source4/kdc/pac-glue.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    PAC Glue between Samba and the KDC
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
   7    Copyright (C) Simo Sorce <idra@samba.org> 2010
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "librpc/gen_ndr/auth.h"
  25
  26 enum samba_asserted_identity {
  27         SAMBA_ASSERTED_IDENTITY_IGNORE = 0,
  28         SAMBA_ASSERTED_IDENTITY_SERVICE,
  29         SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY,
  30 };
  31
  32 enum {
  33         SAMBA_KDC_FLAG_PROTOCOL_TRANSITION    = 0x00000001,
  34         SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION = 0x00000002,
  35         SAMBA_KDC_FLAG_KRBTGT_IN_DB           = 0x00000004,
  36         SAMBA_KDC_FLAG_KRBTGT_IS_TRUSTED      = 0x00000008,
  37         SAMBA_KDC_FLAG_SKIP_PAC_BUFFER        = 0x00000010,
  38 };
  39
  40 krb5_error_code samba_kdc_encrypt_pac_credentials(krb5_context context,
  41                                                   const krb5_keyblock *pkreplykey,
  42                                                   const DATA_BLOB *cred_ndr_blob,
  43                                                   TALLOC_CTX *mem_ctx,
  44                                                   DATA_BLOB *cred_info_blob);
  45
  46 krb5_error_code samba_make_krb5_pac(krb5_context context,
  47                                     const DATA_BLOB *logon_blob,
  48                                     const DATA_BLOB *cred_blob,
  49                                     const DATA_BLOB *upn_blob,
  50                                     const DATA_BLOB *pac_attrs_blob,
  51                                     const DATA_BLOB *requester_sid_blob,
  52                                     const DATA_BLOB *deleg_blob,
  53                                     const DATA_BLOB *client_claims_blob,
  54                                     const DATA_BLOB *device_info_blob,
  55                                     const DATA_BLOB *device_claims_blob,
  56                                     krb5_pac pac);
  57
  58 bool samba_princ_needs_pac(const struct samba_kdc_entry *skdc_entry);
  59
  60 int samba_client_requested_pac(krb5_context context,
  61                                krb5_const_pac pac,
  62                                TALLOC_CTX *mem_ctx,
  63                                bool *requested_pac);
  64
  65 int samba_krbtgt_is_in_db(struct samba_kdc_entry *skdc_entry,
  66                           bool *is_in_db,
  67                           bool *is_trusted);
  68
  69 NTSTATUS samba_kdc_get_user_info_from_db(TALLOC_CTX *mem_ctx,
  70                                          struct samba_kdc_entry *skdc_entry,
  71                                          const struct ldb_message *msg,
  72                                          const struct auth_user_info_dc **user_info_dc);
  73
  74 NTSTATUS samba_kdc_get_pac_blobs(TALLOC_CTX *mem_ctx,
  75                                  struct samba_kdc_entry *skdc_entry,
  76                                  enum samba_asserted_identity asserted_identity,
  77                                  enum auth_group_inclusion group_inclusion,
  78                                  DATA_BLOB **_logon_info_blob,
  79                                  DATA_BLOB **_cred_ndr_blob,
  80                                  DATA_BLOB **_upn_info_blob,
  81                                  DATA_BLOB **_pac_attrs_blob,
  82                                  uint64_t pac_attributes,
  83                                  DATA_BLOB **_requester_sid_blob,
  84                                  DATA_BLOB **_client_claims_blob);
  85 NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx,
  86                                    krb5_context context,
  87                                    struct ldb_context *samdb,
  88                                    enum auth_group_inclusion group_inclusion,
  89                                    const krb5_pac pac, DATA_BLOB *pac_blob,
  90                                    struct PAC_SIGNATURE_DATA *pac_srv_sig,
  91                                    struct PAC_SIGNATURE_DATA *pac_kdc_sig);
  92
  93 NTSTATUS samba_kdc_update_delegation_info_blob(TALLOC_CTX *mem_ctx,
  94                                 krb5_context context,
  95                                 krb5_const_pac pac,
  96                                 krb5_principal server_principal,
  97                                 krb5_principal proxy_principal,
  98                                 DATA_BLOB *pac_blob);
  99
 100 krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status);
 101
 102 NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry,
 103                                        const char *client_name,
 104                                        const char *workstation,
 105                                        bool password_change);
 106
 107 krb5_error_code samba_kdc_validate_pac_blob(
 108                 krb5_context context,
 109                 const struct samba_kdc_entry *client_skdc_entry,
 110                 krb5_const_pac pac);
 111
 112 /*
 113  * In the RODC case, to confirm that the returned user is permitted to
 114  * be replicated to the KDC (krbgtgt_xxx user) represented by *rodc
 115  */
 116 WERROR samba_rodc_confirm_user_is_allowed(uint32_t num_sids,
 117                                           const struct dom_sid *object_sids,
 118                                           const struct samba_kdc_entry *rodc,
 119                                           const struct samba_kdc_entry *object);
 120
 121 krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
 122                                      krb5_context context,
 123                                      struct ldb_context *samdb,
 124                                      uint32_t flags,
 125                                      struct samba_kdc_entry *client,
 126                                      krb5_principal server_principal,
 127                                      const struct samba_kdc_entry *server,
 128                                      const struct samba_kdc_entry *krbtgt,
 129                                      krb5_principal delegated_proxy_principal,
 130                                      const struct samba_kdc_entry *device,
 131                                      const krb5_const_pac *device_pac,
 132                                      krb5_pac old_pac,
 133                                      krb5_pac new_pac);