4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
22 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
24 * Copyright (c) 2016 by Delphix. All rights reserved.
36 #include <smbsrv/libsmb.h>
37 #include <smbsrv/libmlsvc.h>
39 #include <smbsrv/smbinfo.h>
40 #include <smbsrv/smb_token.h>
43 static smb_account_t smb_guest
;
44 static smb_account_t smb_domusers
;
45 static rwlock_t smb_logoninit_rwl
;
47 typedef void (*smb_logonop_t
)(smb_logon_t
*, smb_token_t
*);
49 static void smb_logon_local(smb_logon_t
*, smb_token_t
*);
50 static void smb_logon_guest(smb_logon_t
*, smb_token_t
*);
51 static void smb_logon_anon(smb_logon_t
*, smb_token_t
*);
53 static uint32_t smb_token_auth_local(smb_logon_t
*, smb_token_t
*,
56 static uint32_t smb_token_setup_local(smb_passwd_t
*, smb_token_t
*);
57 static uint32_t smb_token_setup_guest(smb_logon_t
*, smb_token_t
*);
58 static uint32_t smb_token_setup_anon(smb_token_t
*token
);
60 static boolean_t
smb_token_is_member(smb_token_t
*, smb_sid_t
*);
61 static uint32_t smb_token_setup_wingrps(smb_token_t
*);
62 static smb_posix_grps_t
*smb_token_create_pxgrps(uid_t
);
64 static void smb_guest_account(char *, size_t);
66 /* Consolidation private function from Network Repository */
67 extern int _getgroupsbymember(const char *, gid_t
[], int, int);
70 smb_token_idmap(smb_token_t
*token
, smb_idmap_batch_t
*sib
)
78 return (IDMAP_ERR_ARG
);
82 if (token
->tkn_flags
& SMB_ATF_ANON
) {
83 token
->tkn_user
.i_id
= UID_NOBODY
;
84 token
->tkn_owner
.i_id
= UID_NOBODY
;
87 id
= &token
->tkn_user
;
88 sim
->sim_id
= &id
->i_id
;
89 stat
= smb_idmap_batch_getid(sib
->sib_idmaph
, sim
++,
90 id
->i_sid
, SMB_IDMAP_USER
);
92 if (stat
!= IDMAP_SUCCESS
)
96 id
= &token
->tkn_owner
;
97 sim
->sim_id
= &id
->i_id
;
98 stat
= smb_idmap_batch_getid(sib
->sib_idmaph
, sim
++,
99 id
->i_sid
, SMB_IDMAP_USER
);
101 if (stat
!= IDMAP_SUCCESS
)
105 /* Primary Group SID */
106 id
= &token
->tkn_primary_grp
;
107 sim
->sim_id
= &id
->i_id
;
108 stat
= smb_idmap_batch_getid(sib
->sib_idmaph
, sim
++, id
->i_sid
,
111 if (stat
!= IDMAP_SUCCESS
)
114 /* Other Windows Group SIDs */
115 for (i
= 0; i
< token
->tkn_win_grps
.i_cnt
; i
++, sim
++) {
116 id
= &token
->tkn_win_grps
.i_ids
[i
];
117 sim
->sim_id
= &id
->i_id
;
118 stat
= smb_idmap_batch_getid(sib
->sib_idmaph
, sim
,
119 id
->i_sid
, SMB_IDMAP_GROUP
);
121 if (stat
!= IDMAP_SUCCESS
)
131 * This will map all the SIDs of the access token to UIDs/GIDs.
133 * Returns 0 upon success. Otherwise, returns -1.
136 smb_token_sids2ids(smb_token_t
*token
)
140 smb_idmap_batch_t sib
;
143 * Number of idmap lookups: user SID, owner SID, primary group SID,
144 * and all Windows group SIDs. Skip user/owner SID for Anonymous.
146 if (token
->tkn_flags
& SMB_ATF_ANON
)
147 nmaps
= token
->tkn_win_grps
.i_cnt
+ 1;
149 nmaps
= token
->tkn_win_grps
.i_cnt
+ 3;
151 stat
= smb_idmap_batch_create(&sib
, nmaps
, SMB_IDMAP_SID2ID
);
152 if (stat
!= IDMAP_SUCCESS
)
155 stat
= smb_token_idmap(token
, &sib
);
156 if (stat
!= IDMAP_SUCCESS
) {
157 smb_idmap_batch_destroy(&sib
);
161 stat
= smb_idmap_batch_getmappings(&sib
);
162 smb_idmap_check("smb_idmap_batch_getmappings", stat
);
163 smb_idmap_batch_destroy(&sib
);
165 return (stat
== IDMAP_SUCCESS
? 0 : -1);
169 * smb_token_create_pxgrps
171 * Setup the POSIX group membership of the access token if the given UID is
172 * a POSIX UID (non-ephemeral). Both the user's primary group and
173 * supplementary groups will be added to the POSIX group array of the access
176 static smb_posix_grps_t
*
177 smb_token_create_pxgrps(uid_t uid
)
180 smb_posix_grps_t
*pgrps
;
181 int ngroups_max
, num
;
184 if ((ngroups_max
= sysconf(_SC_NGROUPS_MAX
)) < 0) {
185 syslog(LOG_ERR
, "smb_logon: failed to get _SC_NGROUPS_MAX");
191 pgrps
= malloc(sizeof (smb_posix_grps_t
));
199 if (pwd
->pw_name
== NULL
) {
200 pgrps
= malloc(sizeof (smb_posix_grps_t
));
205 pgrps
->pg_grps
[0] = pwd
->pw_gid
;
209 gids
= (gid_t
*)malloc(ngroups_max
* sizeof (gid_t
));
213 bzero(gids
, ngroups_max
* sizeof (gid_t
));
215 gids
[0] = pwd
->pw_gid
;
218 * Setup the groups starting at index 1 (the last arg)
221 num
= _getgroupsbymember(pwd
->pw_name
, gids
, ngroups_max
, 1);
224 syslog(LOG_ERR
, "smb_logon: unable "
225 "to get user's supplementary groups");
229 pgrps
= (smb_posix_grps_t
*)malloc(SMB_POSIX_GRPS_SIZE(num
));
231 pgrps
->pg_ngrps
= num
;
232 bcopy(gids
, pgrps
->pg_grps
, num
* sizeof (gid_t
));
242 * Release all of the memory associated with a token structure. Ensure
243 * that the token has been unlinked before calling.
246 smb_token_destroy(smb_token_t
*token
)
249 smb_sid_free(token
->tkn_user
.i_sid
);
250 smb_sid_free(token
->tkn_owner
.i_sid
);
251 smb_sid_free(token
->tkn_primary_grp
.i_sid
);
252 smb_ids_free(&token
->tkn_win_grps
);
253 smb_privset_free(token
->tkn_privileges
);
254 free(token
->tkn_posix_grps
);
255 free(token
->tkn_account_name
);
256 free(token
->tkn_domain_name
);
257 free(token
->tkn_ssnkey
.val
);
258 bzero(token
, sizeof (smb_token_t
));
264 * Token owner should be set to local Administrators group
266 * 1. The logged on user is a member of Domain Admins group
267 * 2. They are a member of local Administrators group
270 smb_token_set_owner(smb_token_t
*token
)
272 #ifdef SMB_SUPPORT_GROUP_OWNER
273 smb_sid_t
*owner_sid
;
275 if (token
->tkn_flags
& SMB_ATF_ADMIN
) {
276 owner_sid
= smb_wka_get_sid("Administrators");
279 owner_sid
= token
->tkn_user
->i_sid
;
282 token
->tkn_owner
.i_sid
= smb_sid_dup(owner_sid
);
284 token
->tkn_owner
.i_sid
= smb_sid_dup(token
->tkn_user
.i_sid
);
287 static smb_privset_t
*
288 smb_token_create_privs(smb_token_t
*token
)
290 smb_privset_t
*privs
;
295 privs
= smb_privset_new();
299 if (smb_lgrp_iteropen(&gi
) != SMB_LGRP_SUCCESS
) {
300 smb_privset_free(privs
);
304 while (smb_lgrp_iterate(&gi
, &grp
) == SMB_LGRP_SUCCESS
) {
305 if (smb_lgrp_is_member(&grp
, token
->tkn_user
.i_sid
))
306 smb_privset_merge(privs
, grp
.sg_privs
);
309 smb_lgrp_iterclose(&gi
);
311 if (token
->tkn_flags
& SMB_ATF_ADMIN
) {
312 char admgrp
[] = "Administrators";
314 rc
= smb_lgrp_getbyname(admgrp
, &grp
);
315 if (rc
== SMB_LGRP_SUCCESS
) {
316 smb_privset_merge(privs
, grp
.sg_privs
);
321 * This privilege is required to view/edit SACL
323 smb_privset_enable(privs
, SE_SECURITY_LUID
);
330 smb_token_set_flags(smb_token_t
*token
)
332 if (smb_token_is_member(token
, smb_wka_get_sid("Administrators")))
333 token
->tkn_flags
|= SMB_ATF_ADMIN
;
335 if (smb_token_is_member(token
, smb_wka_get_sid("Power Users")))
336 token
->tkn_flags
|= SMB_ATF_POWERUSER
;
338 if (smb_token_is_member(token
, smb_wka_get_sid("Backup Operators")))
339 token
->tkn_flags
|= SMB_ATF_BACKUPOP
;
343 * Common token setup for both local and domain users.
344 * This function must be called after the initial setup
347 * Note that the order of calls in this function are important.
349 * Returns B_TRUE for success.
352 smb_token_setup_common(smb_token_t
*token
)
354 smb_token_set_flags(token
);
356 smb_token_set_owner(token
);
357 if (token
->tkn_owner
.i_sid
== NULL
)
361 token
->tkn_privileges
= smb_token_create_privs(token
);
362 if (token
->tkn_privileges
== NULL
)
365 if (smb_token_sids2ids(token
) != 0) {
366 syslog(LOG_ERR
, "%s\\%s: idmap failed",
367 token
->tkn_domain_name
, token
->tkn_account_name
);
372 token
->tkn_posix_grps
= smb_token_create_pxgrps(token
->tkn_user
.i_id
);
374 return (smb_token_valid(token
));
382 (void) rw_wrlock(&smb_logoninit_rwl
);
383 status
= smb_sam_lookup_name(NULL
, "guest", SidTypeUser
, &smb_guest
);
384 if (status
!= NT_STATUS_SUCCESS
) {
385 (void) rw_unlock(&smb_logoninit_rwl
);
389 status
= smb_sam_lookup_name(NULL
, "domain users", SidTypeGroup
,
391 if (status
!= NT_STATUS_SUCCESS
) {
392 smb_account_free(&smb_guest
);
393 bzero(&smb_guest
, sizeof (smb_account_t
));
394 (void) rw_unlock(&smb_logoninit_rwl
);
398 (void) rw_unlock(&smb_logoninit_rwl
);
405 (void) rw_wrlock(&smb_logoninit_rwl
);
406 smb_account_free(&smb_guest
);
407 smb_account_free(&smb_domusers
);
408 bzero(&smb_guest
, sizeof (smb_account_t
));
409 bzero(&smb_domusers
, sizeof (smb_account_t
));
410 (void) rw_unlock(&smb_logoninit_rwl
);
414 * Perform user authentication.
416 * The dispatched functions must only update the user_info status if they
417 * attempt to authenticate the user.
419 * On success, a pointer to a new access token is returned.
422 smb_logon(smb_logon_t
*user_info
)
424 static smb_logonop_t ops
[] = {
430 smb_token_t
*token
= NULL
;
432 int n_op
= (sizeof (ops
) / sizeof (ops
[0]));
435 user_info
->lg_secmode
= smb_config_get_secmode();
436 user_info
->lg_status
= NT_STATUS_NO_SUCH_USER
;
438 if (smb_domain_lookup_name(user_info
->lg_e_domain
, &domain
))
439 user_info
->lg_domain_type
= domain
.di_type
;
441 user_info
->lg_domain_type
= SMB_DOMAIN_NULL
;
443 if ((token
= calloc(1, sizeof (smb_token_t
))) == NULL
) {
444 syslog(LOG_ERR
, "logon[%s\\%s]: %m",
445 user_info
->lg_e_domain
, user_info
->lg_e_username
);
449 for (i
= 0; i
< n_op
; ++i
) {
450 (*ops
[i
])(user_info
, token
);
452 if (user_info
->lg_status
== NT_STATUS_SUCCESS
)
456 if (user_info
->lg_status
== NT_STATUS_SUCCESS
) {
457 if (smb_token_setup_common(token
))
461 smb_token_destroy(token
);
466 * If the user has an entry in the local database, attempt local authentication.
468 * In domain mode, we try to exclude domain accounts, which we do by only
469 * accepting local or null (blank) domain names here. Some clients (Mac OS)
470 * don't always send the domain name.
472 * If we are not going to attempt authentication, this function must return
473 * without updating the status.
476 smb_logon_local(smb_logon_t
*user_info
, smb_token_t
*token
)
478 char guest
[SMB_USERNAME_MAXLEN
];
482 if (user_info
->lg_secmode
== SMB_SECMODE_DOMAIN
) {
483 if ((user_info
->lg_domain_type
!= SMB_DOMAIN_LOCAL
) &&
484 (user_info
->lg_domain_type
!= SMB_DOMAIN_NULL
))
489 * If the requested account name is "guest" (or whatever
490 * our guest account is named) then don't handle it here.
491 * Let this request fall through to smb_logon_guest().
493 smb_guest_account(guest
, SMB_USERNAME_MAXLEN
);
494 if (smb_strcasecmp(guest
, user_info
->lg_e_username
, 0) == 0)
497 status
= smb_token_auth_local(user_info
, token
, &smbpw
);
498 if (status
== NT_STATUS_SUCCESS
)
499 status
= smb_token_setup_local(&smbpw
, token
);
501 user_info
->lg_status
= status
;
505 * Guest authentication. This may be a local guest account or the guest
506 * account may be mapped to a local account. These accounts are regular
507 * accounts with normal password protection.
509 * Only proceed with a guest logon if previous logon options have resulted
512 * If we are not going to attempt authentication, this function must return
513 * without updating the status.
516 smb_logon_guest(smb_logon_t
*user_info
, smb_token_t
*token
)
518 char guest
[SMB_USERNAME_MAXLEN
];
522 if (user_info
->lg_status
!= NT_STATUS_NO_SUCH_USER
)
525 /* Get the name of the guest account. */
526 smb_guest_account(guest
, SMB_USERNAME_MAXLEN
);
528 /* Does the guest account exist? */
529 if (smb_pwd_getpwnam(guest
, &smbpw
) == NULL
)
532 /* Is it enabled? (empty p/w is OK) */
533 if (smbpw
.pw_flags
& SMB_PWF_DISABLE
)
537 * OK, give the client a guest logon. Note that on entry,
538 * lg_e_username is typically something other than "guest"
539 * so we need to set the effective username when createing
542 temp
= user_info
->lg_e_username
;
543 user_info
->lg_e_username
= guest
;
544 user_info
->lg_status
= smb_token_setup_guest(user_info
, token
);
545 user_info
->lg_e_username
= temp
;
549 * If user_info represents an anonymous user then setup the token.
550 * Otherwise return without updating the status.
553 smb_logon_anon(smb_logon_t
*user_info
, smb_token_t
*token
)
555 if (user_info
->lg_flags
& SMB_ATF_ANON
)
556 user_info
->lg_status
= smb_token_setup_anon(token
);
560 * Try both LM hash and NT hashes with user's password(s) to authenticate
564 smb_token_auth_local(smb_logon_t
*user_info
, smb_token_t
*token
,
568 uint32_t status
= NT_STATUS_SUCCESS
;
570 if (smb_pwd_getpwnam(user_info
->lg_e_username
, smbpw
) == NULL
)
571 return (NT_STATUS_NO_SUCH_USER
);
573 if (smbpw
->pw_flags
& SMB_PWF_DISABLE
)
574 return (NT_STATUS_ACCOUNT_DISABLED
);
576 if ((smbpw
->pw_flags
& (SMB_PWF_LM
| SMB_PWF_NT
)) == 0) {
578 * The SMB passwords have not been set.
579 * Return an error that suggests the
580 * password needs to be set.
582 return (NT_STATUS_PASSWORD_EXPIRED
);
585 token
->tkn_ssnkey
.val
= malloc(SMBAUTH_SESSION_KEY_SZ
);
586 if (token
->tkn_ssnkey
.val
== NULL
)
587 return (NT_STATUS_NO_MEMORY
);
588 token
->tkn_ssnkey
.len
= SMBAUTH_SESSION_KEY_SZ
;
590 ok
= smb_auth_validate(
592 user_info
->lg_domain
,
593 user_info
->lg_username
,
594 user_info
->lg_challenge_key
.val
,
595 user_info
->lg_challenge_key
.len
,
596 user_info
->lg_nt_password
.val
,
597 user_info
->lg_nt_password
.len
,
598 user_info
->lg_lm_password
.val
,
599 user_info
->lg_lm_password
.len
,
600 token
->tkn_ssnkey
.val
);
602 return (NT_STATUS_SUCCESS
);
604 free(token
->tkn_ssnkey
.val
);
605 token
->tkn_ssnkey
.val
= NULL
;
606 token
->tkn_ssnkey
.len
= 0;
608 status
= NT_STATUS_WRONG_PASSWORD
;
609 syslog(LOG_NOTICE
, "logon[%s\\%s]: %s",
610 user_info
->lg_e_domain
, user_info
->lg_e_username
,
611 xlate_nt_status(status
));
617 * Setup an access token for the specified local user.
620 smb_token_setup_local(smb_passwd_t
*smbpw
, smb_token_t
*token
)
623 smb_idmap_batch_t sib
;
624 smb_idmap_t
*umap
, *gmap
;
627 char nbname
[NETBIOS_NAME_SZ
];
629 (void) smb_getnetbiosname(nbname
, sizeof (nbname
));
630 token
->tkn_account_name
= strdup(smbpw
->pw_name
);
631 token
->tkn_domain_name
= strdup(nbname
);
633 if (token
->tkn_account_name
== NULL
||
634 token
->tkn_domain_name
== NULL
)
635 return (NT_STATUS_NO_MEMORY
);
637 if (getpwuid_r(smbpw
->pw_uid
, &pw
, pwbuf
, sizeof (pwbuf
)) == NULL
)
638 return (NT_STATUS_NO_SUCH_USER
);
640 /* Get the SID for user's uid & gid */
641 stat
= smb_idmap_batch_create(&sib
, 2, SMB_IDMAP_ID2SID
);
642 if (stat
!= IDMAP_SUCCESS
)
643 return (NT_STATUS_INTERNAL_ERROR
);
645 umap
= &sib
.sib_maps
[0];
646 stat
= smb_idmap_batch_getsid(sib
.sib_idmaph
, umap
, pw
.pw_uid
,
649 if (stat
!= IDMAP_SUCCESS
) {
650 smb_idmap_batch_destroy(&sib
);
651 return (NT_STATUS_INTERNAL_ERROR
);
654 gmap
= &sib
.sib_maps
[1];
655 stat
= smb_idmap_batch_getsid(sib
.sib_idmaph
, gmap
, pw
.pw_gid
,
658 if (stat
!= IDMAP_SUCCESS
) {
659 smb_idmap_batch_destroy(&sib
);
660 return (NT_STATUS_INTERNAL_ERROR
);
663 if (smb_idmap_batch_getmappings(&sib
) != IDMAP_SUCCESS
)
664 return (NT_STATUS_INTERNAL_ERROR
);
666 token
->tkn_user
.i_sid
= smb_sid_dup(umap
->sim_sid
);
667 token
->tkn_primary_grp
.i_sid
= smb_sid_dup(gmap
->sim_sid
);
669 smb_idmap_batch_destroy(&sib
);
671 if (token
->tkn_user
.i_sid
== NULL
||
672 token
->tkn_primary_grp
.i_sid
== NULL
)
673 return (NT_STATUS_NO_MEMORY
);
675 return (smb_token_setup_wingrps(token
));
679 * Setup access token for guest connections
682 smb_token_setup_guest(smb_logon_t
*user_info
, smb_token_t
*token
)
684 token
->tkn_account_name
= strdup(user_info
->lg_e_username
);
686 (void) rw_rdlock(&smb_logoninit_rwl
);
687 token
->tkn_domain_name
= strdup(smb_guest
.a_domain
);
688 token
->tkn_user
.i_sid
= smb_sid_dup(smb_guest
.a_sid
);
689 token
->tkn_primary_grp
.i_sid
= smb_sid_dup(smb_domusers
.a_sid
);
690 (void) rw_unlock(&smb_logoninit_rwl
);
691 token
->tkn_flags
= SMB_ATF_GUEST
;
693 if (token
->tkn_account_name
== NULL
||
694 token
->tkn_domain_name
== NULL
||
695 token
->tkn_user
.i_sid
== NULL
||
696 token
->tkn_primary_grp
.i_sid
== NULL
)
697 return (NT_STATUS_NO_MEMORY
);
699 return (smb_token_setup_wingrps(token
));
703 * Setup access token for anonymous connections
706 smb_token_setup_anon(smb_token_t
*token
)
710 token
->tkn_account_name
= strdup("Anonymous");
711 token
->tkn_domain_name
= strdup("NT Authority");
712 user_sid
= smb_wka_get_sid("Anonymous");
713 token
->tkn_user
.i_sid
= smb_sid_dup(user_sid
);
714 token
->tkn_primary_grp
.i_sid
= smb_sid_dup(user_sid
);
715 token
->tkn_flags
= SMB_ATF_ANON
;
717 if (token
->tkn_account_name
== NULL
||
718 token
->tkn_domain_name
== NULL
||
719 token
->tkn_user
.i_sid
== NULL
||
720 token
->tkn_primary_grp
.i_sid
== NULL
)
721 return (NT_STATUS_NO_MEMORY
);
723 return (smb_token_setup_wingrps(token
));
729 * Return a pointer to the user SID in the specified token. A null
730 * pointer indicates an error.
733 smb_token_user_sid(smb_token_t
*token
)
735 return ((token
) ? token
->tkn_user
.i_sid
: NULL
);
739 * smb_token_group_sid
741 * Return a pointer to the group SID as indicated by the iterator.
742 * Setting the iterator to 0 before calling this function will return
743 * the first group, which will always be the primary group. The
744 * iterator will be incremented before returning the SID so that this
745 * function can be used to cycle through the groups. The caller can
746 * adjust the iterator as required between calls to obtain any specific
749 * On success a pointer to the appropriate group SID will be returned.
750 * Otherwise a null pointer will be returned.
753 smb_token_group_sid(smb_token_t
*token
, int *iterator
)
757 if (token
== NULL
|| iterator
== NULL
)
760 if (token
->tkn_win_grps
.i_ids
== NULL
)
765 if (index
< 0 || index
>= token
->tkn_win_grps
.i_cnt
)
769 return (token
->tkn_win_grps
.i_ids
[index
].i_sid
);
773 * smb_token_is_member
775 * This function will determine whether or not the specified SID is a
776 * member of a token. The user SID and all group SIDs are tested.
777 * Returns 1 if the SID is a member of the token. Otherwise returns 0.
780 smb_token_is_member(smb_token_t
*token
, smb_sid_t
*sid
)
785 if (token
== NULL
|| sid
== NULL
)
788 tsid
= smb_token_user_sid(token
);
790 if (smb_sid_cmp(tsid
, sid
))
793 tsid
= smb_token_group_sid(token
, &iterator
);
802 * Diagnostic routine to write the contents of a token to the log.
805 smb_token_log(smb_token_t
*token
)
809 smb_posix_grps_t
*x_grps
;
810 char sidstr
[SMB_SID_STRSZ
];
816 syslog(LOG_DEBUG
, "Token for %s\\%s",
817 (token
->tkn_domain_name
) ? token
->tkn_domain_name
: "-NULL-",
818 (token
->tkn_account_name
) ? token
->tkn_account_name
: "-NULL-");
820 syslog(LOG_DEBUG
, " User->Attr: %d", token
->tkn_user
.i_attrs
);
821 smb_sid_tostr((smb_sid_t
*)token
->tkn_user
.i_sid
, sidstr
);
822 syslog(LOG_DEBUG
, " User->Sid: %s (id=%u)", sidstr
,
823 token
->tkn_user
.i_id
);
825 smb_sid_tostr((smb_sid_t
*)token
->tkn_owner
.i_sid
, sidstr
);
826 syslog(LOG_DEBUG
, " Ownr->Sid: %s (id=%u)",
827 sidstr
, token
->tkn_owner
.i_id
);
829 smb_sid_tostr((smb_sid_t
*)token
->tkn_primary_grp
.i_sid
, sidstr
);
830 syslog(LOG_DEBUG
, " PGrp->Sid: %s (id=%u)",
831 sidstr
, token
->tkn_primary_grp
.i_id
);
833 w_grps
= &token
->tkn_win_grps
;
835 syslog(LOG_DEBUG
, " Windows groups: %d", w_grps
->i_cnt
);
837 for (i
= 0; i
< w_grps
->i_cnt
; ++i
, grp
++) {
839 " Grp[%d].Attr:%d", i
, grp
->i_attrs
);
840 if (grp
->i_sid
!= NULL
) {
841 smb_sid_tostr((smb_sid_t
*)grp
->i_sid
, sidstr
);
843 " Grp[%d].Sid: %s (id=%u)", i
, sidstr
,
848 syslog(LOG_DEBUG
, " No Windows groups");
851 x_grps
= token
->tkn_posix_grps
;
853 syslog(LOG_DEBUG
, " Solaris groups: %d", x_grps
->pg_ngrps
);
854 for (i
= 0; i
< x_grps
->pg_ngrps
; i
++)
855 syslog(LOG_DEBUG
, " %u", x_grps
->pg_grps
[i
]);
857 syslog(LOG_DEBUG
, " No Solaris groups");
860 if (token
->tkn_privileges
)
861 smb_privset_log(token
->tkn_privileges
);
863 syslog(LOG_DEBUG
, " No privileges");
867 * Sets up local and well-known group membership for the given
868 * token. Two assumptions have been made here:
870 * a) token already contains a valid user SID so that group
871 * memberships can be established
873 * b) token belongs to a local or anonymous user
876 smb_token_setup_wingrps(smb_token_t
*token
)
883 * We always want the user's primary group in the list
887 if ((tkn_grps
.i_ids
= malloc(sizeof (smb_id_t
))) == NULL
)
888 return (NT_STATUS_NO_MEMORY
);
890 tkn_grps
.i_ids
->i_sid
= smb_sid_dup(token
->tkn_primary_grp
.i_sid
);
891 tkn_grps
.i_ids
->i_attrs
= token
->tkn_primary_grp
.i_attrs
;
892 if (tkn_grps
.i_ids
->i_sid
== NULL
) {
893 smb_ids_free(&tkn_grps
);
894 return (NT_STATUS_NO_MEMORY
);
897 status
= smb_sam_usr_groups(token
->tkn_user
.i_sid
, &tkn_grps
);
898 if (status
!= NT_STATUS_SUCCESS
) {
899 smb_ids_free(&tkn_grps
);
903 status
= smb_wka_token_groups(token
->tkn_flags
, &tkn_grps
);
904 if (status
!= NT_STATUS_SUCCESS
) {
905 smb_ids_free(&tkn_grps
);
909 token
->tkn_win_grps
= tkn_grps
;
914 * Returns the guest account name in the provided buffer.
916 * By default the name would be "guest" unless there's
917 * a idmap name-based rule which maps the guest to a local
918 * Solaris user in which case the name of that user is
922 smb_guest_account(char *guest
, size_t buflen
)
930 /* default Guest account name */
931 (void) rw_rdlock(&smb_logoninit_rwl
);
932 (void) strlcpy(guest
, smb_guest
.a_name
, buflen
);
934 idtype
= SMB_IDMAP_USER
;
935 stat
= smb_idmap_getid(smb_guest
.a_sid
, &guest_uid
, &idtype
);
936 (void) rw_unlock(&smb_logoninit_rwl
);
938 if (stat
!= IDMAP_SUCCESS
)
941 /* If Ephemeral ID return the default name */
942 if (IDMAP_ID_IS_EPHEMERAL(guest_uid
))
945 if (getpwuid_r(guest_uid
, &pw
, pwbuf
, sizeof (pwbuf
)) == NULL
)
948 (void) strlcpy(guest
, pw
.pw_name
, buflen
);