source3/winbindd/winbindd_pam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - pam auth funcions
   5
   6    Copyright (C) Andrew Tridgell 2000
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett 2001-2002
   9    Copyright (C) Guenther Deschner 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_WINBIND
  29
  30 #define LOGON_KRB5_FAIL_CLOCK_SKEW      0x02000000
  31
  32 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
  33                                     struct winbindd_cli_state *state,
  34                                     struct netr_SamInfo3 *info3)
  35 {
  36         char *ex;
  37         size_t size;
  38         uint32_t i;
  39
  40         state->response.data.auth.info3.logon_time =
  41                 nt_time_to_unix(info3->base.last_logon);
  42         state->response.data.auth.info3.logoff_time =
  43                 nt_time_to_unix(info3->base.last_logoff);
  44         state->response.data.auth.info3.kickoff_time =
  45                 nt_time_to_unix(info3->base.acct_expiry);
  46         state->response.data.auth.info3.pass_last_set_time =
  47                 nt_time_to_unix(info3->base.last_password_change);
  48         state->response.data.auth.info3.pass_can_change_time =
  49                 nt_time_to_unix(info3->base.allow_password_change);
  50         state->response.data.auth.info3.pass_must_change_time =
  51                 nt_time_to_unix(info3->base.force_password_change);
  52
  53         state->response.data.auth.info3.logon_count = info3->base.logon_count;
  54         state->response.data.auth.info3.bad_pw_count = info3->base.bad_password_count;
  55
  56         state->response.data.auth.info3.user_rid = info3->base.rid;
  57         state->response.data.auth.info3.group_rid = info3->base.primary_gid;
  58         sid_to_fstring(state->response.data.auth.info3.dom_sid, info3->base.domain_sid);
  59
  60         state->response.data.auth.info3.num_groups = info3->base.groups.count;
  61         state->response.data.auth.info3.user_flgs = info3->base.user_flags;
  62
  63         state->response.data.auth.info3.acct_flags = info3->base.acct_flags;
  64         state->response.data.auth.info3.num_other_sids = info3->sidcount;
  65
  66         fstrcpy(state->response.data.auth.info3.user_name,
  67                 info3->base.account_name.string);
  68         fstrcpy(state->response.data.auth.info3.full_name,
  69                 info3->base.full_name.string);
  70         fstrcpy(state->response.data.auth.info3.logon_script,
  71                 info3->base.logon_script.string);
  72         fstrcpy(state->response.data.auth.info3.profile_path,
  73                 info3->base.profile_path.string);
  74         fstrcpy(state->response.data.auth.info3.home_dir,
  75                 info3->base.home_directory.string);
  76         fstrcpy(state->response.data.auth.info3.dir_drive,
  77                 info3->base.home_drive.string);
  78
  79         fstrcpy(state->response.data.auth.info3.logon_srv,
  80                 info3->base.logon_server.string);
  81         fstrcpy(state->response.data.auth.info3.logon_dom,
  82                 info3->base.domain.string);
  83
  84         ex = talloc_strdup(mem_ctx, "");
  85         NT_STATUS_HAVE_NO_MEMORY(ex);
  86
  87         for (i=0; i < info3->base.groups.count; i++) {
  88                 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
  89                                                    info3->base.groups.rids[i].rid,
  90                                                    info3->base.groups.rids[i].attributes);
  91                 NT_STATUS_HAVE_NO_MEMORY(ex);
  92         }
  93
  94         for (i=0; i < info3->sidcount; i++) {
  95                 char *sid;
  96
  97                 sid = dom_sid_string(mem_ctx, info3->sids[i].sid);
  98                 NT_STATUS_HAVE_NO_MEMORY(sid);
  99
 100                 ex = talloc_asprintf_append_buffer(ex, "%s:0x%08X\n",
 101                                                    sid,
 102                                                    info3->sids[i].attributes);
 103                 NT_STATUS_HAVE_NO_MEMORY(ex);
 104
 105                 talloc_free(sid);
 106         }
 107
 108         size = talloc_get_size(ex);
 109
 110         SAFE_FREE(state->response.extra_data.data);
 111         state->response.extra_data.data = SMB_MALLOC(size);
 112         if (!state->response.extra_data.data) {
 113                 return NT_STATUS_NO_MEMORY;
 114         }
 115         memcpy(state->response.extra_data.data, ex, size);
 116         talloc_free(ex);
 117
 118         state->response.length += size;
 119
 120         return NT_STATUS_OK;
 121 }
 122
 123 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
 124                                     struct winbindd_cli_state *state,
 125                                     struct netr_SamInfo3 *info3)
 126 {
 127         DATA_BLOB blob;
 128         enum ndr_err_code ndr_err;
 129
 130         ndr_err = ndr_push_struct_blob(&blob, mem_ctx, NULL, info3,
 131                                        (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
 132         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 133                 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
 134                 return ndr_map_error2ntstatus(ndr_err);
 135         }
 136
 137         SAFE_FREE(state->response.extra_data.data);
 138         state->response.extra_data.data = SMB_MALLOC(blob.length);
 139         if (!state->response.extra_data.data) {
 140                 data_blob_free(&blob);
 141                 return NT_STATUS_NO_MEMORY;
 142         }
 143
 144         memset(state->response.extra_data.data, '\0', blob.length);
 145         memcpy(state->response.extra_data.data, blob.data, blob.length);
 146         state->response.length += blob.length;
 147
 148         data_blob_free(&blob);
 149
 150         return NT_STATUS_OK;
 151 }
 152
 153 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
 154                                      struct winbindd_cli_state *state,
 155                                      const struct netr_SamInfo3 *info3,
 156                                      const char *name_domain,
 157                                      const char *name_user)
 158 {
 159         /* We've been asked to return the unix username, per
 160            'winbind use default domain' settings and the like */
 161
 162         const char *nt_username, *nt_domain;
 163
 164         nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
 165         if (!nt_domain) {
 166                 /* If the server didn't give us one, just use the one
 167                  * we sent them */
 168                 nt_domain = name_domain;
 169         }
 170
 171         nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
 172         if (!nt_username) {
 173                 /* If the server didn't give us one, just use the one
 174                  * we sent them */
 175                 nt_username = name_user;
 176         }
 177
 178         fill_domain_username(state->response.data.auth.unix_username,
 179                              nt_domain, nt_username, true);
 180
 181         DEBUG(5,("Setting unix username to [%s]\n",
 182                 state->response.data.auth.unix_username));
 183
 184         return NT_STATUS_OK;
 185 }
 186
 187 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 188                                  struct winbindd_cli_state *state,
 189                                  const struct netr_SamInfo3 *info3,
 190                                  const char *name_domain,
 191                                  const char *name_user)
 192 {
 193         char *afsname = NULL;
 194         char *cell;
 195
 196         afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
 197         if (afsname == NULL) {
 198                 return NT_STATUS_NO_MEMORY;
 199         }
 200
 201         afsname = talloc_string_sub(mem_ctx,
 202                                     lp_afs_username_map(),
 203                                     "%D", name_domain);
 204         afsname = talloc_string_sub(mem_ctx, afsname,
 205                                     "%u", name_user);
 206         afsname = talloc_string_sub(mem_ctx, afsname,
 207                                     "%U", name_user);
 208
 209         {
 210                 DOM_SID user_sid;
 211                 fstring sidstr;
 212
 213                 sid_copy(&user_sid, info3->base.domain_sid);
 214                 sid_append_rid(&user_sid, info3->base.rid);
 215                 sid_to_fstring(sidstr, &user_sid);
 216                 afsname = talloc_string_sub(mem_ctx, afsname,
 217                                             "%s", sidstr);
 218         }
 219
 220         if (afsname == NULL) {
 221                 return NT_STATUS_NO_MEMORY;
 222         }
 223
 224         strlower_m(afsname);
 225
 226         DEBUG(10, ("Generating token for user %s\n", afsname));
 227
 228         cell = strchr(afsname, '@');
 229
 230         if (cell == NULL) {
 231                 return NT_STATUS_NO_MEMORY;
 232         }
 233
 234         *cell = '\0';
 235         cell += 1;
 236
 237         /* Append an AFS token string */
 238         SAFE_FREE(state->response.extra_data.data);
 239         state->response.extra_data.data =
 240                 afs_createtoken_str(afsname, cell);
 241
 242         if (state->response.extra_data.data != NULL) {
 243                 state->response.length +=
 244                         strlen((const char *)state->response.extra_data.data)+1;
 245         }
 246
 247         return NT_STATUS_OK;
 248 }
 249
 250 static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 251                                      struct netr_SamInfo3 *info3,
 252                                      const char *group_sid)
 253 /**
 254  * Check whether a user belongs to a group or list of groups.
 255  *
 256  * @param mem_ctx talloc memory context.
 257  * @param info3 user information, including group membership info.
 258  * @param group_sid One or more groups , separated by commas.
 259  *
 260  * @return NT_STATUS_OK on success,
 261  *    NT_STATUS_LOGON_FAILURE if the user does not belong,
 262  *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
 263  */
 264 {
 265         DOM_SID *require_membership_of_sid;
 266         size_t num_require_membership_of_sid;
 267         char *req_sid;
 268         const char *p;
 269         DOM_SID sid;
 270         size_t i;
 271         struct nt_user_token *token;
 272         TALLOC_CTX *frame = NULL;
 273         NTSTATUS status;
 274
 275         /* Parse the 'required group' SID */
 276
 277         if (!group_sid || !group_sid[0]) {
 278                 /* NO sid supplied, all users may access */
 279                 return NT_STATUS_OK;
 280         }
 281
 282         if (!(token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
 283                 DEBUG(0, ("talloc failed\n"));
 284                 return NT_STATUS_NO_MEMORY;
 285         }
 286
 287         num_require_membership_of_sid = 0;
 288         require_membership_of_sid = NULL;
 289
 290         p = group_sid;
 291
 292         frame = talloc_stackframe();
 293         while (next_token_talloc(frame, &p, &req_sid, ",")) {
 294                 if (!string_to_sid(&sid, req_sid)) {
 295                         DEBUG(0, ("check_info3_in_group: could not parse %s "
 296                                   "as a SID!", req_sid));
 297                         TALLOC_FREE(frame);
 298                         return NT_STATUS_INVALID_PARAMETER;
 299                 }
 300
 301                 status = add_sid_to_array(mem_ctx, &sid,
 302                                           &require_membership_of_sid,
 303                                           &num_require_membership_of_sid);
 304                 if (!NT_STATUS_IS_OK(status)) {
 305                         DEBUG(0, ("add_sid_to_array failed\n"));
 306                         TALLOC_FREE(frame);
 307                         return status;
 308                 }
 309         }
 310
 311         TALLOC_FREE(frame);
 312
 313         status = sid_array_from_info3(mem_ctx, info3,
 314                                       &token->user_sids,
 315                                       &token->num_sids,
 316                                       true, false);
 317         if (!NT_STATUS_IS_OK(status)) {
 318                 return status;
 319         }
 320
 321         if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
 322                                                   token))
 323             || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
 324                                                      token))) {
 325                 DEBUG(3, ("could not add aliases: %s\n",
 326                           nt_errstr(status)));
 327                 return status;
 328         }
 329
 330         debug_nt_user_token(DBGC_CLASS, 10, token);
 331
 332         for (i=0; i<num_require_membership_of_sid; i++) {
 333                 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
 334                                    &require_membership_of_sid[i])));
 335                 if (nt_token_check_sid(&require_membership_of_sid[i],
 336                                        token)) {
 337                         DEBUG(10, ("Access ok\n"));
 338                         return NT_STATUS_OK;
 339                 }
 340         }
 341
 342         /* Do not distinguish this error from a wrong username/pw */
 343
 344         return NT_STATUS_LOGON_FAILURE;
 345 }
 346
 347 struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
 348                                         const char *domain_name)
 349 {
 350         struct winbindd_domain *domain;
 351
 352         if (IS_DC) {
 353                 domain = find_domain_from_name_noinit(domain_name);
 354                 if (domain == NULL) {
 355                         DEBUG(3, ("Authentication for domain [%s] refused "
 356                                   "as it is not a trusted domain\n",
 357                                   domain_name));
 358                 }
 359                 return domain;
 360         }
 361
 362         if (is_myname(domain_name)) {
 363                 DEBUG(3, ("Authentication for domain %s (local domain "
 364                           "to this server) not supported at this "
 365                           "stage\n", domain_name));
 366                 return NULL;
 367         }
 368
 369         /* we can auth against trusted domains */
 370         if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
 371                 domain = find_domain_from_name_noinit(domain_name);
 372                 if (domain == NULL) {
 373                         DEBUG(3, ("Authentication for domain [%s] skipped "
 374                                   "as it is not a trusted domain\n",
 375                                   domain_name));
 376                 } else {
 377                         return domain;
 378                 }
 379         }
 380
 381         return find_our_domain();
 382 }
 383
 384 static void fill_in_password_policy(struct winbindd_response *r,
 385                                     const struct samr_DomInfo1 *p)
 386 {
 387         r->data.auth.policy.min_length_password =
 388                 p->min_password_length;
 389         r->data.auth.policy.password_history =
 390                 p->password_history_length;
 391         r->data.auth.policy.password_properties =
 392                 p->password_properties;
 393         r->data.auth.policy.expire      =
 394                 nt_time_to_unix_abs((NTTIME *)&(p->max_password_age));
 395         r->data.auth.policy.min_passwordage =
 396                 nt_time_to_unix_abs((NTTIME *)&(p->min_password_age));
 397 }
 398
 399 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
 400                                        struct winbindd_cli_state *state)
 401 {
 402         struct winbindd_methods *methods;
 403         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 404         struct samr_DomInfo1 password_policy;
 405
 406         if ( !winbindd_can_contact_domain( domain ) ) {
 407                 DEBUG(5,("fillup_password_policy: No inbound trust to "
 408                          "contact domain %s\n", domain->name));
 409                 return NT_STATUS_NOT_SUPPORTED;
 410         }
 411
 412         methods = domain->methods;
 413
 414         status = methods->password_policy(domain, state->mem_ctx, &password_policy);
 415         if (NT_STATUS_IS_ERR(status)) {
 416                 return status;
 417         }
 418
 419         fill_in_password_policy(&state->response, &password_policy);
 420
 421         return NT_STATUS_OK;
 422 }
 423
 424 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
 425                                                          TALLOC_CTX *mem_ctx,
 426                                                          uint16 *lockout_threshold)
 427 {
 428         struct winbindd_methods *methods;
 429         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 430         struct samr_DomInfo12 lockout_policy;
 431
 432         *lockout_threshold = 0;
 433
 434         methods = domain->methods;
 435
 436         status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
 437         if (NT_STATUS_IS_ERR(status)) {
 438                 return status;
 439         }
 440
 441         *lockout_threshold = lockout_policy.lockout_threshold;
 442
 443         return NT_STATUS_OK;
 444 }
 445
 446 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
 447                                    TALLOC_CTX *mem_ctx,
 448                                    uint32 *password_properties)
 449 {
 450         struct winbindd_methods *methods;
 451         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 452         struct samr_DomInfo1 password_policy;
 453
 454         *password_properties = 0;
 455
 456         methods = domain->methods;
 457
 458         status = methods->password_policy(domain, mem_ctx, &password_policy);
 459         if (NT_STATUS_IS_ERR(status)) {
 460                 return status;
 461         }
 462
 463         *password_properties = password_policy.password_properties;
 464
 465         return NT_STATUS_OK;
 466 }
 467
 468 #ifdef HAVE_KRB5
 469
 470 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 471                                         const char *type,
 472                                         uid_t uid,
 473                                         bool *internal_ccache)
 474 {
 475         /* accept FILE and WRFILE as krb5_cc_type from the client and then
 476          * build the full ccname string based on the user's uid here -
 477          * Guenther*/
 478
 479         const char *gen_cc = NULL;
 480
 481         *internal_ccache = true;
 482
 483         if (uid == -1) {
 484                 goto memory_ccache;
 485         }
 486
 487         if (!type || type[0] == '\0') {
 488                 goto memory_ccache;
 489         }
 490
 491         if (strequal(type, "FILE")) {
 492                 gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
 493         } else if (strequal(type, "WRFILE")) {
 494                 gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
 495         } else {
 496                 DEBUG(10,("we don't allow to set a %s type ccache\n", type));
 497                 goto memory_ccache;
 498         }
 499
 500         *internal_ccache = false;
 501         goto done;
 502
 503   memory_ccache:
 504         gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
 505
 506   done:
 507         if (gen_cc == NULL) {
 508                 DEBUG(0,("out of memory\n"));
 509                 return NULL;
 510         }
 511
 512         DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
 513
 514         return gen_cc;
 515 }
 516
 517 static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
 518 {
 519         const char *type = state->request.data.auth.krb5_cc_type;
 520
 521         state->response.data.auth.krb5ccname[0] = '\0';
 522
 523         if (type[0] == '\0') {
 524                 return;
 525         }
 526
 527         if (!strequal(type, "FILE") &&
 528             !strequal(type, "WRFILE")) {
 529                 DEBUG(10,("won't return krbccname for a %s type ccache\n",
 530                         type));
 531                 return;
 532         }
 533
 534         fstrcpy(state->response.data.auth.krb5ccname, cc);
 535 }
 536
 537 #endif
 538
 539 static uid_t get_uid_from_state(struct winbindd_cli_state *state)
 540 {
 541         uid_t uid = -1;
 542
 543         uid = state->request.data.auth.uid;
 544
 545         if (uid < 0) {
 546                 DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
 547                 return -1;
 548         }
 549         return uid;
 550 }
 551
 552 /**********************************************************************
 553  Authenticate a user with a clear text password using Kerberos and fill up
 554  ccache if required
 555  **********************************************************************/
 556
 557 static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 558                                             struct winbindd_cli_state *state,
 559                                             struct netr_SamInfo3 **info3)
 560 {
 561 #ifdef HAVE_KRB5
 562         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 563         krb5_error_code krb5_ret;
 564         const char *cc = NULL;
 565         const char *principal_s = NULL;
 566         const char *service = NULL;
 567         char *realm = NULL;
 568         fstring name_domain, name_user;
 569         time_t ticket_lifetime = 0;
 570         time_t renewal_until = 0;
 571         uid_t uid = -1;
 572         ADS_STRUCT *ads;
 573         time_t time_offset = 0;
 574         bool internal_ccache = true;
 575
 576         ZERO_STRUCTP(info3);
 577
 578         *info3 = NULL;
 579
 580         /* 1st step:
 581          * prepare a krb5_cc_cache string for the user */
 582
 583         uid = get_uid_from_state(state);
 584         if (uid == -1) {
 585                 DEBUG(0,("no valid uid\n"));
 586         }
 587
 588         cc = generate_krb5_ccache(state->mem_ctx,
 589                                   state->request.data.auth.krb5_cc_type,
 590                                   state->request.data.auth.uid,
 591                                   &internal_ccache);
 592         if (cc == NULL) {
 593                 return NT_STATUS_NO_MEMORY;
 594         }
 595
 596
 597         /* 2nd step:
 598          * get kerberos properties */
 599
 600         if (domain->private_data) {
 601                 ads = (ADS_STRUCT *)domain->private_data;
 602                 time_offset = ads->auth.time_offset;
 603         }
 604
 605
 606         /* 3rd step:
 607          * do kerberos auth and setup ccache as the user */
 608
 609         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
 610
 611         realm = domain->alt_name;
 612         strupper_m(realm);
 613
 614         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
 615         if (principal_s == NULL) {
 616                 return NT_STATUS_NO_MEMORY;
 617         }
 618
 619         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
 620         if (service == NULL) {
 621                 return NT_STATUS_NO_MEMORY;
 622         }
 623
 624         /* if this is a user ccache, we need to act as the user to let the krb5
 625          * library handle the chown, etc. */
 626
 627         /************************ ENTERING NON-ROOT **********************/
 628
 629         if (!internal_ccache) {
 630                 set_effective_uid(uid);
 631                 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
 632         }
 633
 634         result = kerberos_return_info3_from_pac(state->mem_ctx,
 635                                                 principal_s,
 636                                                 state->request.data.auth.pass,
 637                                                 time_offset,
 638                                                 &ticket_lifetime,
 639                                                 &renewal_until,
 640                                                 cc,
 641                                                 true,
 642                                                 true,
 643                                                 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 644                                                 info3);
 645         if (!internal_ccache) {
 646                 gain_root_privilege();
 647         }
 648
 649         /************************ RETURNED TO ROOT **********************/
 650
 651         if (!NT_STATUS_IS_OK(result)) {
 652                 goto failed;
 653         }
 654
 655         DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
 656                 principal_s));
 657
 658         /* if we had a user's ccache then return that string for the pam
 659          * environment */
 660
 661         if (!internal_ccache) {
 662
 663                 setup_return_cc_name(state, cc);
 664
 665                 result = add_ccache_to_list(principal_s,
 666                                             cc,
 667                                             service,
 668                                             state->request.data.auth.user,
 669                                             realm,
 670                                             uid,
 671                                             time(NULL),
 672                                             ticket_lifetime,
 673                                             renewal_until,
 674                                             false);
 675
 676                 if (!NT_STATUS_IS_OK(result)) {
 677                         DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
 678                                 nt_errstr(result)));
 679                 }
 680         } else {
 681
 682                 /* need to delete the memory cred cache, it is not used anymore */
 683
 684                 krb5_ret = ads_kdestroy(cc);
 685                 if (krb5_ret) {
 686                         DEBUG(3,("winbindd_raw_kerberos_login: "
 687                                  "could not destroy krb5 credential cache: "
 688                                  "%s\n", error_message(krb5_ret)));
 689                 }
 690
 691         }
 692
 693         return NT_STATUS_OK;
 694
 695 failed:
 696
 697         /* we could have created a new credential cache with a valid tgt in it
 698          * but we werent able to get or verify the service ticket for this
 699          * local host and therefor didn't get the PAC, we need to remove that
 700          * cache entirely now */
 701
 702         krb5_ret = ads_kdestroy(cc);
 703         if (krb5_ret) {
 704                 DEBUG(3,("winbindd_raw_kerberos_login: "
 705                          "could not destroy krb5 credential cache: "
 706                          "%s\n", error_message(krb5_ret)));
 707         }
 708
 709         if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
 710                 DEBUG(3,("winbindd_raw_kerberos_login: "
 711                           "could not remove ccache for user %s\n",
 712                         state->request.data.auth.user));
 713         }
 714
 715         return result;
 716 #else
 717         return NT_STATUS_NOT_SUPPORTED;
 718 #endif /* HAVE_KRB5 */
 719 }
 720
 721 /****************************************************************
 722 ****************************************************************/
 723
 724 static bool check_request_flags(uint32_t flags)
 725 {
 726         uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
 727                                WBFLAG_PAM_INFO3_TEXT |
 728                                WBFLAG_PAM_INFO3_NDR;
 729
 730         if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
 731              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
 732              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
 733               !(flags & flags_edata) ) {
 734                 return true;
 735         }
 736
 737         DEBUG(1,("check_request_flags: invalid request flags[0x%08X]\n",flags));
 738
 739         return false;
 740 }
 741
 742 /****************************************************************
 743 ****************************************************************/
 744
 745 static NTSTATUS append_data(struct winbindd_cli_state *state,
 746                             struct netr_SamInfo3 *info3,
 747                             const char *name_domain,
 748                             const char *name_user)
 749 {
 750         NTSTATUS result;
 751         uint32_t flags = state->request.flags;
 752
 753         if (flags & WBFLAG_PAM_USER_SESSION_KEY) {
 754                 memcpy(state->response.data.auth.user_session_key,
 755                        info3->base.key.key,
 756                        sizeof(state->response.data.auth.user_session_key)
 757                        /* 16 */);
 758         }
 759
 760         if (flags & WBFLAG_PAM_LMKEY) {
 761                 memcpy(state->response.data.auth.first_8_lm_hash,
 762                        info3->base.LMSessKey.key,
 763                        sizeof(state->response.data.auth.first_8_lm_hash)
 764                        /* 8 */);
 765         }
 766
 767         if (flags & WBFLAG_PAM_INFO3_TEXT) {
 768                 result = append_info3_as_txt(state->mem_ctx, state, info3);
 769                 if (!NT_STATUS_IS_OK(result)) {
 770                         DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
 771                                 nt_errstr(result)));
 772                         return result;
 773                 }
 774         }
 775
 776         /* currently, anything from here on potentially overwrites extra_data. */
 777
 778         if (flags & WBFLAG_PAM_INFO3_NDR) {
 779                 result = append_info3_as_ndr(state->mem_ctx, state, info3);
 780                 if (!NT_STATUS_IS_OK(result)) {
 781                         DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
 782                                 nt_errstr(result)));
 783                         return result;
 784                 }
 785         }
 786
 787         if (flags & WBFLAG_PAM_UNIX_NAME) {
 788                 result = append_unix_username(state->mem_ctx, state, info3,
 789                                               name_domain, name_user);
 790                 if (!NT_STATUS_IS_OK(result)) {
 791                         DEBUG(10,("Failed to append Unix Username: %s\n",
 792                                 nt_errstr(result)));
 793                         return result;
 794                 }
 795         }
 796
 797         if (flags & WBFLAG_PAM_AFS_TOKEN) {
 798                 result = append_afs_token(state->mem_ctx, state, info3,
 799                                           name_domain, name_user);
 800                 if (!NT_STATUS_IS_OK(result)) {
 801                         DEBUG(10,("Failed to append AFS token: %s\n",
 802                                 nt_errstr(result)));
 803                         return result;
 804                 }
 805         }
 806
 807         return NT_STATUS_OK;
 808 }
 809
 810 void winbindd_pam_auth(struct winbindd_cli_state *state)
 811 {
 812         struct winbindd_domain *domain;
 813         fstring name_domain, name_user, mapped_user;
 814         char *mapped = NULL;
 815         NTSTATUS result;
 816         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 817
 818         /* Ensure null termination */
 819         state->request.data.auth.user
 820                 [sizeof(state->request.data.auth.user)-1]='\0';
 821
 822         /* Ensure null termination */
 823         state->request.data.auth.pass
 824                 [sizeof(state->request.data.auth.pass)-1]='\0';
 825
 826         DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
 827                   state->request.data.auth.user));
 828
 829         if (!check_request_flags(state->request.flags)) {
 830                 result = NT_STATUS_INVALID_PARAMETER_MIX;
 831                 goto done;
 832         }
 833
 834         /* Parse domain and username */
 835
 836         name_map_status = normalize_name_unmap(state->mem_ctx,
 837                                                state->request.data.auth.user,
 838                                                &mapped);
 839
 840         /* If the name normalization didnt' actually do anything,
 841            just use the original name */
 842
 843         if (NT_STATUS_IS_OK(name_map_status)
 844             ||NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED)) {
 845                 fstrcpy(mapped_user, mapped);
 846         }
 847
 848         if (!canonicalize_username(mapped_user, name_domain, name_user)) {
 849                 result = NT_STATUS_NO_SUCH_USER;
 850                 goto done;
 851         }
 852
 853         domain = find_auth_domain(state, name_domain);
 854
 855         if (domain == NULL) {
 856                 result = NT_STATUS_NO_SUCH_USER;
 857                 goto done;
 858         }
 859
 860         sendto_domain(state, domain);
 861         return;
 862  done:
 863         set_auth_errors(&state->response, result);
 864         DEBUG(5, ("Plain text authentication for %s returned %s "
 865                   "(PAM: %d)\n",
 866                   state->request.data.auth.user,
 867                   state->response.data.auth.nt_status_string,
 868                   state->response.data.auth.pam_error));
 869         request_error(state);
 870 }
 871
 872 NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 873                                        struct winbindd_cli_state *state,
 874                                        struct netr_SamInfo3 **info3)
 875 {
 876         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
 877         uint16 max_allowed_bad_attempts;
 878         fstring name_domain, name_user;
 879         DOM_SID sid;
 880         enum lsa_SidType type;
 881         uchar new_nt_pass[NT_HASH_LEN];
 882         const uint8 *cached_nt_pass;
 883         const uint8 *cached_salt;
 884         struct netr_SamInfo3 *my_info3;
 885         time_t kickoff_time, must_change_time;
 886         bool password_good = false;
 887 #ifdef HAVE_KRB5
 888         struct winbindd_tdc_domain *tdc_domain = NULL;
 889 #endif
 890
 891         *info3 = NULL;
 892
 893         ZERO_STRUCTP(info3);
 894
 895         DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
 896
 897         /* Parse domain and username */
 898
 899         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
 900
 901
 902         if (!lookup_cached_name(state->mem_ctx,
 903                                 name_domain,
 904                                 name_user,
 905                                 &sid,
 906                                 &type)) {
 907                 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
 908                 return NT_STATUS_NO_SUCH_USER;
 909         }
 910
 911         if (type != SID_NAME_USER) {
 912                 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
 913                 return NT_STATUS_LOGON_FAILURE;
 914         }
 915
 916         result = winbindd_get_creds(domain,
 917                                     state->mem_ctx,
 918                                     &sid,
 919                                     &my_info3,
 920                                     &cached_nt_pass,
 921                                     &cached_salt);
 922         if (!NT_STATUS_IS_OK(result)) {
 923                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
 924                 return result;
 925         }
 926
 927         *info3 = my_info3;
 928
 929         E_md4hash(state->request.data.auth.pass, new_nt_pass);
 930
 931         dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
 932         dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
 933         if (cached_salt) {
 934                 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
 935         }
 936
 937         if (cached_salt) {
 938                 /* In this case we didn't store the nt_hash itself,
 939                    but the MD5 combination of salt + nt_hash. */
 940                 uchar salted_hash[NT_HASH_LEN];
 941                 E_md5hash(cached_salt, new_nt_pass, salted_hash);
 942
 943                 password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
 944                         true : false;
 945         } else {
 946                 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
 947                 password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
 948                         true : false;
 949         }
 950
 951         if (password_good) {
 952
 953                 /* User *DOES* know the password, update logon_time and reset
 954                  * bad_pw_count */
 955
 956                 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
 957
 958                 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
 959                         return NT_STATUS_ACCOUNT_LOCKED_OUT;
 960                 }
 961
 962                 if (my_info3->base.acct_flags & ACB_DISABLED) {
 963                         return NT_STATUS_ACCOUNT_DISABLED;
 964                 }
 965
 966                 if (my_info3->base.acct_flags & ACB_WSTRUST) {
 967                         return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 968                 }
 969
 970                 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
 971                         return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 972                 }
 973
 974                 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
 975                         return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 976                 }
 977
 978                 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
 979                         DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
 980                                 my_info3->base.acct_flags));
 981                         return NT_STATUS_LOGON_FAILURE;
 982                 }
 983
 984                 kickoff_time = nt_time_to_unix(my_info3->base.acct_expiry);
 985                 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
 986                         return NT_STATUS_ACCOUNT_EXPIRED;
 987                 }
 988
 989                 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
 990                 if (must_change_time != 0 && must_change_time < time(NULL)) {
 991                         /* we allow grace logons when the password has expired */
 992                         my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
 993                         /* return NT_STATUS_PASSWORD_EXPIRED; */
 994                         goto success;
 995                 }
 996
 997 #ifdef HAVE_KRB5
 998                 if ((state->request.flags & WBFLAG_PAM_KRB5) &&
 999                     ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
1000                     (tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL)) {
1001
1002                         uid_t uid = -1;
1003                         const char *cc = NULL;
1004                         char *realm = NULL;
1005                         const char *principal_s = NULL;
1006                         const char *service = NULL;
1007                         bool internal_ccache = false;
1008
1009                         uid = get_uid_from_state(state);
1010                         if (uid == -1) {
1011                                 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
1012                                 return NT_STATUS_INVALID_PARAMETER;
1013                         }
1014
1015                         cc = generate_krb5_ccache(state->mem_ctx,
1016                                                 state->request.data.auth.krb5_cc_type,
1017                                                 state->request.data.auth.uid,
1018                                                 &internal_ccache);
1019                         if (cc == NULL) {
1020                                 return NT_STATUS_NO_MEMORY;
1021                         }
1022
1023                         realm = domain->alt_name;
1024                         strupper_m(realm);
1025
1026                         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
1027                         if (principal_s == NULL) {
1028                                 return NT_STATUS_NO_MEMORY;
1029                         }
1030
1031                         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
1032                         if (service == NULL) {
1033                                 return NT_STATUS_NO_MEMORY;
1034                         }
1035
1036                         if (!internal_ccache) {
1037
1038                                 setup_return_cc_name(state, cc);
1039
1040                                 result = add_ccache_to_list(principal_s,
1041                                                             cc,
1042                                                             service,
1043                                                             state->request.data.auth.user,
1044                                                             domain->alt_name,
1045                                                             uid,
1046                                                             time(NULL),
1047                                                             time(NULL) + lp_winbind_cache_time(),
1048                                                             time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
1049                                                             true);
1050
1051                                 if (!NT_STATUS_IS_OK(result)) {
1052                                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
1053                                                 "to add ccache to list: %s\n",
1054                                                 nt_errstr(result)));
1055                                 }
1056                         }
1057                 }
1058 #endif /* HAVE_KRB5 */
1059  success:
1060                 /* FIXME: we possibly should handle logon hours as well (does xp when
1061                  * offline?) see auth/auth_sam.c:sam_account_ok for details */
1062
1063                 unix_to_nt_time(&my_info3->base.last_logon, time(NULL));
1064                 my_info3->base.bad_password_count = 0;
1065
1066                 result = winbindd_update_creds_by_info3(domain,
1067                                                         state->mem_ctx,
1068                                                         state->request.data.auth.user,
1069                                                         state->request.data.auth.pass,
1070                                                         my_info3);
1071                 if (!NT_STATUS_IS_OK(result)) {
1072                         DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1073                                 nt_errstr(result)));
1074                         return result;
1075                 }
1076
1077                 return NT_STATUS_OK;
1078
1079         }
1080
1081         /* User does *NOT* know the correct password, modify info3 accordingly */
1082
1083         /* failure of this is not critical */
1084         result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1085         if (!NT_STATUS_IS_OK(result)) {
1086                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1087                           "Won't be able to honour account lockout policies\n"));
1088         }
1089
1090         /* increase counter */
1091         my_info3->base.bad_password_count++;
1092
1093         if (max_allowed_bad_attempts == 0) {
1094                 goto failed;
1095         }
1096
1097         /* lockout user */
1098         if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1099
1100                 uint32 password_properties;
1101
1102                 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1103                 if (!NT_STATUS_IS_OK(result)) {
1104                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1105                 }
1106
1107                 if ((my_info3->base.rid != DOMAIN_USER_RID_ADMIN) ||
1108                     (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1109                         my_info3->base.acct_flags |= ACB_AUTOLOCK;
1110                 }
1111         }
1112
1113 failed:
1114         result = winbindd_update_creds_by_info3(domain,
1115                                                 state->mem_ctx,
1116                                                 state->request.data.auth.user,
1117                                                 NULL,
1118                                                 my_info3);
1119
1120         if (!NT_STATUS_IS_OK(result)) {
1121                 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1122                         nt_errstr(result)));
1123         }
1124
1125         return NT_STATUS_LOGON_FAILURE;
1126 }
1127
1128 NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1129                                          struct winbindd_cli_state *state,
1130                                          struct netr_SamInfo3 **info3)
1131 {
1132         struct winbindd_domain *contact_domain;
1133         fstring name_domain, name_user;
1134         NTSTATUS result;
1135
1136         DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1137
1138         /* Parse domain and username */
1139
1140         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1141
1142         /* what domain should we contact? */
1143
1144         if ( IS_DC ) {
1145                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1146                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1147                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1148                         result = NT_STATUS_NO_SUCH_USER;
1149                         goto done;
1150                 }
1151
1152         } else {
1153                 if (is_myname(name_domain)) {
1154                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1155                         result =  NT_STATUS_NO_SUCH_USER;
1156                         goto done;
1157                 }
1158
1159                 contact_domain = find_domain_from_name(name_domain);
1160                 if (contact_domain == NULL) {
1161                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1162                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1163
1164                         contact_domain = find_our_domain();
1165                 }
1166         }
1167
1168         if (contact_domain->initialized &&
1169             contact_domain->active_directory) {
1170                 goto try_login;
1171         }
1172
1173         if (!contact_domain->initialized) {
1174                 init_dc_connection(contact_domain);
1175         }
1176
1177         if (!contact_domain->active_directory) {
1178                 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1179                 return NT_STATUS_INVALID_LOGON_TYPE;
1180         }
1181 try_login:
1182         result = winbindd_raw_kerberos_login(contact_domain, state, info3);
1183 done:
1184         return result;
1185 }
1186
1187 typedef NTSTATUS (*netlogon_fn_t)(struct rpc_pipe_client *cli,
1188                                   TALLOC_CTX *mem_ctx,
1189                                   uint32 logon_parameters,
1190                                   const char *server,
1191                                   const char *username,
1192                                   const char *domain,
1193                                   const char *workstation,
1194                                   const uint8 chal[8],
1195                                   DATA_BLOB lm_response,
1196                                   DATA_BLOB nt_response,
1197                                   struct netr_SamInfo3 **info3);
1198
1199 NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
1200                                          struct winbindd_cli_state *state,
1201                                          struct netr_SamInfo3 **info3)
1202 {
1203
1204         struct rpc_pipe_client *netlogon_pipe;
1205         uchar chal[8];
1206         DATA_BLOB lm_resp;
1207         DATA_BLOB nt_resp;
1208         int attempts = 0;
1209         unsigned char local_lm_response[24];
1210         unsigned char local_nt_response[24];
1211         struct winbindd_domain *contact_domain;
1212         fstring name_domain, name_user;
1213         bool retry;
1214         NTSTATUS result;
1215         struct netr_SamInfo3 *my_info3 = NULL;
1216
1217         *info3 = NULL;
1218
1219         DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1220
1221         /* Parse domain and username */
1222
1223         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1224
1225         /* do password magic */
1226
1227
1228         generate_random_buffer(chal, 8);
1229         if (lp_client_ntlmv2_auth()) {
1230                 DATA_BLOB server_chal;
1231                 DATA_BLOB names_blob;
1232                 DATA_BLOB nt_response;
1233                 DATA_BLOB lm_response;
1234                 server_chal = data_blob_talloc(state->mem_ctx, chal, 8);
1235
1236                 /* note that the 'workgroup' here is a best guess - we don't know
1237                    the server's domain at this point.  The 'server name' is also
1238                    dodgy...
1239                 */
1240                 names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1241
1242                 if (!SMBNTLMv2encrypt(name_user, name_domain,
1243                                       state->request.data.auth.pass,
1244                                       &server_chal,
1245                                       &names_blob,
1246                                       &lm_response, &nt_response, NULL)) {
1247                         data_blob_free(&names_blob);
1248                         data_blob_free(&server_chal);
1249                         DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1250                         result = NT_STATUS_NO_MEMORY;
1251                         goto done;
1252                 }
1253                 data_blob_free(&names_blob);
1254                 data_blob_free(&server_chal);
1255                 lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data,
1256                                            lm_response.length);
1257                 nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data,
1258                                            nt_response.length);
1259                 data_blob_free(&lm_response);
1260                 data_blob_free(&nt_response);
1261
1262         } else {
1263                 if (lp_client_lanman_auth()
1264                     && SMBencrypt(state->request.data.auth.pass,
1265                                   chal,
1266                                   local_lm_response)) {
1267                         lm_resp = data_blob_talloc(state->mem_ctx,
1268                                                    local_lm_response,
1269                                                    sizeof(local_lm_response));
1270                 } else {
1271                         lm_resp = data_blob_null;
1272                 }
1273                 SMBNTencrypt(state->request.data.auth.pass,
1274                              chal,
1275                              local_nt_response);
1276
1277                 nt_resp = data_blob_talloc(state->mem_ctx,
1278                                            local_nt_response,
1279                                            sizeof(local_nt_response));
1280         }
1281
1282         /* what domain should we contact? */
1283
1284         if ( IS_DC ) {
1285                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1286                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1287                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1288                         result = NT_STATUS_NO_SUCH_USER;
1289                         goto done;
1290                 }
1291
1292         } else {
1293                 if (is_myname(name_domain)) {
1294                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1295                         result =  NT_STATUS_NO_SUCH_USER;
1296                         goto done;
1297                 }
1298
1299                 contact_domain = find_our_domain();
1300         }
1301
1302         /* check authentication loop */
1303
1304         do {
1305                 netlogon_fn_t logon_fn;
1306
1307                 ZERO_STRUCTP(my_info3);
1308                 retry = false;
1309
1310                 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1311
1312                 if (!NT_STATUS_IS_OK(result)) {
1313                         DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1314                         goto done;
1315                 }
1316
1317                 /* It is really important to try SamLogonEx here,
1318                  * because in a clustered environment, we want to use
1319                  * one machine account from multiple physical
1320                  * computers.
1321                  *
1322                  * With a normal SamLogon call, we must keep the
1323                  * credentials chain updated and intact between all
1324                  * users of the machine account (which would imply
1325                  * cross-node communication for every NTLM logon).
1326                  *
1327                  * (The credentials chain is not per NETLOGON pipe
1328                  * connection, but globally on the server/client pair
1329                  * by machine name).
1330                  *
1331                  * When using SamLogonEx, the credentials are not
1332                  * supplied, but the session key is implied by the
1333                  * wrapping SamLogon context.
1334                  *
1335                  *  -- abartlet 21 April 2008
1336                  */
1337
1338                 logon_fn = contact_domain->can_do_samlogon_ex
1339                         ? rpccli_netlogon_sam_network_logon_ex
1340                         : rpccli_netlogon_sam_network_logon;
1341
1342                 result = logon_fn(netlogon_pipe,
1343                                   state->mem_ctx,
1344                                   0,
1345                                   contact_domain->dcname, /* server name */
1346                                   name_user,              /* user name */
1347                                   name_domain,            /* target domain */
1348                                   global_myname(),        /* workstation */
1349                                   chal,
1350                                   lm_resp,
1351                                   nt_resp,
1352                                   &my_info3);
1353                 attempts += 1;
1354
1355                 if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
1356                     && contact_domain->can_do_samlogon_ex) {
1357                         DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1358                                   "retrying with NetSamLogon\n"));
1359                         contact_domain->can_do_samlogon_ex = false;
1360                         retry = true;
1361                         continue;
1362                 }
1363
1364                 /* We have to try a second time as cm_connect_netlogon
1365                    might not yet have noticed that the DC has killed
1366                    our connection. */
1367
1368                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1369                         retry = true;
1370                         continue;
1371                 }
1372
1373                 /* if we get access denied, a possible cause was that we had
1374                    and open connection to the DC, but someone changed our
1375                    machine account password out from underneath us using 'net
1376                    rpc changetrustpw' */
1377
1378                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1379                         DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1380                                  "ACCESS_DENIED.  Maybe the trust account "
1381                                 "password was changed and we didn't know it. "
1382                                  "Killing connections to domain %s\n",
1383                                 name_domain));
1384                         invalidate_cm_connection(&contact_domain->conn);
1385                         retry = true;
1386                 }
1387
1388         } while ( (attempts < 2) && retry );
1389
1390         /* handle the case where a NT4 DC does not fill in the acct_flags in
1391          * the samlogon reply info3. When accurate info3 is required by the
1392          * caller, we look up the account flags ourselve - gd */
1393
1394         if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
1395             NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
1396
1397                 struct rpc_pipe_client *samr_pipe;
1398                 struct policy_handle samr_domain_handle, user_pol;
1399                 union samr_UserInfo *info = NULL;
1400                 NTSTATUS status_tmp;
1401                 uint32 acct_flags;
1402
1403                 status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
1404                                             &samr_pipe, &samr_domain_handle);
1405
1406                 if (!NT_STATUS_IS_OK(status_tmp)) {
1407                         DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1408                                 nt_errstr(status_tmp)));
1409                         goto done;
1410                 }
1411
1412                 status_tmp = rpccli_samr_OpenUser(samr_pipe, state->mem_ctx,
1413                                                   &samr_domain_handle,
1414                                                   MAXIMUM_ALLOWED_ACCESS,
1415                                                   my_info3->base.rid,
1416                                                   &user_pol);
1417
1418                 if (!NT_STATUS_IS_OK(status_tmp)) {
1419                         DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1420                                 nt_errstr(status_tmp)));
1421                         goto done;
1422                 }
1423
1424                 status_tmp = rpccli_samr_QueryUserInfo(samr_pipe, state->mem_ctx,
1425                                                        &user_pol,
1426                                                        16,
1427                                                        &info);
1428
1429                 if (!NT_STATUS_IS_OK(status_tmp)) {
1430                         DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1431                                 nt_errstr(status_tmp)));
1432                         rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1433                         goto done;
1434                 }
1435
1436                 acct_flags = info->info16.acct_flags;
1437
1438                 if (acct_flags == 0) {
1439                         rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1440                         goto done;
1441                 }
1442
1443                 my_info3->base.acct_flags = acct_flags;
1444
1445                 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1446
1447                 rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1448         }
1449
1450         *info3 = my_info3;
1451 done:
1452         return result;
1453 }
1454
1455 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1456                                             struct winbindd_cli_state *state)
1457 {
1458         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1459         NTSTATUS krb5_result = NT_STATUS_OK;
1460         fstring name_domain, name_user;
1461         char *mapped_user;
1462         fstring domain_user;
1463         struct netr_SamInfo3 *info3 = NULL;
1464         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
1465
1466         /* Ensure null termination */
1467         state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
1468
1469         /* Ensure null termination */
1470         state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
1471
1472         DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1473                   state->request.data.auth.user));
1474
1475         if (!check_request_flags(state->request.flags)) {
1476                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1477                 goto done;
1478         }
1479
1480         /* Parse domain and username */
1481
1482         name_map_status = normalize_name_unmap(state->mem_ctx,
1483                                                state->request.data.auth.user,
1484                                                &mapped_user);
1485
1486         /* If the name normalization didnt' actually do anything,
1487            just use the original name */
1488
1489         if (!NT_STATUS_IS_OK(name_map_status) &&
1490             !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
1491         {
1492                 mapped_user = state->request.data.auth.user;
1493         }
1494
1495         parse_domain_user(mapped_user, name_domain, name_user);
1496
1497         if ( mapped_user != state->request.data.auth.user ) {
1498                 fstr_sprintf( domain_user, "%s\\%s", name_domain, name_user );
1499                 safe_strcpy( state->request.data.auth.user, domain_user,
1500                              sizeof(state->request.data.auth.user)-1 );
1501         }
1502
1503         if (domain->online == false) {
1504                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1505                 if (domain->startup) {
1506                         /* Logons are very important to users. If we're offline and
1507                            we get a request within the first 30 seconds of startup,
1508                            try very hard to find a DC and go online. */
1509
1510                         DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1511                                 "request in startup mode.\n", domain->name ));
1512
1513                         winbindd_flush_negative_conn_cache(domain);
1514                         result = init_dc_connection(domain);
1515                 }
1516         }
1517
1518         DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1519
1520         /* Check for Kerberos authentication */
1521         if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
1522
1523                 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1524                 /* save for later */
1525                 krb5_result = result;
1526
1527
1528                 if (NT_STATUS_IS_OK(result)) {
1529                         DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1530                         goto process_result;
1531                 } else {
1532                         DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1533                 }
1534
1535                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1536                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1537                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1538                         DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1539                         set_domain_offline( domain );
1540                         goto cached_logon;
1541                 }
1542
1543                 /* there are quite some NT_STATUS errors where there is no
1544                  * point in retrying with a samlogon, we explictly have to take
1545                  * care not to increase the bad logon counter on the DC */
1546
1547                 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1548                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1549                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1550                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1551                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1552                     NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1553                     NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1554                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1555                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1556                     NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1557                         goto process_result;
1558                 }
1559
1560                 if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1561                         DEBUG(3,("falling back to samlogon\n"));
1562                         goto sam_logon;
1563                 } else {
1564                         goto cached_logon;
1565                 }
1566         }
1567
1568 sam_logon:
1569         /* Check for Samlogon authentication */
1570         if (domain->online) {
1571                 result = winbindd_dual_pam_auth_samlogon(domain, state, &info3);
1572
1573                 if (NT_STATUS_IS_OK(result)) {
1574                         DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1575                         /* add the Krb5 err if we have one */
1576                         if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1577                                 info3->base.user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1578                         }
1579                         goto process_result;
1580                 }
1581
1582                 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1583                           nt_errstr(result)));
1584
1585                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1586                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1587                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1588                 {
1589                         DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1590                         set_domain_offline( domain );
1591                         goto cached_logon;
1592                 }
1593
1594                         if (domain->online) {
1595                                 /* We're still online - fail. */
1596                                 goto done;
1597                         }
1598         }
1599
1600 cached_logon:
1601         /* Check for Cached logons */
1602         if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
1603             lp_winbind_offline_logon()) {
1604
1605                 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1606
1607                 if (NT_STATUS_IS_OK(result)) {
1608                         DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1609                         goto process_result;
1610                 } else {
1611                         DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1612                         goto done;
1613                 }
1614         }
1615
1616 process_result:
1617
1618         if (NT_STATUS_IS_OK(result)) {
1619
1620                 DOM_SID user_sid;
1621
1622                 /* In all codepaths where result == NT_STATUS_OK info3 must have
1623                    been initialized. */
1624                 if (!info3) {
1625                         result = NT_STATUS_INTERNAL_ERROR;
1626                         goto done;
1627                 }
1628
1629                 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1630                 netsamlogon_cache_store(name_user, info3);
1631
1632                 /* save name_to_sid info as early as possible (only if
1633                    this is our primary domain so we don't invalidate
1634                    the cache entry by storing the seq_num for the wrong
1635                    domain). */
1636                 if ( domain->primary ) {
1637                         sid_compose(&user_sid, info3->base.domain_sid,
1638                                     info3->base.rid);
1639                         cache_name2sid(domain, name_domain, name_user,
1640                                        SID_NAME_USER, &user_sid);
1641                 }
1642
1643                 /* Check if the user is in the right group */
1644
1645                 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1646                                         state->request.data.auth.require_membership_of_sid))) {
1647                         DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1648                                   state->request.data.auth.user,
1649                                   state->request.data.auth.require_membership_of_sid));
1650                         goto done;
1651                 }
1652
1653                 result = append_data(state, info3, name_domain, name_user);
1654                 if (!NT_STATUS_IS_OK(result)) {
1655                         goto done;
1656                 }
1657
1658                 if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
1659
1660                         /* Store in-memory creds for single-signon using ntlm_auth. */
1661                         result = winbindd_add_memory_creds(state->request.data.auth.user,
1662                                                         get_uid_from_state(state),
1663                                                         state->request.data.auth.pass);
1664
1665                         if (!NT_STATUS_IS_OK(result)) {
1666                                 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
1667                                 goto done;
1668                         }
1669
1670                         if (lp_winbind_offline_logon()) {
1671                                 result = winbindd_store_creds(domain,
1672                                                       state->mem_ctx,
1673                                                       state->request.data.auth.user,
1674                                                       state->request.data.auth.pass,
1675                                                       info3, NULL);
1676                                 if (!NT_STATUS_IS_OK(result)) {
1677
1678                                         /* Release refcount. */
1679                                         winbindd_delete_memory_creds(state->request.data.auth.user);
1680
1681                                         DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
1682                                         goto done;
1683                                 }
1684                         }
1685                 }
1686
1687
1688                 if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
1689                         struct winbindd_domain *our_domain = find_our_domain();
1690
1691                         /* This is not entirely correct I believe, but it is
1692                            consistent.  Only apply the password policy settings
1693                            too warn users for our own domain.  Cannot obtain these
1694                            from trusted DCs all the  time so don't do it at all.
1695                            -- jerry */
1696
1697                         result = NT_STATUS_NOT_SUPPORTED;
1698                         if (our_domain == domain ) {
1699                                 result = fillup_password_policy(our_domain, state);
1700                         }
1701
1702                         if (!NT_STATUS_IS_OK(result)
1703                             && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1704                         {
1705                                 DEBUG(10,("Failed to get password policies for domain %s: %s\n",
1706                                           domain->name, nt_errstr(result)));
1707                                 goto done;
1708                         }
1709                 }
1710
1711                 result = NT_STATUS_OK;
1712         }
1713
1714 done:
1715         /* give us a more useful (more correct?) error code */
1716         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1717             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1718                 result = NT_STATUS_NO_LOGON_SERVERS;
1719         }
1720
1721         set_auth_errors(&state->response, result);
1722
1723         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1724               state->request.data.auth.user,
1725               state->response.data.auth.nt_status_string,
1726               state->response.data.auth.pam_error));
1727
1728         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1729 }
1730
1731
1732 /**********************************************************************
1733  Challenge Response Authentication Protocol
1734 **********************************************************************/
1735
1736 void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
1737 {
1738         struct winbindd_domain *domain = NULL;
1739         const char *domain_name = NULL;
1740         NTSTATUS result;
1741
1742         if (!check_request_flags(state->request.flags)) {
1743                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1744                 goto done;
1745         }
1746
1747         if (!state->privileged) {
1748                 char *error_string = NULL;
1749                 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1750                           "denied.  !\n"));
1751                 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1752                              "on %s are set correctly.\n",
1753                              get_winbind_priv_pipe_dir()));
1754                 /* send a better message than ACCESS_DENIED */
1755                 error_string = talloc_asprintf(state->mem_ctx,
1756                                                "winbind client not authorized "
1757                                                "to use winbindd_pam_auth_crap."
1758                                                " Ensure permissions on %s "
1759                                                "are set correctly.",
1760                                                get_winbind_priv_pipe_dir());
1761                 fstrcpy(state->response.data.auth.error_string, error_string);
1762                 result = NT_STATUS_ACCESS_DENIED;
1763                 goto done;
1764         }
1765
1766         /* Ensure null termination */
1767         state->request.data.auth_crap.user
1768                 [sizeof(state->request.data.auth_crap.user)-1]=0;
1769         state->request.data.auth_crap.domain
1770                 [sizeof(state->request.data.auth_crap.domain)-1]=0;
1771
1772         DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1773                   (unsigned long)state->pid,
1774                   state->request.data.auth_crap.domain,
1775                   state->request.data.auth_crap.user));
1776
1777         if (*state->request.data.auth_crap.domain != '\0') {
1778                 domain_name = state->request.data.auth_crap.domain;
1779         } else if (lp_winbind_use_default_domain()) {
1780                 domain_name = lp_workgroup();
1781         }
1782
1783         if (domain_name != NULL)
1784                 domain = find_auth_domain(state, domain_name);
1785
1786         if (domain != NULL) {
1787                 sendto_domain(state, domain);
1788                 return;
1789         }
1790
1791         result = NT_STATUS_NO_SUCH_USER;
1792
1793  done:
1794         set_auth_errors(&state->response, result);
1795         DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1796                   state->request.data.auth_crap.domain,
1797                   state->request.data.auth_crap.user,
1798                   state->response.data.auth.nt_status_string,
1799                   state->response.data.auth.pam_error));
1800         request_error(state);
1801         return;
1802 }
1803
1804
1805 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1806                                                  struct winbindd_cli_state *state)
1807 {
1808         NTSTATUS result;
1809         struct netr_SamInfo3 *info3 = NULL;
1810         struct rpc_pipe_client *netlogon_pipe;
1811         const char *name_user = NULL;
1812         const char *name_domain = NULL;
1813         const char *workstation;
1814         struct winbindd_domain *contact_domain;
1815         int attempts = 0;
1816         bool retry;
1817
1818         DATA_BLOB lm_resp, nt_resp;
1819
1820         /* This is child-only, so no check for privileged access is needed
1821            anymore */
1822
1823         /* Ensure null termination */
1824         state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
1825         state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
1826
1827         if (!check_request_flags(state->request.flags)) {
1828                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1829                 goto done;
1830         }
1831
1832         name_user = state->request.data.auth_crap.user;
1833
1834         if (*state->request.data.auth_crap.domain) {
1835                 name_domain = state->request.data.auth_crap.domain;
1836         } else if (lp_winbind_use_default_domain()) {
1837                 name_domain = lp_workgroup();
1838         } else {
1839                 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1840                          name_user));
1841                 result = NT_STATUS_NO_SUCH_USER;
1842                 goto done;
1843         }
1844
1845         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1846                   name_domain, name_user));
1847
1848         if (*state->request.data.auth_crap.workstation) {
1849                 workstation = state->request.data.auth_crap.workstation;
1850         } else {
1851                 workstation = global_myname();
1852         }
1853
1854         if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
1855                 || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
1856                 if (!(state->request.flags & WBFLAG_BIG_NTLMV2_BLOB) ||
1857                      state->request.extra_len != state->request.data.auth_crap.nt_resp_len) {
1858                         DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1859                                   state->request.data.auth_crap.lm_resp_len,
1860                                   state->request.data.auth_crap.nt_resp_len));
1861                         result = NT_STATUS_INVALID_PARAMETER;
1862                         goto done;
1863                 }
1864         }
1865
1866         lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
1867                                         state->request.data.auth_crap.lm_resp_len);
1868
1869         if (state->request.flags & WBFLAG_BIG_NTLMV2_BLOB) {
1870                 nt_resp = data_blob_talloc(state->mem_ctx,
1871                                            state->request.extra_data.data,
1872                                            state->request.data.auth_crap.nt_resp_len);
1873         } else {
1874                 nt_resp = data_blob_talloc(state->mem_ctx,
1875                                            state->request.data.auth_crap.nt_resp,
1876                                            state->request.data.auth_crap.nt_resp_len);
1877         }
1878
1879         /* what domain should we contact? */
1880
1881         if ( IS_DC ) {
1882                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1883                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1884                                   state->request.data.auth_crap.user, name_domain, name_user, name_domain));
1885                         result = NT_STATUS_NO_SUCH_USER;
1886                         goto done;
1887                 }
1888         } else {
1889                 if (is_myname(name_domain)) {
1890                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1891                         result =  NT_STATUS_NO_SUCH_USER;
1892                         goto done;
1893                 }
1894                 contact_domain = find_our_domain();
1895         }
1896
1897         do {
1898                 netlogon_fn_t logon_fn;
1899
1900                 retry = false;
1901
1902                 netlogon_pipe = NULL;
1903                 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1904
1905                 if (!NT_STATUS_IS_OK(result)) {
1906                         DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1907                                   nt_errstr(result)));
1908                         goto done;
1909                 }
1910
1911                 logon_fn = contact_domain->can_do_samlogon_ex
1912                         ? rpccli_netlogon_sam_network_logon_ex
1913                         : rpccli_netlogon_sam_network_logon;
1914
1915                 result = logon_fn(netlogon_pipe,
1916                                   state->mem_ctx,
1917                                   state->request.data.auth_crap.logon_parameters,
1918                                   contact_domain->dcname,
1919                                   name_user,
1920                                   name_domain,
1921                                   /* Bug #3248 - found by Stefan Burkei. */
1922                                   workstation, /* We carefully set this above so use it... */
1923                                   state->request.data.auth_crap.chal,
1924                                   lm_resp,
1925                                   nt_resp,
1926                                   &info3);
1927
1928                 if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
1929                     && contact_domain->can_do_samlogon_ex) {
1930                         DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1931                                   "retrying with NetSamLogon\n"));
1932                         contact_domain->can_do_samlogon_ex = false;
1933                         retry = true;
1934                         continue;
1935                 }
1936
1937                 attempts += 1;
1938
1939                 /* We have to try a second time as cm_connect_netlogon
1940                    might not yet have noticed that the DC has killed
1941                    our connection. */
1942
1943                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1944                         retry = true;
1945                         continue;
1946                 }
1947
1948                 /* if we get access denied, a possible cause was that we had and open
1949                    connection to the DC, but someone changed our machine account password
1950                    out from underneath us using 'net rpc changetrustpw' */
1951
1952                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1953                         DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1954                                  "ACCESS_DENIED.  Maybe the trust account "
1955                                 "password was changed and we didn't know it. "
1956                                  "Killing connections to domain %s\n",
1957                                 name_domain));
1958                         invalidate_cm_connection(&contact_domain->conn);
1959                         retry = true;
1960                 }
1961
1962         } while ( (attempts < 2) && retry );
1963
1964         if (NT_STATUS_IS_OK(result)) {
1965
1966                 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1967                 netsamlogon_cache_store(name_user, info3);
1968
1969                 /* Check if the user is in the right group */
1970
1971                 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1972                                                         state->request.data.auth_crap.require_membership_of_sid))) {
1973                         DEBUG(3, ("User %s is not in the required group (%s), so "
1974                                   "crap authentication is rejected\n",
1975                                   state->request.data.auth_crap.user,
1976                                   state->request.data.auth_crap.require_membership_of_sid));
1977                         goto done;
1978                 }
1979
1980                 result = append_data(state, info3, name_domain, name_user);
1981                 if (!NT_STATUS_IS_OK(result)) {
1982                         goto done;
1983                 }
1984         }
1985
1986 done:
1987
1988         /* give us a more useful (more correct?) error code */
1989         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1990             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1991                 result = NT_STATUS_NO_LOGON_SERVERS;
1992         }
1993
1994         if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1995                 result = nt_status_squash(result);
1996         }
1997
1998         set_auth_errors(&state->response, result);
1999
2000         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2001               ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
2002                name_domain,
2003                name_user,
2004                state->response.data.auth.nt_status_string,
2005                state->response.data.auth.pam_error));
2006
2007         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2008 }
2009
2010 /* Change a user password */
2011
2012 void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
2013 {
2014         fstring domain, user;
2015         char *mapped_user;
2016         struct winbindd_domain *contact_domain;
2017         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
2018
2019         DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
2020                 state->request.data.chauthtok.user));
2021
2022         /* Setup crap */
2023
2024         nt_status = normalize_name_unmap(state->mem_ctx,
2025                                          state->request.data.chauthtok.user,
2026                                          &mapped_user);
2027
2028         /* Update the chauthtok name if we did any mapping */
2029
2030         if (NT_STATUS_IS_OK(nt_status) ||
2031             NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED))
2032         {
2033                 fstrcpy(state->request.data.chauthtok.user, mapped_user);
2034         }
2035
2036         /* Must pass in state->...chauthtok.user because
2037            canonicalize_username() assumes an fstring().  Since
2038            we have already copied it (if necessary), this is ok. */
2039
2040         if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
2041                 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2042                 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
2043                           "(PAM: %d)\n",
2044                           state->request.data.auth.user,
2045                           state->response.data.auth.nt_status_string,
2046                           state->response.data.auth.pam_error));
2047                 request_error(state);
2048                 return;
2049         }
2050
2051         contact_domain = find_domain_from_name(domain);
2052         if (!contact_domain) {
2053                 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2054                 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
2055                           state->request.data.chauthtok.user, domain, user, domain));
2056                 request_error(state);
2057                 return;
2058         }
2059
2060         sendto_domain(state, contact_domain);
2061 }
2062
2063 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
2064                                                  struct winbindd_cli_state *state)
2065 {
2066         char *oldpass;
2067         char *newpass = NULL;
2068         struct policy_handle dom_pol;
2069         struct rpc_pipe_client *cli;
2070         bool got_info = false;
2071         struct samr_DomInfo1 *info = NULL;
2072         struct samr_ChangeReject *reject = NULL;
2073         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2074         fstring domain, user;
2075
2076         DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
2077                   state->request.data.auth.user));
2078
2079         if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
2080                 goto done;
2081         }
2082
2083         /* Change password */
2084
2085         oldpass = state->request.data.chauthtok.oldpass;
2086         newpass = state->request.data.chauthtok.newpass;
2087
2088         /* Initialize reject reason */
2089         state->response.data.auth.reject_reason = Undefined;
2090
2091         /* Get sam handle */
2092
2093         result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
2094                                 &dom_pol);
2095         if (!NT_STATUS_IS_OK(result)) {
2096                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2097                 goto done;
2098         }
2099
2100         result = rpccli_samr_chgpasswd_user3(cli, state->mem_ctx,
2101                                              user,
2102                                              newpass,
2103                                              oldpass,
2104                                              &info,
2105                                              &reject);
2106
2107         /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2108
2109         if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2110
2111                 fill_in_password_policy(&state->response, info);
2112
2113                 state->response.data.auth.reject_reason =
2114                         reject->reason;
2115
2116                 got_info = true;
2117         }
2118
2119         /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
2120          * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
2121          * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
2122          * short to comply with the samr_ChangePasswordUser3 idl - gd */
2123
2124         /* only fallback when the chgpasswd_user3 call is not supported */
2125         if ((NT_STATUS_EQUAL(result, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR))) ||
2126                    (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) ||
2127                    (NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL)) ||
2128                    (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED))) {
2129
2130                 DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
2131                         nt_errstr(result)));
2132
2133                 result = rpccli_samr_chgpasswd_user2(cli, state->mem_ctx, user, newpass, oldpass);
2134
2135                 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2136                    Map to the same status code as Windows 2003. */
2137
2138                 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2139                         result = NT_STATUS_PASSWORD_RESTRICTION;
2140                 }
2141         }
2142
2143 done:
2144
2145         if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
2146
2147                 /* Update the single sign-on memory creds. */
2148                 result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
2149                                                         newpass);
2150
2151                 /* When we login from gdm or xdm and password expires,
2152                  * we change password, but there are no memory crendentials
2153                  * So, winbindd_replace_memory_creds() returns
2154                  * NT_STATUS_OBJECT_NAME_NOT_FOUND. This is not a failure.
2155                  * --- BoYang
2156                  * */
2157                 if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
2158                         result = NT_STATUS_OK;
2159                 }
2160
2161                 if (!NT_STATUS_IS_OK(result)) {
2162                         DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
2163                         goto process_result;
2164                 }
2165
2166                 if (lp_winbind_offline_logon()) {
2167                         result = winbindd_update_creds_by_name(contact_domain,
2168                                                          state->mem_ctx, user,
2169                                                          newpass);
2170                         /* Again, this happens when we login from gdm or xdm
2171                          * and the password expires, *BUT* cached crendentials
2172                          * doesn't exist. winbindd_update_creds_by_name()
2173                          * returns NT_STATUS_NO_SUCH_USER.
2174                          * This is not a failure.
2175                          * --- BoYang
2176                          * */
2177                         if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
2178                                 result = NT_STATUS_OK;
2179                         }
2180
2181                         if (!NT_STATUS_IS_OK(result)) {
2182                                 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
2183                                 goto process_result;
2184                         }
2185                 }
2186         }
2187
2188         if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2189
2190                 NTSTATUS policy_ret;
2191
2192                 policy_ret = fillup_password_policy(contact_domain, state);
2193
2194                 /* failure of this is non critical, it will just provide no
2195                  * additional information to the client why the change has
2196                  * failed - Guenther */
2197
2198                 if (!NT_STATUS_IS_OK(policy_ret)) {
2199                         DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2200                         goto process_result;
2201                 }
2202         }
2203
2204 process_result:
2205
2206         set_auth_errors(&state->response, result);
2207
2208         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2209               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2210                domain,
2211                user,
2212                state->response.data.auth.nt_status_string,
2213                state->response.data.auth.pam_error));
2214
2215         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2216 }
2217
2218 void winbindd_pam_logoff(struct winbindd_cli_state *state)
2219 {
2220         struct winbindd_domain *domain;
2221         fstring name_domain, user;
2222         uid_t caller_uid = (uid_t)-1;
2223         uid_t request_uid = state->request.data.logoff.uid;
2224
2225         DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
2226                 state->request.data.logoff.user));
2227
2228         /* Ensure null termination */
2229         state->request.data.logoff.user
2230                 [sizeof(state->request.data.logoff.user)-1]='\0';
2231
2232         state->request.data.logoff.krb5ccname
2233                 [sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
2234
2235         if (request_uid == (gid_t)-1) {
2236                 goto failed;
2237         }
2238
2239         if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
2240                 goto failed;
2241         }
2242
2243         if ((domain = find_auth_domain(state, name_domain)) == NULL) {
2244                 goto failed;
2245         }
2246
2247         if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
2248                 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2249                         strerror(errno)));
2250                 goto failed;
2251         }
2252
2253         switch (caller_uid) {
2254                 case -1:
2255                         goto failed;
2256                 case 0:
2257                         /* root must be able to logoff any user - gd */
2258                         state->request.data.logoff.uid = request_uid;
2259                         break;
2260                 default:
2261                         if (caller_uid != request_uid) {
2262                                 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2263                                 goto failed;
2264                         }
2265                         state->request.data.logoff.uid = caller_uid;
2266                         break;
2267         }
2268
2269         sendto_domain(state, domain);
2270         return;
2271
2272  failed:
2273         set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2274         DEBUG(5, ("Pam Logoff for %s returned %s "
2275                   "(PAM: %d)\n",
2276                   state->request.data.logoff.user,
2277                   state->response.data.auth.nt_status_string,
2278                   state->response.data.auth.pam_error));
2279         request_error(state);
2280         return;
2281 }
2282
2283 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2284                                               struct winbindd_cli_state *state)
2285 {
2286         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2287
2288         DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2289                 state->request.data.logoff.user));
2290
2291         if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
2292                 result = NT_STATUS_OK;
2293                 goto process_result;
2294         }
2295
2296         if (state->request.data.logoff.krb5ccname[0] == '\0') {
2297                 result = NT_STATUS_OK;
2298                 goto process_result;
2299         }
2300
2301 #ifdef HAVE_KRB5
2302
2303         if (state->request.data.logoff.uid < 0) {
2304                 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2305                 goto process_result;
2306         }
2307
2308         /* what we need here is to find the corresponding krb5 ccache name *we*
2309          * created for a given username and destroy it */
2310
2311         if (!ccache_entry_exists(state->request.data.logoff.user)) {
2312                 result = NT_STATUS_OK;
2313                 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2314                 goto process_result;
2315         }
2316
2317         if (!ccache_entry_identical(state->request.data.logoff.user,
2318                                         state->request.data.logoff.uid,
2319                                         state->request.data.logoff.krb5ccname)) {
2320                 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2321                 goto process_result;
2322         }
2323
2324         result = remove_ccache(state->request.data.logoff.user);
2325         if (!NT_STATUS_IS_OK(result)) {
2326                 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2327                         nt_errstr(result)));
2328                 goto process_result;
2329         }
2330
2331 #else
2332         result = NT_STATUS_NOT_SUPPORTED;
2333 #endif
2334
2335 process_result:
2336
2337         winbindd_delete_memory_creds(state->request.data.logoff.user);
2338
2339         set_auth_errors(&state->response, result);
2340
2341         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2342 }
2343
2344 /* Change user password with auth crap*/
2345
2346 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
2347 {
2348         struct winbindd_domain *domain = NULL;
2349         const char *domain_name = NULL;
2350
2351         /* Ensure null termination */
2352         state->request.data.chng_pswd_auth_crap.user[
2353                 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2354         state->request.data.chng_pswd_auth_crap.domain[
2355                 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2356
2357         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2358                   (unsigned long)state->pid,
2359                   state->request.data.chng_pswd_auth_crap.domain,
2360                   state->request.data.chng_pswd_auth_crap.user));
2361
2362         if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
2363                 domain_name = state->request.data.chng_pswd_auth_crap.domain;
2364         } else if (lp_winbind_use_default_domain()) {
2365                 domain_name = lp_workgroup();
2366         }
2367
2368         if (domain_name != NULL)
2369                 domain = find_domain_from_name(domain_name);
2370
2371         if (domain != NULL) {
2372                 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2373                           "%s\n", (unsigned long)state->pid,domain->name));
2374                 sendto_domain(state, domain);
2375                 return;
2376         }
2377
2378         set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2379         DEBUG(5, ("CRAP change password  for %s\\%s returned %s (PAM: %d)\n",
2380                   state->request.data.chng_pswd_auth_crap.domain,
2381                   state->request.data.chng_pswd_auth_crap.user,
2382                   state->response.data.auth.nt_status_string,
2383                   state->response.data.auth.pam_error));
2384         request_error(state);
2385         return;
2386 }
2387
2388 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2389 {
2390         NTSTATUS result;
2391         DATA_BLOB new_nt_password;
2392         DATA_BLOB old_nt_hash_enc;
2393         DATA_BLOB new_lm_password;
2394         DATA_BLOB old_lm_hash_enc;
2395         fstring  domain,user;
2396         struct policy_handle dom_pol;
2397         struct winbindd_domain *contact_domain = domainSt;
2398         struct rpc_pipe_client *cli;
2399
2400         /* Ensure null termination */
2401         state->request.data.chng_pswd_auth_crap.user[
2402                 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2403         state->request.data.chng_pswd_auth_crap.domain[
2404                 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2405         *domain = 0;
2406         *user = 0;
2407
2408         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2409                   (unsigned long)state->pid,
2410                   state->request.data.chng_pswd_auth_crap.domain,
2411                   state->request.data.chng_pswd_auth_crap.user));
2412
2413         if (lp_winbind_offline_logon()) {
2414                 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2415                 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2416                 result = NT_STATUS_ACCESS_DENIED;
2417                 goto done;
2418         }
2419
2420         if (*state->request.data.chng_pswd_auth_crap.domain) {
2421                 fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
2422         } else {
2423                 parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
2424                                   domain, user);
2425
2426                 if(!*domain) {
2427                         DEBUG(3,("no domain specified with username (%s) - "
2428                                  "failing auth\n",
2429                                  state->request.data.chng_pswd_auth_crap.user));
2430                         result = NT_STATUS_NO_SUCH_USER;
2431                         goto done;
2432                 }
2433         }
2434
2435         if (!*domain && lp_winbind_use_default_domain()) {
2436                 fstrcpy(domain,(char *)lp_workgroup());
2437         }
2438
2439         if(!*user) {
2440                 fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
2441         }
2442
2443         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2444                   (unsigned long)state->pid, domain, user));
2445
2446         /* Change password */
2447         new_nt_password = data_blob_talloc(
2448                 state->mem_ctx,
2449                 state->request.data.chng_pswd_auth_crap.new_nt_pswd,
2450                 state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
2451
2452         old_nt_hash_enc = data_blob_talloc(
2453                 state->mem_ctx,
2454                 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
2455                 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2456
2457         if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2458                 new_lm_password = data_blob_talloc(
2459                         state->mem_ctx,
2460                         state->request.data.chng_pswd_auth_crap.new_lm_pswd,
2461                         state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
2462
2463                 old_lm_hash_enc = data_blob_talloc(
2464                         state->mem_ctx,
2465                         state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
2466                         state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2467         } else {
2468                 new_lm_password.length = 0;
2469                 old_lm_hash_enc.length = 0;
2470         }
2471
2472         /* Get sam handle */
2473
2474         result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2475         if (!NT_STATUS_IS_OK(result)) {
2476                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2477                 goto done;
2478         }
2479
2480         result = rpccli_samr_chng_pswd_auth_crap(
2481                 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2482                 new_lm_password, old_lm_hash_enc);
2483
2484  done:
2485
2486         set_auth_errors(&state->response, result);
2487
2488         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2489               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2490                domain, user,
2491                state->response.data.auth.nt_status_string,
2492                state->response.data.auth.pam_error));
2493
2494         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2495 }