source/nsswitch/pam_winbind.c

   1 /* pam_winbind module
   2
   3    Copyright Andrew Tridgell <tridge@samba.org> 2000
   4    Copyright Tim Potter <tpot@samba.org> 2000
   5    Copyright Andrew Bartlett <abartlet@samba.org> 2002
   6    Copyright Guenther Deschner <gd@samba.org> 2005-2006
   7
   8    largely based on pam_userdb by Cristian Gafton <gafton@redhat.com>
   9    also contains large slabs of code from pam_unix by Elliot Lee <sopwith@redhat.com>
  10    (see copyright below for full details)
  11 */
  12
  13 #include "pam_winbind.h"
  14
  15 /* data tokens */
  16
  17 #define MAX_PASSWD_TRIES        3
  18
  19 /* some syslogging */
  20 static void _pam_log(int err, const char *format, ...)
  21 {
  22         va_list args;
  23
  24         va_start(args, format);
  25         openlog(MODULE_NAME, LOG_CONS|LOG_PID, LOG_AUTH);
  26         vsyslog(err, format, args);
  27         va_end(args);
  28         closelog();
  29 }
  30
  31 static void _pam_log_debug(int ctrl, int err, const char *format, ...)
  32 {
  33         va_list args;
  34
  35         if (!(ctrl & WINBIND_DEBUG_ARG)) {
  36                 return;
  37         }
  38
  39         va_start(args, format);
  40         openlog(MODULE_NAME, LOG_CONS|LOG_PID, LOG_AUTH);
  41         vsyslog(err, format, args);
  42         va_end(args);
  43         closelog();
  44 }
  45
  46 static int _pam_parse(int argc, const char **argv, dictionary **d)
  47 {
  48         int ctrl = 0;
  49         const char *config_file = NULL;
  50         int i;
  51         const char **v;
  52
  53         if (d == NULL) {
  54                 goto config_from_pam;
  55         }
  56
  57         for (i=argc,v=argv; i-- > 0; ++v) {
  58                 if (!strncasecmp(*v, "config", strlen("config"))) {
  59                         ctrl |= WINBIND_CONFIG_FILE;
  60                         config_file = v[i];
  61                         break;
  62                 }
  63         }
  64
  65         if (config_file == NULL) {
  66                 config_file = PAM_WINBIND_CONFIG_FILE;
  67         }
  68
  69         *d = iniparser_load(CONST_DISCARD(char *, config_file));
  70         if (*d == NULL) {
  71                 goto config_from_pam;
  72         }
  73
  74         if (iniparser_getboolean(*d, CONST_DISCARD(char *, "global:debug"), False)) {
  75                 ctrl |= WINBIND_DEBUG_ARG;
  76         }
  77
  78         if (iniparser_getboolean(*d, CONST_DISCARD(char *, "global:cached_login"), False)) {
  79                 ctrl |= WINBIND_CACHED_LOGIN;
  80         }
  81
  82         if (iniparser_getboolean(*d, CONST_DISCARD(char *, "global:krb5_auth"), False)) {
  83                 ctrl |= WINBIND_KRB5_AUTH;
  84         }
  85
  86         if (iniparser_getstr(*d, CONST_DISCARD(char *,"global:krb5_ccache_type")) != NULL) {
  87                 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
  88         }
  89
  90         if ((iniparser_getstr(*d, CONST_DISCARD(char *, "global:require-membership-of")) != NULL) ||
  91             (iniparser_getstr(*d, CONST_DISCARD(char *, "global:require_membership_of")) != NULL)) {
  92                 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
  93         }
  94
  95 config_from_pam:
  96         /* step through arguments */
  97         for (i=argc,v=argv; i-- > 0; ++v) {
  98
  99                 /* generic options */
 100                 if (!strcmp(*v,"debug"))
 101                         ctrl |= WINBIND_DEBUG_ARG;
 102                 else if (!strcasecmp(*v, "use_authtok"))
 103                         ctrl |= WINBIND_USE_AUTHTOK_ARG;
 104                 else if (!strcasecmp(*v, "use_first_pass"))
 105                         ctrl |= WINBIND_USE_FIRST_PASS_ARG;
 106                 else if (!strcasecmp(*v, "try_first_pass"))
 107                         ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
 108                 else if (!strcasecmp(*v, "unknown_ok"))
 109                         ctrl |= WINBIND_UNKNOWN_OK_ARG;
 110                 else if (!strncasecmp(*v, "require_membership_of", strlen("require_membership_of")))
 111                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
 112                 else if (!strncasecmp(*v, "require-membership-of", strlen("require-membership-of")))
 113                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
 114                 else if (!strcasecmp(*v, "krb5_auth"))
 115                         ctrl |= WINBIND_KRB5_AUTH;
 116                 else if (!strncasecmp(*v, "krb5_ccache_type", strlen("krb5_ccache_type")))
 117                         ctrl |= WINBIND_KRB5_CCACHE_TYPE;
 118                 else if (!strcasecmp(*v, "cached_login"))
 119                         ctrl |= WINBIND_CACHED_LOGIN;
 120                 else {
 121                         _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *v);
 122                 }
 123
 124         }
 125         return ctrl;
 126 };
 127
 128 static void _pam_winbind_cleanup_func(pam_handle_t *pamh, void *data, int error_status)
 129 {
 130         SAFE_FREE(data);
 131 }
 132
 133 /*
 134  * Work around the pam API that has functions with void ** as parameters.
 135  * These lead to strict aliasing warnings with gcc.
 136  */
 137 static int _pam_get_item(const pam_handle_t *pamh, int item_type,
 138                          const void *_item)
 139 {
 140         const void **item = (const void **)_item;
 141         return pam_get_item(pamh, item_type, item);
 142 }
 143 static int _pam_get_data(const pam_handle_t *pamh,
 144                          const char *module_data_name, const void *_data)
 145 {
 146         const void **data = (const void **)_data;
 147         return pam_get_data(pamh, module_data_name, data);
 148 }
 149
 150
 151 static const struct ntstatus_errors {
 152         const char *ntstatus_string;
 153         const char *error_string;
 154 } ntstatus_errors[] = {
 155         {"NT_STATUS_OK", "Success"},
 156         {"NT_STATUS_BACKUP_CONTROLLER", "No primary Domain Controler available"},
 157         {"NT_STATUS_PWD_TOO_SHORT", "Password too short"},
 158         {"NT_STATUS_PWD_TOO_RECENT", "The password of this user is too recent to change"},
 159         {"NT_STATUS_PWD_HISTORY_CONFLICT", "Password is already in password history"},
 160         {"NT_STATUS_PASSWORD_EXPIRED", "Your password has expired"},
 161         {"NT_STATUS_PASSWORD_MUST_CHANGE", "You need to change your password now"},
 162         {"NT_STATUS_INVALID_WORKSTATION", "You are not allowed to logon from this workstation"},
 163         {"NT_STATUS_INVALID_LOGON_HOURS", "You are not allowed to logon at this time"},
 164         {"NT_STATUS_ACCOUNT_EXPIRED", "Your account has expired. Please contact your System administrator"}, /* SCNR */
 165         {"NT_STATUS_ACCOUNT_DISABLED", "Your account is disabled. Please contact your System administrator"}, /* SCNR */
 166         {"NT_STATUS_ACCOUNT_LOCKED_OUT", "Your account has been locked. Please contact your System administrator"}, /* SCNR */
 167         {"NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT", "Invalid Trust Account"},
 168         {"NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT", "Invalid Trust Account"},
 169         {"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT", "Invalid Trust Account"},
 170         {"NT_STATUS_ACCESS_DENIED", "Access is denied"},
 171         {NULL, NULL}
 172 };
 173
 174 const char *_get_ntstatus_error_string(const char *nt_status_string)
 175 {
 176         int i;
 177         for (i=0; ntstatus_errors[i].ntstatus_string != NULL; i++) {
 178                 if (!strcasecmp(ntstatus_errors[i].ntstatus_string, nt_status_string)) {
 179                         return ntstatus_errors[i].error_string;
 180                 }
 181         }
 182         return NULL;
 183 }
 184
 185 /* --- authentication management functions --- */
 186
 187 /* Attempt a conversation */
 188
 189 static int converse(pam_handle_t *pamh, int nargs,
 190                     struct pam_message **message,
 191                     struct pam_response **response)
 192 {
 193         int retval;
 194         struct pam_conv *conv;
 195
 196         retval = _pam_get_item(pamh, PAM_CONV, &conv );
 197         if (retval == PAM_SUCCESS) {
 198                 retval = conv->conv(nargs, (const struct pam_message **)message,
 199                                     response, conv->appdata_ptr);
 200         }
 201
 202         return retval; /* propagate error status */
 203 }
 204
 205
 206 static int _make_remark(pam_handle_t * pamh, int type, const char *text)
 207 {
 208         int retval = PAM_SUCCESS;
 209
 210         struct pam_message *pmsg[1], msg[1];
 211         struct pam_response *resp;
 212
 213         pmsg[0] = &msg[0];
 214         msg[0].msg = CONST_DISCARD(char *, text);
 215         msg[0].msg_style = type;
 216
 217         resp = NULL;
 218         retval = converse(pamh, 1, pmsg, &resp);
 219
 220         if (resp) {
 221                 _pam_drop_reply(resp, 1);
 222         }
 223         return retval;
 224 }
 225
 226 static int _make_remark_format(pam_handle_t * pamh, int type, const char *format, ...)
 227 {
 228         va_list args;
 229         char *var;
 230         int ret;
 231
 232         va_start(args, format);
 233         vasprintf(&var, format, args);
 234         va_end(args);
 235
 236         ret = _make_remark(pamh, type, var);
 237         SAFE_FREE(var);
 238         return ret;
 239 }
 240
 241 static int pam_winbind_request(pam_handle_t * pamh, int ctrl,
 242                                enum winbindd_cmd req_type,
 243                                struct winbindd_request *request,
 244                                struct winbindd_response *response)
 245 {
 246         /* Fill in request and send down pipe */
 247         init_request(request, req_type);
 248
 249         if (write_sock(request, sizeof(*request), 0) == -1) {
 250                 _pam_log(LOG_ERR, "write to socket failed!");
 251                 close_sock();
 252                 return PAM_SERVICE_ERR;
 253         }
 254
 255         /* Wait for reply */
 256         if (read_reply(response) == -1) {
 257                 _pam_log(LOG_ERR, "read from socket failed!");
 258                 close_sock();
 259                 return PAM_SERVICE_ERR;
 260         }
 261
 262         /* We are done with the socket - close it and avoid mischeif */
 263         close_sock();
 264
 265         /* Copy reply data from socket */
 266         if (response->result != WINBINDD_OK) {
 267                 if (response->data.auth.pam_error != PAM_SUCCESS) {
 268                         _pam_log(LOG_ERR, "request failed: %s, PAM error was %s (%d), NT error was %s",
 269                                  response->data.auth.error_string,
 270                                  pam_strerror(pamh, response->data.auth.pam_error),
 271                                  response->data.auth.pam_error,
 272                                  response->data.auth.nt_status_string);
 273                         return response->data.auth.pam_error;
 274                 } else {
 275                         _pam_log(LOG_ERR, "request failed, but PAM error 0!");
 276                         return PAM_SERVICE_ERR;
 277                 }
 278         }
 279
 280         return PAM_SUCCESS;
 281 }
 282
 283 static int pam_winbind_request_log(pam_handle_t * pamh,
 284                                    int ctrl,
 285                                    enum winbindd_cmd req_type,
 286                                    struct winbindd_request *request,
 287                                    struct winbindd_response *response,
 288                                    const char *user)
 289 {
 290         int retval;
 291
 292         retval = pam_winbind_request(pamh, ctrl, req_type, request, response);
 293
 294         switch (retval) {
 295         case PAM_AUTH_ERR:
 296                 /* incorrect password */
 297                 _pam_log(LOG_WARNING, "user `%s' denied access (incorrect password or invalid membership)", user);
 298                 return retval;
 299         case PAM_ACCT_EXPIRED:
 300                 /* account expired */
 301                 _pam_log(LOG_WARNING, "user `%s' account expired", user);
 302                 return retval;
 303         case PAM_AUTHTOK_EXPIRED:
 304                 /* password expired */
 305                 _pam_log(LOG_WARNING, "user `%s' password expired", user);
 306                 return retval;
 307         case PAM_NEW_AUTHTOK_REQD:
 308                 /* new password required */
 309                 _pam_log(LOG_WARNING, "user `%s' new password required", user);
 310                 return retval;
 311         case PAM_USER_UNKNOWN:
 312                 /* the user does not exist */
 313                 _pam_log_debug(ctrl, LOG_NOTICE, "user `%s' not found", user);
 314                 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
 315                         return PAM_IGNORE;
 316                 }
 317                 return retval;
 318         case PAM_SUCCESS:
 319                 if (req_type == WINBINDD_PAM_AUTH) {
 320                         /* Otherwise, the authentication looked good */
 321                         _pam_log(LOG_NOTICE, "user '%s' granted access", user);
 322                 } else if (req_type == WINBINDD_PAM_CHAUTHTOK) {
 323                         /* Otherwise, the authentication looked good */
 324                         _pam_log(LOG_NOTICE, "user '%s' password changed", user);
 325                 } else {
 326                         /* Otherwise, the authentication looked good */
 327                         _pam_log(LOG_NOTICE, "user '%s' OK", user);
 328                 }
 329
 330                 return retval;
 331         default:
 332                 /* we don't know anything about this return value */
 333                 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s')",
 334                          retval, user);
 335                 return retval;
 336         }
 337 }
 338
 339 /* talk to winbindd */
 340 static int winbind_auth_request(pam_handle_t * pamh,
 341                                 int ctrl,
 342                                 const char *user,
 343                                 const char *pass,
 344                                 const char *member,
 345                                 const char *cctype,
 346                                 int process_result,
 347                                 time_t *pwd_last_set)
 348 {
 349         struct winbindd_request request;
 350         struct winbindd_response response;
 351         int ret;
 352
 353         ZERO_STRUCT(request);
 354         ZERO_STRUCT(response);
 355
 356         if (pwd_last_set) {
 357                 *pwd_last_set = 0;
 358         }
 359
 360         strncpy(request.data.auth.user, user,
 361                 sizeof(request.data.auth.user)-1);
 362
 363         strncpy(request.data.auth.pass, pass,
 364                 sizeof(request.data.auth.pass)-1);
 365
 366         request.data.auth.krb5_cc_type[0] = '\0';
 367         request.data.auth.uid = -1;
 368
 369         request.flags = WBFLAG_PAM_INFO3_TEXT | WBFLAG_PAM_GET_PWD_POLICY;
 370
 371         if (ctrl & WINBIND_KRB5_AUTH) {
 372
 373                 struct passwd *pwd = NULL;
 374
 375                 _pam_log_debug(ctrl, LOG_DEBUG, "enabling krb5 login flag\n");
 376
 377                 request.flags |= WBFLAG_PAM_KRB5 | WBFLAG_PAM_FALLBACK_AFTER_KRB5;
 378
 379                 pwd = getpwnam(user);
 380                 if (pwd == NULL) {
 381                         return PAM_USER_UNKNOWN;
 382                 }
 383                 request.data.auth.uid = pwd->pw_uid;
 384         }
 385
 386         if (ctrl & WINBIND_CACHED_LOGIN) {
 387                 _pam_log_debug(ctrl, LOG_DEBUG, "enabling cached login flag\n");
 388                 request.flags |= WBFLAG_PAM_CACHED_LOGIN;
 389         }
 390
 391         if (cctype != NULL) {
 392                 strncpy(request.data.auth.krb5_cc_type, cctype,
 393                         sizeof(request.data.auth.krb5_cc_type) - 1);
 394                 _pam_log_debug(ctrl, LOG_DEBUG, "enabling request for a %s krb5 ccache\n", cctype);
 395         }
 396
 397         request.data.auth.require_membership_of_sid[0] = '\0';
 398
 399         if (member != NULL) {
 400                 strncpy(request.data.auth.require_membership_of_sid, member,
 401                         sizeof(request.data.auth.require_membership_of_sid)-1);
 402         }
 403
 404         /* lookup name? */
 405         if ( (member != NULL) && (strncmp("S-", member, 2) != 0) ) {
 406
 407                 struct winbindd_request sid_request;
 408                 struct winbindd_response sid_response;
 409
 410                 ZERO_STRUCT(sid_request);
 411                 ZERO_STRUCT(sid_response);
 412
 413                 _pam_log_debug(ctrl, LOG_DEBUG, "no sid given, looking up: %s\n", member);
 414
 415                 /* fortunatly winbindd can handle non-separated names */
 416                 strncpy(sid_request.data.name.name, member,
 417                         sizeof(sid_request.data.name.name) - 1);
 418
 419                 if (pam_winbind_request_log(pamh, ctrl, WINBINDD_LOOKUPNAME, &sid_request, &sid_response, user)) {
 420                         _pam_log(LOG_INFO, "could not lookup name: %s\n", member);
 421                         return PAM_AUTH_ERR;
 422                 }
 423
 424                 member = sid_response.data.sid.sid;
 425
 426                 strncpy(request.data.auth.require_membership_of_sid, member,
 427                         sizeof(request.data.auth.require_membership_of_sid)-1);
 428         }
 429
 430         ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_AUTH, &request, &response, user);
 431
 432         if (pwd_last_set) {
 433                 *pwd_last_set = response.data.auth.info3.pass_last_set_time;
 434         }
 435
 436         if ((ctrl & WINBIND_KRB5_AUTH) &&
 437             response.data.auth.krb5ccname[0] != '\0') {
 438
 439                 char var[PATH_MAX];
 440
 441                 _pam_log_debug(ctrl, LOG_DEBUG, "request returned KRB5CCNAME: %s",
 442                                response.data.auth.krb5ccname);
 443
 444                 snprintf(var, sizeof(var), "KRB5CCNAME=%s", response.data.auth.krb5ccname);
 445
 446                 ret = pam_putenv(pamh, var);
 447                 if (ret != PAM_SUCCESS) {
 448                         _pam_log(LOG_ERR, "failed to set KRB5CCNAME to %s", var);
 449                         return ret;
 450                 }
 451         }
 452
 453         if (!process_result) {
 454                 return ret;
 455         }
 456
 457         if (ret) {
 458                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PASSWORD_EXPIRED");
 459                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PASSWORD_MUST_CHANGE");
 460                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_INVALID_WORKSTATION");
 461                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_INVALID_LOGON_HOURS");
 462                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_EXPIRED");
 463                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_DISABLED");
 464                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_LOCKED_OUT");
 465                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT");
 466                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT");
 467                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT");
 468         }
 469
 470         /* handle the case where the auth was ok, but the password must expire right now */
 471         /* good catch from Ralf Haferkamp: an expiry of "never" is translated to -1 */
 472         if ( ! (response.data.auth.info3.acct_flags & ACB_PWNOEXP) &&
 473             (response.data.auth.policy.expire > 0) &&
 474             (response.data.auth.info3.pass_last_set_time + response.data.auth.policy.expire < time(NULL))) {
 475
 476                 ret = PAM_AUTHTOK_EXPIRED;
 477
 478                 _pam_log_debug(ctrl, LOG_DEBUG,"Password has expired (Password was last set: %d, "
 479                                "the policy says it should expire here %d (now it's: %d)\n",
 480                                response.data.auth.info3.pass_last_set_time,
 481                                response.data.auth.info3.pass_last_set_time + response.data.auth.policy.expire,
 482                                time(NULL));
 483
 484                 PAM_WB_REMARK_DIRECT_RET(pamh, "NT_STATUS_PASSWORD_EXPIRED");
 485
 486         }
 487
 488         /* warn a user if the password is about to expire soon */
 489         if ( ! (response.data.auth.info3.acct_flags & ACB_PWNOEXP) &&
 490             (response.data.auth.policy.expire) &&
 491             (response.data.auth.info3.pass_last_set_time + response.data.auth.policy.expire > time(NULL) ) ) {
 492
 493                 int days = response.data.auth.policy.expire / SECONDS_PER_DAY;
 494                 if (days <= DAYS_TO_WARN_BEFORE_PWD_EXPIRES) {
 495                         _make_remark_format(pamh, PAM_TEXT_INFO, "Your password will expire in %d days", days);
 496                 }
 497         }
 498
 499         if (response.data.auth.info3.user_flgs & LOGON_CACHED_ACCOUNT) {
 500                 _make_remark(pamh, PAM_ERROR_MSG, "Logging on using cached account. Network ressources can be unavailable");
 501                 _pam_log_debug(ctrl, LOG_DEBUG,"User %s logged on using cached account\n", user);
 502         }
 503
 504         /* save the CIFS homedir for pam_cifs / pam_mount */
 505         if (response.data.auth.info3.home_dir[0] != '\0') {
 506
 507                 int ret2 = pam_set_data(pamh, PAM_WINBIND_HOMEDIR,
 508                                         (void *) strdup(response.data.auth.info3.home_dir),
 509                                         _pam_winbind_cleanup_func);
 510                 if (ret2) {
 511                         _pam_log_debug(ctrl, LOG_DEBUG, "Could not set data: %s",
 512                                        pam_strerror(pamh, ret2));
 513                 }
 514
 515         }
 516
 517         /* save the logon script path for other PAM modules */
 518         if (response.data.auth.info3.logon_script[0] != '\0') {
 519
 520                 int ret2 = pam_set_data(pamh, PAM_WINBIND_LOGONSCRIPT,
 521                                         (void *) strdup(response.data.auth.info3.logon_script),
 522                                         _pam_winbind_cleanup_func);
 523                 if (ret2) {
 524                         _pam_log_debug(ctrl, LOG_DEBUG, "Could not set data: %s",
 525                                        pam_strerror(pamh, ret2));
 526                 }
 527         }
 528
 529         return ret;
 530 }
 531
 532 /* talk to winbindd */
 533 static int winbind_chauthtok_request(pam_handle_t * pamh,
 534                                      int ctrl,
 535                                      const char *user,
 536                                      const char *oldpass,
 537                                      const char *newpass,
 538                                      time_t pwd_last_set)
 539 {
 540         struct winbindd_request request;
 541         struct winbindd_response response;
 542         int ret;
 543
 544         ZERO_STRUCT(request);
 545         ZERO_STRUCT(response);
 546
 547         if (request.data.chauthtok.user == NULL) return -2;
 548
 549         strncpy(request.data.chauthtok.user, user,
 550                 sizeof(request.data.chauthtok.user) - 1);
 551
 552         if (oldpass != NULL) {
 553                 strncpy(request.data.chauthtok.oldpass, oldpass,
 554                         sizeof(request.data.chauthtok.oldpass) - 1);
 555         } else {
 556                 request.data.chauthtok.oldpass[0] = '\0';
 557         }
 558
 559         if (newpass != NULL) {
 560                 strncpy(request.data.chauthtok.newpass, newpass,
 561                         sizeof(request.data.chauthtok.newpass) - 1);
 562         } else {
 563                 request.data.chauthtok.newpass[0] = '\0';
 564         }
 565
 566         if (ctrl & WINBIND_KRB5_AUTH) {
 567                 request.flags = WBFLAG_PAM_KRB5;
 568         }
 569
 570         ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_CHAUTHTOK, &request, &response, user);
 571
 572         if (ret == PAM_SUCCESS) {
 573                 return ret;
 574         }
 575
 576         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_BACKUP_CONTROLLER");
 577         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCESS_DENIED");
 578
 579         /* TODO: tell the min pwd length ? */
 580         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_TOO_SHORT");
 581
 582         /* TODO: tell the minage ? */
 583         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_TOO_RECENT");
 584
 585         /* TODO: tell the history length ? */
 586         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_HISTORY_CONFLICT");
 587
 588         if (!strcasecmp(response.data.auth.nt_status_string, "NT_STATUS_PASSWORD_RESTRICTION")) {
 589
 590                 /* FIXME: avoid to send multiple PAM messages after another */
 591                 switch (response.data.auth.reject_reason) {
 592                         case -1:
 593                                 break;
 594                         case REJECT_REASON_OTHER:
 595                                 if ((response.data.auth.policy.min_passwordage > 0) &&
 596                                     (pwd_last_set + response.data.auth.policy.min_passwordage > time(NULL))) {
 597                                         PAM_WB_REMARK_DIRECT(pamh, "NT_STATUS_PWD_TOO_RECENT");
 598                                 }
 599                                 break;
 600                         case REJECT_REASON_TOO_SHORT:
 601                                 PAM_WB_REMARK_DIRECT(pamh, "NT_STATUS_PWD_TOO_SHORT");
 602                                 break;
 603                         case REJECT_REASON_IN_HISTORY:
 604                                 PAM_WB_REMARK_DIRECT(pamh, "NT_STATUS_PWD_HISTORY_CONFLICT");
 605                                 break;
 606                         case REJECT_REASON_NOT_COMPLEX:
 607                                 _make_remark(pamh, PAM_ERROR_MSG, "Password does not meet complexity requirements");
 608                                 break;
 609                         default:
 610                                 _pam_log_debug(ctrl, LOG_DEBUG,
 611                                                "unknown password change reject reason: %d",
 612                                                response.data.auth.reject_reason);
 613                                 break;
 614                 }
 615
 616                 _make_remark_format(pamh, PAM_ERROR_MSG,
 617                         "Your password must be at least %d characters; "
 618                         "cannot repeat any of the your previous %d passwords"
 619                         "%s. "
 620                         "Please type a different password. "
 621                         "Type a password which meets these requirements in both text boxes.",
 622                         response.data.auth.policy.min_length_password,
 623                         response.data.auth.policy.password_history,
 624                         (response.data.auth.policy.password_properties & DOMAIN_PASSWORD_COMPLEX) ?
 625                                 "; must contain capitals, numerals or punctuation; and cannot contain your account or full name" :
 626                                 "");
 627
 628         }
 629
 630         return ret;
 631 }
 632
 633 /*
 634  * Checks if a user has an account
 635  *
 636  * return values:
 637  *       1  = User not found
 638  *       0  = OK
 639  *      -1  = System error
 640  */
 641 static int valid_user(const char *user, pam_handle_t *pamh, int ctrl)
 642 {
 643         /* check not only if the user is available over NSS calls, also make
 644          * sure it's really a winbind user, this is important when stacking PAM
 645          * modules in the 'account' or 'password' facility. */
 646
 647         struct passwd *pwd = NULL;
 648         struct winbindd_request request;
 649         struct winbindd_response response;
 650         int ret;
 651
 652         ZERO_STRUCT(request);
 653         ZERO_STRUCT(response);
 654
 655         pwd = getpwnam(user);
 656         if (pwd == NULL) {
 657                 return 1;
 658         }
 659
 660         strncpy(request.data.username, user,
 661                 sizeof(request.data.username) - 1);
 662
 663         ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_GETPWNAM, &request, &response, user);
 664
 665         switch (ret) {
 666                 case PAM_USER_UNKNOWN:
 667                         return 1;
 668                 case PAM_SUCCESS:
 669                         return 0;
 670                 default:
 671                         break;
 672         }
 673         return -1;
 674 }
 675
 676 static char *_pam_delete(register char *xx)
 677 {
 678         _pam_overwrite(xx);
 679         _pam_drop(xx);
 680         return NULL;
 681 }
 682
 683 /*
 684  * obtain a password from the user
 685  */
 686
 687 static int _winbind_read_password(pam_handle_t * pamh,
 688                                   unsigned int ctrl,
 689                                   const char *comment,
 690                                   const char *prompt1,
 691                                   const char *prompt2,
 692                                   const char **pass)
 693 {
 694         int authtok_flag;
 695         int retval;
 696         const char *item;
 697         char *token;
 698
 699         /*
 700          * make sure nothing inappropriate gets returned
 701          */
 702
 703         *pass = token = NULL;
 704
 705         /*
 706          * which authentication token are we getting?
 707          */
 708
 709         authtok_flag = on(WINBIND__OLD_PASSWORD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
 710
 711         /*
 712          * should we obtain the password from a PAM item ?
 713          */
 714
 715         if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) || on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
 716                 retval = _pam_get_item(pamh, authtok_flag, &item);
 717                 if (retval != PAM_SUCCESS) {
 718                         /* very strange. */
 719                         _pam_log(LOG_ALERT,
 720                                  "pam_get_item returned error to unix-read-password"
 721                             );
 722                         return retval;
 723                 } else if (item != NULL) {      /* we have a password! */
 724                         *pass = item;
 725                         item = NULL;
 726                         return PAM_SUCCESS;
 727                 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
 728                         return PAM_AUTHTOK_RECOVER_ERR;         /* didn't work */
 729                 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
 730                            && off(WINBIND__OLD_PASSWORD, ctrl)) {
 731                         return PAM_AUTHTOK_RECOVER_ERR;
 732                 }
 733         }
 734         /*
 735          * getting here implies we will have to get the password from the
 736          * user directly.
 737          */
 738
 739         {
 740                 struct pam_message msg[3], *pmsg[3];
 741                 struct pam_response *resp;
 742                 int i, replies;
 743
 744                 /* prepare to converse */
 745
 746                 if (comment != NULL) {
 747                         pmsg[0] = &msg[0];
 748                         msg[0].msg_style = PAM_TEXT_INFO;
 749                         msg[0].msg = CONST_DISCARD(char *, comment);
 750                         i = 1;
 751                 } else {
 752                         i = 0;
 753                 }
 754
 755                 pmsg[i] = &msg[i];
 756                 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
 757                 msg[i++].msg = CONST_DISCARD(char *, prompt1);
 758                 replies = 1;
 759
 760                 if (prompt2 != NULL) {
 761                         pmsg[i] = &msg[i];
 762                         msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
 763                         msg[i++].msg = CONST_DISCARD(char *, prompt2);
 764                         ++replies;
 765                 }
 766                 /* so call the conversation expecting i responses */
 767                 resp = NULL;
 768                 retval = converse(pamh, i, pmsg, &resp);
 769
 770                 if (resp != NULL) {
 771
 772                         /* interpret the response */
 773
 774                         if (retval == PAM_SUCCESS) {    /* a good conversation */
 775
 776                                 token = x_strdup(resp[i - replies].resp);
 777                                 if (token != NULL) {
 778                                         if (replies == 2) {
 779                                                 /* verify that password entered correctly */
 780                                                 if (!resp[i - 1].resp
 781                                                     || strcmp(token, resp[i - 1].resp)) {
 782                                                         _pam_delete(token);     /* mistyped */
 783                                                         retval = PAM_AUTHTOK_RECOVER_ERR;
 784                                                         _make_remark(pamh, PAM_ERROR_MSG, MISTYPED_PASS);
 785                                                 }
 786                                         }
 787                                 } else {
 788                                         _pam_log(LOG_NOTICE, "could not recover authentication token");
 789                                         retval = PAM_AUTHTOK_RECOVER_ERR;
 790                                 }
 791
 792                         }
 793                         /*
 794                          * tidy up the conversation (resp_retcode) is ignored
 795                          * -- what is it for anyway? AGM
 796                          */
 797
 798                         _pam_drop_reply(resp, i);
 799
 800                 } else {
 801                         retval = (retval == PAM_SUCCESS)
 802                             ? PAM_AUTHTOK_RECOVER_ERR : retval;
 803                 }
 804         }
 805
 806         if (retval != PAM_SUCCESS) {
 807                 _pam_log_debug(ctrl, LOG_DEBUG,
 808                                  "unable to obtain a password");
 809                 return retval;
 810         }
 811         /* 'token' is the entered password */
 812
 813         /* we store this password as an item */
 814
 815         retval = pam_set_item(pamh, authtok_flag, token);
 816         _pam_delete(token);     /* clean it up */
 817         if (retval != PAM_SUCCESS ||
 818             (retval = _pam_get_item(pamh, authtok_flag, &item)) != PAM_SUCCESS) {
 819
 820                 _pam_log(LOG_CRIT, "error manipulating password");
 821                 return retval;
 822
 823         }
 824
 825         *pass = item;
 826         item = NULL;            /* break link to password */
 827
 828         return PAM_SUCCESS;
 829 }
 830
 831 const char *get_conf_item_string(int argc,
 832                                  const char **argv,
 833                                  int ctrl,
 834                                  dictionary *d,
 835                                  const char *item,
 836                                  int flag)
 837 {
 838         int i = 0;
 839         char *parm = NULL;
 840         const char *parm_opt = NULL;
 841         char *key = NULL;
 842
 843         if (!(ctrl & flag)) {
 844                 goto out;
 845         }
 846
 847         /* let the pam opt take precedence over the pam_winbind.conf option */
 848
 849         if (d != NULL) {
 850
 851                 if (!asprintf(&key, "global:%s", item)) {
 852                         goto out;
 853                 }
 854
 855                 parm_opt = iniparser_getstr(d, key);
 856                 SAFE_FREE(key);
 857         }
 858
 859         for ( i=0; i<argc; i++ ) {
 860
 861                 if ((strncmp(argv[i], item, strlen(item)) == 0)) {
 862                         char *p;
 863
 864                         parm = strdup(argv[i]);
 865
 866                         if ( (p = strchr( parm, '=' )) == NULL) {
 867                                 _pam_log(LOG_INFO, "no \"=\" delimiter for \"%s\" found\n", item);
 868                                 goto out;
 869                         }
 870                         SAFE_FREE(parm);
 871                         _pam_log_debug(ctrl, LOG_INFO, "PAM config: %s '%s'\n", item, p+1);
 872                         return p + 1;
 873                 }
 874         }
 875
 876         if (d != NULL) {
 877                 _pam_log_debug(ctrl, LOG_INFO, "CONFIG file: %s '%s'\n", item, parm_opt);
 878         }
 879 out:
 880         SAFE_FREE(parm);
 881         return parm_opt;
 882 }
 883
 884 const char *get_krb5_cc_type_from_config(int argc, const char **argv, int ctrl, dictionary *d)
 885 {
 886         return get_conf_item_string(argc, argv, ctrl, d, "krb5_ccache_type", WINBIND_KRB5_CCACHE_TYPE);
 887 }
 888
 889 const char *get_member_from_config(int argc, const char **argv, int ctrl, dictionary *d)
 890 {
 891         const char *ret = NULL;
 892         ret = get_conf_item_string(argc, argv, ctrl, d, "require_membership_of", WINBIND_REQUIRED_MEMBERSHIP);
 893         if (ret) {
 894                 return ret;
 895         }
 896         return get_conf_item_string(argc, argv, ctrl, d, "require-membership-of", WINBIND_REQUIRED_MEMBERSHIP);
 897 }
 898
 899 PAM_EXTERN
 900 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 901                         int argc, const char **argv)
 902 {
 903         const char *username;
 904         const char *password;
 905         const char *member = NULL;
 906         const char *cctype = NULL;
 907         int retval = PAM_AUTH_ERR;
 908         dictionary *d;
 909
 910         /* parse arguments */
 911         int ctrl = _pam_parse(argc, argv, &d);
 912         if (ctrl == -1) {
 913                 retval = PAM_SYSTEM_ERR;
 914                 goto out;
 915         }
 916
 917         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_authenticate (flags: 0x%04x)", flags);
 918
 919         /* Get the username */
 920         retval = pam_get_user(pamh, &username, NULL);
 921         if ((retval != PAM_SUCCESS) || (!username)) {
 922                 _pam_log_debug(ctrl, LOG_DEBUG, "can not get the username");
 923                 retval = PAM_SERVICE_ERR;
 924                 goto out;
 925         }
 926
 927         retval = _winbind_read_password(pamh, ctrl, NULL,
 928                                         "Password: ", NULL,
 929                                         &password);
 930
 931         if (retval != PAM_SUCCESS) {
 932                 _pam_log(LOG_ERR, "Could not retrieve user's password");
 933                 retval = PAM_AUTHTOK_ERR;
 934                 goto out;
 935         }
 936
 937         /* Let's not give too much away in the log file */
 938
 939 #ifdef DEBUG_PASSWORD
 940         _pam_log_debug(ctrl, LOG_INFO, "Verify user `%s' with password `%s'",
 941                        username, password);
 942 #else
 943         _pam_log_debug(ctrl, LOG_INFO, "Verify user `%s'", username);
 944 #endif
 945
 946         member = get_member_from_config(argc, argv, ctrl, d);
 947
 948         cctype = get_krb5_cc_type_from_config(argc, argv, ctrl, d);
 949
 950         /* Now use the username to look up password */
 951         retval = winbind_auth_request(pamh, ctrl, username, password, member, cctype, True, NULL);
 952
 953         if (retval == PAM_NEW_AUTHTOK_REQD ||
 954             retval == PAM_AUTHTOK_EXPIRED) {
 955
 956                 char *buf;
 957
 958                 if (!asprintf(&buf, "%d", retval)) {
 959                         retval = PAM_BUF_ERR;
 960                         goto out;
 961                 }
 962
 963                 pam_set_data( pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, (void *)buf, _pam_winbind_cleanup_func);
 964
 965                 retval = PAM_SUCCESS;
 966                 goto out;
 967         }
 968
 969 out:
 970         if (d) {
 971                 iniparser_freedict(d);
 972         }
 973         return retval;
 974 }
 975
 976 PAM_EXTERN
 977 int pam_sm_setcred(pam_handle_t *pamh, int flags,
 978                    int argc, const char **argv)
 979 {
 980         /* parse arguments */
 981         int ctrl = _pam_parse(argc, argv, NULL);
 982         if (ctrl == -1) {
 983                 return PAM_SYSTEM_ERR;
 984         }
 985
 986         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_setcred (flags: 0x%04x)", flags);
 987
 988         if (flags & PAM_DELETE_CRED) {
 989                 return pam_sm_close_session(pamh, flags, argc, argv);
 990         }
 991
 992         return PAM_SUCCESS;
 993 }
 994
 995 /*
 996  * Account management. We want to verify that the account exists
 997  * before returning PAM_SUCCESS
 998  */
 999 PAM_EXTERN
1000 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
1001                    int argc, const char **argv)
1002 {
1003         const char *username;
1004         int retval = PAM_USER_UNKNOWN;
1005         void *tmp = NULL;
1006
1007         /* parse arguments */
1008         int ctrl = _pam_parse(argc, argv, NULL);
1009         if (ctrl == -1) {
1010                 return PAM_SYSTEM_ERR;
1011         }
1012
1013         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_acct_mgmt (flags: 0x%04x)", flags);
1014
1015
1016         /* Get the username */
1017         retval = pam_get_user(pamh, &username, NULL);
1018         if ((retval != PAM_SUCCESS) || (!username)) {
1019                 _pam_log_debug(ctrl, LOG_DEBUG,"can not get the username");
1020                 return PAM_SERVICE_ERR;
1021         }
1022
1023         /* Verify the username */
1024         retval = valid_user(username, pamh, ctrl);
1025         switch (retval) {
1026         case -1:
1027                 /* some sort of system error. The log was already printed */
1028                 return PAM_SERVICE_ERR;
1029         case 1:
1030                 /* the user does not exist */
1031                 _pam_log_debug(ctrl, LOG_NOTICE, "user `%s' not found", username);
1032                 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
1033                         return PAM_IGNORE;
1034                 }
1035                 return PAM_USER_UNKNOWN;
1036         case 0:
1037                 pam_get_data( pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, (const void **)&tmp);
1038                 if (tmp != NULL) {
1039                         retval = atoi(tmp);
1040                         switch (retval) {
1041                         case PAM_AUTHTOK_EXPIRED:
1042                                 /* fall through, since new token is required in this case */
1043                         case PAM_NEW_AUTHTOK_REQD:
1044                                 _pam_log(LOG_WARNING, "pam_sm_acct_mgmt success but %s is set",
1045                                          PAM_WINBIND_NEW_AUTHTOK_REQD);
1046                                 _pam_log(LOG_NOTICE, "user '%s' needs new password", username);
1047                                 /* PAM_AUTHTOKEN_REQD does not exist, but is documented in the manpage */
1048                                 return PAM_NEW_AUTHTOK_REQD;
1049                         default:
1050                                 _pam_log(LOG_WARNING, "pam_sm_acct_mgmt success");
1051                                 _pam_log(LOG_NOTICE, "user '%s' granted access", username);
1052                                 return PAM_SUCCESS;
1053                         }
1054                 }
1055
1056                 /* Otherwise, the authentication looked good */
1057                 _pam_log(LOG_NOTICE, "user '%s' granted access", username);
1058                 return PAM_SUCCESS;
1059         default:
1060                 /* we don't know anything about this return value */
1061                 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s')",
1062                          retval, username);
1063                 return PAM_SERVICE_ERR;
1064         }
1065
1066         /* should not be reached */
1067         return PAM_IGNORE;
1068 }
1069
1070 PAM_EXTERN
1071 int pam_sm_open_session(pam_handle_t *pamh, int flags,
1072                         int argc, const char **argv)
1073 {
1074         /* parse arguments */
1075         int ctrl = _pam_parse(argc, argv, NULL);
1076         if (ctrl == -1) {
1077                 return PAM_SYSTEM_ERR;
1078         }
1079
1080         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_open_session handler (flags: 0x%04x)", flags);
1081
1082         return PAM_SUCCESS;
1083 }
1084
1085 PAM_EXTERN
1086 int pam_sm_close_session(pam_handle_t *pamh, int flags,
1087                          int argc, const char **argv)
1088 {
1089         dictionary *d;
1090         int retval = PAM_SUCCESS;
1091
1092         /* parse arguments */
1093         int ctrl = _pam_parse(argc, argv, &d);
1094         if (ctrl == -1) {
1095                 retval = PAM_SYSTEM_ERR;
1096                 goto out;
1097         }
1098
1099         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_close_session handler (flags: 0x%04x)", flags);
1100
1101         if (!(flags & PAM_DELETE_CRED)) {
1102                 retval = PAM_SUCCESS;
1103                 goto out;
1104         }
1105
1106         if (ctrl & WINBIND_KRB5_AUTH) {
1107
1108                 /* destroy the ccache here */
1109                 struct winbindd_request request;
1110                 struct winbindd_response response;
1111                 const char *user;
1112                 const char *ccname = NULL;
1113                 struct passwd *pwd = NULL;
1114
1115                 ZERO_STRUCT(request);
1116                 ZERO_STRUCT(response);
1117
1118                 retval = pam_get_user(pamh, &user, "Username: ");
1119                 if (retval == PAM_SUCCESS) {
1120                         if (user == NULL) {
1121                                 _pam_log(LOG_ERR, "username was NULL!");
1122                                 retval = PAM_USER_UNKNOWN;
1123                                 goto out;
1124                         }
1125                         if (retval == PAM_SUCCESS) {
1126                                 _pam_log_debug(ctrl, LOG_DEBUG, "username [%s] obtained", user);
1127                         }
1128                 } else {
1129                         _pam_log_debug(ctrl, LOG_DEBUG, "could not identify user");
1130                         goto out;
1131                 }
1132
1133                 ccname = pam_getenv(pamh, "KRB5CCNAME");
1134                 if (ccname == NULL) {
1135                         _pam_log_debug(ctrl, LOG_DEBUG, "user has no KRB5CCNAME environment");
1136                         retval = PAM_SUCCESS;
1137                         goto out;
1138                 }
1139
1140                 strncpy(request.data.logoff.user, user,
1141                         sizeof(request.data.logoff.user) - 1);
1142
1143                 strncpy(request.data.logoff.krb5ccname, ccname,
1144                         sizeof(request.data.logoff.krb5ccname) - 1);
1145
1146                 pwd = getpwnam(user);
1147                 if (pwd == NULL) {
1148                         retval = PAM_USER_UNKNOWN;
1149                         goto out;
1150                 }
1151                 request.data.logoff.uid = pwd->pw_uid;
1152
1153                 request.flags = WBFLAG_PAM_KRB5;
1154
1155                 retval = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_LOGOFF, &request, &response, user);
1156         }
1157
1158 out:
1159         if (d) {
1160                 iniparser_freedict(d);
1161         }
1162         return retval;
1163 }
1164
1165
1166
1167 PAM_EXTERN
1168 int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
1169                      int argc, const char **argv)
1170 {
1171         unsigned int lctrl;
1172         int retval;
1173         unsigned int ctrl;
1174
1175         /* <DO NOT free() THESE> */
1176         const char *user;
1177         char *pass_old, *pass_new;
1178         /* </DO NOT free() THESE> */
1179
1180         char *Announce;
1181
1182         int retry = 0;
1183         dictionary *d;
1184
1185         ctrl = _pam_parse(argc, argv, &d);
1186         if (ctrl == -1) {
1187                 retval = PAM_SYSTEM_ERR;
1188                 goto out;
1189         }
1190
1191         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_chauthtok (flags: 0x%04x)", flags);
1192
1193         /* clearing offline bit for the auth in the password change */
1194         ctrl &= ~WINBIND_CACHED_LOGIN;
1195
1196         /*
1197          * First get the name of a user
1198          */
1199         retval = pam_get_user(pamh, &user, "Username: ");
1200         if (retval == PAM_SUCCESS) {
1201                 if (user == NULL) {
1202                         _pam_log(LOG_ERR, "username was NULL!");
1203                         retval = PAM_USER_UNKNOWN;
1204                         goto out;
1205                 }
1206                 if (retval == PAM_SUCCESS) {
1207                         _pam_log_debug(ctrl, LOG_DEBUG, "username [%s] obtained",
1208                                  user);
1209                 }
1210         } else {
1211                 _pam_log_debug(ctrl, LOG_DEBUG,
1212                          "password - could not identify user");
1213                 goto out;
1214         }
1215
1216         /* check if this is really a user in winbindd, not only in NSS */
1217         retval = valid_user(user, pamh, ctrl);
1218         switch (retval) {
1219                 case 1:
1220                         retval = PAM_USER_UNKNOWN;
1221                         goto out;
1222                 case -1:
1223                         retval = PAM_SYSTEM_ERR;
1224                         goto out;
1225                 default:
1226                         break;
1227         }
1228
1229         /*
1230          * obtain and verify the current password (OLDAUTHTOK) for
1231          * the user.
1232          */
1233
1234         if (flags & PAM_PRELIM_CHECK) {
1235
1236                 time_t pwdlastset_prelim = 0;
1237
1238                 /* instruct user what is happening */
1239 #define greeting "Changing password for "
1240                 Announce = (char *) malloc(sizeof(greeting) + strlen(user));
1241                 if (Announce == NULL) {
1242                         _pam_log(LOG_CRIT, "password - out of memory");
1243                         retval = PAM_BUF_ERR;
1244                         goto out;
1245                 }
1246                 (void) strcpy(Announce, greeting);
1247                 (void) strcpy(Announce + sizeof(greeting) - 1, user);
1248 #undef greeting
1249
1250                 lctrl = ctrl | WINBIND__OLD_PASSWORD;
1251                 retval = _winbind_read_password(pamh, lctrl,
1252                                                 Announce,
1253                                                 "(current) NT password: ",
1254                                                 NULL,
1255                                                 (const char **) &pass_old);
1256                 if (retval != PAM_SUCCESS) {
1257                         _pam_log(LOG_NOTICE, "password - (old) token not obtained");
1258                         goto out;
1259                 }
1260                 /* verify that this is the password for this user */
1261
1262                 retval = winbind_auth_request(pamh, ctrl, user, pass_old, NULL, NULL, False, &pwdlastset_prelim);
1263
1264                 if (retval != PAM_ACCT_EXPIRED &&
1265                     retval != PAM_AUTHTOK_EXPIRED &&
1266                     retval != PAM_NEW_AUTHTOK_REQD &&
1267                     retval != PAM_SUCCESS) {
1268                         pass_old = NULL;
1269                         goto out;
1270                 }
1271
1272                 pam_set_data(pamh, PAM_WINBIND_PWD_LAST_SET, (void *)pwdlastset_prelim, _pam_winbind_cleanup_func);
1273
1274                 retval = pam_set_item(pamh, PAM_OLDAUTHTOK, (const void *) pass_old);
1275                 pass_old = NULL;
1276                 if (retval != PAM_SUCCESS) {
1277                         _pam_log(LOG_CRIT, "failed to set PAM_OLDAUTHTOK");
1278                 }
1279         } else if (flags & PAM_UPDATE_AUTHTOK) {
1280
1281                 time_t pwdlastset_update = 0;
1282
1283                 /*
1284                  * obtain the proposed password
1285                  */
1286
1287                 /*
1288                  * get the old token back.
1289                  */
1290
1291                 retval = _pam_get_item(pamh, PAM_OLDAUTHTOK, &pass_old);
1292
1293                 if (retval != PAM_SUCCESS) {
1294                         _pam_log(LOG_NOTICE, "user not authenticated");
1295                         goto out;
1296                 }
1297
1298                 lctrl = ctrl;
1299
1300                 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
1301                         lctrl |= WINBIND_USE_FIRST_PASS_ARG;
1302                 }
1303                 retry = 0;
1304                 retval = PAM_AUTHTOK_ERR;
1305                 while ((retval != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
1306                         /*
1307                          * use_authtok is to force the use of a previously entered
1308                          * password -- needed for pluggable password strength checking
1309                          */
1310
1311                         retval = _winbind_read_password(pamh, lctrl,
1312                                                         NULL,
1313                                                         "Enter new NT password: ",
1314                                                         "Retype new NT password: ",
1315                                                         (const char **) &pass_new);
1316
1317                         if (retval != PAM_SUCCESS) {
1318                                 _pam_log_debug(ctrl, LOG_ALERT
1319                                          ,"password - new password not obtained");
1320                                 pass_old = NULL;/* tidy up */
1321                                 goto out;
1322                         }
1323
1324                         /*
1325                          * At this point we know who the user is and what they
1326                          * propose as their new password. Verify that the new
1327                          * password is acceptable.
1328                          */
1329
1330                         if (pass_new[0] == '\0') {/* "\0" password = NULL */
1331                                 pass_new = NULL;
1332                         }
1333                 }
1334
1335                 /*
1336                  * By reaching here we have approved the passwords and must now
1337                  * rebuild the password database file.
1338                  */
1339                 _pam_get_data( pamh, PAM_WINBIND_PWD_LAST_SET,
1340                                &pwdlastset_update);
1341
1342                 retval = winbind_chauthtok_request(pamh, ctrl, user, pass_old, pass_new, pwdlastset_update);
1343                 if (retval) {
1344                         _pam_overwrite(pass_new);
1345                         _pam_overwrite(pass_old);
1346                         pass_old = pass_new = NULL;
1347                         goto out;
1348                 }
1349
1350                 /* just in case we need krb5 creds after a password change over msrpc */
1351
1352                 if (ctrl & WINBIND_KRB5_AUTH) {
1353
1354                         const char *member = get_member_from_config(argc, argv, ctrl, d);
1355                         const char *cctype = get_krb5_cc_type_from_config(argc, argv, ctrl, d);
1356
1357                         retval = winbind_auth_request(pamh, ctrl, user, pass_new, member, cctype, False, NULL);
1358                         _pam_overwrite(pass_new);
1359                         _pam_overwrite(pass_old);
1360                         pass_old = pass_new = NULL;
1361                 }
1362         } else {
1363                 retval = PAM_SERVICE_ERR;
1364         }
1365
1366 out:
1367         if (d) {
1368                 iniparser_freedict(d);
1369         }
1370         return retval;
1371 }
1372
1373 #ifdef PAM_STATIC
1374
1375 /* static module data */
1376
1377 struct pam_module _pam_winbind_modstruct = {
1378         MODULE_NAME,
1379         pam_sm_authenticate,
1380         pam_sm_setcred,
1381         pam_sm_acct_mgmt,
1382         pam_sm_open_session,
1383         pam_sm_close_session,
1384         pam_sm_chauthtok
1385 };
1386
1387 #endif
1388
1389 /*
1390  * Copyright (c) Andrew Tridgell  <tridge@samba.org>   2000
1391  * Copyright (c) Tim Potter       <tpot@samba.org>     2000
1392  * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
1393  * Copyright (c) Guenther Deschner <gd@samba.org>      2005-2006
1394  * Copyright (c) Jan Rêkorajski 1999.
1395  * Copyright (c) Andrew G. Morgan 1996-8.
1396  * Copyright (c) Alex O. Yuriev, 1996.
1397  * Copyright (c) Cristian Gafton 1996.
1398  * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
1399  *
1400  * Redistribution and use in source and binary forms, with or without
1401  * modification, are permitted provided that the following conditions
1402  * are met:
1403  * 1. Redistributions of source code must retain the above copyright
1404  *    notice, and the entire permission notice in its entirety,
1405  *    including the disclaimer of warranties.
1406  * 2. Redistributions in binary form must reproduce the above copyright
1407  *    notice, this list of conditions and the following disclaimer in the
1408  *    documentation and/or other materials provided with the distribution.
1409  * 3. The name of the author may not be used to endorse or promote
1410  *    products derived from this software without specific prior
1411  *    written permission.
1412  *
1413  * ALTERNATIVELY, this product may be distributed under the terms of
1414  * the GNU Public License, in which case the provisions of the GPL are
1415  * required INSTEAD OF the above restrictions.  (This clause is
1416  * necessary due to a potential bad interaction between the GPL and
1417  * the restrictions contained in a BSD-style copyright.)
1418  *
1419  * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
1420  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1421  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
1422  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
1423  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
1424  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
1425  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1426  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
1427  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
1428  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
1429  * OF THE POSSIBILITY OF SUCH DAMAGE.
1430  */