2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2011
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
28 #include "rpc_client/init_lsa.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/util_pw.h"
31 #include "lib/winbind_util.h"
35 #define DBGC_CLASS DBGC_AUTH
37 static struct auth3_session_info *copy_serverinfo_session_info(TALLOC_CTX *mem_ctx,
38 const struct auth_serversupplied_info *src);
40 /****************************************************************************
41 Create a UNIX user on demand.
42 ****************************************************************************/
44 static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
46 TALLOC_CTX *ctx = talloc_tos();
50 add_script = talloc_strdup(ctx, lp_adduser_script());
51 if (!add_script || !*add_script) {
54 add_script = talloc_all_string_sub(ctx,
62 add_script = talloc_all_string_sub(ctx,
71 add_script = talloc_all_string_sub(ctx,
79 ret = smbrun(add_script,NULL);
82 ("smb_create_user: Running the command `%s' gave %d\n",
87 /****************************************************************************
88 Create an auth_usersupplied_data structure after appropriate mapping.
89 ****************************************************************************/
91 NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info,
93 const char *client_domain,
94 const char *workstation_name,
95 const struct tsocket_address *remote_address,
98 const struct samr_Password *lm_interactive_pwd,
99 const struct samr_Password *nt_interactive_pwd,
100 const char *plaintext,
101 enum auth_password_state password_state)
106 char *internal_username = NULL;
108 was_mapped = map_username(talloc_tos(), smb_name, &internal_username);
109 if (!internal_username) {
110 return NT_STATUS_NO_MEMORY;
113 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
114 client_domain, smb_name, workstation_name));
116 domain = client_domain;
118 /* If you connect to a Windows domain member using a bogus domain name,
119 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
120 * the Windows box is a DC the name will become DOMAIN\user and be
121 * authenticated against AD, if the Windows box is a member server but
122 * not a DC the name will become WORKSTATION\user. A standalone
123 * non-domain member box will also map to WORKSTATION\user.
124 * This also deals with the client passing in a "" domain */
126 if (!is_trusted_domain(domain) &&
127 !strequal(domain, my_sam_name()))
129 if (lp_map_untrusted_to_domain())
130 domain = my_sam_name();
132 domain = get_global_sam_name();
133 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
134 "workstation [%s]\n",
135 client_domain, domain, smb_name, workstation_name));
138 /* We know that the given domain is trusted (and we are allowing them),
139 * it is our global SAM name, or for legacy behavior it is our
140 * primary domain name */
142 result = make_user_info(user_info, smb_name, internal_username,
143 client_domain, domain, workstation_name,
144 remote_address, lm_pwd, nt_pwd,
145 lm_interactive_pwd, nt_interactive_pwd,
146 plaintext, password_state);
147 if (NT_STATUS_IS_OK(result)) {
148 /* We have tried mapping */
149 (*user_info)->mapped_state = True;
150 /* did we actually map the user to a different name? */
151 (*user_info)->was_mapped = was_mapped;
156 /****************************************************************************
157 Create an auth_usersupplied_data, making the DATA_BLOBs here.
158 Decrypt and encrypt the passwords.
159 ****************************************************************************/
161 bool make_user_info_netlogon_network(struct auth_usersupplied_info **user_info,
162 const char *smb_name,
163 const char *client_domain,
164 const char *workstation_name,
165 const struct tsocket_address *remote_address,
166 uint32 logon_parameters,
167 const uchar *lm_network_pwd,
169 const uchar *nt_network_pwd,
174 DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
175 DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
177 status = make_user_info_map(user_info,
178 smb_name, client_domain,
181 lm_pwd_len ? &lm_blob : NULL,
182 nt_pwd_len ? &nt_blob : NULL,
184 AUTH_PASSWORD_RESPONSE);
186 if (NT_STATUS_IS_OK(status)) {
187 (*user_info)->logon_parameters = logon_parameters;
189 ret = NT_STATUS_IS_OK(status) ? True : False;
191 data_blob_free(&lm_blob);
192 data_blob_free(&nt_blob);
196 /****************************************************************************
197 Create an auth_usersupplied_data, making the DATA_BLOBs here.
198 Decrypt and encrypt the passwords.
199 ****************************************************************************/
201 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info,
202 const char *smb_name,
203 const char *client_domain,
204 const char *workstation_name,
205 const struct tsocket_address *remote_address,
206 uint32 logon_parameters,
208 const uchar lm_interactive_pwd[16],
209 const uchar nt_interactive_pwd[16],
210 const uchar *dc_sess_key)
212 struct samr_Password lm_pwd;
213 struct samr_Password nt_pwd;
214 unsigned char local_lm_response[24];
215 unsigned char local_nt_response[24];
216 unsigned char key[16];
218 memcpy(key, dc_sess_key, 16);
220 if (lm_interactive_pwd)
221 memcpy(lm_pwd.hash, lm_interactive_pwd, sizeof(lm_pwd.hash));
223 if (nt_interactive_pwd)
224 memcpy(nt_pwd.hash, nt_interactive_pwd, sizeof(nt_pwd.hash));
226 #ifdef DEBUG_PASSWORD
228 dump_data(100, key, sizeof(key));
230 DEBUG(100,("lm owf password:"));
231 dump_data(100, lm_pwd.hash, sizeof(lm_pwd.hash));
233 DEBUG(100,("nt owf password:"));
234 dump_data(100, nt_pwd.hash, sizeof(nt_pwd.hash));
237 if (lm_interactive_pwd)
238 arcfour_crypt(lm_pwd.hash, key, sizeof(lm_pwd.hash));
240 if (nt_interactive_pwd)
241 arcfour_crypt(nt_pwd.hash, key, sizeof(nt_pwd.hash));
243 #ifdef DEBUG_PASSWORD
244 DEBUG(100,("decrypt of lm owf password:"));
245 dump_data(100, lm_pwd.hash, sizeof(lm_pwd));
247 DEBUG(100,("decrypt of nt owf password:"));
248 dump_data(100, nt_pwd.hash, sizeof(nt_pwd));
251 if (lm_interactive_pwd)
252 SMBOWFencrypt(lm_pwd.hash, chal,
255 if (nt_interactive_pwd)
256 SMBOWFencrypt(nt_pwd.hash, chal,
259 /* Password info paranoia */
265 DATA_BLOB local_lm_blob;
266 DATA_BLOB local_nt_blob;
268 if (lm_interactive_pwd) {
269 local_lm_blob = data_blob(local_lm_response,
270 sizeof(local_lm_response));
273 if (nt_interactive_pwd) {
274 local_nt_blob = data_blob(local_nt_response,
275 sizeof(local_nt_response));
278 nt_status = make_user_info_map(
280 smb_name, client_domain, workstation_name,
282 lm_interactive_pwd ? &local_lm_blob : NULL,
283 nt_interactive_pwd ? &local_nt_blob : NULL,
284 lm_interactive_pwd ? &lm_pwd : NULL,
285 nt_interactive_pwd ? &nt_pwd : NULL,
286 NULL, AUTH_PASSWORD_HASH);
288 if (NT_STATUS_IS_OK(nt_status)) {
289 (*user_info)->logon_parameters = logon_parameters;
292 ret = NT_STATUS_IS_OK(nt_status) ? True : False;
293 data_blob_free(&local_lm_blob);
294 data_blob_free(&local_nt_blob);
300 /****************************************************************************
301 Create an auth_usersupplied_data structure
302 ****************************************************************************/
304 bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
305 const char *smb_name,
306 const char *client_domain,
307 const struct tsocket_address *remote_address,
309 DATA_BLOB plaintext_password)
312 DATA_BLOB local_lm_blob;
313 DATA_BLOB local_nt_blob;
314 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
315 char *plaintext_password_string;
317 * Not encrypted - do so.
320 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
322 if (plaintext_password.data && plaintext_password.length) {
323 unsigned char local_lm_response[24];
325 #ifdef DEBUG_PASSWORD
326 DEBUG(10,("Unencrypted password (len %d):\n",
327 (int)plaintext_password.length));
328 dump_data(100, plaintext_password.data,
329 plaintext_password.length);
332 SMBencrypt( (const char *)plaintext_password.data,
333 (const uchar*)chal, local_lm_response);
334 local_lm_blob = data_blob(local_lm_response, 24);
336 /* We can't do an NT hash here, as the password needs to be
338 local_nt_blob = data_blob_null;
340 local_lm_blob = data_blob_null;
341 local_nt_blob = data_blob_null;
344 plaintext_password_string = talloc_strndup(talloc_tos(),
345 (const char *)plaintext_password.data,
346 plaintext_password.length);
347 if (!plaintext_password_string) {
351 ret = make_user_info_map(
352 user_info, smb_name, client_domain,
353 get_remote_machine_name(),
355 local_lm_blob.data ? &local_lm_blob : NULL,
356 local_nt_blob.data ? &local_nt_blob : NULL,
358 plaintext_password_string,
359 AUTH_PASSWORD_PLAIN);
361 if (plaintext_password_string) {
362 memset(plaintext_password_string, '\0', strlen(plaintext_password_string));
363 talloc_free(plaintext_password_string);
366 data_blob_free(&local_lm_blob);
367 return NT_STATUS_IS_OK(ret) ? True : False;
370 /****************************************************************************
371 Create an auth_usersupplied_data structure
372 ****************************************************************************/
374 NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info,
375 const char *smb_name,
376 const char *client_domain,
377 const struct tsocket_address *remote_address,
378 DATA_BLOB lm_resp, DATA_BLOB nt_resp)
380 return make_user_info_map(user_info, smb_name,
382 get_remote_machine_name(),
384 lm_resp.data && (lm_resp.length > 0) ? &lm_resp : NULL,
385 nt_resp.data && (nt_resp.length > 0) ? &nt_resp : NULL,
387 AUTH_PASSWORD_RESPONSE);
390 /****************************************************************************
391 Create a guest user_info blob, for anonymous authenticaion.
392 ****************************************************************************/
394 bool make_user_info_guest(const struct tsocket_address *remote_address,
395 struct auth_usersupplied_info **user_info)
399 nt_status = make_user_info(user_info,
407 AUTH_PASSWORD_RESPONSE);
409 return NT_STATUS_IS_OK(nt_status) ? True : False;
412 static NTSTATUS log_nt_token(struct security_token *token)
414 TALLOC_CTX *frame = talloc_stackframe();
419 if ((lp_log_nt_token_command() == NULL) ||
420 (strlen(lp_log_nt_token_command()) == 0)) {
425 group_sidstr = talloc_strdup(frame, "");
426 for (i=1; i<token->num_sids; i++) {
427 group_sidstr = talloc_asprintf(
428 frame, "%s %s", group_sidstr,
429 sid_string_talloc(frame, &token->sids[i]));
432 command = talloc_string_sub(
433 frame, lp_log_nt_token_command(),
434 "%s", sid_string_talloc(frame, &token->sids[0]));
435 command = talloc_string_sub(frame, command, "%t", group_sidstr);
437 if (command == NULL) {
439 return NT_STATUS_NO_MEMORY;
442 DEBUG(8, ("running command: [%s]\n", command));
443 if (smbrun(command, NULL) != 0) {
444 DEBUG(0, ("Could not log NT token\n"));
446 return NT_STATUS_ACCESS_DENIED;
454 * Create the token to use from server_info->info3 and
455 * server_info->sids (the info3/sam groups). Find the unix gids.
458 NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
459 const struct auth_serversupplied_info *server_info,
460 DATA_BLOB *session_key,
461 struct auth3_session_info **session_info_out)
463 struct security_token *t;
466 struct dom_sid tmp_sid;
467 struct auth3_session_info *session_info;
468 struct wbcUnixId *ids;
470 /* Ensure we can't possible take a code path leading to a
473 return NT_STATUS_LOGON_FAILURE;
476 session_info = copy_serverinfo_session_info(mem_ctx, server_info);
479 return NT_STATUS_NO_MEMORY;
483 data_blob_free(&session_info->session_key);
484 session_info->session_key = data_blob_talloc(session_info,
486 session_key->length);
487 if (!session_info->session_key.data && session_key->length) {
488 return NT_STATUS_NO_MEMORY;
492 if (session_info->security_token) {
493 /* Just copy the token, it has already been finalised
494 * (nasty hack to support a cached guest session_info,
495 * and a possible strategy for auth_samba4 to pass in
496 * a finalised session) */
497 *session_info_out = session_info;
502 * If winbind is not around, we can not make much use of the SIDs the
503 * domain controller provided us with. Likewise if the user name was
504 * mapped to some local unix user.
507 if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
508 (server_info->nss_token)) {
509 status = create_token_from_username(session_info,
510 session_info->unix_name,
512 &session_info->unix_token->uid,
513 &session_info->unix_token->gid,
514 &session_info->unix_name,
515 &session_info->security_token);
518 status = create_local_nt_token_from_info3(session_info,
521 &session_info->extra,
522 &session_info->security_token);
525 if (!NT_STATUS_IS_OK(status)) {
529 /* Convert the SIDs to gids. */
531 session_info->unix_token->ngroups = 0;
532 session_info->unix_token->groups = NULL;
534 t = session_info->security_token;
536 ids = talloc_array(talloc_tos(), struct wbcUnixId,
539 return NT_STATUS_NO_MEMORY;
542 if (!sids_to_unix_ids(t->sids, t->num_sids, ids)) {
544 return NT_STATUS_NO_MEMORY;
547 /* Start at index 1, where the groups start. */
549 for (i=1; i<t->num_sids; i++) {
551 if (ids[i].type != WBC_ID_TYPE_GID) {
552 DEBUG(10, ("Could not convert SID %s to gid, "
554 sid_string_dbg(&t->sids[i])));
557 if (!add_gid_to_array_unique(session_info, ids[i].id.gid,
558 &session_info->unix_token->groups,
559 &session_info->unix_token->ngroups)) {
560 return NT_STATUS_NO_MEMORY;
565 * Add the "Unix Group" SID for each gid to catch mapped groups
566 * and their Unix equivalent. This is to solve the backwards
567 * compatibility problem of 'valid users = +ntadmin' where
568 * ntadmin has been paired with "Domain Admins" in the group
569 * mapping table. Otherwise smb.conf would need to be changed
570 * to 'valid user = "Domain Admins"'. --jerry
572 * For consistency we also add the "Unix User" SID,
573 * so that the complete unix token is represented within
577 uid_to_unix_users_sid(session_info->unix_token->uid, &tmp_sid);
579 add_sid_to_array_unique(session_info->security_token, &tmp_sid,
580 &session_info->security_token->sids,
581 &session_info->security_token->num_sids);
583 for ( i=0; i<session_info->unix_token->ngroups; i++ ) {
584 gid_to_unix_groups_sid(session_info->unix_token->groups[i], &tmp_sid);
585 add_sid_to_array_unique(session_info->security_token, &tmp_sid,
586 &session_info->security_token->sids,
587 &session_info->security_token->num_sids);
590 security_token_debug(DBGC_AUTH, 10, session_info->security_token);
591 debug_unix_user_token(DBGC_AUTH, 10,
592 session_info->unix_token->uid,
593 session_info->unix_token->gid,
594 session_info->unix_token->ngroups,
595 session_info->unix_token->groups);
597 status = log_nt_token(session_info->security_token);
598 if (!NT_STATUS_IS_OK(status)) {
602 *session_info_out = session_info;
606 /***************************************************************************
607 Make (and fill) a server_info struct from a 'struct passwd' by conversion
609 ***************************************************************************/
611 NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
616 struct samu *sampass = NULL;
617 char *qualified_name = NULL;
618 TALLOC_CTX *mem_ctx = NULL;
619 struct dom_sid u_sid;
620 enum lsa_SidType type;
621 struct auth_serversupplied_info *result;
624 * The SID returned in server_info->sam_account is based
625 * on our SAM sid even though for a pure UNIX account this should
626 * not be the case as it doesn't really exist in the SAM db.
627 * This causes lookups on "[in]valid users" to fail as they
628 * will lookup this name as a "Unix User" SID to check against
629 * the user token. Fix this by adding the "Unix User"\unix_username
630 * SID to the sid array. The correct fix should probably be
631 * changing the server_info->sam_account user SID to be a
632 * S-1-22 Unix SID, but this might break old configs where
633 * plaintext passwords were used with no SAM backend.
636 mem_ctx = talloc_init("make_server_info_pw_tmp");
638 return NT_STATUS_NO_MEMORY;
641 qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
642 unix_users_domain_name(),
644 if (!qualified_name) {
645 TALLOC_FREE(mem_ctx);
646 return NT_STATUS_NO_MEMORY;
649 if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
652 TALLOC_FREE(mem_ctx);
653 return NT_STATUS_NO_SUCH_USER;
656 TALLOC_FREE(mem_ctx);
658 if (type != SID_NAME_USER) {
659 return NT_STATUS_NO_SUCH_USER;
662 if ( !(sampass = samu_new( NULL )) ) {
663 return NT_STATUS_NO_MEMORY;
666 status = samu_set_unix( sampass, pwd );
667 if (!NT_STATUS_IS_OK(status)) {
671 /* In pathological cases the above call can set the account
672 * name to the DOMAIN\username form. Reset the account name
673 * using unix_username */
674 pdb_set_username(sampass, unix_username, PDB_SET);
676 /* set the user sid to be the calculated u_sid */
677 pdb_set_user_sid(sampass, &u_sid, PDB_SET);
679 result = make_server_info(NULL);
680 if (result == NULL) {
681 TALLOC_FREE(sampass);
682 return NT_STATUS_NO_MEMORY;
685 status = samu_to_SamInfo3(result, sampass, lp_netbios_name(),
686 &result->info3, &result->extra);
687 TALLOC_FREE(sampass);
688 if (!NT_STATUS_IS_OK(status)) {
689 DEBUG(10, ("Failed to convert samu to info3: %s\n",
695 result->unix_name = talloc_strdup(result, unix_username);
696 result->sanitized_username = sanitize_username(result, unix_username);
698 if ((result->unix_name == NULL)
699 || (result->sanitized_username == NULL)) {
701 return NT_STATUS_NO_MEMORY;
704 result->utok.uid = pwd->pw_uid;
705 result->utok.gid = pwd->pw_gid;
707 *server_info = result;
712 static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,
713 struct netr_SamInfo3 *info3)
715 const char *guest_account = lp_guestaccount();
716 struct dom_sid domain_sid;
720 pwd = Get_Pwnam_alloc(mem_ctx, guest_account);
722 DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
723 "account [%s]!\n", guest_account));
724 return NT_STATUS_NO_SUCH_USER;
727 /* Set acount name */
728 tmp = talloc_strdup(mem_ctx, pwd->pw_name);
730 return NT_STATUS_NO_MEMORY;
732 init_lsa_String(&info3->base.account_name, tmp);
734 /* Set domain name */
735 tmp = talloc_strdup(mem_ctx, get_global_sam_name());
737 return NT_STATUS_NO_MEMORY;
739 init_lsa_StringLarge(&info3->base.domain, tmp);
742 sid_copy(&domain_sid, get_global_sam_sid());
744 info3->base.domain_sid = dom_sid_dup(mem_ctx, &domain_sid);
745 if (info3->base.domain_sid == NULL) {
746 return NT_STATUS_NO_MEMORY;
750 info3->base.rid = DOMAIN_RID_GUEST;
753 info3->base.primary_gid = BUILTIN_RID_GUESTS;
759 /***************************************************************************
760 Make (and fill) a user_info struct for a guest login.
761 This *must* succeed for smbd to start. If there is no mapping entry for
762 the guest gid, then create one.
764 The resulting structure is a 'session_info' because
765 create_local_token() has already been called on it. This is quite
766 nasty, as the auth subsystem isn't expect this, but the behaviour is
768 ***************************************************************************/
770 static NTSTATUS make_new_session_info_guest(struct auth3_session_info **session_info)
772 struct auth_serversupplied_info *server_info;
773 static const char zeros[16] = {0};
774 const char *guest_account = lp_guestaccount();
775 const char *domain = lp_netbios_name();
776 struct netr_SamInfo3 info3;
781 tmp_ctx = talloc_stackframe();
782 if (tmp_ctx == NULL) {
783 return NT_STATUS_NO_MEMORY;
788 status = get_guest_info3(tmp_ctx, &info3);
789 if (!NT_STATUS_IS_OK(status)) {
790 DEBUG(0, ("get_guest_info3 failed with %s\n",
795 status = make_server_info_info3(tmp_ctx,
800 if (!NT_STATUS_IS_OK(status)) {
801 DEBUG(0, ("make_server_info_info3 failed with %s\n",
806 server_info->guest = True;
808 /* This should not be done here (we should produce a server
809 * info, and later construct a session info from it), but for
810 * now this does not change the previous behaviours */
811 status = create_local_token(tmp_ctx, server_info, NULL, session_info);
812 TALLOC_FREE(server_info);
813 if (!NT_STATUS_IS_OK(status)) {
814 DEBUG(0, ("create_local_token failed: %s\n",
818 talloc_steal(NULL, *session_info);
820 /* annoying, but the Guest really does have a session key, and it is
822 (*session_info)->session_key = data_blob(zeros, sizeof(zeros));
823 (*session_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
825 alpha_strcpy(tmp, (*session_info)->info3->base.account_name.string,
826 ". _-$", sizeof(tmp));
827 (*session_info)->sanitized_username = talloc_strdup(*session_info, tmp);
829 status = NT_STATUS_OK;
831 TALLOC_FREE(tmp_ctx);
835 /***************************************************************************
836 Make (and fill) a auth_session_info struct for a system user login.
837 This *must* succeed for smbd to start.
838 ***************************************************************************/
840 static NTSTATUS make_new_session_info_system(TALLOC_CTX *mem_ctx,
841 struct auth3_session_info **session_info)
846 pwd = getpwuid_alloc(mem_ctx, sec_initial_uid());
848 return NT_STATUS_NO_SUCH_USER;
851 status = make_session_info_from_username(mem_ctx,
856 if (!NT_STATUS_IS_OK(status)) {
860 (*session_info)->system = true;
862 status = add_sid_to_array_unique((*session_info)->security_token->sids,
864 &(*session_info)->security_token->sids,
865 &(*session_info)->security_token->num_sids);
866 if (!NT_STATUS_IS_OK(status)) {
867 TALLOC_FREE((*session_info));
874 /****************************************************************************
875 Fake a auth3_session_info just from a username (as a
876 session_info structure, with create_local_token() already called on
878 ****************************************************************************/
880 NTSTATUS make_session_info_from_username(TALLOC_CTX *mem_ctx,
881 const char *username,
883 struct auth3_session_info **session_info)
885 struct auth_serversupplied_info *result;
889 pwd = Get_Pwnam_alloc(talloc_tos(), username);
891 return NT_STATUS_NO_SUCH_USER;
894 status = make_server_info_pw(&result, pwd->pw_name, pwd);
898 if (!NT_STATUS_IS_OK(status)) {
902 result->nss_token = true;
903 result->guest = is_guest;
905 /* Now turn the server_info into a session_info with the full token etc */
906 status = create_local_token(mem_ctx, result, NULL, session_info);
912 struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
913 const struct auth_serversupplied_info *src)
915 struct auth_serversupplied_info *dst;
917 dst = make_server_info(mem_ctx);
922 dst->guest = src->guest;
923 dst->system = src->system;
924 dst->utok.uid = src->utok.uid;
925 dst->utok.gid = src->utok.gid;
926 dst->utok.ngroups = src->utok.ngroups;
927 if (src->utok.ngroups != 0) {
928 dst->utok.groups = (gid_t *)talloc_memdup(
929 dst, src->utok.groups,
930 sizeof(gid_t)*dst->utok.ngroups);
932 dst->utok.groups = NULL;
935 if (src->security_token) {
936 dst->security_token = dup_nt_token(dst, src->security_token);
937 if (!dst->security_token) {
943 dst->session_key = data_blob_talloc( dst, src->session_key.data,
944 src->session_key.length);
946 dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
947 src->lm_session_key.length);
949 dst->info3 = copy_netr_SamInfo3(dst, src->info3);
954 dst->extra = src->extra;
956 dst->unix_name = talloc_strdup(dst, src->unix_name);
957 if (!dst->unix_name) {
962 dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
963 if (!dst->sanitized_username) {
971 static struct auth_serversupplied_info *copy_session_info_serverinfo(TALLOC_CTX *mem_ctx,
972 const struct auth3_session_info *src)
974 struct auth_serversupplied_info *dst;
976 dst = make_server_info(mem_ctx);
981 dst->guest = src->guest;
982 dst->system = src->system;
984 /* This element must be provided to convert back to an auth_serversupplied_info */
985 SMB_ASSERT(src->unix_token);
986 dst->utok.uid = src->unix_token->uid;
987 dst->utok.gid = src->unix_token->gid;
988 dst->utok.ngroups = src->unix_token->ngroups;
989 if (src->unix_token->ngroups != 0) {
990 dst->utok.groups = (gid_t *)talloc_memdup(
991 dst, src->unix_token->groups,
992 sizeof(gid_t)*dst->utok.ngroups);
994 dst->utok.groups = NULL;
997 if (src->security_token) {
998 dst->security_token = dup_nt_token(dst, src->security_token);
999 if (!dst->security_token) {
1005 dst->session_key = data_blob_talloc( dst, src->session_key.data,
1006 src->session_key.length);
1008 dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
1009 src->lm_session_key.length);
1011 dst->info3 = copy_netr_SamInfo3(dst, src->info3);
1016 dst->extra = src->extra;
1018 dst->unix_name = talloc_strdup(dst, src->unix_name);
1019 if (!dst->unix_name) {
1024 dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
1025 if (!dst->sanitized_username) {
1033 static struct auth3_session_info *copy_serverinfo_session_info(TALLOC_CTX *mem_ctx,
1034 const struct auth_serversupplied_info *src)
1036 struct auth3_session_info *dst;
1038 dst = make_auth3_session_info(mem_ctx);
1043 dst->guest = src->guest;
1044 dst->system = src->system;
1046 dst->unix_token = talloc(dst, struct security_unix_token);
1047 if (!dst->unix_token) {
1051 dst->unix_token->uid = src->utok.uid;
1052 dst->unix_token->gid = src->utok.gid;
1053 dst->unix_token->ngroups = src->utok.ngroups;
1054 if (src->utok.ngroups != 0) {
1055 dst->unix_token->groups = (gid_t *)talloc_memdup(
1056 dst->unix_token, src->utok.groups,
1057 sizeof(gid_t)*dst->unix_token->ngroups);
1059 dst->unix_token->groups = NULL;
1062 if (src->security_token) {
1063 dst->security_token = dup_nt_token(dst, src->security_token);
1064 if (!dst->security_token) {
1070 dst->session_key = data_blob_talloc( dst, src->session_key.data,
1071 src->session_key.length);
1073 dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
1074 src->lm_session_key.length);
1076 dst->info3 = copy_netr_SamInfo3(dst, src->info3);
1081 dst->extra = src->extra;
1083 dst->unix_name = talloc_strdup(dst, src->unix_name);
1084 if (!dst->unix_name) {
1089 dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
1090 if (!dst->sanitized_username) {
1098 struct auth3_session_info *copy_session_info(TALLOC_CTX *mem_ctx,
1099 const struct auth3_session_info *src)
1101 struct auth3_session_info *dst;
1103 dst = make_auth3_session_info(mem_ctx);
1108 dst->guest = src->guest;
1109 dst->system = src->system;
1111 if (src->unix_token) {
1112 dst->unix_token = talloc(dst, struct security_unix_token);
1113 if (!dst->unix_token) {
1117 dst->unix_token->uid = src->unix_token->uid;
1118 dst->unix_token->gid = src->unix_token->gid;
1119 dst->unix_token->ngroups = src->unix_token->ngroups;
1120 if (src->unix_token->ngroups != 0) {
1121 dst->unix_token->groups = (gid_t *)talloc_memdup(
1122 dst->unix_token, src->unix_token->groups,
1123 sizeof(gid_t)*dst->unix_token->ngroups);
1125 dst->unix_token->groups = NULL;
1128 dst->unix_token = NULL;
1131 if (src->security_token) {
1132 dst->security_token = dup_nt_token(dst, src->security_token);
1133 if (!dst->security_token) {
1139 dst->session_key = data_blob_talloc( dst, src->session_key.data,
1140 src->session_key.length);
1142 dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
1143 src->lm_session_key.length);
1145 dst->info3 = copy_netr_SamInfo3(dst, src->info3);
1150 dst->extra = src->extra;
1152 dst->unix_name = talloc_strdup(dst, src->unix_name);
1153 if (!dst->unix_name) {
1158 dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
1159 if (!dst->sanitized_username) {
1168 * Set a new session key. Used in the rpc server where we have to override the
1169 * SMB level session key with SystemLibraryDTC
1172 bool session_info_set_session_key(struct auth3_session_info *info,
1173 DATA_BLOB session_key)
1175 TALLOC_FREE(info->session_key.data);
1177 info->session_key = data_blob_talloc(
1178 info, session_key.data, session_key.length);
1180 return (info->session_key.data != NULL);
1183 static struct auth3_session_info *guest_info = NULL;
1185 bool init_guest_info(void)
1187 if (guest_info != NULL)
1190 return NT_STATUS_IS_OK(make_new_session_info_guest(&guest_info));
1193 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
1194 struct auth_serversupplied_info **server_info)
1196 *server_info = copy_session_info_serverinfo(mem_ctx, guest_info);
1197 return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1200 NTSTATUS make_session_info_guest(TALLOC_CTX *mem_ctx,
1201 struct auth3_session_info **session_info)
1203 *session_info = copy_session_info(mem_ctx, guest_info);
1204 return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1207 static struct auth3_session_info *system_info = NULL;
1209 NTSTATUS init_system_info(void)
1211 if (system_info != NULL)
1212 return NT_STATUS_OK;
1214 return make_new_session_info_system(NULL, &system_info);
1217 NTSTATUS make_session_info_system(TALLOC_CTX *mem_ctx,
1218 struct auth3_session_info **session_info)
1220 if (system_info == NULL) return NT_STATUS_UNSUCCESSFUL;
1221 *session_info = copy_session_info(mem_ctx, system_info);
1222 return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1225 const struct auth3_session_info *get_session_info_system(void)
1230 bool copy_current_user(struct current_user *dst, struct current_user *src)
1233 struct security_token *nt_token;
1235 groups = (gid_t *)memdup(src->ut.groups,
1236 sizeof(gid_t) * src->ut.ngroups);
1237 if ((src->ut.ngroups != 0) && (groups == NULL)) {
1241 nt_token = dup_nt_token(NULL, src->nt_user_token);
1242 if (nt_token == NULL) {
1247 dst->conn = src->conn;
1248 dst->vuid = src->vuid;
1249 dst->ut.uid = src->ut.uid;
1250 dst->ut.gid = src->ut.gid;
1251 dst->ut.ngroups = src->ut.ngroups;
1252 dst->ut.groups = groups;
1253 dst->nt_user_token = nt_token;
1257 /***************************************************************************
1258 Purely internal function for make_server_info_info3
1259 ***************************************************************************/
1261 static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
1262 const char *username, char **found_username,
1263 struct passwd **pwd,
1264 bool *username_was_mapped)
1266 char *orig_dom_user = NULL;
1267 char *dom_user = NULL;
1268 char *lower_username = NULL;
1269 char *real_username = NULL;
1270 struct passwd *passwd;
1272 lower_username = talloc_strdup(mem_ctx, username);
1273 if (!lower_username) {
1274 return NT_STATUS_NO_MEMORY;
1276 strlower_m( lower_username );
1278 orig_dom_user = talloc_asprintf(mem_ctx,
1281 *lp_winbind_separator(),
1283 if (!orig_dom_user) {
1284 return NT_STATUS_NO_MEMORY;
1287 /* Get the passwd struct. Try to create the account if necessary. */
1289 *username_was_mapped = map_username(mem_ctx, orig_dom_user, &dom_user);
1291 return NT_STATUS_NO_MEMORY;
1294 passwd = smb_getpwnam(mem_ctx, dom_user, &real_username, True );
1296 DEBUG(3, ("Failed to find authenticated user %s via "
1297 "getpwnam(), denying access.\n", dom_user));
1298 return NT_STATUS_NO_SUCH_USER;
1301 if (!real_username) {
1302 return NT_STATUS_NO_MEMORY;
1307 /* This is pointless -- there is no suport for differing
1308 unix and windows names. Make sure to always store the
1309 one we actually looked up and succeeded. Have I mentioned
1310 why I hate the 'winbind use default domain' parameter?
1313 *found_username = talloc_strdup( mem_ctx, real_username );
1315 return NT_STATUS_OK;
1318 /****************************************************************************
1319 Wrapper to allow the getpwnam() call to strip the domain name and
1320 try again in case a local UNIX user is already there. Also run through
1321 the username if we fallback to the username only.
1322 ****************************************************************************/
1324 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, const char *domuser,
1325 char **p_save_username, bool create )
1327 struct passwd *pw = NULL;
1329 char *username = NULL;
1331 /* we only save a copy of the username it has been mangled
1332 by winbindd use default domain */
1333 *p_save_username = NULL;
1335 /* don't call map_username() here since it has to be done higher
1336 up the stack so we don't call it multiple times */
1338 username = talloc_strdup(mem_ctx, domuser);
1343 p = strchr_m( username, *lp_winbind_separator() );
1345 /* code for a DOMAIN\user string */
1348 pw = Get_Pwnam_alloc( mem_ctx, domuser );
1350 /* make sure we get the case of the username correct */
1351 /* work around 'winbind use default domain = yes' */
1353 if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
1356 /* split the domain and username into 2 strings */
1360 *p_save_username = talloc_asprintf(mem_ctx,
1363 *lp_winbind_separator(),
1365 if (!*p_save_username) {
1370 *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
1377 /* setup for lookup of just the username */
1378 /* remember that p and username are overlapping memory */
1381 username = talloc_strdup(mem_ctx, p);
1387 /* just lookup a plain username */
1389 pw = Get_Pwnam_alloc(mem_ctx, username);
1391 /* Create local user if requested but only if winbindd
1392 is not running. We need to protect against cases
1393 where winbindd is failing and then prematurely
1394 creating users in /etc/passwd */
1396 if ( !pw && create && !winbind_ping() ) {
1397 /* Don't add a machine account. */
1398 if (username[strlen(username)-1] == '$')
1401 _smb_create_user(NULL, username, NULL);
1402 pw = Get_Pwnam_alloc(mem_ctx, username);
1405 /* one last check for a valid passwd struct */
1408 *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
1413 /***************************************************************************
1414 Make a server_info struct from the info3 returned by a domain logon
1415 ***************************************************************************/
1417 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
1418 const char *sent_nt_username,
1420 struct auth_serversupplied_info **server_info,
1421 struct netr_SamInfo3 *info3)
1423 static const char zeros[16] = {0, };
1425 NTSTATUS nt_status = NT_STATUS_OK;
1426 char *found_username = NULL;
1427 const char *nt_domain;
1428 const char *nt_username;
1429 bool username_was_mapped;
1431 struct auth_serversupplied_info *result;
1432 struct dom_sid *group_sid;
1433 struct netr_SamInfo3 *i3;
1436 Here is where we should check the list of
1437 trusted domains, and verify that the SID
1441 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
1443 /* If the server didn't give us one, just use the one we sent
1445 nt_username = sent_nt_username;
1448 nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
1450 /* If the server didn't give us one, just use the one we sent
1455 /* If getpwnam() fails try the add user script (2.2.x behavior).
1457 We use the _unmapped_ username here in an attempt to provide
1458 consistent username mapping behavior between kerberos and NTLM[SSP]
1459 authentication in domain mode security. I.E. Username mapping
1460 should be applied to the fully qualified username
1461 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1462 called map_username() unnecessarily in make_user_info_map() but
1463 that is how the current code is designed. Making the change here
1464 is the least disruptive place. -- jerry */
1466 /* this call will try to create the user if necessary */
1468 nt_status = check_account(mem_ctx, nt_domain, sent_nt_username,
1469 &found_username, &pwd,
1470 &username_was_mapped);
1472 if (!NT_STATUS_IS_OK(nt_status)) {
1476 result = make_server_info(NULL);
1477 if (result == NULL) {
1478 DEBUG(4, ("make_server_info failed!\n"));
1479 return NT_STATUS_NO_MEMORY;
1482 result->unix_name = talloc_strdup(result, found_username);
1484 result->sanitized_username = sanitize_username(result,
1486 if (result->sanitized_username == NULL) {
1487 TALLOC_FREE(result);
1488 return NT_STATUS_NO_MEMORY;
1491 /* copy in the info3 */
1492 result->info3 = i3 = copy_netr_SamInfo3(result, info3);
1493 if (result->info3 == NULL) {
1494 TALLOC_FREE(result);
1495 return NT_STATUS_NO_MEMORY;
1498 /* Fill in the unix info we found on the way */
1499 result->utok.uid = pwd->pw_uid;
1500 result->utok.gid = pwd->pw_gid;
1502 /* We can't just trust that the primary group sid sent us is something
1503 * we can really use. Obtain the useable sid, and store the original
1504 * one as an additional group if it had to be replaced */
1505 nt_status = get_primary_group_sid(mem_ctx, found_username,
1507 if (!NT_STATUS_IS_OK(nt_status)) {
1508 TALLOC_FREE(result);
1512 /* store and check if it is the same we got originally */
1513 sid_peek_rid(group_sid, &i3->base.primary_gid);
1514 if (i3->base.primary_gid != info3->base.primary_gid) {
1515 uint32_t n = i3->base.groups.count;
1516 /* not the same, store the original as an additional group */
1517 i3->base.groups.rids =
1518 talloc_realloc(i3, i3->base.groups.rids,
1519 struct samr_RidWithAttribute, n + 1);
1520 if (i3->base.groups.rids == NULL) {
1521 TALLOC_FREE(result);
1522 return NT_STATUS_NO_MEMORY;
1524 i3->base.groups.rids[n].rid = info3->base.primary_gid;
1525 i3->base.groups.rids[n].attributes = SE_GROUP_ENABLED;
1526 i3->base.groups.count = n + 1;
1529 /* ensure we are never given NULL session keys */
1531 if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
1532 result->session_key = data_blob_null;
1534 result->session_key = data_blob_talloc(
1535 result, info3->base.key.key,
1536 sizeof(info3->base.key.key));
1539 if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
1540 result->lm_session_key = data_blob_null;
1542 result->lm_session_key = data_blob_talloc(
1543 result, info3->base.LMSessKey.key,
1544 sizeof(info3->base.LMSessKey.key));
1547 result->nss_token |= username_was_mapped;
1549 result->guest = (info3->base.user_flags & NETLOGON_GUEST);
1551 *server_info = result;
1553 return NT_STATUS_OK;
1556 /*****************************************************************************
1557 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1558 ******************************************************************************/
1560 NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
1561 const char *sent_nt_username,
1563 const struct wbcAuthUserInfo *info,
1564 struct auth_serversupplied_info **server_info)
1566 struct netr_SamInfo3 *info3;
1568 info3 = wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx, info);
1570 return NT_STATUS_NO_MEMORY;
1573 return make_server_info_info3(mem_ctx,
1574 sent_nt_username, domain,
1575 server_info, info3);
1579 * Verify whether or not given domain is trusted.
1581 * @param domain_name name of the domain to be verified
1582 * @return true if domain is one of the trusted ones or
1583 * false if otherwise
1586 bool is_trusted_domain(const char* dom_name)
1588 struct dom_sid trustdom_sid;
1591 /* no trusted domains for a standalone server */
1593 if ( lp_server_role() == ROLE_STANDALONE )
1596 if (dom_name == NULL || dom_name[0] == '\0') {
1600 if (strequal(dom_name, get_global_sam_name())) {
1604 /* if we are a DC, then check for a direct trust relationships */
1608 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1609 "[%s]\n", dom_name ));
1610 ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
1618 /* If winbind is around, ask it */
1620 result = wb_is_trusted_domain(dom_name);
1622 if (result == WBC_ERR_SUCCESS) {
1626 if (result == WBC_ERR_DOMAIN_NOT_FOUND) {
1627 /* winbind could not find the domain */
1631 /* The only other possible result is that winbind is not up
1632 and running. We need to update the trustdom_cache
1635 update_trustdom_cache();
1638 /* now the trustdom cache should be available a DC could still
1639 * have a transitive trust so fall back to the cache of trusted
1640 * domains (like a domain member would use */
1642 if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) {