2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "smbd/globals.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
30 #define DBGC_CLASS DBGC_AUTH
32 /****************************************************************************
33 Ensure primary group SID is always at position 0 in a
34 auth_serversupplied_info struct.
35 ****************************************************************************/
37 static void sort_sid_array_for_smbd(struct auth_serversupplied_info *result,
38 const struct dom_sid *pgroup_sid)
46 if (sid_compare(&result->sids[0], pgroup_sid)==0) {
50 for (i = 1; i < result->num_sids; i++) {
51 if (sid_compare(pgroup_sid,
52 &result->sids[i]) == 0) {
53 sid_copy(&result->sids[i], &result->sids[0]);
54 sid_copy(&result->sids[0], pgroup_sid);
60 /****************************************************************************
61 Create a UNIX user on demand.
62 ****************************************************************************/
64 static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
66 TALLOC_CTX *ctx = talloc_tos();
70 add_script = talloc_strdup(ctx, lp_adduser_script());
71 if (!add_script || !*add_script) {
74 add_script = talloc_all_string_sub(ctx,
82 add_script = talloc_all_string_sub(ctx,
91 add_script = talloc_all_string_sub(ctx,
99 ret = smbrun(add_script,NULL);
102 ("smb_create_user: Running the command `%s' gave %d\n",
107 /****************************************************************************
108 Create an auth_usersupplied_data structure after appropriate mapping.
109 ****************************************************************************/
111 NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info,
112 const char *smb_name,
113 const char *client_domain,
114 const char *wksta_name,
117 DATA_BLOB *lm_interactive_pwd,
118 DATA_BLOB *nt_interactive_pwd,
119 DATA_BLOB *plaintext,
122 struct smbd_server_connection *sconn = smbd_server_conn;
126 fstring internal_username;
127 fstrcpy(internal_username, smb_name);
128 was_mapped = map_username(sconn, internal_username);
130 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
131 client_domain, smb_name, wksta_name));
133 domain = client_domain;
135 /* If you connect to a Windows domain member using a bogus domain name,
136 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
137 * the Windows box is a DC the name will become DOMAIN\user and be
138 * authenticated against AD, if the Windows box is a member server but
139 * not a DC the name will become WORKSTATION\user. A standalone
140 * non-domain member box will also map to WORKSTATION\user.
141 * This also deals with the client passing in a "" domain */
143 if (!is_trusted_domain(domain) &&
144 !strequal(domain, my_sam_name()))
146 if (lp_map_untrusted_to_domain())
147 domain = my_sam_name();
149 domain = get_global_sam_name();
150 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
151 "workstation [%s]\n",
152 client_domain, domain, smb_name, wksta_name));
155 /* We know that the given domain is trusted (and we are allowing them),
156 * it is our global SAM name, or for legacy behavior it is our
157 * primary domain name */
159 result = make_user_info(user_info, smb_name, internal_username,
160 client_domain, domain, wksta_name,
162 lm_interactive_pwd, nt_interactive_pwd,
163 plaintext, encrypted);
164 if (NT_STATUS_IS_OK(result)) {
165 (*user_info)->was_mapped = was_mapped;
170 /****************************************************************************
171 Create an auth_usersupplied_data, making the DATA_BLOBs here.
172 Decrypt and encrypt the passwords.
173 ****************************************************************************/
175 bool make_user_info_netlogon_network(struct auth_usersupplied_info **user_info,
176 const char *smb_name,
177 const char *client_domain,
178 const char *wksta_name,
179 uint32 logon_parameters,
180 const uchar *lm_network_pwd,
182 const uchar *nt_network_pwd,
187 DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
188 DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
190 status = make_user_info_map(user_info,
191 smb_name, client_domain,
193 lm_pwd_len ? &lm_blob : NULL,
194 nt_pwd_len ? &nt_blob : NULL,
198 if (NT_STATUS_IS_OK(status)) {
199 (*user_info)->logon_parameters = logon_parameters;
201 ret = NT_STATUS_IS_OK(status) ? True : False;
203 data_blob_free(&lm_blob);
204 data_blob_free(&nt_blob);
208 /****************************************************************************
209 Create an auth_usersupplied_data, making the DATA_BLOBs here.
210 Decrypt and encrypt the passwords.
211 ****************************************************************************/
213 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info,
214 const char *smb_name,
215 const char *client_domain,
216 const char *wksta_name,
217 uint32 logon_parameters,
219 const uchar lm_interactive_pwd[16],
220 const uchar nt_interactive_pwd[16],
221 const uchar *dc_sess_key)
223 unsigned char lm_pwd[16];
224 unsigned char nt_pwd[16];
225 unsigned char local_lm_response[24];
226 unsigned char local_nt_response[24];
227 unsigned char key[16];
229 memcpy(key, dc_sess_key, 16);
231 if (lm_interactive_pwd)
232 memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
234 if (nt_interactive_pwd)
235 memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
237 #ifdef DEBUG_PASSWORD
239 dump_data(100, key, sizeof(key));
241 DEBUG(100,("lm owf password:"));
242 dump_data(100, lm_pwd, sizeof(lm_pwd));
244 DEBUG(100,("nt owf password:"));
245 dump_data(100, nt_pwd, sizeof(nt_pwd));
248 if (lm_interactive_pwd)
249 arcfour_crypt(lm_pwd, key, sizeof(lm_pwd));
251 if (nt_interactive_pwd)
252 arcfour_crypt(nt_pwd, key, sizeof(nt_pwd));
254 #ifdef DEBUG_PASSWORD
255 DEBUG(100,("decrypt of lm owf password:"));
256 dump_data(100, lm_pwd, sizeof(lm_pwd));
258 DEBUG(100,("decrypt of nt owf password:"));
259 dump_data(100, nt_pwd, sizeof(nt_pwd));
262 if (lm_interactive_pwd)
263 SMBOWFencrypt(lm_pwd, chal,
266 if (nt_interactive_pwd)
267 SMBOWFencrypt(nt_pwd, chal,
270 /* Password info paranoia */
276 DATA_BLOB local_lm_blob;
277 DATA_BLOB local_nt_blob;
279 DATA_BLOB lm_interactive_blob;
280 DATA_BLOB nt_interactive_blob;
282 if (lm_interactive_pwd) {
283 local_lm_blob = data_blob(local_lm_response,
284 sizeof(local_lm_response));
285 lm_interactive_blob = data_blob(lm_pwd,
290 if (nt_interactive_pwd) {
291 local_nt_blob = data_blob(local_nt_response,
292 sizeof(local_nt_response));
293 nt_interactive_blob = data_blob(nt_pwd,
298 nt_status = make_user_info_map(
300 smb_name, client_domain, wksta_name,
301 lm_interactive_pwd ? &local_lm_blob : NULL,
302 nt_interactive_pwd ? &local_nt_blob : NULL,
303 lm_interactive_pwd ? &lm_interactive_blob : NULL,
304 nt_interactive_pwd ? &nt_interactive_blob : NULL,
307 if (NT_STATUS_IS_OK(nt_status)) {
308 (*user_info)->logon_parameters = logon_parameters;
311 ret = NT_STATUS_IS_OK(nt_status) ? True : False;
312 data_blob_free(&local_lm_blob);
313 data_blob_free(&local_nt_blob);
314 data_blob_free(&lm_interactive_blob);
315 data_blob_free(&nt_interactive_blob);
321 /****************************************************************************
322 Create an auth_usersupplied_data structure
323 ****************************************************************************/
325 bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
326 const char *smb_name,
327 const char *client_domain,
329 DATA_BLOB plaintext_password)
332 DATA_BLOB local_lm_blob;
333 DATA_BLOB local_nt_blob;
334 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
337 * Not encrypted - do so.
340 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
343 if (plaintext_password.data && plaintext_password.length) {
344 unsigned char local_lm_response[24];
346 #ifdef DEBUG_PASSWORD
347 DEBUG(10,("Unencrypted password (len %d):\n",
348 (int)plaintext_password.length));
349 dump_data(100, plaintext_password.data,
350 plaintext_password.length);
353 SMBencrypt( (const char *)plaintext_password.data,
354 (const uchar*)chal, local_lm_response);
355 local_lm_blob = data_blob(local_lm_response, 24);
357 /* We can't do an NT hash here, as the password needs to be
359 local_nt_blob = data_blob_null;
361 local_lm_blob = data_blob_null;
362 local_nt_blob = data_blob_null;
365 ret = make_user_info_map(
366 user_info, smb_name, client_domain,
367 get_remote_machine_name(),
368 local_lm_blob.data ? &local_lm_blob : NULL,
369 local_nt_blob.data ? &local_nt_blob : NULL,
371 plaintext_password.data && plaintext_password.length ? &plaintext_password : NULL,
374 data_blob_free(&local_lm_blob);
375 return NT_STATUS_IS_OK(ret) ? True : False;
378 /****************************************************************************
379 Create an auth_usersupplied_data structure
380 ****************************************************************************/
382 NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info,
383 const char *smb_name,
384 const char *client_domain,
385 DATA_BLOB lm_resp, DATA_BLOB nt_resp)
387 return make_user_info_map(user_info, smb_name,
389 get_remote_machine_name(),
390 lm_resp.data ? &lm_resp : NULL,
391 nt_resp.data ? &nt_resp : NULL,
396 /****************************************************************************
397 Create a guest user_info blob, for anonymous authenticaion.
398 ****************************************************************************/
400 bool make_user_info_guest(struct auth_usersupplied_info **user_info)
404 nt_status = make_user_info(user_info,
413 return NT_STATUS_IS_OK(nt_status) ? True : False;
416 static NTSTATUS log_nt_token(NT_USER_TOKEN *token)
418 TALLOC_CTX *frame = talloc_stackframe();
423 if ((lp_log_nt_token_command() == NULL) ||
424 (strlen(lp_log_nt_token_command()) == 0)) {
429 group_sidstr = talloc_strdup(frame, "");
430 for (i=1; i<token->num_sids; i++) {
431 group_sidstr = talloc_asprintf(
432 frame, "%s %s", group_sidstr,
433 sid_string_talloc(frame, &token->user_sids[i]));
436 command = talloc_string_sub(
437 frame, lp_log_nt_token_command(),
438 "%s", sid_string_talloc(frame, &token->user_sids[0]));
439 command = talloc_string_sub(frame, command, "%t", group_sidstr);
441 if (command == NULL) {
443 return NT_STATUS_NO_MEMORY;
446 DEBUG(8, ("running command: [%s]\n", command));
447 if (smbrun(command, NULL) != 0) {
448 DEBUG(0, ("Could not log NT token\n"));
450 return NT_STATUS_ACCESS_DENIED;
458 * Create the token to use from server_info->info3 and
459 * server_info->sids (the info3/sam groups). Find the unix gids.
462 NTSTATUS create_local_token(struct auth_serversupplied_info *server_info)
466 struct dom_sid tmp_sid;
467 struct dom_sid user_sid;
470 * If winbind is not around, we can not make much use of the SIDs the
471 * domain controller provided us with. Likewise if the user name was
472 * mapped to some local unix user.
475 if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
476 (server_info->nss_token)) {
477 status = create_token_from_username(server_info,
478 server_info->unix_name,
480 &server_info->utok.uid,
481 &server_info->utok.gid,
482 &server_info->unix_name,
486 sid_compose(&user_sid,
487 server_info->info3->base.domain_sid,
488 server_info->info3->base.rid);
490 server_info->ptok = create_local_nt_token(
494 server_info->num_sids, server_info->sids);
495 status = server_info->ptok ?
496 NT_STATUS_OK : NT_STATUS_NO_SUCH_USER;
499 if (!NT_STATUS_IS_OK(status)) {
503 /* Convert the SIDs to gids. */
505 server_info->utok.ngroups = 0;
506 server_info->utok.groups = NULL;
508 /* Start at index 1, where the groups start. */
510 for (i=1; i<server_info->ptok->num_sids; i++) {
512 struct dom_sid *sid = &server_info->ptok->user_sids[i];
514 if (!sid_to_gid(sid, &gid)) {
515 DEBUG(10, ("Could not convert SID %s to gid, "
516 "ignoring it\n", sid_string_dbg(sid)));
519 add_gid_to_array_unique(server_info, gid,
520 &server_info->utok.groups,
521 &server_info->utok.ngroups);
525 * Add the "Unix Group" SID for each gid to catch mapped groups
526 * and their Unix equivalent. This is to solve the backwards
527 * compatibility problem of 'valid users = +ntadmin' where
528 * ntadmin has been paired with "Domain Admins" in the group
529 * mapping table. Otherwise smb.conf would need to be changed
530 * to 'valid user = "Domain Admins"'. --jerry
532 * For consistency we also add the "Unix User" SID,
533 * so that the complete unix token is represented within
537 if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
538 DEBUG(1,("create_local_token: Failed to create SID "
539 "for uid %u!\n", (unsigned int)server_info->utok.uid));
541 add_sid_to_array_unique(server_info->ptok, &tmp_sid,
542 &server_info->ptok->user_sids,
543 &server_info->ptok->num_sids);
545 for ( i=0; i<server_info->utok.ngroups; i++ ) {
546 if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
547 DEBUG(1,("create_local_token: Failed to create SID "
548 "for gid %u!\n", (unsigned int)server_info->utok.groups[i]));
551 add_sid_to_array_unique(server_info->ptok, &tmp_sid,
552 &server_info->ptok->user_sids,
553 &server_info->ptok->num_sids);
556 debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
557 debug_unix_user_token(DBGC_AUTH, 10,
558 server_info->utok.uid,
559 server_info->utok.gid,
560 server_info->utok.ngroups,
561 server_info->utok.groups);
563 status = log_nt_token(server_info->ptok);
567 /***************************************************************************
568 Make (and fill) a server_info struct from a 'struct passwd' by conversion
570 ***************************************************************************/
572 NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
577 struct samu *sampass = NULL;
579 char *qualified_name = NULL;
580 TALLOC_CTX *mem_ctx = NULL;
581 struct dom_sid u_sid;
582 enum lsa_SidType type;
583 struct auth_serversupplied_info *result;
585 if ( !(sampass = samu_new( NULL )) ) {
586 return NT_STATUS_NO_MEMORY;
589 status = samu_set_unix( sampass, pwd );
590 if (!NT_STATUS_IS_OK(status)) {
594 result = make_server_info(NULL);
595 if (result == NULL) {
596 TALLOC_FREE(sampass);
597 return NT_STATUS_NO_MEMORY;
600 status = samu_to_SamInfo3(result, sampass,
601 global_myname(), &result->info3);
602 if (!NT_STATUS_IS_OK(status)) {
603 DEBUG(10, ("Failed to convert samu to info3: %s\n",
605 TALLOC_FREE(sampass);
611 result->unix_name = talloc_strdup(result, unix_username);
612 result->sanitized_username = sanitize_username(result, unix_username);
614 if ((result->unix_name == NULL)
615 || (result->sanitized_username == NULL)) {
616 TALLOC_FREE(sampass);
618 return NT_STATUS_NO_MEMORY;
621 result->utok.uid = pwd->pw_uid;
622 result->utok.gid = pwd->pw_gid;
624 status = pdb_enum_group_memberships(result, sampass,
625 &result->sids, &gids,
628 if (!NT_STATUS_IS_OK(status)) {
629 DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
631 TALLOC_FREE(sampass);
636 TALLOC_FREE(sampass);
639 * The SID returned in server_info->sam_account is based
640 * on our SAM sid even though for a pure UNIX account this should
641 * not be the case as it doesn't really exist in the SAM db.
642 * This causes lookups on "[in]valid users" to fail as they
643 * will lookup this name as a "Unix User" SID to check against
644 * the user token. Fix this by adding the "Unix User"\unix_username
645 * SID to the sid array. The correct fix should probably be
646 * changing the server_info->sam_account user SID to be a
647 * S-1-22 Unix SID, but this might break old configs where
648 * plaintext passwords were used with no SAM backend.
651 mem_ctx = talloc_init("make_server_info_pw_tmp");
654 return NT_STATUS_NO_MEMORY;
657 qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
658 unix_users_domain_name(),
660 if (!qualified_name) {
662 TALLOC_FREE(mem_ctx);
663 return NT_STATUS_NO_MEMORY;
666 if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
670 TALLOC_FREE(mem_ctx);
671 return NT_STATUS_NO_SUCH_USER;
674 TALLOC_FREE(mem_ctx);
676 if (type != SID_NAME_USER) {
678 return NT_STATUS_NO_SUCH_USER;
681 /* FIXME: add to info3 too ? */
682 status = add_sid_to_array_unique(result, &u_sid,
685 if (!NT_STATUS_IS_OK(status)) {
690 /* For now we throw away the gids and convert via sid_to_gid
691 * later. This needs fixing, but I'd like to get the code straight and
695 *server_info = result;
700 /***************************************************************************
701 Make (and fill) a user_info struct for a guest login.
702 This *must* succeed for smbd to start. If there is no mapping entry for
703 the guest gid, then create one.
704 ***************************************************************************/
706 static NTSTATUS make_new_server_info_guest(struct auth_serversupplied_info **server_info)
709 struct samu *sampass = NULL;
710 struct dom_sid guest_sid;
712 static const char zeros[16] = {0, };
715 if ( !(sampass = samu_new( NULL )) ) {
716 return NT_STATUS_NO_MEMORY;
719 sid_compose(&guest_sid, get_global_sam_sid(), DOMAIN_RID_GUEST);
722 ret = pdb_getsampwsid(sampass, &guest_sid);
726 TALLOC_FREE(sampass);
727 return NT_STATUS_NO_SUCH_USER;
730 status = make_server_info_sam(server_info, sampass);
731 if (!NT_STATUS_IS_OK(status)) {
732 TALLOC_FREE(sampass);
736 TALLOC_FREE(sampass);
738 (*server_info)->guest = True;
740 status = create_local_token(*server_info);
741 if (!NT_STATUS_IS_OK(status)) {
742 DEBUG(10, ("create_local_token failed: %s\n",
747 /* annoying, but the Guest really does have a session key, and it is
749 (*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
750 (*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
752 alpha_strcpy(tmp, (*server_info)->info3->base.account_name.string,
753 ". _-$", sizeof(tmp));
754 (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
759 /****************************************************************************
760 Fake a auth_serversupplied_info just from a username
761 ****************************************************************************/
763 NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
764 const char *username,
766 struct auth_serversupplied_info **presult)
768 struct auth_serversupplied_info *result;
772 pwd = getpwnam_alloc(talloc_tos(), username);
774 return NT_STATUS_NO_SUCH_USER;
777 status = make_server_info_pw(&result, pwd->pw_name, pwd);
781 if (!NT_STATUS_IS_OK(status)) {
785 result->nss_token = true;
786 result->guest = is_guest;
788 status = create_local_token(result);
790 if (!NT_STATUS_IS_OK(status)) {
800 struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
801 const struct auth_serversupplied_info *src)
803 struct auth_serversupplied_info *dst;
805 dst = make_server_info(mem_ctx);
810 dst->guest = src->guest;
811 dst->utok.uid = src->utok.uid;
812 dst->utok.gid = src->utok.gid;
813 dst->utok.ngroups = src->utok.ngroups;
814 if (src->utok.ngroups != 0) {
815 dst->utok.groups = (gid_t *)TALLOC_MEMDUP(
816 dst, src->utok.groups,
817 sizeof(gid_t)*dst->utok.ngroups);
819 dst->utok.groups = NULL;
823 dst->ptok = dup_nt_token(dst, src->ptok);
830 dst->user_session_key = data_blob_talloc( dst, src->user_session_key.data,
831 src->user_session_key.length);
833 dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
834 src->lm_session_key.length);
836 dst->info3 = copy_netr_SamInfo3(dst, src->info3);
842 dst->pam_handle = NULL;
843 dst->unix_name = talloc_strdup(dst, src->unix_name);
844 if (!dst->unix_name) {
849 dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
850 if (!dst->sanitized_username) {
859 * Set a new session key. Used in the rpc server where we have to override the
860 * SMB level session key with SystemLibraryDTC
863 bool server_info_set_session_key(struct auth_serversupplied_info *info,
864 DATA_BLOB session_key)
866 TALLOC_FREE(info->user_session_key.data);
868 info->user_session_key = data_blob_talloc(
869 info, session_key.data, session_key.length);
871 return (info->user_session_key.data != NULL);
874 static struct auth_serversupplied_info *guest_info = NULL;
876 bool init_guest_info(void)
878 if (guest_info != NULL)
881 return NT_STATUS_IS_OK(make_new_server_info_guest(&guest_info));
884 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
885 struct auth_serversupplied_info **server_info)
887 *server_info = copy_serverinfo(mem_ctx, guest_info);
888 return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
891 bool copy_current_user(struct current_user *dst, struct current_user *src)
894 NT_USER_TOKEN *nt_token;
896 groups = (gid_t *)memdup(src->ut.groups,
897 sizeof(gid_t) * src->ut.ngroups);
898 if ((src->ut.ngroups != 0) && (groups == NULL)) {
902 nt_token = dup_nt_token(NULL, src->nt_user_token);
903 if (nt_token == NULL) {
908 dst->conn = src->conn;
909 dst->vuid = src->vuid;
910 dst->ut.uid = src->ut.uid;
911 dst->ut.gid = src->ut.gid;
912 dst->ut.ngroups = src->ut.ngroups;
913 dst->ut.groups = groups;
914 dst->nt_user_token = nt_token;
918 /***************************************************************************
919 Purely internal function for make_server_info_info3
920 ***************************************************************************/
922 static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
923 const char *username, char **found_username,
924 uid_t *uid, gid_t *gid,
925 bool *username_was_mapped)
927 struct smbd_server_connection *sconn = smbd_server_conn;
929 fstring dom_user, lower_username;
930 fstring real_username;
931 struct passwd *passwd;
933 fstrcpy( lower_username, username );
934 strlower_m( lower_username );
936 fstr_sprintf(dom_user, "%s%c%s", domain, *lp_winbind_separator(),
939 /* Get the passwd struct. Try to create the account if necessary. */
941 *username_was_mapped = map_username(sconn, dom_user);
943 if ( !(passwd = smb_getpwnam( NULL, dom_user, real_username, True )) )
944 return NT_STATUS_NO_SUCH_USER;
946 *uid = passwd->pw_uid;
947 *gid = passwd->pw_gid;
949 /* This is pointless -- there is no suport for differing
950 unix and windows names. Make sure to always store the
951 one we actually looked up and succeeded. Have I mentioned
952 why I hate the 'winbind use default domain' parameter?
955 *found_username = talloc_strdup( mem_ctx, real_username );
962 /****************************************************************************
963 Wrapper to allow the getpwnam() call to strip the domain name and
964 try again in case a local UNIX user is already there. Also run through
965 the username if we fallback to the username only.
966 ****************************************************************************/
968 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,
969 fstring save_username, bool create )
971 struct passwd *pw = NULL;
975 /* we only save a copy of the username it has been mangled
976 by winbindd use default domain */
978 save_username[0] = '\0';
980 /* don't call map_username() here since it has to be done higher
981 up the stack so we don't call it multiple times */
983 fstrcpy( username, domuser );
985 p = strchr_m( username, *lp_winbind_separator() );
987 /* code for a DOMAIN\user string */
990 fstring strip_username;
992 pw = Get_Pwnam_alloc( mem_ctx, domuser );
994 /* make sure we get the case of the username correct */
995 /* work around 'winbind use default domain = yes' */
997 if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
1000 /* split the domain and username into 2 strings */
1004 fstr_sprintf(save_username, "%s%c%s", domain, *lp_winbind_separator(), pw->pw_name);
1007 fstrcpy( save_username, pw->pw_name );
1013 /* setup for lookup of just the username */
1014 /* remember that p and username are overlapping memory */
1017 fstrcpy( strip_username, p );
1018 fstrcpy( username, strip_username );
1021 /* just lookup a plain username */
1023 pw = Get_Pwnam_alloc(mem_ctx, username);
1025 /* Create local user if requested but only if winbindd
1026 is not running. We need to protect against cases
1027 where winbindd is failing and then prematurely
1028 creating users in /etc/passwd */
1030 if ( !pw && create && !winbind_ping() ) {
1031 /* Don't add a machine account. */
1032 if (username[strlen(username)-1] == '$')
1035 _smb_create_user(NULL, username, NULL);
1036 pw = Get_Pwnam_alloc(mem_ctx, username);
1039 /* one last check for a valid passwd struct */
1042 fstrcpy( save_username, pw->pw_name );
1047 /***************************************************************************
1048 Make a server_info struct from the info3 returned by a domain logon
1049 ***************************************************************************/
1051 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
1052 const char *sent_nt_username,
1054 struct auth_serversupplied_info **server_info,
1055 struct netr_SamInfo3 *info3)
1057 static const char zeros[16] = {0, };
1059 NTSTATUS nt_status = NT_STATUS_OK;
1060 char *found_username = NULL;
1061 const char *nt_domain;
1062 const char *nt_username;
1063 struct dom_sid user_sid;
1064 struct dom_sid group_sid;
1065 bool username_was_mapped;
1067 uid_t uid = (uid_t)-1;
1068 gid_t gid = (gid_t)-1;
1070 struct auth_serversupplied_info *result;
1073 Here is where we should check the list of
1074 trusted domains, and verify that the SID
1078 if (!sid_compose(&user_sid, info3->base.domain_sid, info3->base.rid)) {
1079 return NT_STATUS_INVALID_PARAMETER;
1082 if (!sid_compose(&group_sid, info3->base.domain_sid,
1083 info3->base.primary_gid)) {
1084 return NT_STATUS_INVALID_PARAMETER;
1087 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
1089 /* If the server didn't give us one, just use the one we sent
1091 nt_username = sent_nt_username;
1094 nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
1096 /* If the server didn't give us one, just use the one we sent
1101 /* If getpwnam() fails try the add user script (2.2.x behavior).
1103 We use the _unmapped_ username here in an attempt to provide
1104 consistent username mapping behavior between kerberos and NTLM[SSP]
1105 authentication in domain mode security. I.E. Username mapping
1106 should be applied to the fully qualified username
1107 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1108 called map_username() unnecessarily in make_user_info_map() but
1109 that is how the current code is designed. Making the change here
1110 is the least disruptive place. -- jerry */
1112 /* this call will try to create the user if necessary */
1114 nt_status = check_account(mem_ctx, nt_domain, sent_nt_username,
1115 &found_username, &uid, &gid,
1116 &username_was_mapped);
1118 result = make_server_info(NULL);
1119 if (result == NULL) {
1120 DEBUG(4, ("make_server_info failed!\n"));
1121 return NT_STATUS_NO_MEMORY;
1124 result->unix_name = talloc_strdup(result, found_username);
1126 result->sanitized_username = sanitize_username(result,
1128 if (result->sanitized_username == NULL) {
1129 TALLOC_FREE(result);
1130 return NT_STATUS_NO_MEMORY;
1133 /* copy in the info3 */
1134 result->info3 = copy_netr_SamInfo3(result, info3);
1136 /* Fill in the unix info we found on the way */
1138 result->utok.uid = uid;
1139 result->utok.gid = gid;
1141 /* Create a 'combined' list of all SIDs we might want in the SD */
1143 result->num_sids = 0;
1144 result->sids = NULL;
1146 nt_status = sid_array_from_info3(result, info3,
1150 if (!NT_STATUS_IS_OK(nt_status)) {
1151 TALLOC_FREE(result);
1155 /* Ensure the primary group sid is at position 0. */
1156 sort_sid_array_for_smbd(result, &group_sid);
1158 /* ensure we are never given NULL session keys */
1160 if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
1161 result->user_session_key = data_blob_null;
1163 result->user_session_key = data_blob_talloc(
1164 result, info3->base.key.key,
1165 sizeof(info3->base.key.key));
1168 if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
1169 result->lm_session_key = data_blob_null;
1171 result->lm_session_key = data_blob_talloc(
1172 result, info3->base.LMSessKey.key,
1173 sizeof(info3->base.LMSessKey.key));
1176 result->nss_token |= username_was_mapped;
1178 *server_info = result;
1180 return NT_STATUS_OK;
1183 /*****************************************************************************
1184 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1185 ******************************************************************************/
1187 NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
1188 const char *sent_nt_username,
1190 const struct wbcAuthUserInfo *info,
1191 struct auth_serversupplied_info **server_info)
1193 struct netr_SamInfo3 *info3;
1195 info3 = wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx, info);
1197 return NT_STATUS_NO_MEMORY;
1200 return make_server_info_info3(mem_ctx,
1201 sent_nt_username, domain,
1202 server_info, info3);
1206 * Verify whether or not given domain is trusted.
1208 * @param domain_name name of the domain to be verified
1209 * @return true if domain is one of the trusted ones or
1210 * false if otherwise
1213 bool is_trusted_domain(const char* dom_name)
1215 struct dom_sid trustdom_sid;
1218 /* no trusted domains for a standalone server */
1220 if ( lp_server_role() == ROLE_STANDALONE )
1223 if (dom_name == NULL || dom_name[0] == '\0') {
1227 if (strequal(dom_name, get_global_sam_name())) {
1231 /* if we are a DC, then check for a direct trust relationships */
1235 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1236 "[%s]\n", dom_name ));
1237 ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
1245 /* If winbind is around, ask it */
1247 result = wb_is_trusted_domain(dom_name);
1249 if (result == WBC_ERR_SUCCESS) {
1253 if (result == WBC_ERR_DOMAIN_NOT_FOUND) {
1254 /* winbind could not find the domain */
1258 /* The only other possible result is that winbind is not up
1259 and running. We need to update the trustdom_cache
1262 update_trustdom_cache();
1265 /* now the trustdom cache should be available a DC could still
1266 * have a transitive trust so fall back to the cache of trusted
1267 * domains (like a domain member would use */
1269 if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) {