This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "lib/ldb/include/ldb.h"
#include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
-#include "passdb/secrets.h"
+#include "param/secrets.h"
#include "system/filesys.h"
#include "db_wrap.h"
#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
+#include "param/param.h"
/**
* Read a file descriptor, and parse it for a password (eg from a file or stdin)
*++p = '\0'; /* advance p, and null-terminate pass */
break;
}
+ /* fall through */
case 0:
if (p - pass) {
*p = '\0'; /* null-terminate it, just in case... */
BOOL ret;
if (fd < 0) {
- fprintf(stderr, "Error opening PASSWD_FILE %s: %s\n",
+ fprintf(stderr, "Error opening password file %s: %s\n",
file, strerror(errno));
return False;
}
* @retval NTSTATUS error detailing any failure
*/
NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred,
+ struct ldb_context *ldb,
const char *base,
const char *filter)
{
TALLOC_CTX *mem_ctx;
- struct ldb_context *ldb;
int ldb_ret;
struct ldb_message **msgs;
const char *attrs[] = {
"flatname",
"realm",
"secureChannelType",
- "ntPwdHash",
+ "unicodePwd",
"msDS-KeyVersionNumber",
"saltPrincipal",
"privateKeytab",
"krb5Keytab",
+ "servicePrincipalName",
NULL
};
mem_ctx = talloc_named(cred, 0, "cli_credentials fetch machine password");
- /* Local secrets are stored in secrets.ldb */
- ldb = secrets_db_connect(mem_ctx);
if (!ldb) {
- /* set anonymous as the fallback, if the machine account won't work */
- cli_credentials_set_anonymous(cred);
- DEBUG(1, ("Could not open secrets.ldb\n"));
- return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+ /* Local secrets are stored in secrets.ldb */
+ ldb = secrets_db_connect(mem_ctx);
+ if (!ldb) {
+ /* set anonymous as the fallback, if the machine account won't work */
+ cli_credentials_set_anonymous(cred);
+ DEBUG(1, ("Could not open secrets.ldb\n"));
+ return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+ }
}
/* search for the secret record */
ldb_ret = gendb_search(ldb,
- mem_ctx, ldb_dn_explode(mem_ctx, base),
+ mem_ctx, ldb_dn_new(mem_ctx, ldb, base),
&msgs, attrs,
"%s", filter);
if (ldb_ret == 0) {
- DEBUG(1, ("Could not find entry to match filter: %s\n",
- filter));
+ DEBUG(1, ("Could not find entry to match filter: '%s' base: '%s'\n",
+ filter, base));
/* set anonymous as the fallback, if the machine account won't work */
cli_credentials_set_anonymous(cred);
talloc_free(mem_ctx);
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
} else if (ldb_ret != 1) {
- DEBUG(1, ("Found more than one (%d) entry to match filter: %s\n",
- ldb_ret, filter));
+ DEBUG(1, ("Found more than one (%d) entry to match filter: '%s' base: '%s'\n",
+ ldb_ret, filter, base));
/* set anonymous as the fallback, if the machine account won't work */
cli_credentials_set_anonymous(cred);
talloc_free(mem_ctx);
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
}
- password = ldb_msg_find_string(msgs[0], "secret", NULL);
- old_password = ldb_msg_find_string(msgs[0], "priorSecret", NULL);
+ password = ldb_msg_find_attr_as_string(msgs[0], "secret", NULL);
+ old_password = ldb_msg_find_attr_as_string(msgs[0], "priorSecret", NULL);
- machine_account = ldb_msg_find_string(msgs[0], "samAccountName", NULL);
+ machine_account = ldb_msg_find_attr_as_string(msgs[0], "samAccountName", NULL);
if (!machine_account) {
- DEBUG(1, ("Could not find 'samAccountName' in join record to domain: %s\n",
- cli_credentials_get_domain(cred)));
- /* set anonymous as the fallback, if the machine account won't work */
- cli_credentials_set_anonymous(cred);
- talloc_free(mem_ctx);
- return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+ machine_account = ldb_msg_find_attr_as_string(msgs[0], "servicePrincipalName", NULL);
+
+ if (!machine_account) {
+ DEBUG(1, ("Could not find 'samAccountName' in join record to domain: %s: filter: '%s' base: '%s'\n",
+ cli_credentials_get_domain(cred), filter, base));
+ /* set anonymous as the fallback, if the machine account won't work */
+ cli_credentials_set_anonymous(cred);
+ talloc_free(mem_ctx);
+ return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+ }
}
- salt_principal = ldb_msg_find_string(msgs[0], "saltPrincipal", NULL);
+ salt_principal = ldb_msg_find_attr_as_string(msgs[0], "saltPrincipal", NULL);
cli_credentials_set_salt_principal(cred, salt_principal);
- sct = ldb_msg_find_int(msgs[0], "secureChannelType", 0);
+ sct = ldb_msg_find_attr_as_int(msgs[0], "secureChannelType", 0);
if (sct) {
cli_credentials_set_secure_channel_type(cred, sct);
}
if (!password) {
- const struct ldb_val *nt_password_hash = ldb_msg_find_ldb_val(msgs[0], "ntPwdHash");
+ const struct ldb_val *nt_password_hash = ldb_msg_find_ldb_val(msgs[0], "unicodePwd");
struct samr_Password hash;
ZERO_STRUCT(hash);
if (nt_password_hash) {
}
- domain = ldb_msg_find_string(msgs[0], "flatname", NULL);
+ domain = ldb_msg_find_attr_as_string(msgs[0], "flatname", NULL);
if (domain) {
cli_credentials_set_domain(cred, domain, CRED_SPECIFIED);
}
- realm = ldb_msg_find_string(msgs[0], "realm", NULL);
+ realm = ldb_msg_find_attr_as_string(msgs[0], "realm", NULL);
if (realm) {
cli_credentials_set_realm(cred, realm, CRED_SPECIFIED);
}
cli_credentials_set_username(cred, machine_account, CRED_SPECIFIED);
- cli_credentials_set_kvno(cred, ldb_msg_find_int(msgs[0], "msDS-KeyVersionNumber", 0));
+ cli_credentials_set_kvno(cred, ldb_msg_find_attr_as_int(msgs[0], "msDS-KeyVersionNumber", 0));
/* If there was an external keytab specified by reference in
* the LDB, then use this. Otherwise we will make one up
* (chewing CPU time) from the password */
- keytab = ldb_msg_find_string(msgs[0], "krb5Keytab", NULL);
+ keytab = ldb_msg_find_attr_as_string(msgs[0], "krb5Keytab", NULL);
if (keytab) {
cli_credentials_set_keytab_name(cred, keytab, CRED_SPECIFIED);
} else {
- keytab = ldb_msg_find_string(msgs[0], "privateKeytab", NULL);
+ keytab = ldb_msg_find_attr_as_string(msgs[0], "privateKeytab", NULL);
if (keytab) {
keytab = talloc_asprintf(mem_ctx, "FILE:%s", private_path(mem_ctx, keytab));
if (keytab) {
cred->machine_account_pending = False;
filter = talloc_asprintf(cred, SECRETS_PRIMARY_DOMAIN_FILTER,
cli_credentials_get_domain(cred));
- return cli_credentials_set_secrets(cred, SECRETS_PRIMARY_DOMAIN_DN,
+ return cli_credentials_set_secrets(cred, NULL, SECRETS_PRIMARY_DOMAIN_DN,
filter);
}
filter = talloc_asprintf(cred, SECRETS_KRBTGT_SEARCH,
cli_credentials_get_realm(cred),
cli_credentials_get_domain(cred));
- return cli_credentials_set_secrets(cred, SECRETS_PRINCIPALS_DN,
+ return cli_credentials_set_secrets(cred, NULL, SECRETS_PRINCIPALS_DN,
filter);
}
cli_credentials_get_realm(cred),
cli_credentials_get_domain(cred),
serviceprincipal);
- return cli_credentials_set_secrets(cred, SECRETS_PRINCIPALS_DN,
+ return cli_credentials_set_secrets(cred, NULL, SECRETS_PRINCIPALS_DN,
filter);
}
}
-NTSTATUS cli_credentials_update_all_keytabs(TALLOC_CTX *parent_ctx)
-{
- TALLOC_CTX *mem_ctx;
- int ldb_ret;
- struct ldb_context *ldb;
- struct ldb_message **msgs;
- const char *attrs[] = { NULL };
- struct cli_credentials *creds;
- const char *filter;
- NTSTATUS status;
- int i, ret;
-
- mem_ctx = talloc_new(parent_ctx);
- if (!mem_ctx) {
- return NT_STATUS_NO_MEMORY;
- }
-
- /* Local secrets are stored in secrets.ldb */
- ldb = secrets_db_connect(mem_ctx);
- if (!ldb) {
- DEBUG(1, ("Could not open secrets.ldb\n"));
- talloc_free(mem_ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* search for the secret record, but only of things we can
- * actually update */
- ldb_ret = gendb_search(ldb,
- mem_ctx, NULL,
- &msgs, attrs,
- "(&(objectClass=kerberosSecret)(|(secret=*)(ntPwdHash=*)))");
- if (ldb_ret == -1) {
- DEBUG(1, ("Error looking for kerberos type secrets to push into a keytab:: %s", ldb_errstring(ldb)));
- talloc_free(mem_ctx);
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- }
-
- for (i=0; i < ldb_ret; i++) {
- /* Make a credentials structure from it */
- creds = cli_credentials_init(mem_ctx);
- if (!creds) {
- DEBUG(1, ("cli_credentials_init failed!"));
- talloc_free(mem_ctx);
- return NT_STATUS_NO_MEMORY;
- }
- cli_credentials_set_conf(creds);
- filter = talloc_asprintf(mem_ctx, "dn=%s", ldb_dn_linearize(mem_ctx, msgs[i]->dn));
- status = cli_credentials_set_secrets(creds, NULL, filter);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to read secrets for keytab update for %s\n",
- filter));
- continue;
- }
- ret = cli_credentials_update_keytab(creds);
- if (ret != 0) {
- DEBUG(1, ("Failed to update keytab for %s\n",
- filter));
- continue;
- }
- }
- return NT_STATUS_OK;
-}
-
git.samba.org / samba.git / blobdiff