source3/nsswitch/winbindd_cred_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - krb5 credential cache functions
   5    and in-memory cache functions.
   6
   7    Copyright (C) Guenther Deschner 2005-2006
   8    Copyright (C) Jeremy Allison 2006
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_WINBIND
  29
  30 /* uncomment this to to fast debugging on the krb5 ticket renewal event */
  31 #ifdef DEBUG_KRB5_TKT_RENEWAL
  32 #undef DEBUG_KRB5_TKT_RENEWAL
  33 #endif
  34
  35 #define MAX_CCACHES 100
  36
  37 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
  38
  39 /* The Krb5 ticket refresh handler should be scheduled
  40    at one-half of the period from now till the tkt
  41    expiration */
  42 #define KRB5_EVENT_REFRESH_TIME(x) ((x) - (((x) - time(NULL))/2))
  43
  44 /****************************************************************
  45  Find an entry by name.
  46 ****************************************************************/
  47
  48 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
  49 {
  50         struct WINBINDD_CCACHE_ENTRY *entry;
  51
  52         for (entry = ccache_list; entry; entry = entry->next) {
  53                 if (strequal(entry->username, username)) {
  54                         return entry;
  55                 }
  56         }
  57         return NULL;
  58 }
  59
  60 /****************************************************************
  61  How many do we have ?
  62 ****************************************************************/
  63
  64 static int ccache_entry_count(void)
  65 {
  66         struct WINBINDD_CCACHE_ENTRY *entry;
  67         int i = 0;
  68
  69         for (entry = ccache_list; entry; entry = entry->next) {
  70                 i++;
  71         }
  72         return i;
  73 }
  74
  75 /****************************************************************
  76  Do the work of refreshing the ticket.
  77 ****************************************************************/
  78
  79 static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
  80                                         struct timed_event *te,
  81                                         const struct timeval *now,
  82                                         void *private_data)
  83 {
  84         struct WINBINDD_CCACHE_ENTRY *entry =
  85                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
  86 #ifdef HAVE_KRB5
  87         int ret;
  88         time_t new_start;
  89         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
  90 #endif
  91
  92         DEBUG(10,("krb5_ticket_refresh_handler called\n"));
  93         DEBUGADD(10,("event called for: %s, %s\n", entry->ccname, entry->username));
  94
  95         TALLOC_FREE(entry->event);
  96
  97 #ifdef HAVE_KRB5
  98
  99         /* Kinit again if we have the user password and we can't renew the old
 100          * tgt anymore */
 101
 102         if ((entry->renew_until < time(NULL)) && cred_ptr && cred_ptr->pass) {
 103
 104                 set_effective_uid(entry->uid);
 105
 106                 ret = kerberos_kinit_password_ext(entry->principal_name,
 107                                                   cred_ptr->pass,
 108                                                   0, /* hm, can we do time correction here ? */
 109                                                   &entry->refresh_time,
 110                                                   &entry->renew_until,
 111                                                   entry->ccname,
 112                                                   False, /* no PAC required anymore */
 113                                                   True,
 114                                                   WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 115                                                   NULL);
 116                 gain_root_privilege();
 117
 118                 if (ret) {
 119                         DEBUG(3,("krb5_ticket_refresh_handler: could not re-kinit: %s\n",
 120                                 error_message(ret)));
 121                         TALLOC_FREE(entry->event);
 122                         return;
 123                 }
 124
 125                 DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
 126                         "for: %s in ccache: %s\n",
 127                         entry->principal_name, entry->ccname));
 128
 129 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 130                 new_start = time(NULL) + 30;
 131 #else
 132                 /* The tkt should be refreshed at one-half the period
 133                    from now to the expiration time */
 134                 new_start = KRB5_EVENT_REFRESH_TIME(entry->refresh_time);
 135 #endif
 136
 137                 goto done;
 138         }
 139
 140         set_effective_uid(entry->uid);
 141
 142         ret = smb_krb5_renew_ticket(entry->ccname,
 143                                     entry->principal_name,
 144                                     entry->service,
 145                                     &new_start);
 146 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 147         new_start = time(NULL) + 30;
 148 #else
 149         new_start = KRB5_EVENT_REFRESH_TIME(new_start);
 150 #endif
 151
 152         gain_root_privilege();
 153
 154         if (ret) {
 155                 DEBUG(3,("krb5_ticket_refresh_handler: could not renew tickets: %s\n",
 156                         error_message(ret)));
 157                 /* maybe we are beyond the renewing window */
 158
 159                 /* avoid breaking the renewal chain: retry in lp_winbind_cache_time()
 160                  * seconds when the KDC was not available right now. */
 161
 162                 if (ret == KRB5_KDC_UNREACH) {
 163                         new_start = time(NULL) + MAX(30, lp_winbind_cache_time());
 164                         goto done;
 165                 }
 166
 167                 return;
 168         }
 169
 170 done:
 171
 172         entry->event = event_add_timed(winbind_event_context(), entry,
 173                                        timeval_set(new_start, 0),
 174                                        "krb5_ticket_refresh_handler",
 175                                        krb5_ticket_refresh_handler,
 176                                        entry);
 177
 178 #endif
 179 }
 180
 181 /****************************************************************
 182  Do the work of regaining a ticket when coming from offline auth.
 183 ****************************************************************/
 184
 185 static void krb5_ticket_gain_handler(struct event_context *event_ctx,
 186                                      struct timed_event *te,
 187                                         const struct timeval *now,
 188                                         void *private_data)
 189 {
 190         struct WINBINDD_CCACHE_ENTRY *entry =
 191                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
 192 #ifdef HAVE_KRB5
 193         int ret;
 194         struct timeval t;
 195         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 196         struct winbindd_domain *domain = NULL;
 197 #endif
 198
 199         DEBUG(10,("krb5_ticket_gain_handler called\n"));
 200         DEBUGADD(10,("event called for: %s, %s\n", entry->ccname, entry->username));
 201
 202         TALLOC_FREE(entry->event);
 203
 204 #ifdef HAVE_KRB5
 205
 206         if (!cred_ptr || !cred_ptr->pass) {
 207                 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
 208                 return;
 209         }
 210
 211         if ((domain = find_domain_from_name(entry->realm)) == NULL) {
 212                 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
 213                 return;
 214         }
 215
 216         if (domain->online) {
 217
 218                 set_effective_uid(entry->uid);
 219
 220                 ret = kerberos_kinit_password_ext(entry->principal_name,
 221                                                 cred_ptr->pass,
 222                                                 0, /* hm, can we do time correction here ? */
 223                                                 &entry->refresh_time,
 224                                                 &entry->renew_until,
 225                                                 entry->ccname,
 226                                                 False, /* no PAC required anymore */
 227                                                 True,
 228                                                 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 229                                                 NULL);
 230                 gain_root_privilege();
 231
 232                 if (ret) {
 233                         DEBUG(3,("krb5_ticket_gain_handler: could not kinit: %s\n",
 234                                 error_message(ret)));
 235                         goto retry_later;
 236                 }
 237
 238                 DEBUG(10,("krb5_ticket_gain_handler: successful kinit for: %s in ccache: %s\n",
 239                         entry->principal_name, entry->ccname));
 240
 241                 goto got_ticket;
 242         }
 243
 244   retry_later:
 245
 246         entry->event = event_add_timed(winbind_event_context(), entry,
 247                                         timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0),
 248                                         "krb5_ticket_gain_handler",
 249                                         krb5_ticket_gain_handler,
 250                                         entry);
 251
 252         return;
 253
 254   got_ticket:
 255
 256 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 257         t = timeval_set(time(NULL) + 30, 0);
 258 #else
 259         t = timeval_set(KRB5_EVENT_REFRESH_TIME(entry->refresh_time), 0);
 260 #endif
 261
 262         entry->event = event_add_timed(winbind_event_context(), entry,
 263                                         t,
 264                                         "krb5_ticket_refresh_handler",
 265                                         krb5_ticket_refresh_handler,
 266                                         entry);
 267
 268         return;
 269 #endif
 270 }
 271
 272 /****************************************************************
 273  Check if an ccache entry exists.
 274 ****************************************************************/
 275
 276 BOOL ccache_entry_exists(const char *username)
 277 {
 278         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 279         return (entry != NULL);
 280 }
 281
 282 /****************************************************************
 283  Ensure we're changing the correct entry.
 284 ****************************************************************/
 285
 286 BOOL ccache_entry_identical(const char *username, uid_t uid, const char *ccname)
 287 {
 288         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 289
 290         if (!entry) {
 291                 return False;
 292         }
 293
 294         if (entry->uid != uid) {
 295                 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
 296                         (unsigned int)entry->uid, (unsigned int)uid ));
 297                 return False;
 298         }
 299         if (!strcsequal(entry->ccname, ccname)) {
 300                 DEBUG(0,("cache_entry_identical: ccnames differ: (cache) %s != (client) %s\n",
 301                         entry->ccname, ccname));
 302                 return False;
 303         }
 304         return True;
 305 }
 306
 307 NTSTATUS add_ccache_to_list(const char *princ_name,
 308                             const char *ccname,
 309                             const char *service,
 310                             const char *username,
 311                             const char *realm,
 312                             uid_t uid,
 313                             time_t create_time,
 314                             time_t ticket_end,
 315                             time_t renew_until,
 316                             BOOL postponed_request)
 317 {
 318         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
 319
 320         if ((username == NULL && princ_name == NULL) || ccname == NULL || uid < 0) {
 321                 return NT_STATUS_INVALID_PARAMETER;
 322         }
 323
 324         if (ccache_entry_count() + 1 > MAX_CCACHES) {
 325                 DEBUG(10,("add_ccache_to_list: max number of ccaches reached\n"));
 326                 return NT_STATUS_NO_MORE_ENTRIES;
 327         }
 328
 329         /* Reference count old entries */
 330         entry = get_ccache_by_username(username);
 331         if (entry) {
 332                 /* Check cached entries are identical. */
 333                 if (!ccache_entry_identical(username, uid, ccname)) {
 334                         return NT_STATUS_INVALID_PARAMETER;
 335                 }
 336                 entry->ref_count++;
 337                 DEBUG(10,("add_ccache_to_list: ref count on entry %s is now %d\n",
 338                         username, entry->ref_count));
 339                 /* FIXME: in this case we still might want to have a krb5 cred
 340                  * event handler created - gd*/
 341                 return NT_STATUS_OK;
 342         }
 343
 344         entry = TALLOC_P(NULL, struct WINBINDD_CCACHE_ENTRY);
 345         if (!entry) {
 346                 return NT_STATUS_NO_MEMORY;
 347         }
 348
 349         ZERO_STRUCTP(entry);
 350
 351         if (username) {
 352                 entry->username = talloc_strdup(entry, username);
 353                 if (!entry->username) {
 354                         goto no_mem;
 355                 }
 356         }
 357         if (princ_name) {
 358                 entry->principal_name = talloc_strdup(entry, princ_name);
 359                 if (!entry->principal_name) {
 360                         goto no_mem;
 361                 }
 362         }
 363         if (service) {
 364                 entry->service = talloc_strdup(entry, service);
 365                 if (!entry->service) {
 366                         goto no_mem;
 367                 }
 368         }
 369
 370         entry->ccname = talloc_strdup(entry, ccname);
 371         if (!entry->ccname) {
 372                 goto no_mem;
 373         }
 374
 375         entry->realm = talloc_strdup(entry, realm);
 376         if (!entry->realm) {
 377                 goto no_mem;
 378         }
 379
 380         entry->create_time = create_time;
 381         entry->renew_until = renew_until;
 382         entry->uid = uid;
 383         entry->ref_count = 1;
 384
 385         if (lp_winbind_refresh_tickets() && renew_until > 0) {
 386                 if (postponed_request) {
 387                         entry->event = event_add_timed(winbind_event_context(), entry,
 388                                                 timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0),
 389                                                 "krb5_ticket_gain_handler",
 390                                                 krb5_ticket_gain_handler,
 391                                                 entry);
 392                 } else {
 393                         /* Renew at 1/2 the ticket expiration time */
 394                         entry->event = event_add_timed(winbind_event_context(), entry,
 395 #if defined(DEBUG_KRB5_TKT_RENEWAL)
 396                                                 timeval_set(time(NULL)+30, 0),
 397 #else
 398                                                 timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0),
 399 #endif
 400                                                 "krb5_ticket_refresh_handler",
 401                                                 krb5_ticket_refresh_handler,
 402                                                 entry);
 403                 }
 404
 405                 if (!entry->event) {
 406                         goto no_mem;
 407                 }
 408
 409                 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
 410         }
 411
 412         DLIST_ADD(ccache_list, entry);
 413
 414         DEBUG(10,("add_ccache_to_list: added ccache [%s] for user [%s] to the list\n", ccname, username));
 415
 416         return NT_STATUS_OK;
 417
 418  no_mem:
 419
 420         TALLOC_FREE(entry);
 421         return NT_STATUS_NO_MEMORY;
 422 }
 423
 424 /*******************************************************************
 425  Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer referenced.
 426 *******************************************************************/
 427
 428 NTSTATUS remove_ccache(const char *username)
 429 {
 430         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 431         NTSTATUS status;
 432 #ifdef HAVE_KRB5
 433         krb5_error_code ret;
 434 #endif
 435
 436         if (!entry) {
 437                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 438         }
 439
 440         if (entry->ref_count <= 0) {
 441                 DEBUG(0,("remove_ccache: logic error. ref count for user %s = %d\n",
 442                         username, entry->ref_count));
 443                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 444         }
 445
 446         entry->ref_count--;
 447
 448         if (entry->ref_count > 0) {
 449                 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
 450                         username, entry->ref_count ));
 451                 return NT_STATUS_OK;
 452         }
 453
 454         /* no references any more */
 455
 456         DLIST_REMOVE(ccache_list, entry);
 457         TALLOC_FREE(entry->event); /* unregisters events */
 458
 459 #ifdef HAVE_KRB5
 460         ret = ads_kdestroy(entry->ccname);
 461
 462         /* we ignore the error when there has been no credential cache */
 463         if (ret == KRB5_FCC_NOFILE) {
 464                 ret = 0;
 465         } else if (ret) {
 466                 DEBUG(0,("remove_ccache: failed to destroy user krb5 ccache %s with: %s\n",
 467                         entry->ccname, error_message(ret)));
 468         } else {
 469                 DEBUG(10,("remove_ccache: successfully destroyed krb5 ccache %s for user %s\n",
 470                         entry->ccname, username));
 471         }
 472         status = krb5_to_nt_status(ret);
 473 #endif
 474
 475         TALLOC_FREE(entry);
 476         DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
 477
 478         return status;
 479 }
 480
 481 /*******************************************************************
 482  In memory credentials cache code.
 483 *******************************************************************/
 484
 485 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
 486
 487 /***********************************************************
 488  Find an entry on the list by name.
 489 ***********************************************************/
 490
 491 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
 492 {
 493         struct WINBINDD_MEMORY_CREDS *p;
 494
 495         for (p = memory_creds_list; p; p = p->next) {
 496                 if (strequal(p->username, username)) {
 497                         return p;
 498                 }
 499         }
 500         return NULL;
 501 }
 502
 503 /***********************************************************
 504  Store the required creds and mlock them.
 505 ***********************************************************/
 506
 507 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp, const char *pass)
 508 {
 509 #if !defined(HAVE_MLOCK)
 510         return NT_STATUS_OK;
 511 #else
 512         /* new_entry->nt_hash is the base pointer for the block
 513            of memory pointed into by new_entry->lm_hash and
 514            new_entry->pass (if we're storing plaintext). */
 515
 516         memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
 517         if (pass) {
 518                 memcredp->len += strlen(pass)+1;
 519         }
 520
 521
 522 #if defined(LINUX)
 523         /* aligning the memory on on x86_64 and compiling
 524            with gcc 4.1 using -O2 causes a segv in the
 525            next memset()  --jerry */
 526         memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
 527 #else
 528         /* On non-linux platforms, mlock()'d memory must be aligned */
 529         memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
 530                                                getpagesize(), memcredp->len);
 531 #endif
 532         if (!memcredp->nt_hash) {
 533                 return NT_STATUS_NO_MEMORY;
 534         }
 535         memset( memcredp->nt_hash, 0x0, memcredp->len );
 536
 537         memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
 538
 539 #ifdef DEBUG_PASSWORD
 540         DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
 541 #endif
 542         if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
 543                 DEBUG(0,("failed to mlock memory: %s (%d)\n",
 544                         strerror(errno), errno));
 545                 SAFE_FREE(memcredp->nt_hash);
 546                 return map_nt_error_from_unix(errno);
 547         }
 548
 549 #ifdef DEBUG_PASSWORD
 550         DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
 551 #endif
 552
 553         /* Create and store the password hashes. */
 554         E_md4hash(pass, memcredp->nt_hash);
 555         E_deshash(pass, memcredp->lm_hash);
 556
 557         if (pass) {
 558                 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
 559                 memcpy(memcredp->pass, pass, memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
 560         }
 561
 562         return NT_STATUS_OK;
 563 #endif
 564 }
 565
 566 /***********************************************************
 567  Destroy existing creds.
 568 ***********************************************************/
 569
 570 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
 571 {
 572 #if !defined(HAVE_MUNLOCK)
 573         return NT_STATUS_OK;
 574 #else
 575         if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
 576                 DEBUG(0,("failed to munlock memory: %s (%d)\n",
 577                         strerror(errno), errno));
 578                 return map_nt_error_from_unix(errno);
 579         }
 580         memset(memcredp->nt_hash, '\0', memcredp->len);
 581         SAFE_FREE(memcredp->nt_hash);
 582         memcredp->nt_hash = NULL;
 583         memcredp->lm_hash = NULL;
 584         memcredp->pass = NULL;
 585         memcredp->len = 0;
 586         return NT_STATUS_OK;
 587 #endif
 588 }
 589
 590 /***********************************************************
 591  Replace the required creds with new ones (password change).
 592 ***********************************************************/
 593
 594 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
 595                                                 const char *pass)
 596 {
 597         NTSTATUS status = delete_memory_creds(memcredp);
 598         if (!NT_STATUS_IS_OK(status)) {
 599                 return status;
 600         }
 601         return store_memory_creds(memcredp, pass);
 602 }
 603
 604 /*************************************************************
 605  Store credentials in memory in a list.
 606 *************************************************************/
 607
 608 static NTSTATUS winbindd_add_memory_creds_internal(const char *username, uid_t uid, const char *pass)
 609 {
 610         /* Shortcut to ensure we don't store if no mlock. */
 611 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
 612         return NT_STATUS_OK;
 613 #else
 614         NTSTATUS status;
 615         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 616
 617         if (uid == (uid_t)-1) {
 618                 DEBUG(0,("winbindd_add_memory_creds_internal: invalid uid for user %s.\n",
 619                         username ));
 620                 return NT_STATUS_INVALID_PARAMETER;
 621         }
 622
 623         if (memcredp) {
 624                 /* Already exists. Increment the reference count and replace stored creds. */
 625                 if (uid != memcredp->uid) {
 626                         DEBUG(0,("winbindd_add_memory_creds_internal: uid %u for user %s doesn't "
 627                                 "match stored uid %u. Replacing.\n",
 628                                 (unsigned int)uid, username, (unsigned int)memcredp->uid ));
 629                         memcredp->uid = uid;
 630                 }
 631                 memcredp->ref_count++;
 632                 DEBUG(10,("winbindd_add_memory_creds_internal: ref count for user %s is now %d\n",
 633                         username, memcredp->ref_count ));
 634                 return winbindd_replace_memory_creds_internal(memcredp, pass);
 635         }
 636
 637         memcredp = TALLOC_ZERO_P(NULL, struct WINBINDD_MEMORY_CREDS);
 638         if (!memcredp) {
 639                 return NT_STATUS_NO_MEMORY;
 640         }
 641         memcredp->username = talloc_strdup(memcredp, username);
 642         if (!memcredp->username) {
 643                 talloc_destroy(memcredp);
 644                 return NT_STATUS_NO_MEMORY;
 645         }
 646
 647         status = store_memory_creds(memcredp, pass);
 648         if (!NT_STATUS_IS_OK(status)) {
 649                 talloc_destroy(memcredp);
 650                 return status;
 651         }
 652
 653         memcredp->uid = uid;
 654         memcredp->ref_count = 1;
 655         DLIST_ADD(memory_creds_list, memcredp);
 656
 657         DEBUG(10,("winbindd_add_memory_creds_internal: added entry for user %s\n",
 658                 username ));
 659
 660         return NT_STATUS_OK;
 661 #endif
 662 }
 663
 664 /*************************************************************
 665  Store users credentials in memory. If we also have a
 666  struct WINBINDD_CCACHE_ENTRY for this username with a
 667  refresh timer, then store the plaintext of the password
 668  and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
 669 *************************************************************/
 670
 671 NTSTATUS winbindd_add_memory_creds(const char *username, uid_t uid, const char *pass)
 672 {
 673         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 674         NTSTATUS status;
 675
 676         status = winbindd_add_memory_creds_internal(username, uid, pass);
 677         if (!NT_STATUS_IS_OK(status)) {
 678                 return status;
 679         }
 680
 681         if (entry) {
 682                 struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 683                 if (memcredp) {
 684                         entry->cred_ptr = memcredp;
 685                 }
 686         }
 687
 688         return status;
 689 }
 690
 691 /*************************************************************
 692  Decrement the in-memory ref count - delete if zero.
 693 *************************************************************/
 694
 695 NTSTATUS winbindd_delete_memory_creds(const char *username)
 696 {
 697         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 698         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 699         NTSTATUS status = NT_STATUS_OK;
 700
 701         if (!memcredp) {
 702                 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
 703                         username ));
 704                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 705         }
 706
 707         if (memcredp->ref_count <= 0) {
 708                 DEBUG(0,("winbindd_delete_memory_creds: logic error. ref count for user %s = %d\n",
 709                         username, memcredp->ref_count));
 710                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 711         }
 712
 713         memcredp->ref_count--;
 714         if (memcredp->ref_count <= 0) {
 715                 delete_memory_creds(memcredp);
 716                 DLIST_REMOVE(memory_creds_list, memcredp);
 717                 talloc_destroy(memcredp);
 718                 DEBUG(10,("winbindd_delete_memory_creds: deleted entry for user %s\n",
 719                         username));
 720         } else {
 721                 DEBUG(10,("winbindd_delete_memory_creds: entry for user %s ref_count now %d\n",
 722                         username, memcredp->ref_count));
 723         }
 724
 725         if (entry) {
 726                 entry->cred_ptr = NULL; /* Ensure we have no dangling references to this. */
 727         }
 728         return status;
 729 }
 730
 731 /***********************************************************
 732  Replace the required creds with new ones (password change).
 733 ***********************************************************/
 734
 735 NTSTATUS winbindd_replace_memory_creds(const char *username, const char *pass)
 736 {
 737         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 738
 739         if (!memcredp) {
 740                 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
 741                         username ));
 742                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 743         }
 744
 745         DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
 746                 username ));
 747
 748         return winbindd_replace_memory_creds_internal(memcredp, pass);
 749 }