source3/auth/auth_util.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    Authentication utility functions
   5    Copyright (C) Andrew Tridgell 1992-1998
   6    Copyright (C) Andrew Bartlett 2001
   7    Copyright (C) Jeremy Allison 2000-2001
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25
  26 extern fstring remote_machine;
  27 extern pstring global_myname;
  28
  29 /****************************************************************************
  30  Create a UNIX user on demand.
  31 ****************************************************************************/
  32
  33 static int smb_create_user(const char *unix_user, const char *homedir)
  34 {
  35         pstring add_script;
  36         int ret;
  37
  38         pstrcpy(add_script, lp_adduser_script());
  39         if (! *add_script)
  40                 return -1;
  41         all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
  42         if (homedir)
  43                 all_string_sub(add_script, "%H", homedir, sizeof(pstring));
  44         ret = smbrun(add_script,NULL);
  45         DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
  46         return ret;
  47 }
  48
  49 /****************************************************************************
  50  Delete a UNIX user on demand.
  51 ****************************************************************************/
  52
  53 int smb_delete_user(const char *unix_user)
  54 {
  55         pstring del_script;
  56         int ret;
  57
  58         pstrcpy(del_script, lp_deluser_script());
  59         if (! *del_script)
  60                 return -1;
  61         all_string_sub(del_script, "%u", unix_user, sizeof(pstring));
  62         ret = smbrun(del_script,NULL);
  63         DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
  64         return ret;
  65 }
  66
  67 /****************************************************************************
  68  Add and Delete UNIX users on demand, based on NTSTATUS codes.
  69 ****************************************************************************/
  70
  71 void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
  72 {
  73         struct passwd *pwd=NULL;
  74
  75         if (NT_STATUS_IS_OK(nt_status)) {
  76
  77                 if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
  78
  79                         /*
  80                          * User validated ok against Domain controller.
  81                          * If the admin wants us to try and create a UNIX
  82                          * user on the fly, do so.
  83                          */
  84
  85                         if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
  86                                 smb_create_user(user_info->internal_username.str, NULL);
  87                         }
  88                 }
  89         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
  90                 /*
  91                  * User failed to validate ok against Domain controller.
  92                  * If the failure was "user doesn't exist" and admin
  93                  * wants us to try and delete that UNIX user on the fly,
  94                  * do so.
  95                  */
  96                 if (lp_deluser_script()) {
  97                         smb_delete_user(user_info->internal_username.str);
  98                 }
  99         }
 100 }
 101
 102 /****************************************************************************
 103  Create an auth_usersupplied_data structure
 104 ****************************************************************************/
 105
 106 static BOOL make_user_info(auth_usersupplied_info **user_info,
 107                            const char *smb_name,
 108                            const char *internal_username,
 109                            const char *client_domain,
 110                            const char *domain,
 111                            const char *wksta_name,
 112                            DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
 113                            DATA_BLOB plaintext,
 114                            uint32 auth_flags, BOOL encrypted)
 115 {
 116
 117         DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
 118
 119         *user_info = malloc(sizeof(**user_info));
 120         if (!user_info) {
 121                 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info)));
 122                 return False;
 123         }
 124
 125         ZERO_STRUCTP(*user_info);
 126
 127         DEBUG(5,("makeing strings for %s's user_info struct\n", internal_username));
 128
 129         (*user_info)->smb_name.str = strdup(smb_name);
 130         if ((*user_info)->smb_name.str) {
 131                 (*user_info)->smb_name.len = strlen(smb_name);
 132         } else {
 133                 free_user_info(user_info);
 134                 return False;
 135         }
 136
 137         (*user_info)->internal_username.str = strdup(internal_username);
 138         if ((*user_info)->internal_username.str) {
 139                 (*user_info)->internal_username.len = strlen(internal_username);
 140         } else {
 141                 free_user_info(user_info);
 142                 return False;
 143         }
 144
 145         (*user_info)->domain.str = strdup(domain);
 146         if ((*user_info)->domain.str) {
 147                 (*user_info)->domain.len = strlen(domain);
 148         } else {
 149                 free_user_info(user_info);
 150                 return False;
 151         }
 152
 153         (*user_info)->client_domain.str = strdup(client_domain);
 154         if ((*user_info)->client_domain.str) {
 155                 (*user_info)->client_domain.len = strlen(client_domain);
 156         } else {
 157                 free_user_info(user_info);
 158                 return False;
 159         }
 160
 161         (*user_info)->wksta_name.str = strdup(wksta_name);
 162         if ((*user_info)->wksta_name.str) {
 163                 (*user_info)->wksta_name.len = strlen(wksta_name);
 164         } else {
 165                 free_user_info(user_info);
 166                 return False;
 167         }
 168
 169         DEBUG(5,("makeing blobs for %s's user_info struct\n", internal_username));
 170
 171         (*user_info)->lm_resp = data_blob(lm_pwd.data, lm_pwd.length);
 172         (*user_info)->nt_resp = data_blob(nt_pwd.data, nt_pwd.length);
 173         (*user_info)->plaintext_password = data_blob(plaintext.data, plaintext.length);
 174
 175         (*user_info)->encrypted = encrypted;
 176         (*user_info)->auth_flags = auth_flags;
 177
 178         DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
 179
 180         return True;
 181 }
 182
 183 /****************************************************************************
 184  Create an auth_usersupplied_data structure after appropriate mapping.
 185 ****************************************************************************/
 186
 187 BOOL make_user_info_map(auth_usersupplied_info **user_info,
 188                         const char *smb_name,
 189                         const char *client_domain,
 190                         const char *wksta_name,
 191                         DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
 192                         DATA_BLOB plaintext,
 193                         uint32 ntlmssp_flags, BOOL encrypted)
 194 {
 195         const char *domain;
 196         fstring internal_username;
 197         fstrcpy(internal_username, smb_name);
 198         map_username(internal_username);
 199
 200         if (lp_allow_trusted_domains()) {
 201                 /* the client could have given us a workstation name
 202                    or other crap for the workgroup - we really need a
 203                    way of telling if this domain name is one of our
 204                    trusted domain names
 205
 206                    The way I do it here is by checking if the fully
 207                    qualified username exists. This is rather reliant
 208                    on winbind, but until we have a better method this
 209                    will have to do
 210                 */
 211
 212                 domain = client_domain;
 213
 214                 if ((smb_name) && (*smb_name)) { /* Don't do this for guests */
 215                         char *user;
 216                         asprintf(&user, "%s%s%s",
 217                                  client_domain, lp_winbind_separator(),
 218                                  smb_name);
 219                         if (Get_Pwnam(user) == NULL) {
 220                                 domain = lp_workgroup();
 221                         }
 222                         free(user);
 223                 }
 224         } else {
 225                 domain = lp_workgroup();
 226         }
 227
 228         return make_user_info(user_info,
 229                               smb_name, internal_username,
 230                               client_domain, domain,
 231                               wksta_name,
 232                               lm_pwd, nt_pwd,
 233                               plaintext,
 234                               ntlmssp_flags, encrypted);
 235
 236 }
 237
 238 /****************************************************************************
 239  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 240  Decrypt and encrypt the passwords.
 241 ****************************************************************************/
 242
 243 BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
 244                                      const char *smb_name,
 245                                      const char *client_domain,
 246                                      const char *wksta_name,
 247                                      const uchar *lm_network_pwd, int lm_pwd_len,
 248                                      const uchar *nt_network_pwd, int nt_pwd_len)
 249 {
 250         BOOL ret;
 251         DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
 252         DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
 253         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 254         uint32 auth_flags = AUTH_FLAG_NONE;
 255
 256         if (lm_pwd_len)
 257                 auth_flags |= AUTH_FLAG_LM_RESP;
 258         if (nt_pwd_len == 24) {
 259                 auth_flags |= AUTH_FLAG_NTLM_RESP;
 260         } else if (nt_pwd_len != 0) {
 261                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
 262         }
 263
 264         ret = make_user_info_map(user_info,
 265                                  smb_name, client_domain,
 266                                  wksta_name,
 267                                  lm_blob, nt_blob,
 268                                  plaintext_blob,
 269                                  auth_flags, True);
 270
 271         data_blob_free(&lm_blob);
 272         data_blob_free(&nt_blob);
 273         return ret;
 274 }
 275
 276 /****************************************************************************
 277  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 278  Decrypt and encrypt the passwords.
 279 ****************************************************************************/
 280
 281 BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
 282                                          const char *smb_name,
 283                                          const char *client_domain,
 284                                          const char *wksta_name,
 285                                          const uchar chal[8],
 286                                          const uchar lm_interactive_pwd[16],
 287                                          const uchar nt_interactive_pwd[16],
 288                                          const uchar *dc_sess_key)
 289 {
 290         char lm_pwd[16];
 291         char nt_pwd[16];
 292         unsigned char local_lm_response[24];
 293         unsigned char local_nt_response[24];
 294         unsigned char key[16];
 295         uint32 auth_flags = AUTH_FLAG_NONE;
 296
 297         ZERO_STRUCT(key);
 298         memcpy(key, dc_sess_key, 8);
 299
 300         if (lm_interactive_pwd) memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
 301         if (nt_interactive_pwd) memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
 302
 303 #ifdef DEBUG_PASSWORD
 304         DEBUG(100,("key:"));
 305         dump_data(100, (char *)key, sizeof(key));
 306
 307         DEBUG(100,("lm owf password:"));
 308         dump_data(100, lm_pwd, sizeof(lm_pwd));
 309
 310         DEBUG(100,("nt owf password:"));
 311         dump_data(100, nt_pwd, sizeof(nt_pwd));
 312 #endif
 313
 314         SamOEMhash((uchar *)lm_pwd, key, sizeof(lm_pwd));
 315         SamOEMhash((uchar *)nt_pwd, key, sizeof(nt_pwd));
 316
 317 #ifdef DEBUG_PASSWORD
 318         DEBUG(100,("decrypt of lm owf password:"));
 319         dump_data(100, lm_pwd, sizeof(lm_pwd));
 320
 321         DEBUG(100,("decrypt of nt owf password:"));
 322         dump_data(100, nt_pwd, sizeof(nt_pwd));
 323 #endif
 324
 325         SMBOWFencrypt((const unsigned char *)lm_pwd, chal, local_lm_response);
 326         SMBOWFencrypt((const unsigned char *)nt_pwd, chal, local_nt_response);
 327
 328         /* Password info parinoia */
 329         ZERO_STRUCT(lm_pwd);
 330         ZERO_STRUCT(nt_pwd);
 331         ZERO_STRUCT(key);
 332
 333         {
 334                 BOOL ret;
 335                 DATA_BLOB local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
 336                 DATA_BLOB local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
 337                 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 338
 339                 if (lm_interactive_pwd)
 340                         auth_flags |= AUTH_FLAG_LM_RESP;
 341                 if (nt_interactive_pwd)
 342                         auth_flags |= AUTH_FLAG_NTLM_RESP;
 343
 344                 ret = make_user_info_map(user_info,
 345                                          smb_name, client_domain,
 346                                          wksta_name,
 347                                          local_lm_blob,
 348                                          local_nt_blob,
 349                                          plaintext_blob,
 350                                          auth_flags, True);
 351
 352                 data_blob_free(&local_lm_blob);
 353                 data_blob_free(&local_nt_blob);
 354                 return ret;
 355         }
 356 }
 357
 358
 359 /****************************************************************************
 360  Create an auth_usersupplied_data structure
 361 ****************************************************************************/
 362
 363 BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
 364                               const char *smb_name,
 365                               const char *client_domain,
 366                               const uint8 chal[8],
 367                               DATA_BLOB plaintext_password)
 368 {
 369
 370         DATA_BLOB local_lm_blob;
 371         DATA_BLOB local_nt_blob;
 372         BOOL ret = False;
 373         uint32 auth_flags = AUTH_FLAG_NONE;
 374
 375         /*
 376          * Not encrypted - do so.
 377          */
 378
 379         DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
 380
 381         if (plaintext_password.data) {
 382                 unsigned char local_lm_response[24];
 383
 384 #ifdef DEBUG_PASSWORD
 385                 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password.length));
 386                 dump_data(100, plaintext_password.data, plaintext_password.length);
 387 #endif
 388
 389                 SMBencrypt( (const uchar *)plaintext_password.data, (const uchar*)chal, local_lm_response);
 390                 local_lm_blob = data_blob(local_lm_response, 24);
 391
 392                 /* We can't do an NT hash here, as the password needs to be
 393                    case insensitive */
 394                 local_nt_blob = data_blob(NULL, 0);
 395
 396                 auth_flags = (AUTH_FLAG_PLAINTEXT | AUTH_FLAG_LM_RESP);
 397         } else {
 398                 local_lm_blob = data_blob(NULL, 0);
 399                 local_nt_blob = data_blob(NULL, 0);
 400         }
 401
 402         ret = make_user_info_map(user_info, smb_name,
 403                                  client_domain,
 404                                  remote_machine,
 405                                  local_lm_blob,
 406                                  local_nt_blob,
 407                                  plaintext_password,
 408                                  auth_flags, False);
 409
 410         data_blob_free(&local_lm_blob);
 411         return ret;
 412 }
 413
 414 /****************************************************************************
 415  Create an auth_usersupplied_data structure
 416 ****************************************************************************/
 417
 418 BOOL make_user_info_for_reply_enc(auth_usersupplied_info **user_info,
 419                                   const char *smb_name,
 420                                   const char *client_domain,
 421                                   DATA_BLOB lm_resp, DATA_BLOB nt_resp)
 422 {
 423         uint32 auth_flags = AUTH_FLAG_NONE;
 424
 425         DATA_BLOB no_plaintext_blob = data_blob(NULL, 0);
 426
 427         if (lm_resp.length == 24) {
 428                 auth_flags |= AUTH_FLAG_LM_RESP;
 429         }
 430         if (nt_resp.length == 0) {
 431         } else if (nt_resp.length == 24) {
 432                 auth_flags |= AUTH_FLAG_NTLM_RESP;
 433         } else {
 434                 auth_flags |= AUTH_FLAG_NTLMv2_RESP;
 435         }
 436
 437         return make_user_info_map(user_info, smb_name,
 438                                  client_domain,
 439                                  remote_machine,
 440                                  lm_resp,
 441                                  nt_resp,
 442                                  no_plaintext_blob,
 443                                  auth_flags, True);
 444 }
 445
 446 /****************************************************************************
 447  Create a guest user_info blob, for anonymous authenticaion.
 448 ****************************************************************************/
 449
 450 BOOL make_user_info_guest(auth_usersupplied_info **user_info)
 451 {
 452         DATA_BLOB lm_blob = data_blob(NULL, 0);
 453         DATA_BLOB nt_blob = data_blob(NULL, 0);
 454         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 455         uint32 auth_flags = AUTH_FLAG_NONE;
 456
 457         return make_user_info(user_info,
 458                               "","",
 459                               "","",
 460                               "",
 461                               nt_blob, lm_blob,
 462                               plaintext_blob,
 463                               auth_flags, True);
 464 }
 465
 466 /***************************************************************************
 467  Make a user_info struct
 468 ***************************************************************************/
 469
 470 BOOL make_server_info(auth_serversupplied_info **server_info)
 471 {
 472         *server_info = malloc(sizeof(**server_info));
 473         if (!*server_info) {
 474                 DEBUG(0,("make_server_info: malloc failed!\n"));
 475                 return False;
 476         }
 477         ZERO_STRUCTP(*server_info);
 478         return True;
 479 }
 480
 481 /***************************************************************************
 482  Make (and fill) a user_info struct from a SAM_ACCOUNT
 483 ***************************************************************************/
 484
 485 BOOL make_server_info_sam(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
 486 {
 487         if (!make_server_info(server_info)) {
 488                 return False;
 489         }
 490
 491         (*server_info)->sam_fill_level = SAM_FILL_ALL;
 492         (*server_info)->sam_account = sampass;
 493
 494         DEBUG(5,("make_server_info_sam: made server info for user %s\n",
 495                  pdb_get_username((*server_info)->sam_account)));
 496         return True;
 497 }
 498
 499 /***************************************************************************
 500  Make (and fill) a user_info struct from a 'struct passwd' by conversion
 501  to a SAM_ACCOUNT
 502 ***************************************************************************/
 503
 504 BOOL make_server_info_pw(auth_serversupplied_info **server_info, const struct passwd *pwd)
 505 {
 506         SAM_ACCOUNT *sampass = NULL;
 507         if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sampass, pwd))) {
 508                 return False;
 509         }
 510         return make_server_info_sam(server_info, sampass);
 511 }
 512
 513 /***************************************************************************
 514  Free a user_info struct
 515 ***************************************************************************/
 516
 517 void free_user_info(auth_usersupplied_info **user_info)
 518 {
 519         DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
 520         if (*user_info != NULL) {
 521                 if ((*user_info)->smb_name.str) {
 522                         DEBUG(10,("structure was created for %s\n", (*user_info)->smb_name.str));
 523                 }
 524                 SAFE_FREE((*user_info)->smb_name.str);
 525                 SAFE_FREE((*user_info)->internal_username.str);
 526                 SAFE_FREE((*user_info)->client_domain.str);
 527                 SAFE_FREE((*user_info)->domain.str);
 528                 SAFE_FREE((*user_info)->wksta_name.str);
 529                 data_blob_free(&(*user_info)->lm_resp);
 530                 data_blob_free(&(*user_info)->nt_resp);
 531                 SAFE_FREE((*user_info)->interactive_password);
 532                 data_blob_clear_free(&(*user_info)->plaintext_password);
 533                 ZERO_STRUCT(**user_info);
 534         }
 535         SAFE_FREE(*user_info);
 536 }
 537
 538 /***************************************************************************
 539  Clear out a server_info struct that has been allocated
 540 ***************************************************************************/
 541
 542 void free_server_info(auth_serversupplied_info **server_info)
 543 {
 544         if (*server_info != NULL) {
 545                 pdb_free_sam(&(*server_info)->sam_account);
 546
 547                 /* call pam_end here, unless we know we are keeping it */
 548                 delete_nt_token( &(*server_info)->ptok );
 549                 ZERO_STRUCT(**server_info);
 550         }
 551         SAFE_FREE(*server_info);
 552 }
 553
 554 /***************************************************************************
 555  Make a server_info struct for a guest user
 556 ***************************************************************************/
 557
 558 BOOL make_server_info_guest(auth_serversupplied_info **server_info)
 559 {
 560         struct passwd *pass = getpwnam_alloc(lp_guestaccount());
 561
 562         if (pass) {
 563                 if (!make_server_info_pw(server_info, pass)) {
 564                         passwd_free(&pass);
 565                         return False;
 566                 }
 567                 (*server_info)->guest = True;
 568                 passwd_free(&pass);
 569                 return True;
 570         }
 571         DEBUG(0,("make_server_info_guest: getpwnam_alloc() failed on guest account!\n"));
 572         return False;
 573 }
 574
 575 /***************************************************************************
 576  Make an auth_methods struct
 577 ***************************************************************************/
 578
 579 BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method)
 580 {
 581         if (!auth_context) {
 582                 smb_panic("no auth_context supplied to make_auth_methods()!\n");
 583         }
 584
 585         if (!auth_method) {
 586                 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
 587         }
 588
 589         *auth_method = talloc(auth_context->mem_ctx, sizeof(**auth_method));
 590         if (!*auth_method) {
 591                 DEBUG(0,("make_auth_method: malloc failed!\n"));
 592                 return False;
 593         }
 594         ZERO_STRUCTP(*auth_method);
 595
 596         return True;
 597 }
 598
 599 /****************************************************************************
 600  Delete a SID token.
 601 ****************************************************************************/
 602
 603 void delete_nt_token(NT_USER_TOKEN **pptoken)
 604 {
 605     if (*pptoken) {
 606                 NT_USER_TOKEN *ptoken = *pptoken;
 607         SAFE_FREE( ptoken->user_sids );
 608         ZERO_STRUCTP(ptoken);
 609     }
 610     SAFE_FREE(*pptoken);
 611 }
 612
 613 /****************************************************************************
 614  Duplicate a SID token.
 615 ****************************************************************************/
 616
 617 NT_USER_TOKEN *dup_nt_token(NT_USER_TOKEN *ptoken)
 618 {
 619         NT_USER_TOKEN *token;
 620
 621         if (!ptoken)
 622                 return NULL;
 623
 624     if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
 625         return NULL;
 626
 627     ZERO_STRUCTP(token);
 628
 629     if ((token->user_sids = (DOM_SID *)memdup( ptoken->user_sids, sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
 630         SAFE_FREE(token);
 631         return NULL;
 632     }
 633
 634     token->num_sids = ptoken->num_sids;
 635
 636         return token;
 637 }
 638
 639 /**
 640  * Squash an NT_STATUS in line with security requirements.
 641  * In an attempt to avoid giving the whole game away when users
 642  * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
 643  * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
 644  * (session setups in particular).
 645  *
 646  * @param nt_status NTSTATUS input for squashing.
 647  * @return the 'squashed' nt_status
 648  **/
 649
 650 NTSTATUS nt_status_squash(NTSTATUS nt_status)
 651 {
 652         if NT_STATUS_IS_OK(nt_status) {
 653                 return nt_status;
 654         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
 655                 /* Match WinXP and don't give the game away */
 656                 return NT_STATUS_LOGON_FAILURE;
 657
 658         } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
 659                 /* Match WinXP and don't give the game away */
 660                 return NT_STATUS_LOGON_FAILURE;
 661         } else {
 662                 return nt_status;
 663         }
 664 }
 665
 666
 667