#include "lib/param/param.h"
#ifdef HAVE_KRB5
#include "auth/kerberos/pac_utils.h"
+#include "nsswitch/libwbclient/wbclient.h"
#endif
#include "librpc/crypto/gse.h"
#include "auth/credentials/credentials.h"
{
TALLOC_CTX *tmp_ctx;
struct PAC_LOGON_INFO *logon_info = NULL;
+ struct netr_SamInfo3 *info3_copy = NULL;
bool is_mapped;
bool is_guest;
char *ntuser;
if (pac_blob) {
#ifdef HAVE_KRB5
+ struct wbcAuthUserParams params = {};
+ struct wbcAuthUserInfo *info = NULL;
+ struct wbcAuthErrorInfo *err = NULL;
+ wbcErr wbc_err;
+
+ /*
+ * Let winbind decode the PAC.
+ * This will also store the user
+ * data in the netsamlogon cache.
+ *
+ * We need to do this *before* we
+ * call get_user_from_kerberos_info()
+ * as that does a user lookup that
+ * expects info in the netsamlogon cache.
+ *
+ * See BUG: https://bugzilla.samba.org/show_bug.cgi?id=11259
+ */
+ params.level = WBC_AUTH_USER_LEVEL_PAC;
+ params.password.pac.data = pac_blob->data;
+ params.password.pac.length = pac_blob->length;
+
+ become_root();
+ wbc_err = wbcAuthenticateUserEx(¶ms, &info, &err);
+ unbecome_root();
+
+ /*
+ * As this is merely a cache prime
+ * WBC_ERR_WINBIND_NOT_AVAILABLE
+ * is not a fatal error, treat it
+ * as success.
+ */
+
+ switch (wbc_err) {
+ case WBC_ERR_WINBIND_NOT_AVAILABLE:
+ case WBC_ERR_SUCCESS:
+ break;
+ case WBC_ERR_AUTH_ERROR:
+ status = NT_STATUS(err->nt_status);
+ wbcFreeMemory(err);
+ goto done;
+ default:
+ status = NT_STATUS_LOGON_FAILURE;
+ goto done;
+ }
+
status = kerberos_pac_logon_info(tmp_ctx, *pac_blob, NULL, NULL,
NULL, NULL, 0, &logon_info);
#else
&ntuser, &ntdomain,
&username, &pw);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to map kerberos principal to system user "
- "(%s)\n", nt_errstr(status)));
+ DBG_NOTICE("Failed to map kerberos principal to system user "
+ "(%s)\n", nt_errstr(status));
status = NT_STATUS_ACCESS_DENIED;
goto done;
}
- /* save the PAC data if we have it */
+ /* Get the info3 from the PAC data if we have it */
if (logon_info) {
- netsamlogon_cache_store(ntuser, &logon_info->info3);
+ status = create_info3_from_pac_logon_info(tmp_ctx,
+ logon_info,
+ &info3_copy);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto done;
+ }
}
/* setup the string used by %U */
sub_set_smb_name(username);
/* reload services so that the new %U is taken into account */
- lp_load(get_dyn_CONFIGFILE(), false, false, true, true);
+ lp_load_with_shares(get_dyn_CONFIGFILE());
status = make_session_info_krb5(mem_ctx,
ntuser, ntdomain, username, pw,
- logon_info, is_guest, is_mapped, NULL /* No session key for now, caller will sort it out */,
+ info3_copy, is_guest, is_mapped, NULL /* No session key for now, caller will sort it out */,
session_info);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",