source3/libads/kerberos_verify.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Luke Howard 2003
   7    Copyright (C) Guenther Deschner 2003, 2005
   8    Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
   9    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
  10    Copyright (C) Jeremy Allison 2007
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27
  28 #ifdef HAVE_KRB5
  29
  30 #if !defined(HAVE_KRB5_PRINC_COMPONENT)
  31 const krb5_data *krb5_princ_component(krb5_context, krb5_principal, int );
  32 #endif
  33
  34 static bool ads_dedicated_keytab_verify_ticket(krb5_context context,
  35                                           krb5_auth_context auth_context,
  36                                           const DATA_BLOB *ticket,
  37                                           krb5_ticket **pp_tkt,
  38                                           krb5_keyblock **keyblock,
  39                                           krb5_error_code *perr)
  40 {
  41         krb5_error_code ret = 0;
  42         bool auth_ok = false;
  43         krb5_keytab keytab = NULL;
  44         krb5_keytab_entry kt_entry;
  45         krb5_ticket *dec_ticket = NULL;
  46
  47         krb5_data packet;
  48         krb5_kvno kvno = 0;
  49         krb5_enctype enctype;
  50
  51         *pp_tkt = NULL;
  52         *keyblock = NULL;
  53         *perr = 0;
  54
  55         ZERO_STRUCT(kt_entry);
  56
  57         ret = smb_krb5_open_keytab(context, lp_dedicated_keytab_file(), true,
  58             &keytab);
  59         if (ret) {
  60                 DEBUG(1, ("smb_krb5_open_keytab failed (%s)\n",
  61                         error_message(ret)));
  62                 goto out;
  63         }
  64
  65         packet.length = ticket->length;
  66         packet.data = (char *)ticket->data;
  67
  68         ret = krb5_rd_req(context, &auth_context, &packet, NULL, keytab,
  69             NULL, &dec_ticket);
  70         if (ret) {
  71                 DEBUG(0, ("krb5_rd_req failed (%s)\n", error_message(ret)));
  72                 goto out;
  73         }
  74
  75 #ifdef HAVE_ETYPE_IN_ENCRYPTEDDATA /* Heimdal */
  76         enctype = dec_ticket->ticket.key.keytype;
  77 #else /* MIT */
  78         enctype = dec_ticket->enc_part.enctype;
  79         kvno    = dec_ticket->enc_part.kvno;
  80 #endif
  81
  82         /* Get the key for checking the pac signature */
  83         ret = krb5_kt_get_entry(context, keytab, dec_ticket->server,
  84                                 kvno, enctype, &kt_entry);
  85         if (ret) {
  86                 DEBUG(0, ("krb5_kt_get_entry failed (%s)\n",
  87                           error_message(ret)));
  88                 goto out;
  89         }
  90
  91         ret = krb5_copy_keyblock(context, KRB5_KT_KEY(&kt_entry), keyblock);
  92         smb_krb5_kt_free_entry(context, &kt_entry);
  93
  94         if (ret) {
  95                 DEBUG(0, ("failed to copy key: %s\n",
  96                           error_message(ret)));
  97                 goto out;
  98         }
  99
 100         auth_ok = true;
 101         *pp_tkt = dec_ticket;
 102         dec_ticket = NULL;
 103
 104   out:
 105         if (dec_ticket)
 106                 krb5_free_ticket(context, dec_ticket);
 107
 108         if (keytab)
 109                 krb5_kt_close(context, keytab);
 110
 111         *perr = ret;
 112         return auth_ok;
 113 }
 114
 115 /**********************************************************************************
 116  Try to verify a ticket using the system keytab... the system keytab has kvno -1 entries, so
 117  it's more like what microsoft does... see comment in utils/net_ads.c in the
 118  ads_keytab_add_entry function for details.
 119 ***********************************************************************************/
 120
 121 static bool ads_keytab_verify_ticket(krb5_context context,
 122                                         krb5_auth_context auth_context,
 123                                         const DATA_BLOB *ticket,
 124                                         krb5_ticket **pp_tkt,
 125                                         krb5_keyblock **keyblock,
 126                                         krb5_error_code *perr)
 127 {
 128         krb5_error_code ret = 0;
 129         bool auth_ok = False;
 130         krb5_keytab keytab = NULL;
 131         krb5_kt_cursor kt_cursor;
 132         krb5_keytab_entry kt_entry;
 133         char *valid_princ_formats[7] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL };
 134         char *entry_princ_s = NULL;
 135         fstring my_name, my_fqdn;
 136         int i;
 137         int number_matched_principals = 0;
 138         krb5_data packet;
 139
 140         *pp_tkt = NULL;
 141         *keyblock = NULL;
 142         *perr = 0;
 143
 144         /* Generate the list of principal names which we expect
 145          * clients might want to use for authenticating to the file
 146          * service.  We allow name$,{host,cifs}/{name,fqdn,name.REALM}. */
 147
 148         fstrcpy(my_name, global_myname());
 149
 150         my_fqdn[0] = '\0';
 151         name_to_fqdn(my_fqdn, global_myname());
 152
 153         if (asprintf(&valid_princ_formats[0], "%s$@%s", my_name, lp_realm()) == -1) {
 154                 goto out;
 155         }
 156         if (asprintf(&valid_princ_formats[1], "host/%s@%s", my_name, lp_realm()) == -1) {
 157                 goto out;
 158         }
 159         if (asprintf(&valid_princ_formats[2], "host/%s@%s", my_fqdn, lp_realm()) == -1) {
 160                 goto out;
 161         }
 162         if (asprintf(&valid_princ_formats[3], "host/%s.%s@%s", my_name, lp_realm(), lp_realm()) == -1) {
 163                 goto out;
 164         }
 165         if (asprintf(&valid_princ_formats[4], "cifs/%s@%s", my_name, lp_realm()) == -1) {
 166                 goto out;
 167         }
 168         if (asprintf(&valid_princ_formats[5], "cifs/%s@%s", my_fqdn, lp_realm()) == -1) {
 169                 goto out;
 170         }
 171         if (asprintf(&valid_princ_formats[6], "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm()) == -1) {
 172                 goto out;
 173         }
 174
 175         ZERO_STRUCT(kt_entry);
 176         ZERO_STRUCT(kt_cursor);
 177
 178         ret = smb_krb5_open_keytab(context, NULL, False, &keytab);
 179         if (ret) {
 180                 DEBUG(1, ("ads_keytab_verify_ticket: smb_krb5_open_keytab failed (%s)\n", error_message(ret)));
 181                 goto out;
 182         }
 183
 184         /* Iterate through the keytab.  For each key, if the principal
 185          * name case-insensitively matches one of the allowed formats,
 186          * try verifying the ticket using that principal. */
 187
 188         ret = krb5_kt_start_seq_get(context, keytab, &kt_cursor);
 189         if (ret) {
 190                 DEBUG(1, ("ads_keytab_verify_ticket: krb5_kt_start_seq_get failed (%s)\n", error_message(ret)));
 191                 goto out;
 192         }
 193
 194         while (!auth_ok && (krb5_kt_next_entry(context, keytab, &kt_entry, &kt_cursor) == 0)) {
 195                 ret = smb_krb5_unparse_name(context, kt_entry.principal, &entry_princ_s);
 196                 if (ret) {
 197                         DEBUG(1, ("ads_keytab_verify_ticket: smb_krb5_unparse_name failed (%s)\n",
 198                                 error_message(ret)));
 199                         goto out;
 200                 }
 201
 202                 for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {
 203
 204                         if (!strequal(entry_princ_s, valid_princ_formats[i])) {
 205                                 continue;
 206                         }
 207
 208                         number_matched_principals++;
 209                         packet.length = ticket->length;
 210                         packet.data = (char *)ticket->data;
 211                         *pp_tkt = NULL;
 212
 213                         ret = krb5_rd_req_return_keyblock_from_keytab(context, &auth_context, &packet,
 214                                                                       kt_entry.principal, keytab,
 215                                                                       NULL, pp_tkt, keyblock);
 216
 217                         if (ret) {
 218                                 DEBUG(10,("ads_keytab_verify_ticket: "
 219                                         "krb5_rd_req_return_keyblock_from_keytab(%s) failed: %s\n",
 220                                         entry_princ_s, error_message(ret)));
 221
 222                                 /* workaround for MIT:
 223                                 * as krb5_ktfile_get_entry will explicitly
 224                                 * close the krb5_keytab as soon as krb5_rd_req
 225                                 * has successfully decrypted the ticket but the
 226                                 * ticket is not valid yet (due to clockskew)
 227                                 * there is no point in querying more keytab
 228                                 * entries - Guenther */
 229
 230                                 if (ret == KRB5KRB_AP_ERR_TKT_NYV ||
 231                                     ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
 232                                     ret == KRB5KRB_AP_ERR_SKEW) {
 233                                         break;
 234                                 }
 235                         } else {
 236                                 DEBUG(3,("ads_keytab_verify_ticket: "
 237                                         "krb5_rd_req_return_keyblock_from_keytab succeeded for principal %s\n",
 238                                         entry_princ_s));
 239                                 auth_ok = True;
 240                                 break;
 241                         }
 242                 }
 243
 244                 /* Free the name we parsed. */
 245                 SAFE_FREE(entry_princ_s);
 246
 247                 /* Free the entry we just read. */
 248                 smb_krb5_kt_free_entry(context, &kt_entry);
 249                 ZERO_STRUCT(kt_entry);
 250         }
 251         krb5_kt_end_seq_get(context, keytab, &kt_cursor);
 252
 253         ZERO_STRUCT(kt_cursor);
 254
 255   out:
 256
 257         for (i = 0; i < ARRAY_SIZE(valid_princ_formats); i++) {
 258                 SAFE_FREE(valid_princ_formats[i]);
 259         }
 260
 261         if (!auth_ok) {
 262                 if (!number_matched_principals) {
 263                         DEBUG(3, ("ads_keytab_verify_ticket: no keytab principals matched expected file service name.\n"));
 264                 } else {
 265                         DEBUG(3, ("ads_keytab_verify_ticket: krb5_rd_req failed for all %d matched keytab principals\n",
 266                                 number_matched_principals));
 267                 }
 268         }
 269
 270         SAFE_FREE(entry_princ_s);
 271
 272         {
 273                 krb5_keytab_entry zero_kt_entry;
 274                 ZERO_STRUCT(zero_kt_entry);
 275                 if (memcmp(&zero_kt_entry, &kt_entry, sizeof(krb5_keytab_entry))) {
 276                         smb_krb5_kt_free_entry(context, &kt_entry);
 277                 }
 278         }
 279
 280         {
 281                 krb5_kt_cursor zero_csr;
 282                 ZERO_STRUCT(zero_csr);
 283                 if ((memcmp(&kt_cursor, &zero_csr, sizeof(krb5_kt_cursor)) != 0) && keytab) {
 284                         krb5_kt_end_seq_get(context, keytab, &kt_cursor);
 285                 }
 286         }
 287
 288         if (keytab) {
 289                 krb5_kt_close(context, keytab);
 290         }
 291         *perr = ret;
 292         return auth_ok;
 293 }
 294
 295 /**********************************************************************************
 296  Try to verify a ticket using the secrets.tdb.
 297 ***********************************************************************************/
 298
 299 static krb5_error_code ads_secrets_verify_ticket(krb5_context context,
 300                                                 krb5_auth_context auth_context,
 301                                                 krb5_principal host_princ,
 302                                                 const DATA_BLOB *ticket,
 303                                                 krb5_ticket **pp_tkt,
 304                                                 krb5_keyblock **keyblock,
 305                                                 krb5_error_code *perr)
 306 {
 307         krb5_error_code ret = 0;
 308         bool auth_ok = False;
 309         char *password_s = NULL;
 310         krb5_data password;
 311         krb5_enctype enctypes[] = {
 312 #if defined(ENCTYPE_ARCFOUR_HMAC)
 313                 ENCTYPE_ARCFOUR_HMAC,
 314 #endif
 315                 ENCTYPE_DES_CBC_CRC,
 316                 ENCTYPE_DES_CBC_MD5,
 317                 ENCTYPE_NULL
 318         };
 319         krb5_data packet;
 320         int i;
 321
 322         *pp_tkt = NULL;
 323         *keyblock = NULL;
 324         *perr = 0;
 325
 326
 327         if (!secrets_init()) {
 328                 DEBUG(1,("ads_secrets_verify_ticket: secrets_init failed\n"));
 329                 *perr = KRB5_CONFIG_CANTOPEN;
 330                 return False;
 331         }
 332
 333         password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 334         if (!password_s) {
 335                 DEBUG(1,("ads_secrets_verify_ticket: failed to fetch machine password\n"));
 336                 *perr = KRB5_LIBOS_CANTREADPWD;
 337                 return False;
 338         }
 339
 340         password.data = password_s;
 341         password.length = strlen(password_s);
 342
 343         /* CIFS doesn't use addresses in tickets. This would break NAT. JRA */
 344
 345         packet.length = ticket->length;
 346         packet.data = (char *)ticket->data;
 347
 348         /* We need to setup a auth context with each possible encoding type in turn. */
 349         for (i=0;enctypes[i];i++) {
 350                 krb5_keyblock *key = NULL;
 351
 352                 if (!(key = SMB_MALLOC_P(krb5_keyblock))) {
 353                         ret = ENOMEM;
 354                         goto out;
 355                 }
 356
 357                 if (create_kerberos_key_from_string(context, host_princ, &password, key, enctypes[i], false)) {
 358                         SAFE_FREE(key);
 359                         continue;
 360                 }
 361
 362                 krb5_auth_con_setuseruserkey(context, auth_context, key);
 363
 364                 if (!(ret = krb5_rd_req(context, &auth_context, &packet,
 365                                         NULL,
 366                                         NULL, NULL, pp_tkt))) {
 367                         DEBUG(10,("ads_secrets_verify_ticket: enc type [%u] decrypted message !\n",
 368                                 (unsigned int)enctypes[i] ));
 369                         auth_ok = True;
 370                         krb5_copy_keyblock(context, key, keyblock);
 371                         krb5_free_keyblock(context, key);
 372                         break;
 373                 }
 374
 375                 DEBUG((ret != KRB5_BAD_ENCTYPE) ? 3 : 10,
 376                                 ("ads_secrets_verify_ticket: enc type [%u] failed to decrypt with error %s\n",
 377                                 (unsigned int)enctypes[i], error_message(ret)));
 378
 379                 /* successfully decrypted but ticket is just not valid at the moment */
 380                 if (ret == KRB5KRB_AP_ERR_TKT_NYV ||
 381                     ret == KRB5KRB_AP_ERR_TKT_EXPIRED ||
 382                     ret == KRB5KRB_AP_ERR_SKEW) {
 383                         krb5_free_keyblock(context, key);
 384                         break;
 385                 }
 386
 387                 krb5_free_keyblock(context, key);
 388
 389         }
 390
 391  out:
 392         SAFE_FREE(password_s);
 393         *perr = ret;
 394         return auth_ok;
 395 }
 396
 397 /**********************************************************************************
 398  Verify an incoming ticket and parse out the principal name and
 399  authorization_data if available.
 400 ***********************************************************************************/
 401
 402 NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
 403                            const char *realm,
 404                            time_t time_offset,
 405                            const DATA_BLOB *ticket,
 406                            char **principal,
 407                            struct PAC_DATA **pac_data,
 408                            DATA_BLOB *ap_rep,
 409                            DATA_BLOB *session_key,
 410                            bool use_replay_cache)
 411 {
 412         NTSTATUS sret = NT_STATUS_LOGON_FAILURE;
 413         NTSTATUS pac_ret;
 414         DATA_BLOB auth_data;
 415         krb5_context context = NULL;
 416         krb5_auth_context auth_context = NULL;
 417         krb5_data packet;
 418         krb5_ticket *tkt = NULL;
 419         krb5_rcache rcache = NULL;
 420         krb5_keyblock *keyblock = NULL;
 421         time_t authtime;
 422         krb5_error_code ret = 0;
 423         int flags = 0;
 424         krb5_principal host_princ = NULL;
 425         krb5_const_principal client_principal = NULL;
 426         char *host_princ_s = NULL;
 427         bool auth_ok = False;
 428         bool got_auth_data = False;
 429         struct named_mutex *mutex = NULL;
 430
 431         ZERO_STRUCT(packet);
 432         ZERO_STRUCT(auth_data);
 433
 434         *principal = NULL;
 435         *pac_data = NULL;
 436         *ap_rep = data_blob_null;
 437         *session_key = data_blob_null;
 438
 439         initialize_krb5_error_table();
 440         ret = krb5_init_context(&context);
 441         if (ret) {
 442                 DEBUG(1,("ads_verify_ticket: krb5_init_context failed (%s)\n", error_message(ret)));
 443                 return NT_STATUS_LOGON_FAILURE;
 444         }
 445
 446         if (time_offset != 0) {
 447                 krb5_set_real_time(context, time(NULL) + time_offset, 0);
 448         }
 449
 450         ret = krb5_set_default_realm(context, realm);
 451         if (ret) {
 452                 DEBUG(1,("ads_verify_ticket: krb5_set_default_realm failed (%s)\n", error_message(ret)));
 453                 goto out;
 454         }
 455
 456         /* This whole process is far more complex than I would
 457            like. We have to go through all this to allow us to store
 458            the secret internally, instead of using /etc/krb5.keytab */
 459
 460         ret = krb5_auth_con_init(context, &auth_context);
 461         if (ret) {
 462                 DEBUG(1,("ads_verify_ticket: krb5_auth_con_init failed (%s)\n", error_message(ret)));
 463                 goto out;
 464         }
 465
 466         krb5_auth_con_getflags( context, auth_context, &flags );
 467         if ( !use_replay_cache ) {
 468                 /* Disable default use of a replay cache */
 469                 flags &= ~KRB5_AUTH_CONTEXT_DO_TIME;
 470                 krb5_auth_con_setflags( context, auth_context, flags );
 471         }
 472
 473         if (asprintf(&host_princ_s, "%s$", global_myname()) == -1) {
 474                 goto out;
 475         }
 476
 477         strlower_m(host_princ_s);
 478         ret = smb_krb5_parse_name(context, host_princ_s, &host_princ);
 479         if (ret) {
 480                 DEBUG(1,("ads_verify_ticket: smb_krb5_parse_name(%s) failed (%s)\n",
 481                                         host_princ_s, error_message(ret)));
 482                 goto out;
 483         }
 484
 485
 486         if ( use_replay_cache ) {
 487
 488                 /* Lock a mutex surrounding the replay as there is no
 489                    locking in the MIT krb5 code surrounding the replay
 490                    cache... */
 491
 492                 mutex = grab_named_mutex(talloc_tos(), "replay cache mutex",
 493                                          10);
 494                 if (mutex == NULL) {
 495                         DEBUG(1,("ads_verify_ticket: unable to protect "
 496                                  "replay cache with mutex.\n"));
 497                         ret = KRB5_CC_IO;
 498                         goto out;
 499                 }
 500
 501                 /* JRA. We must set the rcache here. This will prevent
 502                    replay attacks. */
 503
 504                 ret = krb5_get_server_rcache(context,
 505                                              krb5_princ_component(context, host_princ, 0),
 506                                              &rcache);
 507                 if (ret) {
 508                         DEBUG(1,("ads_verify_ticket: krb5_get_server_rcache "
 509                                  "failed (%s)\n", error_message(ret)));
 510                         goto out;
 511                 }
 512
 513                 ret = krb5_auth_con_setrcache(context, auth_context, rcache);
 514                 if (ret) {
 515                         DEBUG(1,("ads_verify_ticket: krb5_auth_con_setrcache "
 516                                  "failed (%s)\n", error_message(ret)));
 517                         goto out;
 518                 }
 519         }
 520
 521         switch (lp_kerberos_method()) {
 522         default:
 523         case KERBEROS_VERIFY_SECRETS:
 524                 auth_ok = ads_secrets_verify_ticket(context, auth_context,
 525                     host_princ, ticket, &tkt, &keyblock, &ret);
 526                 break;
 527         case KERBEROS_VERIFY_SYSTEM_KEYTAB:
 528                 auth_ok = ads_keytab_verify_ticket(context, auth_context,
 529                     ticket, &tkt, &keyblock, &ret);
 530                 break;
 531         case KERBEROS_VERIFY_DEDICATED_KEYTAB:
 532                 auth_ok = ads_dedicated_keytab_verify_ticket(context,
 533                     auth_context, ticket, &tkt, &keyblock, &ret);
 534                 break;
 535         case KERBEROS_VERIFY_SECRETS_AND_KEYTAB:
 536                 /* First try secrets.tdb and fallback to the krb5.keytab if
 537                    necessary.  This is the pre 3.4 behavior when
 538                    "use kerberos keytab" was true.*/
 539                 auth_ok = ads_secrets_verify_ticket(context, auth_context,
 540                     host_princ, ticket, &tkt, &keyblock, &ret);
 541
 542                 if (!auth_ok) {
 543                         /* Only fallback if we failed to decrypt the ticket */
 544                         if (ret != KRB5KRB_AP_ERR_TKT_NYV &&
 545                             ret != KRB5KRB_AP_ERR_TKT_EXPIRED &&
 546                             ret != KRB5KRB_AP_ERR_SKEW) {
 547                                 auth_ok = ads_keytab_verify_ticket(context,
 548                                     auth_context, ticket, &tkt, &keyblock,
 549                                     &ret);
 550                         }
 551                 }
 552                 break;
 553         }
 554
 555         if ( use_replay_cache ) {
 556                 TALLOC_FREE(mutex);
 557 #if 0
 558                 /* Heimdal leaks here, if we fix the leak, MIT crashes */
 559                 if (rcache) {
 560                         krb5_rc_close(context, rcache);
 561                 }
 562 #endif
 563         }
 564
 565         if (!auth_ok) {
 566                 DEBUG(3,("ads_verify_ticket: krb5_rd_req with auth failed (%s)\n",
 567                          error_message(ret)));
 568                 /* Try map the error return in case it's something like
 569                  * a clock skew error.
 570                  */
 571                 sret = krb5_to_nt_status(ret);
 572                 if (NT_STATUS_IS_OK(sret) || NT_STATUS_EQUAL(sret,NT_STATUS_UNSUCCESSFUL)) {
 573                         sret = NT_STATUS_LOGON_FAILURE;
 574                 }
 575                 DEBUG(10,("ads_verify_ticket: returning error %s\n",
 576                         nt_errstr(sret) ));
 577                 goto out;
 578         }
 579
 580         authtime = get_authtime_from_tkt(tkt);
 581         client_principal = get_principal_from_tkt(tkt);
 582
 583         ret = krb5_mk_rep(context, auth_context, &packet);
 584         if (ret) {
 585                 DEBUG(3,("ads_verify_ticket: Failed to generate mutual authentication reply (%s)\n",
 586                         error_message(ret)));
 587                 goto out;
 588         }
 589
 590         *ap_rep = data_blob(packet.data, packet.length);
 591         if (packet.data) {
 592                 kerberos_free_data_contents(context, &packet);
 593                 ZERO_STRUCT(packet);
 594         }
 595
 596         get_krb5_smb_session_key(context, auth_context, session_key, True);
 597         dump_data_pw("SMB session key (from ticket)\n", session_key->data, session_key->length);
 598
 599 #if 0
 600         file_save("/tmp/ticket.dat", ticket->data, ticket->length);
 601 #endif
 602
 603         /* continue when no PAC is retrieved or we couldn't decode the PAC
 604            (like accounts that have the UF_NO_AUTH_DATA_REQUIRED flag set, or
 605            Kerberos tickets encrypted using a DES key) - Guenther */
 606
 607         got_auth_data = get_auth_data_from_tkt(mem_ctx, &auth_data, tkt);
 608         if (!got_auth_data) {
 609                 DEBUG(3,("ads_verify_ticket: did not retrieve auth data. continuing without PAC\n"));
 610         }
 611
 612         if (got_auth_data) {
 613                 pac_ret = decode_pac_data(mem_ctx, &auth_data, context, keyblock, client_principal, authtime, pac_data);
 614                 if (!NT_STATUS_IS_OK(pac_ret)) {
 615                         DEBUG(3,("ads_verify_ticket: failed to decode PAC_DATA: %s\n", nt_errstr(pac_ret)));
 616                         *pac_data = NULL;
 617                 }
 618                 data_blob_free(&auth_data);
 619         }
 620
 621 #if 0
 622 #if defined(HAVE_KRB5_TKT_ENC_PART2)
 623         /* MIT */
 624         if (tkt->enc_part2) {
 625                 file_save("/tmp/authdata.dat",
 626                           tkt->enc_part2->authorization_data[0]->contents,
 627                           tkt->enc_part2->authorization_data[0]->length);
 628         }
 629 #else
 630         /* Heimdal */
 631         if (tkt->ticket.authorization_data) {
 632                 file_save("/tmp/authdata.dat",
 633                           tkt->ticket.authorization_data->val->ad_data.data,
 634                           tkt->ticket.authorization_data->val->ad_data.length);
 635         }
 636 #endif
 637 #endif
 638
 639         if ((ret = smb_krb5_unparse_name(context, client_principal, principal))) {
 640                 DEBUG(3,("ads_verify_ticket: smb_krb5_unparse_name failed (%s)\n",
 641                          error_message(ret)));
 642                 sret = NT_STATUS_LOGON_FAILURE;
 643                 goto out;
 644         }
 645
 646         sret = NT_STATUS_OK;
 647
 648  out:
 649
 650         TALLOC_FREE(mutex);
 651
 652         if (!NT_STATUS_IS_OK(sret)) {
 653                 data_blob_free(&auth_data);
 654         }
 655
 656         if (!NT_STATUS_IS_OK(sret)) {
 657                 data_blob_free(ap_rep);
 658         }
 659
 660         if (host_princ) {
 661                 krb5_free_principal(context, host_princ);
 662         }
 663
 664         if (keyblock) {
 665                 krb5_free_keyblock(context, keyblock);
 666         }
 667
 668         if (tkt != NULL) {
 669                 krb5_free_ticket(context, tkt);
 670         }
 671
 672         SAFE_FREE(host_princ_s);
 673
 674         if (auth_context) {
 675                 krb5_auth_con_free(context, auth_context);
 676         }
 677
 678         if (context) {
 679                 krb5_free_context(context);
 680         }
 681
 682         return sret;
 683 }
 684
 685 #endif /* HAVE_KRB5 */