Create a UNIX user on demand.
****************************************************************************/
-static int smb_create_user(const char *domain, const char *unix_username, const char *homedir)
+static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
{
TALLOC_CTX *ctx = talloc_tos();
char *add_script;
Create an auth_usersupplied_data structure after appropriate mapping.
****************************************************************************/
-NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
- const char *smb_name,
- const char *client_domain,
- const char *wksta_name,
- DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
- DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
- DATA_BLOB *plaintext,
+NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
+ const char *smb_name,
+ const char *client_domain,
+ const char *wksta_name,
+ DATA_BLOB *lm_pwd,
+ DATA_BLOB *nt_pwd,
+ DATA_BLOB *lm_interactive_pwd,
+ DATA_BLOB *nt_interactive_pwd,
+ DATA_BLOB *plaintext,
bool encrypted)
{
const char *domain;
bool was_mapped;
fstring internal_username;
fstrcpy(internal_username, smb_name);
- was_mapped = map_username(internal_username);
-
- DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
- client_domain, smb_name, wksta_name));
-
- /* don't allow "" as a domain, fixes a Win9X bug
- where it doens't supply a domain for logon script
- 'net use' commands. */
+ was_mapped = map_username(internal_username);
- if ( *client_domain )
- domain = client_domain;
- else
- domain = lp_workgroup();
+ DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
+ client_domain, smb_name, wksta_name));
- /* do what win2k does. Always map unknown domains to our own
- and let the "passdb backend" handle unknown users. */
+ domain = client_domain;
- if ( !is_trusted_domain(domain) && !strequal(domain, get_global_sam_name()) )
- domain = my_sam_name();
-
- /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
-
- result = make_user_info(user_info, smb_name, internal_username,
- client_domain, domain, wksta_name,
+ /* If you connect to a Windows domain member using a bogus domain name,
+ * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
+ * the Windows box is a DC the name will become DOMAIN\user and be
+ * authenticated against AD, if the Windows box is a member server but
+ * not a DC the name will become WORKSTATION\user. A standalone
+ * non-domain member box will also map to WORKSTATION\user.
+ * This also deals with the client passing in a "" domain */
+
+ if (!is_trusted_domain(domain) &&
+ !strequal(domain, my_sam_name()))
+ {
+ if (lp_map_untrusted_to_domain())
+ domain = my_sam_name();
+ else
+ domain = get_global_sam_name();
+ DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
+ "workstation [%s]\n",
+ client_domain, domain, smb_name, wksta_name));
+ }
+
+ /* We know that the given domain is trusted (and we are allowing them),
+ * it is our global SAM name, or for legacy behavior it is our
+ * primary domain name */
+
+ result = make_user_info(user_info, smb_name, internal_username,
+ client_domain, domain, wksta_name,
lm_pwd, nt_pwd,
lm_interactive_pwd, nt_interactive_pwd,
plaintext, encrypted);
unsigned char local_nt_response[24];
unsigned char key[16];
- ZERO_STRUCT(key);
- memcpy(key, dc_sess_key, 8);
+ memcpy(key, dc_sess_key, 16);
if (lm_interactive_pwd)
memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
struct passwd *pwd;
gid_t *gids;
auth_serversupplied_info *result;
- int i;
- size_t num_gids;
- DOM_SID unix_group_sid;
const char *username = pdb_get_username(sampass);
NTSTATUS status;
}
}
- /* Add the "Unix Group" SID for each gid to catch mapped groups
- and their Unix equivalent. This is to solve the backwards
- compatibility problem of 'valid users = +ntadmin' where
- ntadmin has been paired with "Domain Admins" in the group
- mapping table. Otherwise smb.conf would need to be changed
- to 'valid user = "Domain Admins"'. --jerry */
-
- num_gids = result->num_sids;
- for ( i=0; i<num_gids; i++ ) {
- if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
- DEBUG(1,("make_server_info_sam: Failed to create SID "
- "for gid %d!\n", gids[i]));
- continue;
- }
- status = add_sid_to_array_unique(result, &unix_group_sid,
- &result->sids,
- &result->num_sids);
- if (!NT_STATUS_IS_OK(status)) {
- result->sam_account = NULL; /* Don't free on error exit. */
- TALLOC_FREE(result);
- return status;
- }
- }
-
/* For now we throw away the gids and convert via sid_to_gid
* later. This needs fixing, but I'd like to get the code straight and
* simple first. */
{
NTSTATUS status;
size_t i;
+ struct dom_sid tmp_sid;
/*
* If winbind is not around, we can not make much use of the SIDs the
&server_info->utok.ngroups);
}
+ /*
+ * Add the "Unix Group" SID for each gid to catch mapped groups
+ * and their Unix equivalent. This is to solve the backwards
+ * compatibility problem of 'valid users = +ntadmin' where
+ * ntadmin has been paired with "Domain Admins" in the group
+ * mapping table. Otherwise smb.conf would need to be changed
+ * to 'valid user = "Domain Admins"'. --jerry
+ *
+ * For consistency we also add the "Unix User" SID,
+ * so that the complete unix token is represented within
+ * the nt token.
+ */
+
+ if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
+ DEBUG(1,("create_local_token: Failed to create SID "
+ "for uid %u!\n", (unsigned int)server_info->utok.uid));
+ }
+ add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+ &server_info->ptok->user_sids,
+ &server_info->ptok->num_sids);
+
+ for ( i=0; i<server_info->utok.ngroups; i++ ) {
+ if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
+ DEBUG(1,("create_local_token: Failed to create SID "
+ "for gid %u!\n", (unsigned int)server_info->utok.groups[i]));
+ continue;
+ }
+ add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+ &server_info->ptok->user_sids,
+ &server_info->ptok->num_sids);
+ }
+
debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
+ debug_unix_user_token(DBGC_AUTH, 10,
+ server_info->utok.uid,
+ server_info->utok.gid,
+ server_info->utok.ngroups,
+ server_info->utok.groups);
status = log_nt_token(server_info->ptok);
return status;
}
/*
- * Create an artificial NT token given just a username. (Initially indended
+ * Create an artificial NT token given just a username. (Initially intended
* for force user)
*
* We go through lookup_name() to avoid problems we had with 'winbind use
goto done;
}
- if (!sid_to_uid(&user_sid, uid)) {
- DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
- username, sid_string_dbg(&user_sid)));
- goto done;
- }
-
if (sid_check_is_in_our_domain(&user_sid)) {
bool ret;
*found_username = talloc_strdup(mem_ctx,
pdb_get_username(sam_acct));
+ /*
+ * If the SID from lookup_name() was the guest sid, passdb knows
+ * about the mapping of guest sid to lp_guestaccount()
+ * username and will return the unix_pw info for a guest
+ * user. Use it if it's there, else lookup the *uid details
+ * using getpwnam_alloc(). See bug #6291 for details. JRA.
+ */
+
+ /* We must always assign the *uid. */
+ if (sam_acct->unix_pw == NULL) {
+ struct passwd *pwd = getpwnam_alloc(sam_acct, *found_username );
+ if (!pwd) {
+ DEBUG(10, ("getpwnam_alloc failed for %s\n",
+ *found_username));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+ result = samu_set_unix(sam_acct, pwd );
+ if (!NT_STATUS_IS_OK(result)) {
+ DEBUG(10, ("samu_set_unix failed for %s\n",
+ *found_username));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+ }
+ *uid = sam_acct->unix_pw->pw_uid;
+
} else if (sid_check_is_in_unix_users(&user_sid)) {
/* This is a unix user not in passdb. We need to ask nss
unix_user:
+ if (!sid_to_uid(&user_sid, uid)) {
+ DEBUG(1, ("unix_user case, sid_to_uid for %s (%s) failed\n",
+ username, sid_string_dbg(&user_sid)));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+
uid_to_unix_users_sid(*uid, &user_sid);
pass = getpwuid_alloc(tmp_ctx, *uid);
if (pass == NULL) {
- DEBUG(1, ("getpwuid(%d) for user %s failed\n",
- *uid, username));
+ DEBUG(1, ("getpwuid(%u) for user %s failed\n",
+ (unsigned int)*uid, username));
goto done;
}
uint32 dummy;
+ /* We must always assign the *uid. */
+ if (!sid_to_uid(&user_sid, uid)) {
+ DEBUG(1, ("winbindd case, sid_to_uid for %s (%s) failed\n",
+ username, sid_string_dbg(&user_sid)));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+
num_group_sids = 1;
group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
if (group_sids == NULL) {
if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
DEBUG(1,("create_token_from_username: Failed to create SID "
- "for gid %d!\n", gids[i]));
+ "for gid %u!\n", (unsigned int)gids[i]));
continue;
}
result = add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
if (username[strlen(username)-1] == '$')
return NULL;
- smb_create_user(NULL, username, NULL);
+ _smb_create_user(NULL, username, NULL);
pw = Get_Pwnam_alloc(mem_ctx, username);
}
if (!pdb_set_pass_last_set_time(
sam_account,
- nt_time_to_unix(info->pass_last_set_time),
+ info->pass_last_set_time,
PDB_CHANGED)) {
TALLOC_FREE(result);
return NT_STATUS_NO_MEMORY;
if (!pdb_set_pass_can_change_time(
sam_account,
- nt_time_to_unix(info->pass_can_change_time),
+ info->pass_can_change_time,
PDB_CHANGED)) {
TALLOC_FREE(result);
return NT_STATUS_NO_MEMORY;
if (!pdb_set_pass_must_change_time(
sam_account,
- nt_time_to_unix(info->pass_must_change_time),
+ info->pass_must_change_time,
PDB_CHANGED)) {
TALLOC_FREE(result);
return NT_STATUS_NO_MEMORY;
if ( lp_server_role() == ROLE_STANDALONE )
return False;
+ if (dom_name == NULL || dom_name[0] == '\0') {
+ return false;
+ }
+
+ if (strequal(dom_name, get_global_sam_name())) {
+ return false;
+ }
+
/* if we are a DC, then check for a direct trust relationships */
if ( IS_DC ) {
git.samba.org / samba.git / blobdiff