2 Unix SMB/Netbios implementation.
4 handle GENSEC authentication, server side
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett 2001-2003,2011
8 Copyright (C) Simo Sorce 2010.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../lib/util/tevent_ntstatus.h"
28 #include "../lib/tsocket/tsocket.h"
29 #include "auth/gensec/gensec.h"
30 #include "lib/param/param.h"
32 #include "auth/kerberos/pac_utils.h"
33 #include "nsswitch/libwbclient/wbclient.h"
35 #include "librpc/crypto/gse.h"
36 #include "auth/credentials/credentials.h"
37 #include "lib/param/loadparm.h"
38 #include "librpc/gen_ndr/dcerpc.h"
39 #include "source3/lib/substitute.h"
41 static NTSTATUS
auth3_generate_session_info_pac(struct auth4_context
*auth_ctx
,
43 struct smb_krb5_context
*smb_krb5_context
,
45 const char *princ_name
,
46 const struct tsocket_address
*remote_address
,
47 uint32_t session_info_flags
,
48 struct auth_session_info
**session_info
)
50 enum server_role server_role
= lp_server_role();
61 tmp_ctx
= talloc_new(mem_ctx
);
63 return NT_STATUS_NO_MEMORY
;
66 if (tsocket_address_is_inet(remote_address
, "ip")) {
67 rhost
= tsocket_address_inet_addr_string(
68 remote_address
, tmp_ctx
);
70 status
= NT_STATUS_NO_MEMORY
;
77 if (server_role
!= ROLE_STANDALONE
) {
78 struct wbcAuthUserParams params
= { 0 };
79 struct wbcAuthUserInfo
*info
= NULL
;
80 struct wbcAuthErrorInfo
*err
= NULL
;
81 struct auth_serversupplied_info
*server_info
= NULL
;
82 char *original_user_name
= NULL
;
86 if (pac_blob
== NULL
) {
88 * This should already be caught at the main
89 * gensec layer, but better check twice
91 status
= NT_STATUS_INTERNAL_ERROR
;
96 * Let winbind decode the PAC.
97 * This will also store the user
98 * data in the netsamlogon cache.
100 * This used to be a cache prime
101 * optimization, but now we delegate
102 * all logic to winbindd, as we require
103 * winbindd as domain member anyway.
105 params
.level
= WBC_AUTH_USER_LEVEL_PAC
;
106 params
.password
.pac
.data
= pac_blob
->data
;
107 params
.password
.pac
.length
= pac_blob
->length
;
109 /* we are contacting the privileged pipe */
111 wbc_err
= wbcAuthenticateUserEx(¶ms
, &info
, &err
);
115 * As this is merely a cache prime
116 * WBC_ERR_WINBIND_NOT_AVAILABLE
117 * is not a fatal error, treat it
122 case WBC_ERR_SUCCESS
:
124 case WBC_ERR_WINBIND_NOT_AVAILABLE
:
125 status
= NT_STATUS_NO_LOGON_SERVERS
;
126 DBG_ERR("winbindd not running - "
127 "but required as domain member: %s\n",
130 case WBC_ERR_AUTH_ERROR
:
131 status
= NT_STATUS(err
->nt_status
);
134 case WBC_ERR_NO_MEMORY
:
135 status
= NT_STATUS_NO_MEMORY
;
138 status
= NT_STATUS_LOGON_FAILURE
;
142 status
= make_server_info_wbcAuthUserInfo(tmp_ctx
,
147 if (!NT_STATUS_IS_OK(status
)) {
148 DEBUG(10, ("make_server_info_wbcAuthUserInfo failed: %s\n",
153 /* We skip doing this step if the caller asked us not to */
154 if (!(server_info
->guest
)) {
155 const char *unix_username
= server_info
->unix_name
;
157 /* We might not be root if we are an RPC call */
159 status
= smb_pam_accountcheck(unix_username
, rhost
);
162 if (!NT_STATUS_IS_OK(status
)) {
163 DEBUG(3, ("check_ntlm_password: PAM Account for user [%s] "
164 "FAILED with error %s\n",
165 unix_username
, nt_errstr(status
)));
169 DEBUG(5, ("check_ntlm_password: PAM Account for user [%s] "
170 "succeeded\n", unix_username
));
173 DEBUG(3, ("Kerberos ticket principal name is [%s]\n", princ_name
));
175 p
= strchr_m(princ_name
, '@');
177 DEBUG(3, ("[%s] Doesn't look like a valid principal\n",
179 status
= NT_STATUS_LOGON_FAILURE
;
183 original_user_name
= talloc_strndup(tmp_ctx
, princ_name
, p
- princ_name
);
184 if (original_user_name
== NULL
) {
185 status
= NT_STATUS_NO_MEMORY
;
189 status
= create_local_token(mem_ctx
,
194 if (!NT_STATUS_IS_OK(status
)) {
195 DEBUG(10, ("create_local_token failed: %s\n",
200 goto session_info_ready
;
203 /* This is the standalone legacy code path */
205 if (pac_blob
!= NULL
) {
207 * In standalone mode we don't expect a PAC!
208 * we only support MIT realms
210 status
= NT_STATUS_BAD_TOKEN_TYPE
;
211 DBG_WARNING("Unexpected PAC for [%s] in standalone mode - %s\n",
212 princ_name
, nt_errstr(status
));
213 if (!NT_STATUS_IS_OK(status
)) {
218 status
= get_user_from_kerberos_info(tmp_ctx
, rhost
,
220 &is_mapped
, &is_guest
,
223 if (!NT_STATUS_IS_OK(status
)) {
224 DBG_NOTICE("Failed to map kerberos principal to system user "
225 "(%s)\n", nt_errstr(status
));
226 status
= NT_STATUS_ACCESS_DENIED
;
230 status
= make_session_info_krb5(mem_ctx
,
231 ntuser
, ntdomain
, username
, pw
,
234 if (!NT_STATUS_IS_OK(status
)) {
235 DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
237 status
= nt_status_squash(status
);
243 /* setup the string used by %U */
244 set_current_user_info((*session_info
)->unix_info
->sanitized_username
,
245 (*session_info
)->unix_info
->unix_name
,
246 (*session_info
)->info
->domain_name
);
248 /* reload services so that the new %U is taken into account */
249 lp_load_with_shares(get_dyn_CONFIGFILE());
251 DEBUG(5, (__location__
"OK: user: %s domain: %s client: %s\n",
252 (*session_info
)->info
->account_name
,
253 (*session_info
)->info
->domain_name
,
256 status
= NT_STATUS_OK
;
259 TALLOC_FREE(tmp_ctx
);
263 static struct auth4_context
*make_auth4_context_s3(TALLOC_CTX
*mem_ctx
, struct auth_context
*auth_context
)
265 struct auth4_context
*auth4_context
= talloc_zero(mem_ctx
, struct auth4_context
);
266 if (auth4_context
== NULL
) {
267 DEBUG(10, ("failed to allocate auth4_context failed\n"));
270 auth4_context
->generate_session_info_pac
= auth3_generate_session_info_pac
;
271 auth4_context
->generate_session_info
= auth3_generate_session_info
;
272 auth4_context
->get_ntlm_challenge
= auth3_get_challenge
;
273 auth4_context
->set_ntlm_challenge
= auth3_set_challenge
;
274 auth4_context
->check_ntlm_password_send
= auth3_check_password_send
;
275 auth4_context
->check_ntlm_password_recv
= auth3_check_password_recv
;
276 auth4_context
->private_data
= talloc_steal(auth4_context
, auth_context
);
277 return auth4_context
;
280 NTSTATUS
make_auth4_context(TALLOC_CTX
*mem_ctx
, struct auth4_context
**auth4_context_out
)
282 struct auth_context
*auth_context
;
285 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
286 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
288 nt_status
= make_auth3_context_for_ntlm(tmp_ctx
, &auth_context
);
289 if (!NT_STATUS_IS_OK(nt_status
)) {
290 TALLOC_FREE(tmp_ctx
);
294 if (auth_context
->make_auth4_context
) {
295 nt_status
= auth_context
->make_auth4_context(auth_context
, mem_ctx
, auth4_context_out
);
296 TALLOC_FREE(tmp_ctx
);
300 struct auth4_context
*auth4_context
= make_auth4_context_s3(tmp_ctx
, auth_context
);
301 if (auth4_context
== NULL
) {
302 TALLOC_FREE(tmp_ctx
);
303 return NT_STATUS_NO_MEMORY
;
305 *auth4_context_out
= talloc_steal(mem_ctx
, auth4_context
);
306 TALLOC_FREE(tmp_ctx
);
311 NTSTATUS
auth_generic_prepare(TALLOC_CTX
*mem_ctx
,
312 const struct tsocket_address
*remote_address
,
313 const struct tsocket_address
*local_address
,
314 const char *service_description
,
315 struct gensec_security
**gensec_security_out
)
317 struct gensec_security
*gensec_security
;
318 struct auth_context
*auth_context
= NULL
;
321 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
322 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
324 nt_status
= make_auth3_context_for_ntlm(tmp_ctx
, &auth_context
);
325 if (!NT_STATUS_IS_OK(nt_status
)) {
329 if (auth_context
->prepare_gensec
) {
330 nt_status
= auth_context
->prepare_gensec(auth_context
, tmp_ctx
,
332 if (!NT_STATUS_IS_OK(nt_status
)) {
336 const struct gensec_security_ops
**backends
= NULL
;
337 struct gensec_settings
*gensec_settings
;
338 struct loadparm_context
*lp_ctx
;
340 struct cli_credentials
*server_credentials
;
341 const char *dns_name
;
342 const char *dns_domain
;
344 struct auth4_context
*auth4_context
= make_auth4_context_s3(tmp_ctx
, auth_context
);
345 if (auth4_context
== NULL
) {
349 lp_ctx
= loadparm_init_s3(tmp_ctx
, loadparm_s3_helpers());
350 if (lp_ctx
== NULL
) {
351 DEBUG(10, ("loadparm_init_s3 failed\n"));
352 nt_status
= NT_STATUS_INVALID_SERVER_STATE
;
356 gensec_settings
= lpcfg_gensec_settings(tmp_ctx
, lp_ctx
);
357 if (lp_ctx
== NULL
) {
358 DEBUG(10, ("lpcfg_gensec_settings failed\n"));
363 * This should be a 'netbios domain -> DNS domain'
364 * mapping, and can currently validly return NULL on
365 * poorly configured systems.
367 * This is used for the NTLMSSP server
370 dns_name
= get_mydnsfullname();
371 if (dns_name
== NULL
) {
375 dns_domain
= get_mydnsdomname(tmp_ctx
);
376 if (dns_domain
== NULL
) {
380 gensec_settings
->server_dns_name
= strlower_talloc(gensec_settings
, dns_name
);
381 if (gensec_settings
->server_dns_name
== NULL
) {
385 gensec_settings
->server_dns_domain
= strlower_talloc(gensec_settings
, dns_domain
);
386 if (gensec_settings
->server_dns_domain
== NULL
) {
390 backends
= talloc_zero_array(gensec_settings
,
391 const struct gensec_security_ops
*, 6);
392 if (backends
== NULL
) {
395 gensec_settings
->backends
= backends
;
399 /* These need to be in priority order, krb5 before NTLMSSP */
400 #if defined(HAVE_KRB5)
401 backends
[idx
++] = &gensec_gse_krb5_security_ops
;
404 backends
[idx
++] = gensec_security_by_oid(NULL
, GENSEC_OID_NTLMSSP
);
406 backends
[idx
++] = gensec_security_by_oid(NULL
, GENSEC_OID_SPNEGO
);
408 backends
[idx
++] = gensec_security_by_auth_type(NULL
, DCERPC_AUTH_TYPE_SCHANNEL
);
410 backends
[idx
++] = gensec_security_by_auth_type(NULL
, DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM
);
413 * This is anonymous for now, because we just use it
414 * to set the kerberos state at the moment
416 server_credentials
= cli_credentials_init_anon(tmp_ctx
);
417 if (!server_credentials
) {
418 DEBUG(0, ("auth_generic_prepare: Failed to init server credentials\n"));
422 ok
= cli_credentials_set_conf(server_credentials
, lp_ctx
);
424 DBG_ERR("Failed to set server credentials defaults "
429 if (lp_security() == SEC_ADS
|| USE_KERBEROS_KEYTAB
) {
430 cli_credentials_set_kerberos_state(server_credentials
,
431 CRED_USE_KERBEROS_DESIRED
,
434 cli_credentials_set_kerberos_state(server_credentials
,
435 CRED_USE_KERBEROS_DISABLED
,
439 nt_status
= gensec_server_start(tmp_ctx
, gensec_settings
,
440 auth4_context
, &gensec_security
);
442 if (!NT_STATUS_IS_OK(nt_status
)) {
446 nt_status
= gensec_set_credentials(
447 gensec_security
, server_credentials
);
448 if (!NT_STATUS_IS_OK(nt_status
)) {
453 nt_status
= gensec_set_remote_address(gensec_security
,
455 if (!NT_STATUS_IS_OK(nt_status
)) {
459 nt_status
= gensec_set_local_address(gensec_security
,
461 if (!NT_STATUS_IS_OK(nt_status
)) {
465 nt_status
= gensec_set_target_service_description(gensec_security
,
466 service_description
);
467 if (!NT_STATUS_IS_OK(nt_status
)) {
471 *gensec_security_out
= talloc_move(mem_ctx
, &gensec_security
);
472 nt_status
= NT_STATUS_OK
;
475 nt_status
= NT_STATUS_NO_MEMORY
;
477 TALLOC_FREE(tmp_ctx
);
482 * Check a username and password, and return the final session_info.
483 * We also log the authorization of the session here, just as
484 * gensec_session_info() does.
486 NTSTATUS
auth_check_password_session_info(struct auth4_context
*auth_context
,
488 struct auth_usersupplied_info
*user_info
,
489 struct auth_session_info
**session_info
)
493 uint8_t authoritative
= 1;
494 struct tevent_context
*ev
= NULL
;
495 struct tevent_req
*subreq
= NULL
;
498 ev
= samba_tevent_context_init(talloc_tos());
500 return NT_STATUS_NO_MEMORY
;
503 subreq
= auth_context
->check_ntlm_password_send(ev
, ev
,
506 if (subreq
== NULL
) {
508 return NT_STATUS_NO_MEMORY
;
510 ok
= tevent_req_poll_ntstatus(subreq
, ev
, &nt_status
);
515 nt_status
= auth_context
->check_ntlm_password_recv(subreq
,
521 if (!NT_STATUS_IS_OK(nt_status
)) {
525 nt_status
= auth_context
->generate_session_info(auth_context
,
528 user_info
->client
.account_name
,
529 AUTH_SESSION_INFO_UNIX_TOKEN
|
530 AUTH_SESSION_INFO_DEFAULT_GROUPS
|
531 AUTH_SESSION_INFO_NTLM
,
533 TALLOC_FREE(server_info
);
535 if (!NT_STATUS_IS_OK(nt_status
)) {
540 * This is rather redundant (the authentication has just been
541 * logged, with much the same details), but because we want to
542 * log all authorizations consistently (be they NLTM, NTLMSSP
543 * or krb5) we log this info again as an authorization.
545 log_successful_authz_event(auth_context
->msg_ctx
,
546 auth_context
->lp_ctx
,
547 user_info
->remote_host
,
548 user_info
->local_host
,
549 user_info
->service_description
,
550 user_info
->auth_description
,
551 AUTHZ_TRANSPORT_PROTECTION_SMB
,
553 NULL
/* client_audit_info */,
554 NULL
/* server_audit_info */);