2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2010
5 Copyright (C) Gerald Carter 2003
6 Copyright (C) Stefan Metzmacher 2005
7 Copyright (C) Matthias Dieter Wallnöfer 2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/time.h"
25 #include "auth/auth.h"
27 #include "dsdb/samdb/samdb.h"
28 #include "libcli/security/security.h"
29 #include "auth/auth_sam.h"
30 #include "dsdb/common/util.h"
31 #include "libcli/ldap/ldap_ndr.h"
32 #include "param/param.h"
34 #define KRBTGT_ATTRS \
35 /* required for the krb5 kdc */ \
38 "userPrincipalName", \
39 "servicePrincipalName", \
40 "msDS-KeyVersionNumber", \
41 "msDS-SecondaryKrbTgtNumber", \
42 "msDS-SupportedEncryptionTypes", \
43 "supplementalCredentials", \
44 "msDS-AllowedToDelegateTo", \
50 "userAccountControl", \
56 const char *krbtgt_attrs[] = {
60 const char *server_attrs[] = {
64 const char *user_attrs[] = {
69 /* check 'allowed workstations' */
72 /* required for user_info_dc, not access control: */
88 /****************************************************************************
89 Check if a user is allowed to logon at this time. Note this is the
90 servers local time, as logon hours are just specified as a weekly
92 ****************************************************************************/
94 static bool logon_hours_ok(struct ldb_message *msg, const char *name_for_logs)
96 /* In logon hours first bit is Sunday from 12AM to 1AM */
97 const struct ldb_val *hours;
101 uint8_t bitmask, bitpos;
103 hours = ldb_msg_find_ldb_val(msg, "logonHours");
105 DEBUG(5,("logon_hours_ok: No hours restrictions for user %s\n", name_for_logs));
109 if (hours->length != 168/8) {
110 DEBUG(5,("logon_hours_ok: malformed logon hours restrictions for user %s\n", name_for_logs));
114 lasttime = time(NULL);
115 utctime = gmtime(&lasttime);
117 DEBUG(1, ("logon_hours_ok: failed to get gmtime. Failing logon for user %s\n",
122 /* find the corresponding byte and bit */
123 bitpos = (utctime->tm_wday * 24 + utctime->tm_hour) % 168;
124 bitmask = 1 << (bitpos % 8);
126 if (! (hours->data[bitpos/8] & bitmask)) {
127 struct tm *t = localtime(&lasttime);
129 asct = "INVALID TIME";
133 asct = "INVALID TIME";
137 DEBUG(1, ("logon_hours_ok: Account for user %s not allowed to "
138 "logon at this time (%s).\n",
139 name_for_logs, asct ));
143 asct = asctime(utctime);
144 DEBUG(5,("logon_hours_ok: user %s allowed to logon at this time (%s)\n",
145 name_for_logs, asct ? asct : "UNKNOWN TIME" ));
150 /****************************************************************************
151 Do a specific test for a SAM_ACCOUNT being valid for this connection
152 (ie not disabled, expired and the like).
153 ****************************************************************************/
154 _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
155 struct ldb_context *sam_ctx,
156 uint32_t logon_parameters,
157 struct ldb_dn *domain_dn,
158 struct ldb_message *msg,
159 const char *logon_workstation,
160 const char *name_for_logs,
161 bool allow_domain_trust,
162 bool password_change)
165 const char *workstation_list;
167 NTTIME must_change_time;
170 DEBUG(4,("authsam_account_ok: Checking SMB password for user %s\n", name_for_logs));
172 acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
174 acct_expiry = samdb_result_account_expires(msg);
176 /* Check for when we must change this password, taking the
177 * userAccountControl flags into account */
178 must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx,
181 workstation_list = ldb_msg_find_attr_as_string(msg, "userWorkstations", NULL);
183 /* Quit if the account was disabled. */
184 if (acct_flags & ACB_DISABLED) {
185 DEBUG(2,("authsam_account_ok: Account for user '%s' was disabled.\n", name_for_logs));
186 return NT_STATUS_ACCOUNT_DISABLED;
189 /* Quit if the account was locked out. */
190 if (acct_flags & ACB_AUTOLOCK) {
191 DEBUG(2,("authsam_account_ok: Account for user %s was locked out.\n", name_for_logs));
192 return NT_STATUS_ACCOUNT_LOCKED_OUT;
195 /* Test account expire time */
196 unix_to_nt_time(&now, time(NULL));
197 if (now > acct_expiry) {
198 DEBUG(2,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
199 DEBUG(3,("authsam_account_ok: Account expired at '%s'.\n",
200 nt_time_string(mem_ctx, acct_expiry)));
201 return NT_STATUS_ACCOUNT_EXPIRED;
204 /* check for immediate expiry "must change at next logon" (but not if this is a password change request) */
205 if ((must_change_time == 0) && !password_change) {
206 DEBUG(2,("sam_account_ok: Account for user '%s' password must change!.\n",
208 return NT_STATUS_PASSWORD_MUST_CHANGE;
211 /* check for expired password (but not if this is a password change request) */
212 if ((must_change_time < now) && !password_change) {
213 DEBUG(2,("sam_account_ok: Account for user '%s' password expired!.\n",
215 DEBUG(2,("sam_account_ok: Password expired at '%s' unix time.\n",
216 nt_time_string(mem_ctx, must_change_time)));
217 return NT_STATUS_PASSWORD_EXPIRED;
220 /* Test workstation. Workstation list is comma separated. */
221 if (logon_workstation && workstation_list && *workstation_list) {
222 bool invalid_ws = true;
224 const char **workstations = (const char **)str_list_make(mem_ctx, workstation_list, ",");
226 for (i = 0; workstations && workstations[i]; i++) {
227 DEBUG(10,("sam_account_ok: checking for workstation match '%s' and '%s'\n",
228 workstations[i], logon_workstation));
230 if (strequal(workstations[i], logon_workstation)) {
236 talloc_free(workstations);
239 return NT_STATUS_INVALID_WORKSTATION;
243 if (!logon_hours_ok(msg, name_for_logs)) {
244 return NT_STATUS_INVALID_LOGON_HOURS;
247 if (!allow_domain_trust) {
248 if (acct_flags & ACB_DOMTRUST) {
249 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", name_for_logs));
250 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
253 if (!(logon_parameters & MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT)) {
254 if (acct_flags & ACB_SVRTRUST) {
255 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", name_for_logs));
256 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
259 if (!(logon_parameters & MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT)) {
260 /* TODO: this fails with current solaris client. We
261 need to work with Gordon to work out why */
262 if (acct_flags & ACB_WSTRUST) {
263 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", name_for_logs));
264 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
271 _PUBLIC_ NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx,
272 struct ldb_context *sam_ctx,
273 const char *netbios_name,
274 const char *domain_name,
275 struct ldb_dn *domain_dn,
276 struct ldb_message *msg,
277 DATA_BLOB user_sess_key,
278 DATA_BLOB lm_sess_key,
279 struct auth_user_info_dc **_user_info_dc)
282 struct auth_user_info_dc *user_info_dc;
283 struct auth_user_info *info;
284 const char *str, *filter;
285 /* SIDs for the account and his primary group */
286 struct dom_sid *account_sid;
287 const char *primary_group_string;
288 const char *primary_group_dn;
289 DATA_BLOB primary_group_blob;
290 /* SID structures for the expanded group memberships */
291 struct dom_sid *sids = NULL;
292 unsigned int num_sids = 0, i;
293 struct dom_sid *domain_sid;
295 struct ldb_message_element *el;
297 user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
298 NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
300 tmp_ctx = talloc_new(user_info_dc);
301 if (user_info_dc == NULL) {
302 TALLOC_FREE(user_info_dc);
303 return NT_STATUS_NO_MEMORY;
306 sids = talloc_array(user_info_dc, struct dom_sid, 2);
308 TALLOC_FREE(user_info_dc);
309 return NT_STATUS_NO_MEMORY;
314 account_sid = samdb_result_dom_sid(user_info_dc, msg, "objectSid");
315 if (account_sid == NULL) {
316 TALLOC_FREE(user_info_dc);
317 return NT_STATUS_NO_MEMORY;
320 status = dom_sid_split_rid(tmp_ctx, account_sid, &domain_sid, NULL);
321 if (!NT_STATUS_IS_OK(status)) {
322 talloc_free(user_info_dc);
326 sids[PRIMARY_USER_SID_INDEX] = *account_sid;
327 sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
328 sid_append_rid(&sids[PRIMARY_GROUP_SID_INDEX], ldb_msg_find_attr_as_uint(msg, "primaryGroupID", ~0));
330 /* Filter out builtin groups from this token. We will search
331 * for builtin groups later, and not include them in the PAC
332 * on SamLogon validation info */
333 filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(!(groupType:1.2.840.113556.1.4.803:=%u))(groupType:1.2.840.113556.1.4.803:=%u))", GROUP_TYPE_BUILTIN_LOCAL_GROUP, GROUP_TYPE_SECURITY_ENABLED);
334 if (filter == NULL) {
335 TALLOC_FREE(user_info_dc);
336 return NT_STATUS_NO_MEMORY;
339 primary_group_string = dom_sid_string(tmp_ctx, &sids[PRIMARY_GROUP_SID_INDEX]);
340 if (primary_group_string == NULL) {
341 TALLOC_FREE(user_info_dc);
342 return NT_STATUS_NO_MEMORY;
345 primary_group_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", primary_group_string);
346 if (primary_group_dn == NULL) {
347 TALLOC_FREE(user_info_dc);
348 return NT_STATUS_NO_MEMORY;
351 primary_group_blob = data_blob_string_const(primary_group_dn);
353 /* Expands the primary group - this function takes in
354 * memberOf-like values, so we fake one up with the
355 * <SID=S-...> format of DN and then let it expand
356 * them, as long as they meet the filter - so only
357 * domain groups, not builtin groups
359 * The primary group is still treated specially, so we set the
360 * 'only childs' flag to true
362 status = dsdb_expand_nested_groups(sam_ctx, &primary_group_blob, true, filter,
363 user_info_dc, &sids, &num_sids);
364 if (!NT_STATUS_IS_OK(status)) {
365 talloc_free(user_info_dc);
369 /* Expands the additional groups */
370 el = ldb_msg_find_element(msg, "memberOf");
371 for (i = 0; el && i < el->num_values; i++) {
372 /* This function takes in memberOf values and expands
373 * them, as long as they meet the filter - so only
374 * domain groups, not builtin groups */
375 status = dsdb_expand_nested_groups(sam_ctx, &el->values[i], false, filter,
376 user_info_dc, &sids, &num_sids);
377 if (!NT_STATUS_IS_OK(status)) {
378 talloc_free(user_info_dc);
383 user_info_dc->sids = sids;
384 user_info_dc->num_sids = num_sids;
386 user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
387 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
389 info->account_name = talloc_steal(info,
390 ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL));
392 info->domain_name = talloc_strdup(info, domain_name);
393 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->domain_name,
396 str = ldb_msg_find_attr_as_string(msg, "displayName", "");
397 info->full_name = talloc_strdup(info, str);
398 if (info->full_name == NULL) {
399 TALLOC_FREE(user_info_dc);
400 return NT_STATUS_NO_MEMORY;
403 str = ldb_msg_find_attr_as_string(msg, "scriptPath", "");
404 info->logon_script = talloc_strdup(info, str);
405 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_script,
408 str = ldb_msg_find_attr_as_string(msg, "profilePath", "");
409 info->profile_path = talloc_strdup(info, str);
410 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->profile_path,
413 str = ldb_msg_find_attr_as_string(msg, "homeDirectory", "");
414 info->home_directory = talloc_strdup(info, str);
415 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_directory,
418 str = ldb_msg_find_attr_as_string(msg, "homeDrive", "");
419 info->home_drive = talloc_strdup(info, str);
420 if (info->home_drive == NULL) {
421 TALLOC_FREE(user_info_dc);
422 return NT_STATUS_NO_MEMORY;
425 info->logon_server = talloc_strdup(info, netbios_name);
426 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_server,
429 info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
430 info->last_logoff = samdb_result_last_logoff(msg);
431 info->acct_expiry = samdb_result_account_expires(msg);
432 info->last_password_change = samdb_result_nttime(msg,
434 info->allow_password_change
435 = samdb_result_allow_password_change(sam_ctx, mem_ctx,
436 domain_dn, msg, "pwdLastSet");
437 info->force_password_change
438 = samdb_result_force_password_change(sam_ctx, mem_ctx,
440 info->logon_count = ldb_msg_find_attr_as_uint(msg, "logonCount", 0);
441 info->bad_password_count = ldb_msg_find_attr_as_uint(msg, "badPwdCount",
444 info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx,
447 user_info_dc->user_session_key = data_blob_talloc(user_info_dc,
449 user_sess_key.length);
450 if (user_sess_key.data) {
451 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->user_session_key.data,
454 user_info_dc->lm_session_key = data_blob_talloc(user_info_dc,
457 if (lm_sess_key.data) {
458 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->lm_session_key.data,
462 if (info->acct_flags & ACB_SVRTRUST) {
463 /* the SID_NT_ENTERPRISE_DCS SID gets added into the
465 user_info_dc->sids = talloc_realloc(user_info_dc,
468 user_info_dc->num_sids+1);
469 if (user_info_dc->sids == NULL) {
470 TALLOC_FREE(user_info_dc);
471 return NT_STATUS_NO_MEMORY;
473 user_info_dc->sids[user_info_dc->num_sids] = global_sid_Enterprise_DCs;
474 user_info_dc->num_sids++;
477 if ((info->acct_flags & (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) ==
478 (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) {
479 /* the DOMAIN_RID_ENTERPRISE_READONLY_DCS PAC */
480 user_info_dc->sids = talloc_realloc(user_info_dc,
483 user_info_dc->num_sids+1);
484 if (user_info_dc->sids == NULL) {
485 TALLOC_FREE(user_info_dc);
486 return NT_STATUS_NO_MEMORY;
488 user_info_dc->sids[user_info_dc->num_sids] = *domain_sid;
489 sid_append_rid(&user_info_dc->sids[user_info_dc->num_sids],
490 DOMAIN_RID_ENTERPRISE_READONLY_DCS);
491 user_info_dc->num_sids++;
494 info->authenticated = true;
496 talloc_free(tmp_ctx);
497 *_user_info_dc = user_info_dc;
502 NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
503 TALLOC_CTX *mem_ctx, const char *principal,
505 struct ldb_dn **domain_dn,
506 struct ldb_message **msg)
508 struct ldb_dn *user_dn;
510 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
514 return NT_STATUS_NO_MEMORY;
517 nt_status = crack_user_principal_name(sam_ctx, tmp_ctx, principal,
518 &user_dn, domain_dn);
519 if (!NT_STATUS_IS_OK(nt_status)) {
520 talloc_free(tmp_ctx);
524 /* pull the user attributes */
525 ret = dsdb_search_one(sam_ctx, tmp_ctx, msg, user_dn,
526 LDB_SCOPE_BASE, attrs,
527 DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
529 if (ret != LDB_SUCCESS) {
530 talloc_free(tmp_ctx);
531 return NT_STATUS_INTERNAL_DB_CORRUPTION;
533 talloc_steal(mem_ctx, *msg);
534 talloc_steal(mem_ctx, *domain_dn);
535 talloc_free(tmp_ctx);
540 /* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available, and for tokenGroups in the DSDB stack.
542 Supply either a principal or a DN
544 NTSTATUS authsam_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
545 struct loadparm_context *lp_ctx,
546 struct ldb_context *sam_ctx,
547 const char *principal,
548 struct ldb_dn *user_dn,
549 struct auth_user_info_dc **user_info_dc)
552 DATA_BLOB user_sess_key = data_blob(NULL, 0);
553 DATA_BLOB lm_sess_key = data_blob(NULL, 0);
555 struct ldb_message *msg;
556 struct ldb_dn *domain_dn;
558 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
560 return NT_STATUS_NO_MEMORY;
564 nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal,
565 user_attrs, &domain_dn, &msg);
566 if (!NT_STATUS_IS_OK(nt_status)) {
567 talloc_free(tmp_ctx);
570 } else if (user_dn) {
571 struct dom_sid *user_sid, *domain_sid;
573 /* pull the user attributes */
574 ret = dsdb_search_one(sam_ctx, tmp_ctx, &msg, user_dn,
575 LDB_SCOPE_BASE, user_attrs,
576 DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
578 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
579 talloc_free(tmp_ctx);
580 return NT_STATUS_NO_SUCH_USER;
581 } else if (ret != LDB_SUCCESS) {
582 talloc_free(tmp_ctx);
583 return NT_STATUS_INTERNAL_DB_CORRUPTION;
586 user_sid = samdb_result_dom_sid(msg, msg, "objectSid");
588 nt_status = dom_sid_split_rid(tmp_ctx, user_sid, &domain_sid, NULL);
589 if (!NT_STATUS_IS_OK(nt_status)) {
593 domain_dn = samdb_search_dn(sam_ctx, mem_ctx, NULL,
594 "(&(objectSid=%s)(objectClass=domain))",
595 ldap_encode_ndr_dom_sid(tmp_ctx, domain_sid));
597 DEBUG(3, ("authsam_get_user_info_dc_principal: Failed to find domain with: SID %s\n",
598 dom_sid_string(tmp_ctx, domain_sid)));
599 return NT_STATUS_NO_SUCH_USER;
603 return NT_STATUS_INVALID_PARAMETER;
606 nt_status = authsam_make_user_info_dc(tmp_ctx, sam_ctx,
607 lpcfg_netbios_name(lp_ctx),
608 lpcfg_workgroup(lp_ctx),
611 user_sess_key, lm_sess_key,
613 if (!NT_STATUS_IS_OK(nt_status)) {
614 talloc_free(tmp_ctx);
618 talloc_steal(mem_ctx, *user_info_dc);
619 talloc_free(tmp_ctx);