2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2009
5 Copyright (C) Gerald Carter 2003
6 Copyright (C) Stefan Metzmacher 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "system/time.h"
24 #include "lib/ldb/include/ldb.h"
25 #include "../lib/util/util_ldb.h"
26 #include "libcli/ldap/ldap_ndr.h"
27 #include "libcli/security/security.h"
28 #include "auth/auth.h"
29 #include "../libcli/auth/ntlm_check.h"
30 #include "auth/ntlm/auth_proto.h"
31 #include "auth/auth_sam.h"
32 #include "dsdb/samdb/samdb.h"
33 #include "dsdb/common/util.h"
34 #include "param/param.h"
36 extern const char *user_attrs[];
37 extern const char *domain_ref_attrs[];
39 /****************************************************************************
40 Look for the specified user in the sam, return ldb result structures
41 ****************************************************************************/
43 static NTSTATUS authsam_search_account(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
44 const char *account_name,
45 struct ldb_dn *domain_dn,
46 struct ldb_message **ret_msg)
50 /* pull the user attributes */
51 ret = dsdb_search_one(sam_ctx, mem_ctx, ret_msg, domain_dn, LDB_SCOPE_SUBTREE,
53 DSDB_SEARCH_SHOW_EXTENDED_DN,
54 "(&(sAMAccountName=%s)(objectclass=user))",
55 ldb_binary_encode_string(mem_ctx, account_name));
56 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
57 DEBUG(3,("sam_search_user: Couldn't find user [%s] in samdb, under %s\n",
58 account_name, ldb_dn_get_linearized(domain_dn)));
59 return NT_STATUS_NO_SUCH_USER;
61 if (ret != LDB_SUCCESS) {
62 return NT_STATUS_INTERNAL_DB_CORRUPTION;
68 /****************************************************************************
69 Do a specific test for an smb password being correct, given a smb_password and
70 the lanman and NT responses.
71 ****************************************************************************/
72 static NTSTATUS authsam_password_ok(struct auth_context *auth_context,
75 const struct samr_Password *lm_pwd,
76 const struct samr_Password *nt_pwd,
77 const struct auth_usersupplied_info *user_info,
78 DATA_BLOB *user_sess_key,
79 DATA_BLOB *lm_sess_key)
83 switch (user_info->password_state) {
84 case AUTH_PASSWORD_PLAIN:
86 const struct auth_usersupplied_info *user_info_temp;
87 status = encrypt_user_info(mem_ctx, auth_context,
89 user_info, &user_info_temp);
90 if (!NT_STATUS_IS_OK(status)) {
91 DEBUG(1, ("Failed to convert plaintext password to password HASH: %s\n", nt_errstr(status)));
94 user_info = user_info_temp;
98 case AUTH_PASSWORD_HASH:
99 *lm_sess_key = data_blob(NULL, 0);
100 *user_sess_key = data_blob(NULL, 0);
101 status = hash_password_check(mem_ctx,
102 lp_lanman_auth(auth_context->lp_ctx),
103 user_info->password.hash.lanman,
104 user_info->password.hash.nt,
105 user_info->mapped.account_name,
107 NT_STATUS_NOT_OK_RETURN(status);
110 case AUTH_PASSWORD_RESPONSE:
111 status = ntlm_password_check(mem_ctx,
112 lp_lanman_auth(auth_context->lp_ctx),
113 lp_ntlm_auth(auth_context->lp_ctx),
114 user_info->logon_parameters,
115 &auth_context->challenge.data,
116 &user_info->password.response.lanman,
117 &user_info->password.response.nt,
118 user_info->mapped.account_name,
119 user_info->client.account_name,
120 user_info->client.domain_name,
122 user_sess_key, lm_sess_key);
123 NT_STATUS_NOT_OK_RETURN(status);
127 if (user_sess_key && user_sess_key->data) {
128 talloc_steal(auth_context, user_sess_key->data);
130 if (lm_sess_key && lm_sess_key->data) {
131 talloc_steal(auth_context, lm_sess_key->data);
139 static NTSTATUS authsam_authenticate(struct auth_context *auth_context,
140 TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
141 struct ldb_dn *domain_dn,
142 struct ldb_message *msg,
143 const struct auth_usersupplied_info *user_info,
144 DATA_BLOB *user_sess_key, DATA_BLOB *lm_sess_key)
146 struct samr_Password *lm_pwd, *nt_pwd;
149 uint16_t acct_flags = samdb_result_acct_flags(auth_context->sam_ctx, mem_ctx, msg, domain_dn);
151 /* Quit if the account was locked out. */
152 if (acct_flags & ACB_AUTOLOCK) {
153 DEBUG(3,("check_sam_security: Account for user %s was locked out.\n",
154 user_info->mapped.account_name));
155 return NT_STATUS_ACCOUNT_LOCKED_OUT;
158 /* You can only do an interactive login to normal accounts */
159 if (user_info->flags & USER_INFO_INTERACTIVE_LOGON) {
160 if (!(acct_flags & ACB_NORMAL)) {
161 return NT_STATUS_NO_SUCH_USER;
165 nt_status = samdb_result_passwords(mem_ctx, auth_context->lp_ctx, msg, &lm_pwd, &nt_pwd);
166 NT_STATUS_NOT_OK_RETURN(nt_status);
168 nt_status = authsam_password_ok(auth_context, mem_ctx,
169 acct_flags, lm_pwd, nt_pwd,
170 user_info, user_sess_key, lm_sess_key);
171 NT_STATUS_NOT_OK_RETURN(nt_status);
173 nt_status = authsam_account_ok(mem_ctx, auth_context->sam_ctx,
174 user_info->logon_parameters,
177 user_info->workstation_name,
178 user_info->mapped.account_name,
186 static NTSTATUS authsam_check_password_internals(struct auth_method_context *ctx,
188 const struct auth_usersupplied_info *user_info,
189 struct auth_serversupplied_info **server_info)
192 const char *account_name = user_info->mapped.account_name;
193 struct ldb_message *msg;
194 struct ldb_dn *domain_dn;
195 DATA_BLOB user_sess_key, lm_sess_key;
198 if (ctx->auth_ctx->sam_ctx == NULL) {
199 DEBUG(0, ("No SAM available, cannot log in users\n"));
200 return NT_STATUS_INVALID_SYSTEM_SERVICE;
203 if (!account_name || !*account_name) {
205 return NT_STATUS_NOT_IMPLEMENTED;
208 tmp_ctx = talloc_new(mem_ctx);
210 return NT_STATUS_NO_MEMORY;
213 domain_dn = ldb_get_default_basedn(ctx->auth_ctx->sam_ctx);
214 if (domain_dn == NULL) {
215 talloc_free(tmp_ctx);
216 return NT_STATUS_NO_SUCH_DOMAIN;
219 nt_status = authsam_search_account(tmp_ctx, ctx->auth_ctx->sam_ctx, account_name, domain_dn, &msg);
220 if (!NT_STATUS_IS_OK(nt_status)) {
221 talloc_free(tmp_ctx);
225 nt_status = authsam_authenticate(ctx->auth_ctx, tmp_ctx, ctx->auth_ctx->sam_ctx, domain_dn, msg, user_info,
226 &user_sess_key, &lm_sess_key);
227 if (!NT_STATUS_IS_OK(nt_status)) {
228 talloc_free(tmp_ctx);
232 nt_status = authsam_make_server_info(tmp_ctx, ctx->auth_ctx->sam_ctx, lp_netbios_name(ctx->auth_ctx->lp_ctx),
233 lp_sam_name(ctx->auth_ctx->lp_ctx),
236 user_sess_key, lm_sess_key,
238 if (!NT_STATUS_IS_OK(nt_status)) {
239 talloc_free(tmp_ctx);
243 talloc_steal(mem_ctx, *server_info);
244 talloc_free(tmp_ctx);
249 static NTSTATUS authsam_ignoredomain_want_check(struct auth_method_context *ctx,
251 const struct auth_usersupplied_info *user_info)
253 if (!user_info->mapped.account_name || !*user_info->mapped.account_name) {
254 return NT_STATUS_NOT_IMPLEMENTED;
260 /****************************************************************************
261 Check SAM security (above) but with a few extra checks.
262 ****************************************************************************/
263 static NTSTATUS authsam_want_check(struct auth_method_context *ctx,
265 const struct auth_usersupplied_info *user_info)
267 bool is_local_name, is_my_domain;
269 if (!user_info->mapped.account_name || !*user_info->mapped.account_name) {
270 return NT_STATUS_NOT_IMPLEMENTED;
273 is_local_name = lp_is_myname(ctx->auth_ctx->lp_ctx,
274 user_info->mapped.domain_name);
275 is_my_domain = lp_is_mydomain(ctx->auth_ctx->lp_ctx,
276 user_info->mapped.domain_name);
278 /* check whether or not we service this domain/workgroup name */
279 switch (lp_server_role(ctx->auth_ctx->lp_ctx)) {
280 case ROLE_STANDALONE:
283 case ROLE_DOMAIN_MEMBER:
284 if (!is_local_name) {
285 DEBUG(6,("authsam_check_password: %s is not one of my local names (DOMAIN_MEMBER)\n",
286 user_info->mapped.domain_name));
287 return NT_STATUS_NOT_IMPLEMENTED;
291 case ROLE_DOMAIN_CONTROLLER:
292 if (!is_local_name && !is_my_domain) {
293 DEBUG(6,("authsam_check_password: %s is not one of my local names or domain name (DC)\n",
294 user_info->mapped.domain_name));
295 return NT_STATUS_NOT_IMPLEMENTED;
300 DEBUG(6,("authsam_check_password: lp_server_role() has an undefined value\n"));
301 return NT_STATUS_NOT_IMPLEMENTED;
305 /* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available, and for tokenGroups in the DSDB stack.
307 Supply either a principal or a DN
309 NTSTATUS authsam_get_server_info_principal(TALLOC_CTX *mem_ctx,
310 struct auth_context *auth_context,
311 const char *principal,
312 struct ldb_dn *user_dn,
313 struct auth_serversupplied_info **server_info)
316 DATA_BLOB user_sess_key = data_blob(NULL, 0);
317 DATA_BLOB lm_sess_key = data_blob(NULL, 0);
319 struct ldb_message *msg;
320 struct ldb_dn *domain_dn;
322 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
324 return NT_STATUS_NO_MEMORY;
328 nt_status = sam_get_results_principal(auth_context->sam_ctx, tmp_ctx, principal,
329 user_attrs, &domain_dn, &msg);
330 if (!NT_STATUS_IS_OK(nt_status)) {
331 talloc_free(tmp_ctx);
334 } else if (user_dn) {
335 struct dom_sid *user_sid, *domain_sid;
337 /* pull the user attributes */
338 ret = dsdb_search_one(auth_context->sam_ctx, tmp_ctx, &msg, user_dn,
339 LDB_SCOPE_BASE, user_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
340 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
341 talloc_free(tmp_ctx);
342 return NT_STATUS_NO_SUCH_USER;
343 } else if (ret != LDB_SUCCESS) {
344 talloc_free(tmp_ctx);
345 return NT_STATUS_INTERNAL_DB_CORRUPTION;
348 user_sid = samdb_result_dom_sid(msg, msg, "objectSid");
350 nt_status = dom_sid_split_rid(tmp_ctx, user_sid, &domain_sid, NULL);
351 if (!NT_STATUS_IS_OK(nt_status)) {
355 domain_dn = samdb_search_dn(auth_context->sam_ctx, mem_ctx, NULL,
356 "(&(objectSid=%s)(objectClass=domain))",
357 ldap_encode_ndr_dom_sid(tmp_ctx, domain_sid));
359 DEBUG(3, ("authsam_get_server_info_principal: Failed to find domain with: SID %s\n",
360 dom_sid_string(tmp_ctx, domain_sid)));
361 return NT_STATUS_NO_SUCH_USER;
365 return NT_STATUS_INVALID_PARAMETER;
368 nt_status = authsam_make_server_info(tmp_ctx, auth_context->sam_ctx,
369 lp_netbios_name(auth_context->lp_ctx),
370 lp_workgroup(auth_context->lp_ctx),
373 user_sess_key, lm_sess_key,
375 if (!NT_STATUS_IS_OK(nt_status)) {
376 talloc_free(tmp_ctx);
380 talloc_steal(mem_ctx, *server_info);
381 talloc_free(tmp_ctx);
386 static const struct auth_operations sam_ignoredomain_ops = {
387 .name = "sam_ignoredomain",
388 .get_challenge = auth_get_challenge_not_implemented,
389 .want_check = authsam_ignoredomain_want_check,
390 .check_password = authsam_check_password_internals,
391 .get_server_info_principal = authsam_get_server_info_principal
394 static const struct auth_operations sam_ops = {
396 .get_challenge = auth_get_challenge_not_implemented,
397 .want_check = authsam_want_check,
398 .check_password = authsam_check_password_internals,
399 .get_server_info_principal = authsam_get_server_info_principal
402 _PUBLIC_ NTSTATUS auth_sam_init(void)
406 ret = auth_register(&sam_ops);
407 if (!NT_STATUS_IS_OK(ret)) {
408 DEBUG(0,("Failed to register 'sam' auth backend!\n"));
412 ret = auth_register(&sam_ignoredomain_ops);
413 if (!NT_STATUS_IS_OK(ret)) {
414 DEBUG(0,("Failed to register 'sam_ignoredomain' auth backend!\n"));