2 Unix SMB/CIFS implementation.
4 Winbind authentication mechnism
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Andrew Bartlett 2001 - 2002
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #define DBGC_CLASS DBGC_AUTH
28 /* Authenticate a user with a challenge/response */
30 static NTSTATUS check_winbind_security(const struct auth_context *auth_context,
31 void *my_private_data,
33 const auth_usersupplied_info *user_info,
34 auth_serversupplied_info **server_info)
38 struct wbcAuthUserParams params;
39 struct wbcAuthUserInfo *info = NULL;
40 struct wbcAuthErrorInfo *err = NULL;
45 return NT_STATUS_INVALID_PARAMETER;
49 DEBUG(3,("Password for user %s cannot be checked because we have no auth_info to get the challenge from.\n",
50 user_info->internal_username));
51 return NT_STATUS_INVALID_PARAMETER;
54 if (strequal(user_info->domain, get_global_sam_name())) {
55 DEBUG(3,("check_winbind_security: Not using winbind, requested domain [%s] was for this SAM.\n",
57 return NT_STATUS_NOT_IMPLEMENTED;
60 /* Send off request */
62 params.account_name = user_info->smb_name;
63 params.domain_name = user_info->domain;
64 params.workstation_name = user_info->wksta_name;
67 params.parameter_control= user_info->logon_parameters;
69 params.level = WBC_AUTH_USER_LEVEL_RESPONSE;
71 memcpy(params.password.response.challenge,
72 auth_context->challenge.data,
73 sizeof(params.password.response.challenge));
75 if (user_info->nt_resp.length != 0) {
76 params.password.response.nt_length = user_info->nt_resp.length;
77 params.password.response.nt_data = user_info->nt_resp.data;
79 if (user_info->lm_resp.length != 0) {
80 params.password.response.lm_length = user_info->lm_resp.length;
81 params.password.response.lm_data = user_info->lm_resp.data;
84 /* we are contacting the privileged pipe */
86 wbc_status = wbcAuthenticateUserEx(¶ms, &info, &err);
89 if (!WBC_ERROR_IS_OK(wbc_status)) {
90 DEBUG(10,("check_winbind_security: wbcAuthenticateUserEx failed: %s\n",
91 wbcErrorString(wbc_status)));
94 if (wbc_status == WBC_ERR_NO_MEMORY) {
95 return NT_STATUS_NO_MEMORY;
98 if (wbc_status == WBC_ERR_WINBIND_NOT_AVAILABLE) {
99 struct auth_methods *auth_method =
100 (struct auth_methods *)my_private_data;
103 return auth_method->auth(auth_context, auth_method->private_data,
104 mem_ctx, user_info, server_info);
106 /* log an error since this should not happen */
107 DEBUG(0,("check_winbind_security: ERROR! my_private_data == NULL!\n"));
110 if (wbc_status == WBC_ERR_AUTH_ERROR) {
111 nt_status = NT_STATUS(err->nt_status);
116 if (!WBC_ERROR_IS_OK(wbc_status)) {
117 return NT_STATUS_LOGON_FAILURE;
120 nt_status = make_server_info_wbcAuthUserInfo(mem_ctx,
125 if (!NT_STATUS_IS_OK(nt_status)) {
129 (*server_info)->nss_token |= user_info->was_mapped;
134 /* module initialisation */
135 static NTSTATUS auth_init_winbind(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
137 if (!make_auth_methods(auth_context, auth_method)) {
138 return NT_STATUS_NO_MEMORY;
141 (*auth_method)->name = "winbind";
142 (*auth_method)->auth = check_winbind_security;
144 if (param && *param) {
145 /* we load the 'fallback' module - if winbind isn't here, call this
148 if (!load_auth_module(auth_context, param, &priv)) {
149 return NT_STATUS_UNSUCCESSFUL;
151 (*auth_method)->private_data = (void *)priv;
156 NTSTATUS auth_winbind_init(void)
158 return smb_register_auth(AUTH_INTERFACE_VERSION, "winbind", auth_init_winbind);