#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
+/****************************************************************************
+ Ensure primary group SID is always at position 0 in a
+ auth_serversupplied_info struct.
+****************************************************************************/
+
+static void sort_sid_array_for_smbd(auth_serversupplied_info *result,
+ const DOM_SID *pgroup_sid)
+{
+ unsigned int i;
+
+ if (!result->sids) {
+ return;
+ }
+
+ if (sid_compare(&result->sids[0], pgroup_sid)==0) {
+ return;
+ }
+
+ for (i = 1; i < result->num_sids; i++) {
+ if (sid_compare(pgroup_sid,
+ &result->sids[i]) == 0) {
+ sid_copy(&result->sids[i], &result->sids[0]);
+ sid_copy(&result->sids[0], pgroup_sid);
+ return;
+ }
+ }
+}
+
/****************************************************************************
Create a UNIX user on demand.
****************************************************************************/
-static int smb_create_user(const char *domain, const char *unix_username, const char *homedir)
+static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
{
TALLOC_CTX *ctx = talloc_tos();
char *add_script;
Create an auth_usersupplied_data structure after appropriate mapping.
****************************************************************************/
-NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
- const char *smb_name,
- const char *client_domain,
- const char *wksta_name,
- DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
- DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
- DATA_BLOB *plaintext,
+NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
+ const char *smb_name,
+ const char *client_domain,
+ const char *wksta_name,
+ DATA_BLOB *lm_pwd,
+ DATA_BLOB *nt_pwd,
+ DATA_BLOB *lm_interactive_pwd,
+ DATA_BLOB *nt_interactive_pwd,
+ DATA_BLOB *plaintext,
bool encrypted)
{
const char *domain;
bool was_mapped;
fstring internal_username;
fstrcpy(internal_username, smb_name);
- was_mapped = map_username(internal_username);
-
- DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
- client_domain, smb_name, wksta_name));
-
- /* don't allow "" as a domain, fixes a Win9X bug
- where it doens't supply a domain for logon script
- 'net use' commands. */
+ was_mapped = map_username(internal_username);
- if ( *client_domain )
- domain = client_domain;
- else
- domain = lp_workgroup();
+ DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
+ client_domain, smb_name, wksta_name));
- /* do what win2k does. Always map unknown domains to our own
- and let the "passdb backend" handle unknown users. */
+ domain = client_domain;
- if ( !is_trusted_domain(domain) && !strequal(domain, get_global_sam_name()) )
- domain = my_sam_name();
-
- /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
-
- result = make_user_info(user_info, smb_name, internal_username,
- client_domain, domain, wksta_name,
+ /* If you connect to a Windows domain member using a bogus domain name,
+ * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
+ * the Windows box is a DC the name will become DOMAIN\user and be
+ * authenticated against AD, if the Windows box is a member server but
+ * not a DC the name will become WORKSTATION\user. A standalone
+ * non-domain member box will also map to WORKSTATION\user.
+ * This also deals with the client passing in a "" domain */
+
+ if (!is_trusted_domain(domain) &&
+ !strequal(domain, my_sam_name()))
+ {
+ if (lp_map_untrusted_to_domain())
+ domain = my_sam_name();
+ else
+ domain = get_global_sam_name();
+ DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
+ "workstation [%s]\n",
+ client_domain, domain, smb_name, wksta_name));
+ }
+
+ /* We know that the given domain is trusted (and we are allowing them),
+ * it is our global SAM name, or for legacy behavior it is our
+ * primary domain name */
+
+ result = make_user_info(user_info, smb_name, internal_username,
+ client_domain, domain, wksta_name,
lm_pwd, nt_pwd,
lm_interactive_pwd, nt_interactive_pwd,
plaintext, encrypted);
unsigned char local_nt_response[24];
unsigned char key[16];
- ZERO_STRUCT(key);
- memcpy(key, dc_sess_key, 8);
+ memcpy(key, dc_sess_key, 16);
if (lm_interactive_pwd)
memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
which may save us from giving away root access if there
is a bug in allocating these fields. */
- result->uid = -1;
- result->gid = -1;
+ result->utok.uid = -1;
+ result->utok.gid = -1;
return result;
}
+static char *sanitize_username(TALLOC_CTX *mem_ctx, const char *username)
+{
+ fstring tmp;
+
+ alpha_strcpy(tmp, username, ". _-$", sizeof(tmp));
+ return talloc_strdup(mem_ctx, tmp);
+}
+
+/***************************************************************************
+ Is the incoming username our own machine account ?
+ If so, the connection is almost certainly from winbindd.
+***************************************************************************/
+
+static bool is_our_machine_account(const char *username)
+{
+ bool ret;
+ char *truncname = NULL;
+ size_t ulen = strlen(username);
+
+ if (ulen == 0 || username[ulen-1] != '$') {
+ return false;
+ }
+ truncname = SMB_STRDUP(username);
+ if (!truncname) {
+ return false;
+ }
+ truncname[ulen-1] = '\0';
+ ret = strequal(truncname, global_myname());
+ SAFE_FREE(truncname);
+ return ret;
+}
+
/***************************************************************************
Make (and fill) a user_info struct from a struct samu
***************************************************************************/
-NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
+NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
struct samu *sampass)
{
- NTSTATUS status;
struct passwd *pwd;
gid_t *gids;
auth_serversupplied_info *result;
- int i;
- size_t num_gids;
- DOM_SID unix_group_sid;
-
+ const char *username = pdb_get_username(sampass);
+ NTSTATUS status;
if ( !(result = make_server_info(NULL)) ) {
return NT_STATUS_NO_MEMORY;
}
- if ( !(pwd = getpwnam_alloc(result, pdb_get_username(sampass))) ) {
+ if ( !(pwd = getpwnam_alloc(result, username)) ) {
DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
pdb_get_username(sampass)));
TALLOC_FREE(result);
}
result->sam_account = sampass;
- /* Ensure thaat the sampass will be freed with the result */
- talloc_steal(result, sampass);
result->unix_name = pwd->pw_name;
/* Ensure that we keep pwd->pw_name, because we will free pwd below */
talloc_steal(result, pwd->pw_name);
- result->gid = pwd->pw_gid;
- result->uid = pwd->pw_uid;
-
+ result->utok.gid = pwd->pw_gid;
+ result->utok.uid = pwd->pw_uid;
+
TALLOC_FREE(pwd);
- status = pdb_enum_group_memberships(result, sampass,
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
+ if (result->sanitized_username == NULL) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (IS_DC && is_our_machine_account(username)) {
+ /*
+ * Ensure for a connection from our own
+ * machine account (from winbindd on a DC)
+ * there are no supplementary groups.
+ * Prevents loops in calling gid_to_sid().
+ */
+ result->sids = NULL;
+ gids = NULL;
+ result->num_sids = 0;
+
+ /*
+ * This is a hack of monstrous proportions.
+ * If we know it's winbindd talking to us,
+ * we know we must never recurse into it,
+ * so turn off contacting winbindd for this
+ * entire process. This will get fixed when
+ * winbindd doesn't need to talk to smbd on
+ * a PDC. JRA.
+ */
+
+ (void)winbind_off();
+
+ DEBUG(10, ("make_server_info_sam: our machine account %s "
+ "setting supplementary group list empty and "
+ "turning off winbindd requests.\n",
+ username));
+ } else {
+ status = pdb_enum_group_memberships(result, sampass,
&result->sids, &gids,
&result->num_sids);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
- nt_errstr(status)));
- result->sam_account = NULL; /* Don't free on error exit. */
- TALLOC_FREE(result);
- return status;
- }
-
- /* Add the "Unix Group" SID for each gid to catch mapped groups
- and their Unix equivalent. This is to solve the backwards
- compatibility problem of 'valid users = +ntadmin' where
- ntadmin has been paired with "Domain Admins" in the group
- mapping table. Otherwise smb.conf would need to be changed
- to 'valid user = "Domain Admins"'. --jerry */
-
- num_gids = result->num_sids;
- for ( i=0; i<num_gids; i++ ) {
- if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
- DEBUG(1,("make_server_info_sam: Failed to create SID "
- "for gid %d!\n", gids[i]));
- continue;
- }
- status = add_sid_to_array_unique(result, &unix_group_sid,
- &result->sids,
- &result->num_sids);
if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
+ nt_errstr(status)));
result->sam_account = NULL; /* Don't free on error exit. */
TALLOC_FREE(result);
return status;
pdb_get_username(sampass), result->unix_name));
*server_info = result;
+ /* Ensure that the sampass will be freed with the result */
+ talloc_steal(result, sampass);
return NT_STATUS_OK;
}
-static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
+static NTSTATUS log_nt_token(NT_USER_TOKEN *token)
{
+ TALLOC_CTX *frame = talloc_stackframe();
char *command;
char *group_sidstr;
size_t i;
if ((lp_log_nt_token_command() == NULL) ||
(strlen(lp_log_nt_token_command()) == 0)) {
+ TALLOC_FREE(frame);
return NT_STATUS_OK;
}
- group_sidstr = talloc_strdup(tmp_ctx, "");
+ group_sidstr = talloc_strdup(frame, "");
for (i=1; i<token->num_sids; i++) {
group_sidstr = talloc_asprintf(
- tmp_ctx, "%s %s", group_sidstr,
- sid_string_talloc(tmp_ctx, &token->user_sids[i]));
+ frame, "%s %s", group_sidstr,
+ sid_string_talloc(frame, &token->user_sids[i]));
}
command = talloc_string_sub(
- tmp_ctx, lp_log_nt_token_command(),
- "%s", sid_string_talloc(tmp_ctx, &token->user_sids[0]));
- command = talloc_string_sub(tmp_ctx, command, "%t", group_sidstr);
+ frame, lp_log_nt_token_command(),
+ "%s", sid_string_talloc(frame, &token->user_sids[0]));
+ command = talloc_string_sub(frame, command, "%t", group_sidstr);
if (command == NULL) {
+ TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
DEBUG(8, ("running command: [%s]\n", command));
if (smbrun(command, NULL) != 0) {
DEBUG(0, ("Could not log NT token\n"));
+ TALLOC_FREE(frame);
return NT_STATUS_ACCESS_DENIED;
}
+ TALLOC_FREE(frame);
return NT_STATUS_OK;
}
NTSTATUS create_local_token(auth_serversupplied_info *server_info)
{
- TALLOC_CTX *mem_ctx;
NTSTATUS status;
size_t i;
-
-
- mem_ctx = talloc_new(NULL);
- if (mem_ctx == NULL) {
- DEBUG(0, ("talloc_new failed\n"));
- return NT_STATUS_NO_MEMORY;
- }
+ struct dom_sid tmp_sid;
/*
* If winbind is not around, we can not make much use of the SIDs the
*/
if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
- (server_info->was_mapped)) {
+ (server_info->nss_token)) {
status = create_token_from_username(server_info,
server_info->unix_name,
server_info->guest,
- &server_info->uid,
- &server_info->gid,
+ &server_info->utok.uid,
+ &server_info->utok.gid,
&server_info->unix_name,
&server_info->ptok);
-
+
} else {
server_info->ptok = create_local_nt_token(
server_info,
}
if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(mem_ctx);
return status;
}
-
+
/* Convert the SIDs to gids. */
- server_info->n_groups = 0;
- server_info->groups = NULL;
+ server_info->utok.ngroups = 0;
+ server_info->utok.groups = NULL;
/* Start at index 1, where the groups start. */
"ignoring it\n", sid_string_dbg(sid)));
continue;
}
- add_gid_to_array_unique(server_info, gid, &server_info->groups,
- &server_info->n_groups);
+ add_gid_to_array_unique(server_info, gid,
+ &server_info->utok.groups,
+ &server_info->utok.ngroups);
}
-
- debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
- status = log_nt_token(mem_ctx, server_info->ptok);
+ /*
+ * Add the "Unix Group" SID for each gid to catch mapped groups
+ * and their Unix equivalent. This is to solve the backwards
+ * compatibility problem of 'valid users = +ntadmin' where
+ * ntadmin has been paired with "Domain Admins" in the group
+ * mapping table. Otherwise smb.conf would need to be changed
+ * to 'valid user = "Domain Admins"'. --jerry
+ *
+ * For consistency we also add the "Unix User" SID,
+ * so that the complete unix token is represented within
+ * the nt token.
+ */
- TALLOC_FREE(mem_ctx);
+ if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
+ DEBUG(1,("create_local_token: Failed to create SID "
+ "for uid %u!\n", (unsigned int)server_info->utok.uid));
+ }
+ add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+ &server_info->ptok->user_sids,
+ &server_info->ptok->num_sids);
+
+ for ( i=0; i<server_info->utok.ngroups; i++ ) {
+ if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
+ DEBUG(1,("create_local_token: Failed to create SID "
+ "for gid %u!\n", (unsigned int)server_info->utok.groups[i]));
+ continue;
+ }
+ add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+ &server_info->ptok->user_sids,
+ &server_info->ptok->num_sids);
+ }
+
+ debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
+ debug_unix_user_token(DBGC_AUTH, 10,
+ server_info->utok.uid,
+ server_info->utok.gid,
+ server_info->utok.ngroups,
+ server_info->utok.groups);
+
+ status = log_nt_token(server_info->ptok);
return status;
}
/*
- * Create an artificial NT token given just a username. (Initially indended
+ * Create an artificial NT token given just a username. (Initially intended
* for force user)
*
* We go through lookup_name() to avoid problems we had with 'winbind use
goto done;
}
- if (!sid_to_uid(&user_sid, uid)) {
- DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
- username, sid_string_dbg(&user_sid)));
- goto done;
- }
-
if (sid_check_is_in_our_domain(&user_sid)) {
bool ret;
*found_username = talloc_strdup(mem_ctx,
pdb_get_username(sam_acct));
+ /*
+ * If the SID from lookup_name() was the guest sid, passdb knows
+ * about the mapping of guest sid to lp_guestaccount()
+ * username and will return the unix_pw info for a guest
+ * user. Use it if it's there, else lookup the *uid details
+ * using getpwnam_alloc(). See bug #6291 for details. JRA.
+ */
+
+ /* We must always assign the *uid. */
+ if (sam_acct->unix_pw == NULL) {
+ struct passwd *pwd = getpwnam_alloc(sam_acct, *found_username );
+ if (!pwd) {
+ DEBUG(10, ("getpwnam_alloc failed for %s\n",
+ *found_username));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+ result = samu_set_unix(sam_acct, pwd );
+ if (!NT_STATUS_IS_OK(result)) {
+ DEBUG(10, ("samu_set_unix failed for %s\n",
+ *found_username));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+ }
+ *uid = sam_acct->unix_pw->pw_uid;
+
} else if (sid_check_is_in_unix_users(&user_sid)) {
/* This is a unix user not in passdb. We need to ask nss
unix_user:
+ if (!sid_to_uid(&user_sid, uid)) {
+ DEBUG(1, ("unix_user case, sid_to_uid for %s (%s) failed\n",
+ username, sid_string_dbg(&user_sid)));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+
uid_to_unix_users_sid(*uid, &user_sid);
pass = getpwuid_alloc(tmp_ctx, *uid);
if (pass == NULL) {
- DEBUG(1, ("getpwuid(%d) for user %s failed\n",
- *uid, username));
+ DEBUG(1, ("getpwuid(%u) for user %s failed\n",
+ (unsigned int)*uid, username));
goto done;
}
uint32 dummy;
+ /* We must always assign the *uid. */
+ if (!sid_to_uid(&user_sid, uid)) {
+ DEBUG(1, ("winbindd case, sid_to_uid for %s (%s) failed\n",
+ username, sid_string_dbg(&user_sid)));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+
num_group_sids = 1;
group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
if (group_sids == NULL) {
if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
DEBUG(1,("create_token_from_username: Failed to create SID "
- "for gid %d!\n", gids[i]));
+ "for gid %u!\n", (unsigned int)gids[i]));
continue;
}
result = add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
return user_in_group_sid(username, &group_sid);
}
-
/***************************************************************************
- Make (and fill) a user_info struct from a 'struct passwd' by conversion
+ Make (and fill) a server_info struct from a 'struct passwd' by conversion
to a struct samu
***************************************************************************/
}
result->sam_account = sampass;
+
result->unix_name = talloc_strdup(result, unix_username);
- result->uid = pwd->pw_uid;
- result->gid = pwd->pw_gid;
+ result->sanitized_username = sanitize_username(result, unix_username);
+
+ if ((result->unix_name == NULL)
+ || (result->sanitized_username == NULL)) {
+ TALLOC_FREE(sampass);
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ result->utok.uid = pwd->pw_uid;
+ result->utok.gid = pwd->pw_gid;
status = pdb_enum_group_memberships(result, sampass,
&result->sids, &gids,
DOM_SID guest_sid;
bool ret;
char zeros[16];
+ fstring tmp;
if ( !(sampass = samu_new( NULL )) ) {
return NT_STATUS_NO_MEMORY;
(*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
(*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
+ alpha_strcpy(tmp, pdb_get_username(sampass), ". _-$", sizeof(tmp));
+ (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
+
return NT_STATUS_OK;
}
-static auth_serversupplied_info *copy_serverinfo(auth_serversupplied_info *src)
+/****************************************************************************
+ Fake a auth_serversupplied_info just from a username
+****************************************************************************/
+
+NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
+ const char *username,
+ bool is_guest,
+ struct auth_serversupplied_info **presult)
+{
+ struct auth_serversupplied_info *result;
+ struct passwd *pwd;
+ NTSTATUS status;
+
+ pwd = getpwnam_alloc(talloc_tos(), username);
+ if (pwd == NULL) {
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ status = make_server_info_pw(&result, pwd->pw_name, pwd);
+
+ TALLOC_FREE(pwd);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ result->nss_token = true;
+ result->guest = is_guest;
+
+ status = create_local_token(result);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(result);
+ return status;
+ }
+
+ *presult = result;
+ return NT_STATUS_OK;
+}
+
+
+struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
+ const auth_serversupplied_info *src)
{
auth_serversupplied_info *dst;
- dst = make_server_info(NULL);
+ dst = make_server_info(mem_ctx);
if (dst == NULL) {
return NULL;
}
dst->guest = src->guest;
- dst->uid = src->uid;
- dst->gid = src->gid;
- dst->n_groups = src->n_groups;
- if (src->n_groups != 0) {
- dst->groups = (gid_t *)TALLOC_MEMDUP(
- dst, src->groups, sizeof(gid_t)*dst->n_groups);
+ dst->utok.uid = src->utok.uid;
+ dst->utok.gid = src->utok.gid;
+ dst->utok.ngroups = src->utok.ngroups;
+ if (src->utok.ngroups != 0) {
+ dst->utok.groups = (gid_t *)TALLOC_MEMDUP(
+ dst, src->utok.groups,
+ sizeof(gid_t)*dst->utok.ngroups);
} else {
- dst->groups = NULL;
+ dst->utok.groups = NULL;
}
if (src->ptok) {
return NULL;
}
+ dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
+ if (!dst->sanitized_username) {
+ TALLOC_FREE(dst);
+ return NULL;
+ }
+
return dst;
}
+/*
+ * Set a new session key. Used in the rpc server where we have to override the
+ * SMB level session key with SystemLibraryDTC
+ */
+
+bool server_info_set_session_key(struct auth_serversupplied_info *info,
+ DATA_BLOB session_key)
+{
+ TALLOC_FREE(info->user_session_key.data);
+
+ info->user_session_key = data_blob_talloc(
+ info, session_key.data, session_key.length);
+
+ return (info->user_session_key.data != NULL);
+}
+
static auth_serversupplied_info *guest_info = NULL;
bool init_guest_info(void)
return NT_STATUS_IS_OK(make_new_server_info_guest(&guest_info));
}
-NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
+NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
+ auth_serversupplied_info **server_info)
{
- *server_info = copy_serverinfo(guest_info);
+ *server_info = copy_serverinfo(mem_ctx, guest_info);
return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
}
return True;
}
-bool set_current_user_guest(struct current_user *dst)
-{
- gid_t *groups;
- NT_USER_TOKEN *nt_token;
-
- groups = (gid_t *)memdup(guest_info->groups,
- sizeof(gid_t) * guest_info->n_groups);
- if (groups == NULL) {
- return False;
- }
-
- nt_token = dup_nt_token(NULL, guest_info->ptok);
- if (nt_token == NULL) {
- SAFE_FREE(groups);
- return False;
- }
-
- TALLOC_FREE(dst->nt_user_token);
- SAFE_FREE(dst->ut.groups);
-
- /* dst->conn is never really dereferenced, it's only tested for
- * equality in uid.c */
- dst->conn = NULL;
-
- dst->vuid = UID_FIELD_INVALID;
- dst->ut.uid = guest_info->uid;
- dst->ut.gid = guest_info->gid;
- dst->ut.ngroups = guest_info->n_groups;
- dst->ut.groups = groups;
- dst->nt_user_token = nt_token;
- return True;
-}
-
/***************************************************************************
Purely internal function for make_server_info_info3
Fill the sam account from getpwnam
if (username[strlen(username)-1] == '$')
return NULL;
- smb_create_user(NULL, username, NULL);
+ _smb_create_user(NULL, username, NULL);
pw = Get_Pwnam_alloc(mem_ctx, username);
}
const char *sent_nt_username,
const char *domain,
auth_serversupplied_info **server_info,
- NET_USER_INFO_3 *info3)
+ struct netr_SamInfo3 *info3)
{
char zeros[16];
matches.
*/
- sid_copy(&user_sid, &info3->dom_sid.sid);
- if (!sid_append_rid(&user_sid, info3->user_rid)) {
+ sid_copy(&user_sid, info3->base.domain_sid);
+ if (!sid_append_rid(&user_sid, info3->base.rid)) {
return NT_STATUS_INVALID_PARAMETER;
}
- sid_copy(&group_sid, &info3->dom_sid.sid);
- if (!sid_append_rid(&group_sid, info3->group_rid)) {
+ sid_copy(&group_sid, info3->base.domain_sid);
+ if (!sid_append_rid(&group_sid, info3->base.primary_gid)) {
return NT_STATUS_INVALID_PARAMETER;
}
- if (!(nt_username = unistr2_to_ascii_talloc(mem_ctx, &(info3->uni_user_name)))) {
+ nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
+ if (!nt_username) {
/* If the server didn't give us one, just use the one we sent
* them */
nt_username = sent_nt_username;
}
- if (!(nt_domain = unistr2_to_ascii_talloc(mem_ctx, &(info3->uni_logon_dom)))) {
+ nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
+ if (!nt_domain) {
/* If the server didn't give us one, just use the one we sent
* them */
nt_domain = domain;
if (!NT_STATUS_IS_OK(nt_status)) {
TALLOC_FREE( sam_account );
if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
- make_server_info_guest(server_info);
+ make_server_info_guest(NULL, server_info);
return NT_STATUS_OK;
}
return nt_status;
TALLOC_FREE(sam_account);
return NT_STATUS_UNSUCCESSFUL;
}
-
+
if (!pdb_set_fullname(sam_account,
- unistr2_static(&(info3->uni_full_name)),
+ info3->base.full_name.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_logon_script(sam_account,
- unistr2_static(&(info3->uni_logon_script)),
+ info3->base.logon_script.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_profile_path(sam_account,
- unistr2_static(&(info3->uni_profile_path)),
+ info3->base.profile_path.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_homedir(sam_account,
- unistr2_static(&(info3->uni_home_dir)),
+ info3->base.home_directory.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_dir_drive(sam_account,
- unistr2_static(&(info3->uni_dir_drive)),
+ info3->base.home_drive.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
- if (!pdb_set_acct_ctrl(sam_account, info3->acct_flags, PDB_CHANGED)) {
+ if (!pdb_set_acct_ctrl(sam_account, info3->base.acct_flags, PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_pass_last_set_time(
sam_account,
- nt_time_to_unix(info3->pass_last_set_time),
+ nt_time_to_unix(info3->base.last_password_change),
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
if (!pdb_set_pass_can_change_time(
sam_account,
- nt_time_to_unix(info3->pass_can_change_time),
+ nt_time_to_unix(info3->base.allow_password_change),
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
if (!pdb_set_pass_must_change_time(
sam_account,
- nt_time_to_unix(info3->pass_must_change_time),
+ nt_time_to_unix(info3->base.force_password_change),
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
result->sam_account = sam_account;
result->unix_name = talloc_strdup(result, found_username);
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
+ if (result->sanitized_username == NULL) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
/* Fill in the unix info we found on the way */
- result->uid = uid;
- result->gid = gid;
+ result->utok.uid = uid;
+ result->utok.gid = gid;
/* Create a 'combined' list of all SIDs we might want in the SD */
nt_status = sid_array_from_info3(result, info3,
&result->sids,
&result->num_sids,
- False);
+ false, false);
if (!NT_STATUS_IS_OK(nt_status)) {
TALLOC_FREE(result);
return nt_status;
}
- result->login_server = unistr2_to_ascii_talloc(result,
- &(info3->uni_logon_srv));
+ /* Ensure the primary group sid is at position 0. */
+ sort_sid_array_for_smbd(result, &group_sid);
+
+ result->login_server = talloc_strdup(result,
+ info3->base.logon_server.string);
/* ensure we are never given NULL session keys */
ZERO_STRUCT(zeros);
- if (memcmp(info3->user_sess_key, zeros, sizeof(zeros)) == 0) {
+ if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
result->user_session_key = data_blob_null;
} else {
result->user_session_key = data_blob_talloc(
- result, info3->user_sess_key,
- sizeof(info3->user_sess_key));
+ result, info3->base.key.key,
+ sizeof(info3->base.key.key));
}
- if (memcmp(info3->lm_sess_key, zeros, 8) == 0) {
+ if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
result->lm_session_key = data_blob_null;
} else {
result->lm_session_key = data_blob_talloc(
- result, info3->lm_sess_key,
- sizeof(info3->lm_sess_key));
+ result, info3->base.LMSessKey.key,
+ sizeof(info3->base.LMSessKey.key));
}
- result->was_mapped = username_was_mapped;
+ result->nss_token |= username_was_mapped;
*server_info = result;
if (!NT_STATUS_IS_OK(nt_status)) {
TALLOC_FREE( result );
if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
- make_server_info_guest(server_info);
+ make_server_info_guest(NULL, server_info);
return NT_STATUS_OK;
}
return nt_status;
if (!pdb_set_pass_last_set_time(
sam_account,
- nt_time_to_unix(info->pass_last_set_time),
+ info->pass_last_set_time,
PDB_CHANGED)) {
TALLOC_FREE(result);
return NT_STATUS_NO_MEMORY;
if (!pdb_set_pass_can_change_time(
sam_account,
- nt_time_to_unix(info->pass_can_change_time),
+ info->pass_can_change_time,
PDB_CHANGED)) {
TALLOC_FREE(result);
return NT_STATUS_NO_MEMORY;
if (!pdb_set_pass_must_change_time(
sam_account,
- nt_time_to_unix(info->pass_must_change_time),
+ info->pass_must_change_time,
PDB_CHANGED)) {
TALLOC_FREE(result);
return NT_STATUS_NO_MEMORY;
result->sam_account = sam_account;
result->unix_name = talloc_strdup(result, found_username);
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
result->login_server = talloc_strdup(result, info->logon_server);
+ if ((result->unix_name == NULL)
+ || (result->sanitized_username == NULL)
+ || (result->login_server == NULL)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
/* Fill in the unix info we found on the way */
- result->uid = uid;
- result->gid = gid;
+ result->utok.uid = uid;
+ result->utok.gid = gid;
/* Create a 'combined' list of all SIDs we might want in the SD */
memcpy(&result->sids[i], &info->sids[i+2].sid, sizeof(result->sids[i]));
}
+ /* Ensure the primary group sid is at position 0. */
+ sort_sid_array_for_smbd(result, &group_sid);
+
/* ensure we are never given NULL session keys */
ZERO_STRUCT(zeros);
sizeof(info->lm_session_key));
}
- result->was_mapped = username_was_mapped;
+ result->nss_token |= username_was_mapped;
*server_info = result;
if ( lp_server_role() == ROLE_STANDALONE )
return False;
+ if (dom_name == NULL || dom_name[0] == '\0') {
+ return false;
+ }
+
+ if (strequal(dom_name, get_global_sam_name())) {
+ return false;
+ }
+
/* if we are a DC, then check for a direct trust relationships */
if ( IS_DC ) {