (const char *)plaintext_password
.data
,
346 plaintext_password
.length
);
347 if (!plaintext_password_string
) {
351 ret
= make_user_info(
352 user_info
, smb_name
, smb_name
, client_domain
, client_domain
,
353 get_remote_machine_name(),
355 local_lm_blob
.data
? &local_lm_blob
: NULL
,
356 local_nt_blob
.data
? &local_nt_blob
: NULL
,
358 plaintext_password_string
,
359 AUTH_PASSWORD_PLAIN
);
361 if (plaintext_password_string
) {
362 memset(plaintext_password_string
, '\0', strlen(plaintext_password_string
));
363 talloc_free(plaintext_password_string
);
366 data_blob_free(&local_lm_blob
);
367 return NT_STATUS_IS_OK(ret
) ? true : false;
370 /****************************************************************************
371 Create an auth_usersupplied_data structure
372 ****************************************************************************/
374 NTSTATUS
make_user_info_for_reply_enc(struct auth_usersupplied_info
**user_info
,
375 const char *smb_name
,
376 const char *client_domain
,
377 const struct tsocket_address
*remote_address
,
378 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
380 return make_user_info(user_info
, smb_name
, smb_name
,
381 client_domain
, client_domain
,
382 get_remote_machine_name(),
384 lm_resp
.data
&& (lm_resp
.length
> 0) ? &lm_resp
: NULL
,
385 nt_resp
.data
&& (nt_resp
.length
> 0) ? &nt_resp
: NULL
,
387 AUTH_PASSWORD_RESPONSE
);
390 /****************************************************************************
391 Create a guest user_info blob, for anonymous authentication.
392 ****************************************************************************/
394 bool make_user_info_guest(const struct tsocket_address
*remote_address
,
395 struct auth_usersupplied_info
**user_info
)
399 nt_status
= make_user_info(user_info
,
407 AUTH_PASSWORD_RESPONSE
);
409 return NT_STATUS_IS_OK(nt_status
) ? true : false;
412 static NTSTATUS
log_nt_token(struct security_token
*token
)
414 TALLOC_CTX
*frame
= talloc_stackframe();
419 if ((lp_log_nt_token_command() == NULL
) ||
420 (strlen(lp_log_nt_token_command()) == 0)) {
425 group_sidstr
= talloc_strdup(frame
, "");
426 for (i
=1; i
<token
->num_sids
; i
++) {
427 group_sidstr
= talloc_asprintf(
428 frame
, "%s %s", group_sidstr
,
429 sid_string_talloc(frame
, &token
->sids
[i
]));
432 command
= talloc_string_sub(
433 frame
, lp_log_nt_token_command(),
434 "%s", sid_string_talloc(frame
, &token
->sids
[0]));
435 command
= talloc_string_sub(frame
, command
, "%t", group_sidstr
);
437 if (command
== NULL
) {
439 return NT_STATUS_NO_MEMORY
;
442 DEBUG(8, ("running command: [%s]\n", command
));
443 if (smbrun(command
, NULL
) != 0) {
444 DEBUG(0, ("Could not log NT token\n"));
446 return NT_STATUS_ACCESS_DENIED
;
454 * Create the token to use from server_info->info3 and
455 * server_info->sids (the info3/sam groups). Find the unix gids.
458 NTSTATUS
create_local_token(TALLOC_CTX
*mem_ctx
,
459 const struct auth_serversupplied_info
*server_info
,
460 DATA_BLOB
*session_key
,
461 const char *smb_username
, /* for ->sanitized_username, for %U subs */
462 struct auth_session_info
**session_info_out
)
464 struct security_token
*t
;
467 struct dom_sid tmp_sid
;
468 struct auth_session_info
*session_info
;
472 /* Ensure we can't possible take a code path leading to a
475 return NT_STATUS_LOGON_FAILURE
;
478 session_info
= talloc_zero(mem_ctx
, struct auth_session_info
);
480 return NT_STATUS_NO_MEMORY
;
483 session_info
->unix_token
= talloc_zero(session_info
, struct security_unix_token
);
484 if (!session_info
->unix_token
) {
485 TALLOC_FREE(session_info
);
486 return NT_STATUS_NO_MEMORY
;
489 session_info
->unix_token
->uid
= server_info
->utok
.uid
;
490 session_info
->unix_token
->gid
= server_info
->utok
.gid
;
492 session_info
->unix_info
= talloc_zero(session_info
, struct auth_user_info_unix
);
493 if (!session_info
->unix_info
) {
494 TALLOC_FREE(session_info
);
495 return NT_STATUS_NO_MEMORY
;
498 session_info
->unix_info
->unix_name
= talloc_strdup(session_info
, server_info
->unix_name
);
499 if (!session_info
->unix_info
->unix_name
) {
500 TALLOC_FREE(session_info
);
501 return NT_STATUS_NO_MEMORY
;
504 /* This is a potentially untrusted username for use in %U */
505 alpha_strcpy(tmp
, smb_username
, ". _-$", sizeof(tmp
));
506 session_info
->unix_info
->sanitized_username
=
507 talloc_strdup(session_info
->unix_info
, tmp
);
509 session_info
->unix_info
->system
= server_info
->system
;
512 data_blob_free(&session_info
->session_key
);
513 session_info
->session_key
= data_blob_talloc(session_info
,
515 session_key
->length
);
516 if (!session_info
->session_key
.data
&& session_key
->length
) {
517 return NT_STATUS_NO_MEMORY
;
520 session_info
->session_key
= data_blob_talloc( session_info
, server_info
->session_key
.data
,
521 server_info
->session_key
.length
);
524 /* We need to populate session_info->info with the information found in server_info->info3 */
525 status
= make_user_info_SamBaseInfo(session_info
, "", &server_info
->info3
->base
,
526 server_info
->guest
== false,
527 &session_info
->info
);
528 if (!NT_STATUS_IS_OK(status
)) {
529 DEBUG(0, ("conversion of info3 into auth_user_info failed!\n"));
530 TALLOC_FREE(session_info
);
534 if (server_info
->security_token
) {
535 /* Just copy the token, it has already been finalised
536 * (nasty hack to support a cached guest session_info,
537 * and a possible strategy for auth_samba4 to pass in
538 * a finalised session) */
540 session_info
->security_token
= dup_nt_token(session_info
, server_info
->security_token
);
541 if (!session_info
->security_token
) {
542 TALLOC_FREE(session_info
);
543 return NT_STATUS_NO_MEMORY
;
546 session_info
->unix_token
->ngroups
= server_info
->utok
.ngroups
;
547 if (server_info
->utok
.ngroups
!= 0) {
548 session_info
->unix_token
->groups
= (gid_t
*)talloc_memdup(
549 session_info
->unix_token
, server_info
->utok
.groups
,
550 sizeof(gid_t
)*session_info
->unix_token
->ngroups
);
552 session_info
->unix_token
->groups
= NULL
;
555 *session_info_out
= session_info
;
560 * If winbind is not around, we can not make much use of the SIDs the
561 * domain controller provided us with. Likewise if the user name was
562 * mapped to some local unix user.
565 if (((lp_server_role() == ROLE_DOMAIN_MEMBER
) && !winbind_ping()) ||
566 (server_info
->nss_token
)) {
567 char *found_username
= NULL
;
568 status
= create_token_from_username(session_info
,
569 server_info
->unix_name
,
571 &session_info
->unix_token
->uid
,
572 &session_info
->unix_token
->gid
,
574 &session_info
->security_token
);
575 if (NT_STATUS_IS_OK(status
)) {
576 session_info
->unix_info
->unix_name
= found_username
;
579 status
= create_local_nt_token_from_info3(session_info
,
583 &session_info
->security_token
);
586 if (!NT_STATUS_IS_OK(status
)) {
590 /* Convert the SIDs to gids. */
592 session_info
->unix_token
->ngroups
= 0;
593 session_info
->unix_token
->groups
= NULL
;
595 t
= session_info
->security_token
;
597 ids
= talloc_array(talloc_tos(), struct unixid
,
600 return NT_STATUS_NO_MEMORY
;
603 if (!sids_to_unixids(t
->sids
, t
->num_sids
, ids
)) {
605 return NT_STATUS_NO_MEMORY
;
608 for (i
=0; i
<t
->num_sids
; i
++) {
610 if (i
== 0 && ids
[i
].type
!= ID_TYPE_BOTH
) {
614 if (ids
[i
].type
!= ID_TYPE_GID
&&
615 ids
[i
].type
!= ID_TYPE_BOTH
) {
616 DEBUG(10, ("Could not convert SID %s to gid, "
618 sid_string_dbg(&t
->sids
[i
])));
621 if (!add_gid_to_array_unique(session_info
, ids
[i
].id
,
622 &session_info
->unix_token
->groups
,
623 &session_info
->unix_token
->ngroups
)) {
624 return NT_STATUS_NO_MEMORY
;
629 * Add the "Unix Group" SID for each gid to catch mapped groups
630 * and their Unix equivalent. This is to solve the backwards
631 * compatibility problem of 'valid users = +ntadmin' where
632 * ntadmin has been paired with "Domain Admins" in the group
633 * mapping table. Otherwise smb.conf would need to be changed
634 * to 'valid user = "Domain Admins"'. --jerry
636 * For consistency we also add the "Unix User" SID,
637 * so that the complete unix token is represented within
641 uid_to_unix_users_sid(session_info
->unix_token
->uid
, &tmp_sid
);
643 add_sid_to_array_unique(session_info
->security_token
, &tmp_sid
,
644 &session_info
->security_token
->sids
,
645 &session_info
->security_token
->num_sids
);
647 for ( i
=0; i
<session_info
->unix_token
->ngroups
; i
++ ) {
648 gid_to_unix_groups_sid(session_info
->unix_token
->groups
[i
], &tmp_sid
);
649 add_sid_to_array_unique(session_info
->security_token
, &tmp_sid
,
650 &session_info
->security_token
->sids
,
651 &session_info
->security_token
->num_sids
);
654 security_token_debug(DBGC_AUTH
, 10, session_info
->security_token
);
655 debug_unix_user_token(DBGC_AUTH
, 10,
656 session_info
->unix_token
->uid
,
657 session_info
->unix_token
->gid
,
658 session_info
->unix_token
->ngroups
,
659 session_info
->unix_token
->groups
);
661 status
= log_nt_token(session_info
->security_token
);
662 if (!NT_STATUS_IS_OK(status
)) {
666 *session_info_out
= session_info
;
670 /***************************************************************************
671 Make (and fill) a server_info struct from a 'struct passwd' by conversion
673 ***************************************************************************/
675 NTSTATUS
make_server_info_pw(struct auth_serversupplied_info
**server_info
,
680 struct samu
*sampass
= NULL
;
681 char *qualified_name
= NULL
;
682 TALLOC_CTX
*mem_ctx
= NULL
;
683 struct dom_sid u_sid
;
684 enum lsa_SidType type
;
685 struct auth_serversupplied_info
*result
;
688 * The SID returned in server_info->sam_account is based
689 * on our SAM sid even though for a pure UNIX account this should
690 * not be the case as it doesn't really exist in the SAM db.
691 * This causes lookups on "[in]valid users" to fail as they
692 * will lookup this name as a "Unix User" SID to check against
693 * the user token. Fix this by adding the "Unix User"\unix_username
694 * SID to the sid array. The correct fix should probably be
695 * changing the server_info->sam_account user SID to be a
696 * S-1-22 Unix SID, but this might break old configs where
697 * plaintext passwords were used with no SAM backend.
700 mem_ctx
= talloc_init("make_server_info_pw_tmp");
702 return NT_STATUS_NO_MEMORY
;
705 qualified_name
= talloc_asprintf(mem_ctx
, "%s\\%s",
706 unix_users_domain_name(),
708 if (!qualified_name
) {
709 TALLOC_FREE(mem_ctx
);
710 return NT_STATUS_NO_MEMORY
;
713 if (!lookup_name(mem_ctx
, qualified_name
, LOOKUP_NAME_ALL
,
716 TALLOC_FREE(mem_ctx
);
717 return NT_STATUS_NO_SUCH_USER
;
720 TALLOC_FREE(mem_ctx
);
722 if (type
!= SID_NAME_USER
) {
723 return NT_STATUS_NO_SUCH_USER
;
726 if ( !(sampass
= samu_new( NULL
)) ) {
727 return NT_STATUS_NO_MEMORY
;
730 status
= samu_set_unix( sampass
, pwd
);
731 if (!NT_STATUS_IS_OK(status
)) {
735 /* In pathological cases the above call can set the account
736 * name to the DOMAIN\username form. Reset the account name
737 * using unix_username */
738 pdb_set_username(sampass
, unix_username
, PDB_SET
);
740 /* set the user sid to be the calculated u_sid */
741 pdb_set_user_sid(sampass
, &u_sid
, PDB_SET
);
743 result
= make_server_info(NULL
);
744 if (result
== NULL
) {
745 TALLOC_FREE(sampass
);
746 return NT_STATUS_NO_MEMORY
;
749 status
= samu_to_SamInfo3(result
, sampass
, lp_netbios_name(),
750 &result
->info3
, &result
->extra
);
751 TALLOC_FREE(sampass
);
752 if (!NT_STATUS_IS_OK(status
)) {
753 DEBUG(10, ("Failed to convert samu to info3: %s\n",
759 result
->unix_name
= talloc_strdup(result
, unix_username
);
761 if (result
->unix_name
== NULL
) {
763 return NT_STATUS_NO_MEMORY
;
766 result
->utok
.uid
= pwd
->pw_uid
;
767 result
->utok
.gid
= pwd
->pw_gid
;
769 *server_info
= result
;
774 static NTSTATUS
get_guest_info3(TALLOC_CTX
*mem_ctx
,
775 struct netr_SamInfo3
*info3
)
777 const char *guest_account
= lp_guestaccount();
778 struct dom_sid domain_sid
;
782 pwd
= Get_Pwnam_alloc(mem_ctx
, guest_account
);
784 DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
785 "account [%s]!\n", guest_account
));
786 return NT_STATUS_NO_SUCH_USER
;
789 /* Set account name */
790 tmp
= talloc_strdup(mem_ctx
, pwd
->pw_name
);
792 return NT_STATUS_NO_MEMORY
;
794 init_lsa_String(&info3
->base
.account_name
, tmp
);
796 /* Set domain name */
797 tmp
= talloc_strdup(mem_ctx
, get_global_sam_name());
799 return NT_STATUS_NO_MEMORY
;
801 init_lsa_StringLarge(&info3
->base
.logon_domain
, tmp
);
804 sid_copy(&domain_sid
, get_global_sam_sid());
806 info3
->base
.domain_sid
= dom_sid_dup(mem_ctx
, &domain_sid
);
807 if (info3
->base
.domain_sid
== NULL
) {
808 return NT_STATUS_NO_MEMORY
;
812 info3
->base
.rid
= DOMAIN_RID_GUEST
;
815 info3
->base
.primary_gid
= BUILTIN_RID_GUESTS
;
818 info3
->base
.user_flags
= NETLOGON_GUEST
;
824 /***************************************************************************
825 Make (and fill) a user_info struct for a guest login.
826 This *must* succeed for smbd to start. If there is no mapping entry for
827 the guest gid, then create one.
829 The resulting structure is a 'session_info' because
830 create_local_token() has already been called on it. This is quite
831 nasty, as the auth subsystem isn't expect this, but the behavior is
833 ***************************************************************************/
835 static NTSTATUS
make_new_session_info_guest(struct auth_session_info
**session_info
, struct auth_serversupplied_info
**server_info
)
837 static const char zeros
[16] = {0};
838 const char *guest_account
= lp_guestaccount();
839 const char *domain
= lp_netbios_name();
840 struct netr_SamInfo3 info3
;
844 tmp_ctx
= talloc_stackframe();
845 if (tmp_ctx
== NULL
) {
846 return NT_STATUS_NO_MEMORY
;
851 status
= get_guest_info3(tmp_ctx
, &info3
);
852 if (!NT_STATUS_IS_OK(status
)) {
853 DEBUG(0, ("get_guest_info3 failed with %s\n",
858 status
= make_server_info_info3(tmp_ctx
,
863 if (!NT_STATUS_IS_OK(status
)) {
864 DEBUG(0, ("make_server_info_info3 failed with %s\n",
869 (*server_info
)->guest
= true;
871 /* This should not be done here (we should produce a server
872 * info, and later construct a session info from it), but for
873 * now this does not change the previous behavior */
874 status
= create_local_token(tmp_ctx
, *server_info
, NULL
,
875 (*server_info
)->info3
->base
.account_name
.string
,
877 if (!NT_STATUS_IS_OK(status
)) {
878 DEBUG(0, ("create_local_token failed: %s\n",
882 talloc_steal(NULL
, *session_info
);
883 talloc_steal(NULL
, *server_info
);
885 /* annoying, but the Guest really does have a session key, and it is
887 (*session_info
)->session_key
= data_blob(zeros
, sizeof(zeros
));
889 status
= NT_STATUS_OK
;
891 TALLOC_FREE(tmp_ctx
);
895 /****************************************************************************
896 Fake a auth_session_info just from a username (as a
897 session_info structure, with create_local_token() already called on
899 ****************************************************************************/
901 static NTSTATUS
make_session_info_from_pw(TALLOC_CTX
*mem_ctx
,
904 struct auth_session_info
**session_info
)
906 struct auth_serversupplied_info
*result
;
909 status
= make_server_info_pw(&result
, pwd
->pw_name
, pwd
);
911 if (!NT_STATUS_IS_OK(status
)) {
915 result
->nss_token
= true;
916 result
->guest
= is_guest
;
918 /* Now turn the server_info into a session_info with the full token etc */
919 status
= create_local_token(mem_ctx
, result
, NULL
, pwd
->pw_name
, session_info
);
924 /***************************************************************************
925 Make (and fill) a auth_session_info struct for a system user login.
926 This *must* succeed for smbd to start.
927 ***************************************************************************/
929 static NTSTATUS
make_new_session_info_system(TALLOC_CTX
*mem_ctx
,
930 struct auth_session_info
**session_info
)
935 pwd
= getpwuid_alloc(mem_ctx
, sec_initial_uid());
937 return NT_STATUS_NO_SUCH_USER
;
940 status
= make_session_info_from_pw(mem_ctx
,
945 if (!NT_STATUS_IS_OK(status
)) {
949 (*session_info
)->unix_info
->system
= true;
951 status
= add_sid_to_array_unique((*session_info
)->security_token
->sids
,
953 &(*session_info
)->security_token
->sids
,
954 &(*session_info
)->security_token
->num_sids
);
955 if (!NT_STATUS_IS_OK(status
)) {
956 TALLOC_FREE((*session_info
));
963 /****************************************************************************
964 Fake a auth_session_info just from a username (as a
965 session_info structure, with create_local_token() already called on
967 ****************************************************************************/
969 NTSTATUS
make_session_info_from_username(TALLOC_CTX
*mem_ctx
,
970 const char *username
,
972 struct auth_session_info
**session_info
)
977 pwd
= Get_Pwnam_alloc(talloc_tos(), username
);
979 return NT_STATUS_NO_SUCH_USER
;
982 status
= make_session_info_from_pw(mem_ctx
, pwd
, is_guest
, session_info
);
984 if (!NT_STATUS_IS_OK(status
)) {
993 /* This function MUST only used to create the cached server_info for
996 * This is a lossy conversion. Variables known to be lost so far
999 * - nss_token (not needed because the only read doesn't happen
1000 * for the GUEST user, as this routine populates ->security_token
1002 * - extra (not needed because the guest account must have valid RIDs per the output of get_guest_info3())
1004 * - The 'server_info' parameter allows the missing 'info3' to be copied across.
1006 static struct auth_serversupplied_info
*copy_session_info_serverinfo_guest(TALLOC_CTX
*mem_ctx
,
1007 const struct auth_session_info
*src
,
1008 struct auth_serversupplied_info
*server_info
)
1010 struct auth_serversupplied_info
*dst
;
1012 dst
= make_server_info(mem_ctx
);
1017 /* This element must be provided to convert back to an auth_serversupplied_info */
1018 SMB_ASSERT(src
->unix_info
);
1021 dst
->system
= false;
1023 /* This element must be provided to convert back to an
1024 * auth_serversupplied_info. This needs to be from the
1025 * auth_session_info because the group values in particular
1026 * may change during create_local_token() processing */
1027 SMB_ASSERT(src
->unix_token
);
1028 dst
->utok
.uid
= src
->unix_token
->uid
;
1029 dst
->utok
.gid
= src
->unix_token
->gid
;
1030 dst
->utok
.ngroups
= src
->unix_token
->ngroups
;
1031 if (src
->unix_token
->ngroups
!= 0) {
1032 dst
->utok
.groups
= (gid_t
*)talloc_memdup(
1033 dst
, src
->unix_token
->groups
,
1034 sizeof(gid_t
)*dst
->utok
.ngroups
);
1036 dst
->utok
.groups
= NULL
;
1039 /* We must have a security_token as otherwise the lossy
1040 * conversion without nss_token would cause create_local_token
1041 * to take the wrong path */
1042 SMB_ASSERT(src
->security_token
);
1044 dst
->security_token
= dup_nt_token(dst
, src
->security_token
);
1045 if (!dst
->security_token
) {
1050 dst
->session_key
= data_blob_talloc( dst
, src
->session_key
.data
,
1051 src
->session_key
.length
);
1053 /* This is OK because this functions is only used for the
1054 * GUEST account, which has all-zero keys for both values */
1055 dst
->lm_session_key
= data_blob_talloc(dst
, src
->session_key
.data
,
1056 src
->session_key
.length
);
1058 dst
->info3
= copy_netr_SamInfo3(dst
, server_info
->info3
);
1064 dst
->unix_name
= talloc_strdup(dst
, src
->unix_info
->unix_name
);
1065 if (!dst
->unix_name
) {
1073 struct auth_session_info
*copy_session_info(TALLOC_CTX
*mem_ctx
,
1074 const struct auth_session_info
*src
)
1076 struct auth_session_info
*dst
;
1078 enum ndr_err_code ndr_err
;
1080 ndr_err
= ndr_push_struct_blob(
1081 &blob
, talloc_tos(), src
,
1082 (ndr_push_flags_fn_t
)ndr_push_auth_session_info
);
1083 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1084 DEBUG(0, ("copy_session_info(): ndr_push_auth_session_info failed: "
1085 "%s\n", ndr_errstr(ndr_err
)));
1089 dst
= talloc(mem_ctx
, struct auth_session_info
);
1091 DEBUG(0, ("talloc failed\n"));
1092 TALLOC_FREE(blob
.data
);
1096 ndr_err
= ndr_pull_struct_blob(
1098 (ndr_pull_flags_fn_t
)ndr_pull_auth_session_info
);
1099 TALLOC_FREE(blob
.data
);
1101 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
1102 DEBUG(0, ("copy_session_info(): ndr_pull_auth_session_info failed: "
1103 "%s\n", ndr_errstr(ndr_err
)));
1112 * Set a new session key. Used in the rpc server where we have to override the
1113 * SMB level session key with SystemLibraryDTC
1116 bool session_info_set_session_key(struct auth_session_info
*info
,
1117 DATA_BLOB session_key
)
1119 TALLOC_FREE(info
->session_key
.data
);
1121 info
->session_key
= data_blob_talloc(
1122 info
, session_key
.data
, session_key
.length
);
1124 return (info
->session_key
.data
!= NULL
);
1127 static struct auth_session_info
*guest_info
= NULL
;
1129 static struct auth_serversupplied_info
*guest_server_info
= NULL
;
1131 bool init_guest_info(void)
1133 if (guest_info
!= NULL
)
1136 return NT_STATUS_IS_OK(make_new_session_info_guest(&guest_info
, &guest_server_info
));
1139 NTSTATUS
make_server_info_guest(TALLOC_CTX
*mem_ctx
,
1140 struct auth_serversupplied_info
**server_info
)
1142 /* This is trickier than it would appear to need to be because
1143 * we are trying to avoid certain costly operations when the
1144 * structure is converted to a 'auth_session_info' again in
1145 * create_local_token() */
1146 *server_info
= copy_session_info_serverinfo_guest(mem_ctx
, guest_info
, guest_server_info
);
1147 return (*server_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1150 NTSTATUS
make_session_info_guest(TALLOC_CTX
*mem_ctx
,
1151 struct auth_session_info
**session_info
)
1153 *session_info
= copy_session_info(mem_ctx
, guest_info
);
1154 return (*session_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1157 static struct auth_session_info
*system_info
= NULL
;
1159 NTSTATUS
init_system_info(void)
1161 if (system_info
!= NULL
)
1162 return NT_STATUS_OK
;
1164 return make_new_session_info_system(NULL
, &system_info
);
1167 NTSTATUS
make_session_info_system(TALLOC_CTX
*mem_ctx
,
1168 struct auth_session_info
**session_info
)
1170 if (system_info
== NULL
) return NT_STATUS_UNSUCCESSFUL
;
1171 *session_info
= copy_session_info(mem_ctx
, system_info
);
1172 return (*session_info
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1175 const struct auth_session_info
*get_session_info_system(void)
1180 bool copy_current_user(struct current_user
*dst
, struct current_user
*src
)
1183 struct security_token
*nt_token
;
1185 groups
= (gid_t
*)memdup(src
->ut
.groups
,
1186 sizeof(gid_t
) * src
->ut
.ngroups
);
1187 if ((src
->ut
.ngroups
!= 0) && (groups
== NULL
)) {
1191 nt_token
= dup_nt_token(NULL
, src
->nt_user_token
);
1192 if (nt_token
== NULL
) {
1197 dst
->conn
= src
->conn
;
1198 dst
->vuid
= src
->vuid
;
1199 dst
->ut
.uid
= src
->ut
.uid
;
1200 dst
->ut
.gid
= src
->ut
.gid
;
1201 dst
->ut
.ngroups
= src
->ut
.ngroups
;
1202 dst
->ut
.groups
= groups
;
1203 dst
->nt_user_token
= nt_token
;
1207 /***************************************************************************
1208 Purely internal function for make_server_info_info3
1209 ***************************************************************************/
1211 static NTSTATUS
check_account(TALLOC_CTX
*mem_ctx
, const char *domain
,
1212 const char *username
, char **found_username
,
1213 struct passwd
**pwd
,
1214 bool *username_was_mapped
)
1216 char *orig_dom_user
= NULL
;
1217 char *dom_user
= NULL
;
1218 char *lower_username
= NULL
;
1219 char *real_username
= NULL
;
1220 struct passwd
*passwd
;
1222 lower_username
= talloc_strdup(mem_ctx
, username
);
1223 if (!lower_username
) {
1224 return NT_STATUS_NO_MEMORY
;
1226 strlower_m( lower_username
);
1228 orig_dom_user
= talloc_asprintf(mem_ctx
,
1231 *lp_winbind_separator(),
1233 if (!orig_dom_user
) {
1234 return NT_STATUS_NO_MEMORY
;
1237 /* Get the passwd struct. Try to create the account if necessary. */
1239 *username_was_mapped
= map_username(mem_ctx
, orig_dom_user
, &dom_user
);
1241 return NT_STATUS_NO_MEMORY
;
1244 passwd
= smb_getpwnam(mem_ctx
, dom_user
, &real_username
, true );
1246 DEBUG(3, ("Failed to find authenticated user %s via "
1247 "getpwnam(), denying access.\n", dom_user
));
1248 return NT_STATUS_NO_SUCH_USER
;
1251 if (!real_username
) {
1252 return NT_STATUS_NO_MEMORY
;
1257 /* This is pointless -- there is no support for differing
1258 unix and windows names. Make sure to always store the
1259 one we actually looked up and succeeded. Have I mentioned
1260 why I hate the 'winbind use default domain' parameter?
1263 *found_username
= talloc_strdup( mem_ctx
, real_username
);
1265 return NT_STATUS_OK
;
1268 /****************************************************************************
1269 Wrapper to allow the getpwnam() call to strip the domain name and
1270 try again in case a local UNIX user is already there. Also run through
1271 the username if we fallback to the username only.
1272 ****************************************************************************/
1274 struct passwd
*smb_getpwnam( TALLOC_CTX
*mem_ctx
, const char *domuser
,
1275 char **p_save_username
, bool create
)
1277 struct passwd
*pw
= NULL
;
1279 char *username
= NULL
;
1281 /* we only save a copy of the username it has been mangled
1282 by winbindd use default domain */
1283 *p_save_username
= NULL
;
1285 /* don't call map_username() here since it has to be done higher
1286 up the stack so we don't call it multiple times */
1288 username
= talloc_strdup(mem_ctx
, domuser
);
1293 p
= strchr_m( username
, *lp_winbind_separator() );
1295 /* code for a DOMAIN\user string */
1298 pw
= Get_Pwnam_alloc( mem_ctx
, domuser
);
1300 /* make sure we get the case of the username correct */
1301 /* work around 'winbind use default domain = yes' */
1303 if ( !strchr_m( pw
->pw_name
, *lp_winbind_separator() ) ) {
1306 /* split the domain and username into 2 strings */
1310 *p_save_username
= talloc_asprintf(mem_ctx
,
1313 *lp_winbind_separator(),
1315 if (!*p_save_username
) {
1320 *p_save_username
= talloc_strdup(mem_ctx
, pw
->pw_name
);
1327 /* setup for lookup of just the username */
1328 /* remember that p and username are overlapping memory */
1331 username
= talloc_strdup(mem_ctx
, p
);
1337 /* just lookup a plain username */
1339 pw
= Get_Pwnam_alloc(mem_ctx
, username
);
1341 /* Create local user if requested but only if winbindd
1342 is not running. We need to protect against cases
1343 where winbindd is failing and then prematurely
1344 creating users in /etc/passwd */
1346 if ( !pw
&& create
&& !winbind_ping() ) {
1347 /* Don't add a machine account. */
1348 if (username
[strlen(username
)-1] == '$')
1351 _smb_create_user(NULL
, username
, NULL
);
1352 pw
= Get_Pwnam_alloc(mem_ctx
, username
);
1355 /* one last check for a valid passwd struct */
1358 *p_save_username
= talloc_strdup(mem_ctx
, pw
->pw_name
);
1363 /***************************************************************************
1364 Make a server_info struct from the info3 returned by a domain logon
1365 ***************************************************************************/
1367 NTSTATUS
make_server_info_info3(TALLOC_CTX
*mem_ctx
,
1368 const char *sent_nt_username
,
1370 struct auth_serversupplied_info
**server_info
,
1371 struct netr_SamInfo3
*info3
)
1373 static const char zeros
[16] = {0, };
1375 NTSTATUS nt_status
= NT_STATUS_OK
;
1376 char *found_username
= NULL
;
1377 const char *nt_domain
;
1378 const char *nt_username
;
1379 bool username_was_mapped
;
1381 struct auth_serversupplied_info
*result
;
1382 struct dom_sid
*group_sid
;
1383 struct netr_SamInfo3
*i3
;
1386 Here is where we should check the list of
1387 trusted domains, and verify that the SID
1391 nt_username
= talloc_strdup(mem_ctx
, info3
->base
.account_name
.string
);
1393 /* If the server didn't give us one, just use the one we sent
1395 nt_username
= sent_nt_username
;
1398 nt_domain
= talloc_strdup(mem_ctx
, info3
->base
.logon_domain
.string
);
1400 /* If the server didn't give us one, just use the one we sent
1405 /* If getpwnam() fails try the add user script (2.2.x behavior).
1407 We use the _unmapped_ username here in an attempt to provide
1408 consistent username mapping behavior between kerberos and NTLM[SSP]
1409 authentication in domain mode security. I.E. Username mapping
1410 should be applied to the fully qualified username
1411 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1412 called map_username() unnecessarily in make_user_info_map() but
1413 that is how the current code is designed. Making the change here
1414 is the least disruptive place. -- jerry */
1416 /* this call will try to create the user if necessary */
1418 nt_status
= check_account(mem_ctx
, nt_domain
, sent_nt_username
,
1419 &found_username
, &pwd
,
1420 &username_was_mapped
);
1422 if (!NT_STATUS_IS_OK(nt_status
)) {
1426 result
= make_server_info(NULL
);
1427 if (result
== NULL
) {
1428 DEBUG(4, ("make_server_info failed!\n"));
1429 return NT_STATUS_NO_MEMORY
;
1432 result
->unix_name
= talloc_strdup(result
, found_username
);
1434 /* copy in the info3 */
1435 result
->info3
= i3
= copy_netr_SamInfo3(result
, info3
);
1436 if (result
->info3
== NULL
) {
1437 TALLOC_FREE(result
);
1438 return NT_STATUS_NO_MEMORY
;
1441 /* Fill in the unix info we found on the way */
1442 result
->utok
.uid
= pwd
->pw_uid
;
1443 result
->utok
.gid
= pwd
->pw_gid
;
1445 /* We can't just trust that the primary group sid sent us is something
1446 * we can really use. Obtain the usable sid, and store the original
1447 * one as an additional group if it had to be replaced */
1448 nt_status
= get_primary_group_sid(mem_ctx
, found_username
,
1450 if (!NT_STATUS_IS_OK(nt_status
)) {
1451 TALLOC_FREE(result
);
1455 /* store and check if it is the same we got originally */
1456 sid_peek_rid(group_sid
, &i3
->base
.primary_gid
);
1457 if (i3
->base
.primary_gid
!= info3
->base
.primary_gid
) {
1458 uint32_t n
= i3
->base
.groups
.count
;
1459 /* not the same, store the original as an additional group */
1460 i3
->base
.groups
.rids
=
1461 talloc_realloc(i3
, i3
->base
.groups
.rids
,
1462 struct samr_RidWithAttribute
, n
+ 1);
1463 if (i3
->base
.groups
.rids
== NULL
) {
1464 TALLOC_FREE(result
);
1465 return NT_STATUS_NO_MEMORY
;
1467 i3
->base
.groups
.rids
[n
].rid
= info3
->base
.primary_gid
;
1468 i3
->base
.groups
.rids
[n
].attributes
= SE_GROUP_ENABLED
;
1469 i3
->base
.groups
.count
= n
+ 1;
1472 /* ensure we are never given NULL session keys */
1474 if (memcmp(info3
->base
.key
.key
, zeros
, sizeof(zeros
)) == 0) {
1475 result
->session_key
= data_blob_null
;
1477 result
->session_key
= data_blob_talloc(
1478 result
, info3
->base
.key
.key
,
1479 sizeof(info3
->base
.key
.key
));
1482 if (memcmp(info3
->base
.LMSessKey
.key
, zeros
, 8) == 0) {
1483 result
->lm_session_key
= data_blob_null
;
1485 result
->lm_session_key
= data_blob_talloc(
1486 result
, info3
->base
.LMSessKey
.key
,
1487 sizeof(info3
->base
.LMSessKey
.key
));
1490 result
->nss_token
|= username_was_mapped
;
1492 result
->guest
= (info3
->base
.user_flags
& NETLOGON_GUEST
);
1494 *server_info
= result
;
1496 return NT_STATUS_OK
;
1499 /*****************************************************************************
1500 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1501 ******************************************************************************/
1503 NTSTATUS
make_server_info_wbcAuthUserInfo(TALLOC_CTX
*mem_ctx
,
1504 const char *sent_nt_username
,
1506 const struct wbcAuthUserInfo
*info
,
1507 struct auth_serversupplied_info
**server_info
)
1509 struct netr_SamInfo3
*info3
;
1511 info3
= wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx
, info
);
1513 return NT_STATUS_NO_MEMORY
;
1516 return make_server_info_info3(mem_ctx
,
1517 sent_nt_username
, domain
,
1518 server_info
, info3
);
1522 * Verify whether or not given domain is trusted.
1524 * @param domain_name name of the domain to be verified
1525 * @return true if domain is one of the trusted ones or
1526 * false if otherwise
1529 bool is_trusted_domain(const char* dom_name
)
1531 struct dom_sid trustdom_sid
;
1534 /* no trusted domains for a standalone server */
1536 if ( lp_server_role() == ROLE_STANDALONE
)
1539 if (dom_name
== NULL
|| dom_name
[0] == '\0') {
1543 if (strequal(dom_name
, get_global_sam_name())) {
1547 /* if we are a DC, then check for a direct trust relationships */
1551 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1552 "[%s]\n", dom_name
));
1553 ret
= pdb_get_trusteddom_pw(dom_name
, NULL
, NULL
, NULL
);
1561 /* If winbind is around, ask it */
1563 result
= wb_is_trusted_domain(dom_name
);
1565 if (result
== WBC_ERR_SUCCESS
) {
1569 if (result
== WBC_ERR_DOMAIN_NOT_FOUND
) {
1570 /* winbind could not find the domain */
1574 /* The only other possible result is that winbind is not up
1575 and running. We need to update the trustdom_cache
1578 update_trustdom_cache();
1581 /* now the trustdom cache should be available a DC could still
1582 * have a transitive trust so fall back to the cache of trusted
1583 * domains (like a domain member would use */
1585 if ( trustdom_cache_fetch(dom_name
, &trustdom_sid
) ) {
1595 on a logon error possibly map the error to success if "map to guest"
1598 NTSTATUS
do_map_to_guest_server_info(NTSTATUS status
,
1599 struct auth_serversupplied_info
**server_info
,
1600 const char *user
, const char *domain
)
1602 user
= user
? user
: "";
1603 domain
= domain
? domain
: "";
1605 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)) {
1606 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER
) ||
1607 (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD
)) {
1608 DEBUG(3,("No such user %s [%s] - using guest account\n",
1610 return make_server_info_guest(NULL
, server_info
);
1612 } else if (NT_STATUS_EQUAL(status
, NT_STATUS_WRONG_PASSWORD
)) {
1613 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD
) {
1614 DEBUG(3,("Registered username %s for guest access\n",
1616 return make_server_info_guest(NULL
, server_info
);
1624 Extract session key from a session info and return it in a blob
1625 if intent is KEY_USE_16BYTES, truncate it to 16 bytes
1627 See sections 3.2.4.15 and 3.3.4.2 of MS-SMB
1628 Also see https://lists.samba.org/archive/cifs-protocol/2012-January/002265.html for details
1630 Note that returned session_key is referencing the original key, it is supposed to be
1631 short-lived. If original session_info->session_key is gone, the reference will be broken.
1633 NTSTATUS
session_extract_session_key(const struct auth_session_info
*session_info
, DATA_BLOB
*session_key
, enum session_key_use_intent intent
)
1636 if (session_key
== NULL
|| session_info
== NULL
) {
1637 return NT_STATUS_INVALID_PARAMETER
;
1640 if (session_info
->session_key
.length
== 0) {
1641 return NT_STATUS_NO_USER_SESSION_KEY
;
1644 *session_key
= session_info
->session_key
;
1645 if (intent
== KEY_USE_16BYTES
) {
1646 session_key
->length
= MIN(session_info
->session_key
.length
, 16);
1648 return NT_STATUS_OK
;