source3/auth/auth_util.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6    Copyright (C) Jeremy Allison 2000-2001
   7    Copyright (C) Rafal Szczesniak 2002
   8    Copyright (C) Volker Lendecke 2006
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "smbd/globals.h"
  26 #include "../libcli/auth/libcli_auth.h"
  27 #include "../lib/crypto/arcfour.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_AUTH
  31
  32 /****************************************************************************
  33  Ensure primary group SID is always at position 0 in a
  34  auth_serversupplied_info struct.
  35 ****************************************************************************/
  36
  37 static void sort_sid_array_for_smbd(struct auth_serversupplied_info *result,
  38                                 const struct dom_sid *pgroup_sid)
  39 {
  40         unsigned int i;
  41
  42         if (!result->sids) {
  43                 return;
  44         }
  45
  46         if (sid_compare(&result->sids[0], pgroup_sid)==0) {
  47                 return;
  48         }
  49
  50         for (i = 1; i < result->num_sids; i++) {
  51                 if (sid_compare(pgroup_sid,
  52                                 &result->sids[i]) == 0) {
  53                         sid_copy(&result->sids[i], &result->sids[0]);
  54                         sid_copy(&result->sids[0], pgroup_sid);
  55                         return;
  56                 }
  57         }
  58 }
  59
  60 /****************************************************************************
  61  Create a UNIX user on demand.
  62 ****************************************************************************/
  63
  64 static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
  65 {
  66         TALLOC_CTX *ctx = talloc_tos();
  67         char *add_script;
  68         int ret;
  69
  70         add_script = talloc_strdup(ctx, lp_adduser_script());
  71         if (!add_script || !*add_script) {
  72                 return -1;
  73         }
  74         add_script = talloc_all_string_sub(ctx,
  75                                 add_script,
  76                                 "%u",
  77                                 unix_username);
  78         if (!add_script) {
  79                 return -1;
  80         }
  81         if (domain) {
  82                 add_script = talloc_all_string_sub(ctx,
  83                                         add_script,
  84                                         "%D",
  85                                         domain);
  86                 if (!add_script) {
  87                         return -1;
  88                 }
  89         }
  90         if (homedir) {
  91                 add_script = talloc_all_string_sub(ctx,
  92                                 add_script,
  93                                 "%H",
  94                                 homedir);
  95                 if (!add_script) {
  96                         return -1;
  97                 }
  98         }
  99         ret = smbrun(add_script,NULL);
 100         flush_pwnam_cache();
 101         DEBUG(ret ? 0 : 3,
 102                 ("smb_create_user: Running the command `%s' gave %d\n",
 103                  add_script,ret));
 104         return ret;
 105 }
 106
 107 /****************************************************************************
 108  Create an auth_usersupplied_data structure after appropriate mapping.
 109 ****************************************************************************/
 110
 111 NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info,
 112                             const char *smb_name,
 113                             const char *client_domain,
 114                             const char *wksta_name,
 115                             DATA_BLOB *lm_pwd,
 116                             DATA_BLOB *nt_pwd,
 117                             DATA_BLOB *lm_interactive_pwd,
 118                             DATA_BLOB *nt_interactive_pwd,
 119                             DATA_BLOB *plaintext,
 120                             bool encrypted)
 121 {
 122         struct smbd_server_connection *sconn = smbd_server_conn;
 123         const char *domain;
 124         NTSTATUS result;
 125         bool was_mapped;
 126         fstring internal_username;
 127         fstrcpy(internal_username, smb_name);
 128         was_mapped = map_username(sconn, internal_username);
 129
 130         DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
 131                  client_domain, smb_name, wksta_name));
 132
 133         domain = client_domain;
 134
 135         /* If you connect to a Windows domain member using a bogus domain name,
 136          * the Windows box will map the BOGUS\user to SAMNAME\user.  Thus, if
 137          * the Windows box is a DC the name will become DOMAIN\user and be
 138          * authenticated against AD, if the Windows box is a member server but
 139          * not a DC the name will become WORKSTATION\user.  A standalone
 140          * non-domain member box will also map to WORKSTATION\user.
 141          * This also deals with the client passing in a "" domain */
 142
 143         if (!is_trusted_domain(domain) &&
 144             !strequal(domain, my_sam_name()))
 145         {
 146                 if (lp_map_untrusted_to_domain())
 147                         domain = my_sam_name();
 148                 else
 149                         domain = get_global_sam_name();
 150                 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
 151                           "workstation [%s]\n",
 152                           client_domain, domain, smb_name, wksta_name));
 153         }
 154
 155         /* We know that the given domain is trusted (and we are allowing them),
 156          * it is our global SAM name, or for legacy behavior it is our
 157          * primary domain name */
 158
 159         result = make_user_info(user_info, smb_name, internal_username,
 160                               client_domain, domain, wksta_name,
 161                               lm_pwd, nt_pwd,
 162                               lm_interactive_pwd, nt_interactive_pwd,
 163                               plaintext, encrypted);
 164         if (NT_STATUS_IS_OK(result)) {
 165                 (*user_info)->was_mapped = was_mapped;
 166         }
 167         return result;
 168 }
 169
 170 /****************************************************************************
 171  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 172  Decrypt and encrypt the passwords.
 173 ****************************************************************************/
 174
 175 bool make_user_info_netlogon_network(struct auth_usersupplied_info **user_info,
 176                                      const char *smb_name,
 177                                      const char *client_domain,
 178                                      const char *wksta_name,
 179                                      uint32 logon_parameters,
 180                                      const uchar *lm_network_pwd,
 181                                      int lm_pwd_len,
 182                                      const uchar *nt_network_pwd,
 183                                      int nt_pwd_len)
 184 {
 185         bool ret;
 186         NTSTATUS status;
 187         DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
 188         DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
 189
 190         status = make_user_info_map(user_info,
 191                                     smb_name, client_domain,
 192                                     wksta_name,
 193                                     lm_pwd_len ? &lm_blob : NULL,
 194                                     nt_pwd_len ? &nt_blob : NULL,
 195                                     NULL, NULL, NULL,
 196                                     True);
 197
 198         if (NT_STATUS_IS_OK(status)) {
 199                 (*user_info)->logon_parameters = logon_parameters;
 200         }
 201         ret = NT_STATUS_IS_OK(status) ? True : False;
 202
 203         data_blob_free(&lm_blob);
 204         data_blob_free(&nt_blob);
 205         return ret;
 206 }
 207
 208 /****************************************************************************
 209  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 210  Decrypt and encrypt the passwords.
 211 ****************************************************************************/
 212
 213 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info,
 214                                          const char *smb_name,
 215                                          const char *client_domain,
 216                                          const char *wksta_name,
 217                                          uint32 logon_parameters,
 218                                          const uchar chal[8],
 219                                          const uchar lm_interactive_pwd[16],
 220                                          const uchar nt_interactive_pwd[16],
 221                                          const uchar *dc_sess_key)
 222 {
 223         unsigned char lm_pwd[16];
 224         unsigned char nt_pwd[16];
 225         unsigned char local_lm_response[24];
 226         unsigned char local_nt_response[24];
 227         unsigned char key[16];
 228
 229         memcpy(key, dc_sess_key, 16);
 230
 231         if (lm_interactive_pwd)
 232                 memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
 233
 234         if (nt_interactive_pwd)
 235                 memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
 236
 237 #ifdef DEBUG_PASSWORD
 238         DEBUG(100,("key:"));
 239         dump_data(100, key, sizeof(key));
 240
 241         DEBUG(100,("lm owf password:"));
 242         dump_data(100, lm_pwd, sizeof(lm_pwd));
 243
 244         DEBUG(100,("nt owf password:"));
 245         dump_data(100, nt_pwd, sizeof(nt_pwd));
 246 #endif
 247
 248         if (lm_interactive_pwd)
 249                 arcfour_crypt(lm_pwd, key, sizeof(lm_pwd));
 250
 251         if (nt_interactive_pwd)
 252                 arcfour_crypt(nt_pwd, key, sizeof(nt_pwd));
 253
 254 #ifdef DEBUG_PASSWORD
 255         DEBUG(100,("decrypt of lm owf password:"));
 256         dump_data(100, lm_pwd, sizeof(lm_pwd));
 257
 258         DEBUG(100,("decrypt of nt owf password:"));
 259         dump_data(100, nt_pwd, sizeof(nt_pwd));
 260 #endif
 261
 262         if (lm_interactive_pwd)
 263                 SMBOWFencrypt(lm_pwd, chal,
 264                               local_lm_response);
 265
 266         if (nt_interactive_pwd)
 267                 SMBOWFencrypt(nt_pwd, chal,
 268                               local_nt_response);
 269
 270         /* Password info paranoia */
 271         ZERO_STRUCT(key);
 272
 273         {
 274                 bool ret;
 275                 NTSTATUS nt_status;
 276                 DATA_BLOB local_lm_blob;
 277                 DATA_BLOB local_nt_blob;
 278
 279                 DATA_BLOB lm_interactive_blob;
 280                 DATA_BLOB nt_interactive_blob;
 281
 282                 if (lm_interactive_pwd) {
 283                         local_lm_blob = data_blob(local_lm_response,
 284                                                   sizeof(local_lm_response));
 285                         lm_interactive_blob = data_blob(lm_pwd,
 286                                                         sizeof(lm_pwd));
 287                         ZERO_STRUCT(lm_pwd);
 288                 }
 289
 290                 if (nt_interactive_pwd) {
 291                         local_nt_blob = data_blob(local_nt_response,
 292                                                   sizeof(local_nt_response));
 293                         nt_interactive_blob = data_blob(nt_pwd,
 294                                                         sizeof(nt_pwd));
 295                         ZERO_STRUCT(nt_pwd);
 296                 }
 297
 298                 nt_status = make_user_info_map(
 299                         user_info,
 300                         smb_name, client_domain, wksta_name,
 301                         lm_interactive_pwd ? &local_lm_blob : NULL,
 302                         nt_interactive_pwd ? &local_nt_blob : NULL,
 303                         lm_interactive_pwd ? &lm_interactive_blob : NULL,
 304                         nt_interactive_pwd ? &nt_interactive_blob : NULL,
 305                         NULL, True);
 306
 307                 if (NT_STATUS_IS_OK(nt_status)) {
 308                         (*user_info)->logon_parameters = logon_parameters;
 309                 }
 310
 311                 ret = NT_STATUS_IS_OK(nt_status) ? True : False;
 312                 data_blob_free(&local_lm_blob);
 313                 data_blob_free(&local_nt_blob);
 314                 data_blob_free(&lm_interactive_blob);
 315                 data_blob_free(&nt_interactive_blob);
 316                 return ret;
 317         }
 318 }
 319
 320
 321 /****************************************************************************
 322  Create an auth_usersupplied_data structure
 323 ****************************************************************************/
 324
 325 bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
 326                               const char *smb_name,
 327                               const char *client_domain,
 328                               const uint8 chal[8],
 329                               DATA_BLOB plaintext_password)
 330 {
 331
 332         DATA_BLOB local_lm_blob;
 333         DATA_BLOB local_nt_blob;
 334         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 335
 336         /*
 337          * Not encrypted - do so.
 338          */
 339
 340         DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
 341                  "format.\n"));
 342
 343         if (plaintext_password.data && plaintext_password.length) {
 344                 unsigned char local_lm_response[24];
 345
 346 #ifdef DEBUG_PASSWORD
 347                 DEBUG(10,("Unencrypted password (len %d):\n",
 348                           (int)plaintext_password.length));
 349                 dump_data(100, plaintext_password.data,
 350                           plaintext_password.length);
 351 #endif
 352
 353                 SMBencrypt( (const char *)plaintext_password.data,
 354                             (const uchar*)chal, local_lm_response);
 355                 local_lm_blob = data_blob(local_lm_response, 24);
 356
 357                 /* We can't do an NT hash here, as the password needs to be
 358                    case insensitive */
 359                 local_nt_blob = data_blob_null;
 360         } else {
 361                 local_lm_blob = data_blob_null;
 362                 local_nt_blob = data_blob_null;
 363         }
 364
 365         ret = make_user_info_map(
 366                 user_info, smb_name, client_domain,
 367                 get_remote_machine_name(),
 368                 local_lm_blob.data ? &local_lm_blob : NULL,
 369                 local_nt_blob.data ? &local_nt_blob : NULL,
 370                 NULL, NULL,
 371                 plaintext_password.data && plaintext_password.length ? &plaintext_password : NULL,
 372                 False);
 373
 374         data_blob_free(&local_lm_blob);
 375         return NT_STATUS_IS_OK(ret) ? True : False;
 376 }
 377
 378 /****************************************************************************
 379  Create an auth_usersupplied_data structure
 380 ****************************************************************************/
 381
 382 NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info,
 383                                       const char *smb_name,
 384                                       const char *client_domain,
 385                                       DATA_BLOB lm_resp, DATA_BLOB nt_resp)
 386 {
 387         return make_user_info_map(user_info, smb_name,
 388                                   client_domain,
 389                                   get_remote_machine_name(),
 390                                   lm_resp.data ? &lm_resp : NULL,
 391                                   nt_resp.data ? &nt_resp : NULL,
 392                                   NULL, NULL, NULL,
 393                                   True);
 394 }
 395
 396 /****************************************************************************
 397  Create a guest user_info blob, for anonymous authenticaion.
 398 ****************************************************************************/
 399
 400 bool make_user_info_guest(struct auth_usersupplied_info **user_info)
 401 {
 402         NTSTATUS nt_status;
 403
 404         nt_status = make_user_info(user_info,
 405                                    "","",
 406                                    "","",
 407                                    "",
 408                                    NULL, NULL,
 409                                    NULL, NULL,
 410                                    NULL,
 411                                    True);
 412
 413         return NT_STATUS_IS_OK(nt_status) ? True : False;
 414 }
 415
 416 static NTSTATUS log_nt_token(NT_USER_TOKEN *token)
 417 {
 418         TALLOC_CTX *frame = talloc_stackframe();
 419         char *command;
 420         char *group_sidstr;
 421         size_t i;
 422
 423         if ((lp_log_nt_token_command() == NULL) ||
 424             (strlen(lp_log_nt_token_command()) == 0)) {
 425                 TALLOC_FREE(frame);
 426                 return NT_STATUS_OK;
 427         }
 428
 429         group_sidstr = talloc_strdup(frame, "");
 430         for (i=1; i<token->num_sids; i++) {
 431                 group_sidstr = talloc_asprintf(
 432                         frame, "%s %s", group_sidstr,
 433                         sid_string_talloc(frame, &token->user_sids[i]));
 434         }
 435
 436         command = talloc_string_sub(
 437                 frame, lp_log_nt_token_command(),
 438                 "%s", sid_string_talloc(frame, &token->user_sids[0]));
 439         command = talloc_string_sub(frame, command, "%t", group_sidstr);
 440
 441         if (command == NULL) {
 442                 TALLOC_FREE(frame);
 443                 return NT_STATUS_NO_MEMORY;
 444         }
 445
 446         DEBUG(8, ("running command: [%s]\n", command));
 447         if (smbrun(command, NULL) != 0) {
 448                 DEBUG(0, ("Could not log NT token\n"));
 449                 TALLOC_FREE(frame);
 450                 return NT_STATUS_ACCESS_DENIED;
 451         }
 452
 453         TALLOC_FREE(frame);
 454         return NT_STATUS_OK;
 455 }
 456
 457 /*
 458  * Create the token to use from server_info->sam_account and
 459  * server_info->sids (the info3/sam groups). Find the unix gids.
 460  */
 461
 462 NTSTATUS create_local_token(struct auth_serversupplied_info *server_info)
 463 {
 464         NTSTATUS status;
 465         size_t i;
 466         struct dom_sid tmp_sid;
 467
 468         /*
 469          * If winbind is not around, we can not make much use of the SIDs the
 470          * domain controller provided us with. Likewise if the user name was
 471          * mapped to some local unix user.
 472          */
 473
 474         if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
 475             (server_info->nss_token)) {
 476                 status = create_token_from_username(server_info,
 477                                                     server_info->unix_name,
 478                                                     server_info->guest,
 479                                                     &server_info->utok.uid,
 480                                                     &server_info->utok.gid,
 481                                                     &server_info->unix_name,
 482                                                     &server_info->ptok);
 483
 484         } else {
 485                 server_info->ptok = create_local_nt_token(
 486                         server_info,
 487                         pdb_get_user_sid(server_info->sam_account),
 488                         server_info->guest,
 489                         server_info->num_sids, server_info->sids);
 490                 status = server_info->ptok ?
 491                         NT_STATUS_OK : NT_STATUS_NO_SUCH_USER;
 492         }
 493
 494         if (!NT_STATUS_IS_OK(status)) {
 495                 return status;
 496         }
 497
 498         /* Convert the SIDs to gids. */
 499
 500         server_info->utok.ngroups = 0;
 501         server_info->utok.groups = NULL;
 502
 503         /* Start at index 1, where the groups start. */
 504
 505         for (i=1; i<server_info->ptok->num_sids; i++) {
 506                 gid_t gid;
 507                 struct dom_sid *sid = &server_info->ptok->user_sids[i];
 508
 509                 if (!sid_to_gid(sid, &gid)) {
 510                         DEBUG(10, ("Could not convert SID %s to gid, "
 511                                    "ignoring it\n", sid_string_dbg(sid)));
 512                         continue;
 513                 }
 514                 add_gid_to_array_unique(server_info, gid,
 515                                         &server_info->utok.groups,
 516                                         &server_info->utok.ngroups);
 517         }
 518
 519         /*
 520          * Add the "Unix Group" SID for each gid to catch mapped groups
 521          * and their Unix equivalent.  This is to solve the backwards
 522          * compatibility problem of 'valid users = +ntadmin' where
 523          * ntadmin has been paired with "Domain Admins" in the group
 524          * mapping table.  Otherwise smb.conf would need to be changed
 525          * to 'valid user = "Domain Admins"'.  --jerry
 526          *
 527          * For consistency we also add the "Unix User" SID,
 528          * so that the complete unix token is represented within
 529          * the nt token.
 530          */
 531
 532         if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
 533                 DEBUG(1,("create_local_token: Failed to create SID "
 534                         "for uid %u!\n", (unsigned int)server_info->utok.uid));
 535         }
 536         add_sid_to_array_unique(server_info->ptok, &tmp_sid,
 537                                 &server_info->ptok->user_sids,
 538                                 &server_info->ptok->num_sids);
 539
 540         for ( i=0; i<server_info->utok.ngroups; i++ ) {
 541                 if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
 542                         DEBUG(1,("create_local_token: Failed to create SID "
 543                                 "for gid %u!\n", (unsigned int)server_info->utok.groups[i]));
 544                         continue;
 545                 }
 546                 add_sid_to_array_unique(server_info->ptok, &tmp_sid,
 547                                         &server_info->ptok->user_sids,
 548                                         &server_info->ptok->num_sids);
 549         }
 550
 551         debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
 552         debug_unix_user_token(DBGC_AUTH, 10,
 553                               server_info->utok.uid,
 554                               server_info->utok.gid,
 555                               server_info->utok.ngroups,
 556                               server_info->utok.groups);
 557
 558         status = log_nt_token(server_info->ptok);
 559         return status;
 560 }
 561
 562 /***************************************************************************
 563  Make (and fill) a server_info struct from a 'struct passwd' by conversion
 564  to a struct samu
 565 ***************************************************************************/
 566
 567 NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
 568                              char *unix_username,
 569                              struct passwd *pwd)
 570 {
 571         NTSTATUS status;
 572         struct samu *sampass = NULL;
 573         gid_t *gids;
 574         char *qualified_name = NULL;
 575         TALLOC_CTX *mem_ctx = NULL;
 576         struct dom_sid u_sid;
 577         enum lsa_SidType type;
 578         struct auth_serversupplied_info *result;
 579
 580         if ( !(sampass = samu_new( NULL )) ) {
 581                 return NT_STATUS_NO_MEMORY;
 582         }
 583
 584         status = samu_set_unix( sampass, pwd );
 585         if (!NT_STATUS_IS_OK(status)) {
 586                 return status;
 587         }
 588
 589         result = make_server_info(NULL);
 590         if (result == NULL) {
 591                 TALLOC_FREE(sampass);
 592                 return NT_STATUS_NO_MEMORY;
 593         }
 594
 595         result->sam_account = sampass;
 596
 597         result->unix_name = talloc_strdup(result, unix_username);
 598         result->sanitized_username = sanitize_username(result, unix_username);
 599
 600         if ((result->unix_name == NULL)
 601             || (result->sanitized_username == NULL)) {
 602                 TALLOC_FREE(sampass);
 603                 TALLOC_FREE(result);
 604                 return NT_STATUS_NO_MEMORY;
 605         }
 606
 607         result->utok.uid = pwd->pw_uid;
 608         result->utok.gid = pwd->pw_gid;
 609
 610         status = pdb_enum_group_memberships(result, sampass,
 611                                             &result->sids, &gids,
 612                                             &result->num_sids);
 613
 614         if (!NT_STATUS_IS_OK(status)) {
 615                 DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
 616                            nt_errstr(status)));
 617                 TALLOC_FREE(result);
 618                 return status;
 619         }
 620
 621         /*
 622          * The SID returned in server_info->sam_account is based
 623          * on our SAM sid even though for a pure UNIX account this should
 624          * not be the case as it doesn't really exist in the SAM db.
 625          * This causes lookups on "[in]valid users" to fail as they
 626          * will lookup this name as a "Unix User" SID to check against
 627          * the user token. Fix this by adding the "Unix User"\unix_username
 628          * SID to the sid array. The correct fix should probably be
 629          * changing the server_info->sam_account user SID to be a
 630          * S-1-22 Unix SID, but this might break old configs where
 631          * plaintext passwords were used with no SAM backend.
 632          */
 633
 634         mem_ctx = talloc_init("make_server_info_pw_tmp");
 635         if (!mem_ctx) {
 636                 TALLOC_FREE(result);
 637                 return NT_STATUS_NO_MEMORY;
 638         }
 639
 640         qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
 641                                         unix_users_domain_name(),
 642                                         unix_username );
 643         if (!qualified_name) {
 644                 TALLOC_FREE(result);
 645                 TALLOC_FREE(mem_ctx);
 646                 return NT_STATUS_NO_MEMORY;
 647         }
 648
 649         if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
 650                                                 NULL, NULL,
 651                                                 &u_sid, &type)) {
 652                 TALLOC_FREE(result);
 653                 TALLOC_FREE(mem_ctx);
 654                 return NT_STATUS_NO_SUCH_USER;
 655         }
 656
 657         TALLOC_FREE(mem_ctx);
 658
 659         if (type != SID_NAME_USER) {
 660                 TALLOC_FREE(result);
 661                 return NT_STATUS_NO_SUCH_USER;
 662         }
 663
 664         status = add_sid_to_array_unique(result, &u_sid,
 665                                          &result->sids,
 666                                          &result->num_sids);
 667         if (!NT_STATUS_IS_OK(status)) {
 668                 TALLOC_FREE(result);
 669                 return status;
 670         }
 671
 672         /* For now we throw away the gids and convert via sid_to_gid
 673          * later. This needs fixing, but I'd like to get the code straight and
 674          * simple first. */
 675         TALLOC_FREE(gids);
 676
 677         *server_info = result;
 678
 679         return NT_STATUS_OK;
 680 }
 681
 682 /***************************************************************************
 683  Make (and fill) a user_info struct for a guest login.
 684  This *must* succeed for smbd to start. If there is no mapping entry for
 685  the guest gid, then create one.
 686 ***************************************************************************/
 687
 688 static NTSTATUS make_new_server_info_guest(struct auth_serversupplied_info **server_info)
 689 {
 690         NTSTATUS status;
 691         struct samu *sampass = NULL;
 692         struct dom_sid guest_sid;
 693         bool ret;
 694         static const char zeros[16] = {0, };
 695         fstring tmp;
 696
 697         if ( !(sampass = samu_new( NULL )) ) {
 698                 return NT_STATUS_NO_MEMORY;
 699         }
 700
 701         sid_compose(&guest_sid, get_global_sam_sid(), DOMAIN_RID_GUEST);
 702
 703         become_root();
 704         ret = pdb_getsampwsid(sampass, &guest_sid);
 705         unbecome_root();
 706
 707         if (!ret) {
 708                 TALLOC_FREE(sampass);
 709                 return NT_STATUS_NO_SUCH_USER;
 710         }
 711
 712         status = make_server_info_sam(server_info, sampass);
 713         if (!NT_STATUS_IS_OK(status)) {
 714                 TALLOC_FREE(sampass);
 715                 return status;
 716         }
 717
 718         (*server_info)->guest = True;
 719
 720         status = create_local_token(*server_info);
 721         if (!NT_STATUS_IS_OK(status)) {
 722                 DEBUG(10, ("create_local_token failed: %s\n",
 723                            nt_errstr(status)));
 724                 return status;
 725         }
 726
 727         /* annoying, but the Guest really does have a session key, and it is
 728            all zeros! */
 729         (*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
 730         (*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
 731
 732         alpha_strcpy(tmp, pdb_get_username(sampass), ". _-$", sizeof(tmp));
 733         (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
 734
 735         return NT_STATUS_OK;
 736 }
 737
 738 /****************************************************************************
 739   Fake a auth_serversupplied_info just from a username
 740 ****************************************************************************/
 741
 742 NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
 743                                        const char *username,
 744                                        bool is_guest,
 745                                        struct auth_serversupplied_info **presult)
 746 {
 747         struct auth_serversupplied_info *result;
 748         struct passwd *pwd;
 749         NTSTATUS status;
 750
 751         pwd = getpwnam_alloc(talloc_tos(), username);
 752         if (pwd == NULL) {
 753                 return NT_STATUS_NO_SUCH_USER;
 754         }
 755
 756         status = make_server_info_pw(&result, pwd->pw_name, pwd);
 757
 758         TALLOC_FREE(pwd);
 759
 760         if (!NT_STATUS_IS_OK(status)) {
 761                 return status;
 762         }
 763
 764         result->nss_token = true;
 765         result->guest = is_guest;
 766
 767         status = create_local_token(result);
 768
 769         if (!NT_STATUS_IS_OK(status)) {
 770                 TALLOC_FREE(result);
 771                 return status;
 772         }
 773
 774         *presult = result;
 775         return NT_STATUS_OK;
 776 }
 777
 778
 779 struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
 780                                                  const struct auth_serversupplied_info *src)
 781 {
 782         struct auth_serversupplied_info *dst;
 783
 784         dst = make_server_info(mem_ctx);
 785         if (dst == NULL) {
 786                 return NULL;
 787         }
 788
 789         dst->guest = src->guest;
 790         dst->utok.uid = src->utok.uid;
 791         dst->utok.gid = src->utok.gid;
 792         dst->utok.ngroups = src->utok.ngroups;
 793         if (src->utok.ngroups != 0) {
 794                 dst->utok.groups = (gid_t *)TALLOC_MEMDUP(
 795                         dst, src->utok.groups,
 796                         sizeof(gid_t)*dst->utok.ngroups);
 797         } else {
 798                 dst->utok.groups = NULL;
 799         }
 800
 801         if (src->ptok) {
 802                 dst->ptok = dup_nt_token(dst, src->ptok);
 803                 if (!dst->ptok) {
 804                         TALLOC_FREE(dst);
 805                         return NULL;
 806                 }
 807         }
 808
 809         dst->user_session_key = data_blob_talloc( dst, src->user_session_key.data,
 810                                                 src->user_session_key.length);
 811
 812         dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
 813                                                 src->lm_session_key.length);
 814
 815         dst->sam_account = samu_new(NULL);
 816         if (!dst->sam_account) {
 817                 TALLOC_FREE(dst);
 818                 return NULL;
 819         }
 820
 821         if (!pdb_copy_sam_account(dst->sam_account, src->sam_account)) {
 822                 TALLOC_FREE(dst);
 823                 return NULL;
 824         }
 825
 826         dst->pam_handle = NULL;
 827         dst->unix_name = talloc_strdup(dst, src->unix_name);
 828         if (!dst->unix_name) {
 829                 TALLOC_FREE(dst);
 830                 return NULL;
 831         }
 832
 833         dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
 834         if (!dst->sanitized_username) {
 835                 TALLOC_FREE(dst);
 836                 return NULL;
 837         }
 838
 839         return dst;
 840 }
 841
 842 /*
 843  * Set a new session key. Used in the rpc server where we have to override the
 844  * SMB level session key with SystemLibraryDTC
 845  */
 846
 847 bool server_info_set_session_key(struct auth_serversupplied_info *info,
 848                                  DATA_BLOB session_key)
 849 {
 850         TALLOC_FREE(info->user_session_key.data);
 851
 852         info->user_session_key = data_blob_talloc(
 853                 info, session_key.data, session_key.length);
 854
 855         return (info->user_session_key.data != NULL);
 856 }
 857
 858 static struct auth_serversupplied_info *guest_info = NULL;
 859
 860 bool init_guest_info(void)
 861 {
 862         if (guest_info != NULL)
 863                 return True;
 864
 865         return NT_STATUS_IS_OK(make_new_server_info_guest(&guest_info));
 866 }
 867
 868 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
 869                                 struct auth_serversupplied_info **server_info)
 870 {
 871         *server_info = copy_serverinfo(mem_ctx, guest_info);
 872         return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 873 }
 874
 875 bool copy_current_user(struct current_user *dst, struct current_user *src)
 876 {
 877         gid_t *groups;
 878         NT_USER_TOKEN *nt_token;
 879
 880         groups = (gid_t *)memdup(src->ut.groups,
 881                                  sizeof(gid_t) * src->ut.ngroups);
 882         if ((src->ut.ngroups != 0) && (groups == NULL)) {
 883                 return False;
 884         }
 885
 886         nt_token = dup_nt_token(NULL, src->nt_user_token);
 887         if (nt_token == NULL) {
 888                 SAFE_FREE(groups);
 889                 return False;
 890         }
 891
 892         dst->conn = src->conn;
 893         dst->vuid = src->vuid;
 894         dst->ut.uid = src->ut.uid;
 895         dst->ut.gid = src->ut.gid;
 896         dst->ut.ngroups = src->ut.ngroups;
 897         dst->ut.groups = groups;
 898         dst->nt_user_token = nt_token;
 899         return True;
 900 }
 901
 902 /***************************************************************************
 903  Purely internal function for make_server_info_info3
 904  Fill the sam account from getpwnam
 905 ***************************************************************************/
 906 static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx,
 907                                  const char *domain,
 908                                  const char *username,
 909                                  char **found_username,
 910                                  uid_t *uid, gid_t *gid,
 911                                  struct samu *account,
 912                                  bool *username_was_mapped)
 913 {
 914         struct smbd_server_connection *sconn = smbd_server_conn;
 915         NTSTATUS nt_status;
 916         fstring dom_user, lower_username;
 917         fstring real_username;
 918         struct passwd *passwd;
 919
 920         fstrcpy( lower_username, username );
 921         strlower_m( lower_username );
 922
 923         fstr_sprintf(dom_user, "%s%c%s", domain, *lp_winbind_separator(),
 924                 lower_username);
 925
 926         /* Get the passwd struct.  Try to create the account is necessary. */
 927
 928         *username_was_mapped = map_username(sconn, dom_user);
 929
 930         if ( !(passwd = smb_getpwnam( NULL, dom_user, real_username, True )) )
 931                 return NT_STATUS_NO_SUCH_USER;
 932
 933         *uid = passwd->pw_uid;
 934         *gid = passwd->pw_gid;
 935
 936         /* This is pointless -- there is no suport for differing
 937            unix and windows names.  Make sure to always store the
 938            one we actually looked up and succeeded. Have I mentioned
 939            why I hate the 'winbind use default domain' parameter?
 940                                          --jerry              */
 941
 942         *found_username = talloc_strdup( mem_ctx, real_username );
 943
 944         DEBUG(5,("fill_sam_account: located username was [%s]\n", *found_username));
 945
 946         nt_status = samu_set_unix( account, passwd );
 947
 948         TALLOC_FREE(passwd);
 949
 950         return nt_status;
 951 }
 952
 953 /****************************************************************************
 954  Wrapper to allow the getpwnam() call to strip the domain name and
 955  try again in case a local UNIX user is already there.  Also run through
 956  the username if we fallback to the username only.
 957  ****************************************************************************/
 958
 959 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,
 960                              fstring save_username, bool create )
 961 {
 962         struct passwd *pw = NULL;
 963         char *p;
 964         fstring username;
 965
 966         /* we only save a copy of the username it has been mangled
 967            by winbindd use default domain */
 968
 969         save_username[0] = '\0';
 970
 971         /* don't call map_username() here since it has to be done higher
 972            up the stack so we don't call it multiple times */
 973
 974         fstrcpy( username, domuser );
 975
 976         p = strchr_m( username, *lp_winbind_separator() );
 977
 978         /* code for a DOMAIN\user string */
 979
 980         if ( p ) {
 981                 fstring strip_username;
 982
 983                 pw = Get_Pwnam_alloc( mem_ctx, domuser );
 984                 if ( pw ) {
 985                         /* make sure we get the case of the username correct */
 986                         /* work around 'winbind use default domain = yes' */
 987
 988                         if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
 989                                 char *domain;
 990
 991                                 /* split the domain and username into 2 strings */
 992                                 *p = '\0';
 993                                 domain = username;
 994
 995                                 fstr_sprintf(save_username, "%s%c%s", domain, *lp_winbind_separator(), pw->pw_name);
 996                         }
 997                         else
 998                                 fstrcpy( save_username, pw->pw_name );
 999
1000                         /* whew -- done! */
1001                         return pw;
1002                 }
1003
1004                 /* setup for lookup of just the username */
1005                 /* remember that p and username are overlapping memory */
1006
1007                 p++;
1008                 fstrcpy( strip_username, p );
1009                 fstrcpy( username, strip_username );
1010         }
1011
1012         /* just lookup a plain username */
1013
1014         pw = Get_Pwnam_alloc(mem_ctx, username);
1015
1016         /* Create local user if requested but only if winbindd
1017            is not running.  We need to protect against cases
1018            where winbindd is failing and then prematurely
1019            creating users in /etc/passwd */
1020
1021         if ( !pw && create && !winbind_ping() ) {
1022                 /* Don't add a machine account. */
1023                 if (username[strlen(username)-1] == '$')
1024                         return NULL;
1025
1026                 _smb_create_user(NULL, username, NULL);
1027                 pw = Get_Pwnam_alloc(mem_ctx, username);
1028         }
1029
1030         /* one last check for a valid passwd struct */
1031
1032         if ( pw )
1033                 fstrcpy( save_username, pw->pw_name );
1034
1035         return pw;
1036 }
1037
1038 /***************************************************************************
1039  Make a server_info struct from the info3 returned by a domain logon
1040 ***************************************************************************/
1041
1042 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
1043                                 const char *sent_nt_username,
1044                                 const char *domain,
1045                                 struct auth_serversupplied_info **server_info,
1046                                 struct netr_SamInfo3 *info3)
1047 {
1048         static const char zeros[16] = {0, };
1049
1050         NTSTATUS nt_status = NT_STATUS_OK;
1051         char *found_username = NULL;
1052         const char *nt_domain;
1053         const char *nt_username;
1054         struct samu *sam_account = NULL;
1055         struct dom_sid user_sid;
1056         struct dom_sid group_sid;
1057         bool username_was_mapped;
1058
1059         uid_t uid = (uid_t)-1;
1060         gid_t gid = (gid_t)-1;
1061
1062         struct auth_serversupplied_info *result;
1063
1064         /*
1065            Here is where we should check the list of
1066            trusted domains, and verify that the SID
1067            matches.
1068         */
1069
1070         if (!sid_compose(&user_sid, info3->base.domain_sid, info3->base.rid)) {
1071                 return NT_STATUS_INVALID_PARAMETER;
1072         }
1073
1074         if (!sid_compose(&group_sid, info3->base.domain_sid,
1075                          info3->base.primary_gid)) {
1076                 return NT_STATUS_INVALID_PARAMETER;
1077         }
1078
1079         nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
1080         if (!nt_username) {
1081                 /* If the server didn't give us one, just use the one we sent
1082                  * them */
1083                 nt_username = sent_nt_username;
1084         }
1085
1086         nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
1087         if (!nt_domain) {
1088                 /* If the server didn't give us one, just use the one we sent
1089                  * them */
1090                 nt_domain = domain;
1091         }
1092
1093         /* try to fill the SAM account..  If getpwnam() fails, then try the
1094            add user script (2.2.x behavior).
1095
1096            We use the _unmapped_ username here in an attempt to provide
1097            consistent username mapping behavior between kerberos and NTLM[SSP]
1098            authentication in domain mode security.  I.E. Username mapping
1099            should be applied to the fully qualified username
1100            (e.g. DOMAIN\user) and not just the login name.  Yes this means we
1101            called map_username() unnecessarily in make_user_info_map() but
1102            that is how the current code is designed.  Making the change here
1103            is the least disruptive place.  -- jerry */
1104
1105         if ( !(sam_account = samu_new( NULL )) ) {
1106                 return NT_STATUS_NO_MEMORY;
1107         }
1108
1109         /* this call will try to create the user if necessary */
1110
1111         nt_status = fill_sam_account(mem_ctx, nt_domain, sent_nt_username,
1112                                      &found_username, &uid, &gid, sam_account,
1113                                      &username_was_mapped);
1114
1115
1116         /* if we still don't have a valid unix account check for
1117           'map to guest = bad uid' */
1118
1119         if (!NT_STATUS_IS_OK(nt_status)) {
1120                 TALLOC_FREE( sam_account );
1121                 if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
1122                         make_server_info_guest(NULL, server_info);
1123                         return NT_STATUS_OK;
1124                 }
1125                 return nt_status;
1126         }
1127
1128         if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
1129                 TALLOC_FREE(sam_account);
1130                 return NT_STATUS_NO_MEMORY;
1131         }
1132
1133         if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
1134                 TALLOC_FREE(sam_account);
1135                 return NT_STATUS_NO_MEMORY;
1136         }
1137
1138         if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
1139                 TALLOC_FREE(sam_account);
1140                 return NT_STATUS_NO_MEMORY;
1141         }
1142
1143         if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
1144                 TALLOC_FREE(sam_account);
1145                 return NT_STATUS_UNSUCCESSFUL;
1146         }
1147
1148         if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
1149                 TALLOC_FREE(sam_account);
1150                 return NT_STATUS_UNSUCCESSFUL;
1151         }
1152
1153         if (!pdb_set_fullname(sam_account,
1154                               info3->base.full_name.string,
1155                               PDB_CHANGED)) {
1156                 TALLOC_FREE(sam_account);
1157                 return NT_STATUS_NO_MEMORY;
1158         }
1159
1160         if (!pdb_set_logon_script(sam_account,
1161                                   info3->base.logon_script.string,
1162                                   PDB_CHANGED)) {
1163                 TALLOC_FREE(sam_account);
1164                 return NT_STATUS_NO_MEMORY;
1165         }
1166
1167         if (!pdb_set_profile_path(sam_account,
1168                                   info3->base.profile_path.string,
1169                                   PDB_CHANGED)) {
1170                 TALLOC_FREE(sam_account);
1171                 return NT_STATUS_NO_MEMORY;
1172         }
1173
1174         if (!pdb_set_homedir(sam_account,
1175                              info3->base.home_directory.string,
1176                              PDB_CHANGED)) {
1177                 TALLOC_FREE(sam_account);
1178                 return NT_STATUS_NO_MEMORY;
1179         }
1180
1181         if (!pdb_set_dir_drive(sam_account,
1182                                info3->base.home_drive.string,
1183                                PDB_CHANGED)) {
1184                 TALLOC_FREE(sam_account);
1185                 return NT_STATUS_NO_MEMORY;
1186         }
1187
1188         if (!pdb_set_acct_ctrl(sam_account, info3->base.acct_flags, PDB_CHANGED)) {
1189                 TALLOC_FREE(sam_account);
1190                 return NT_STATUS_NO_MEMORY;
1191         }
1192
1193         if (!pdb_set_pass_last_set_time(
1194                     sam_account,
1195                     nt_time_to_unix(info3->base.last_password_change),
1196                     PDB_CHANGED)) {
1197                 TALLOC_FREE(sam_account);
1198                 return NT_STATUS_NO_MEMORY;
1199         }
1200
1201         if (!pdb_set_pass_can_change_time(
1202                     sam_account,
1203                     nt_time_to_unix(info3->base.allow_password_change),
1204                     PDB_CHANGED)) {
1205                 TALLOC_FREE(sam_account);
1206                 return NT_STATUS_NO_MEMORY;
1207         }
1208
1209         if (!pdb_set_pass_must_change_time(
1210                     sam_account,
1211                     nt_time_to_unix(info3->base.force_password_change),
1212                     PDB_CHANGED)) {
1213                 TALLOC_FREE(sam_account);
1214                 return NT_STATUS_NO_MEMORY;
1215         }
1216
1217         result = make_server_info(NULL);
1218         if (result == NULL) {
1219                 DEBUG(4, ("make_server_info failed!\n"));
1220                 TALLOC_FREE(sam_account);
1221                 return NT_STATUS_NO_MEMORY;
1222         }
1223
1224         /* save this here to _net_sam_logon() doesn't fail (it assumes a
1225            valid struct samu) */
1226
1227         result->sam_account = sam_account;
1228         result->unix_name = talloc_strdup(result, found_username);
1229
1230         result->sanitized_username = sanitize_username(result,
1231                                                        result->unix_name);
1232         if (result->sanitized_username == NULL) {
1233                 TALLOC_FREE(result);
1234                 return NT_STATUS_NO_MEMORY;
1235         }
1236
1237         /* Fill in the unix info we found on the way */
1238
1239         result->utok.uid = uid;
1240         result->utok.gid = gid;
1241
1242         /* Create a 'combined' list of all SIDs we might want in the SD */
1243
1244         result->num_sids = 0;
1245         result->sids = NULL;
1246
1247         nt_status = sid_array_from_info3(result, info3,
1248                                          &result->sids,
1249                                          &result->num_sids,
1250                                          false, false);
1251         if (!NT_STATUS_IS_OK(nt_status)) {
1252                 TALLOC_FREE(result);
1253                 return nt_status;
1254         }
1255
1256         /* Ensure the primary group sid is at position 0. */
1257         sort_sid_array_for_smbd(result, &group_sid);
1258
1259         result->login_server = talloc_strdup(result,
1260                                              info3->base.logon_server.string);
1261
1262         /* ensure we are never given NULL session keys */
1263
1264         if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
1265                 result->user_session_key = data_blob_null;
1266         } else {
1267                 result->user_session_key = data_blob_talloc(
1268                         result, info3->base.key.key,
1269                         sizeof(info3->base.key.key));
1270         }
1271
1272         if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
1273                 result->lm_session_key = data_blob_null;
1274         } else {
1275                 result->lm_session_key = data_blob_talloc(
1276                         result, info3->base.LMSessKey.key,
1277                         sizeof(info3->base.LMSessKey.key));
1278         }
1279
1280         result->nss_token |= username_was_mapped;
1281
1282         *server_info = result;
1283
1284         return NT_STATUS_OK;
1285 }
1286
1287 /*****************************************************************************
1288  Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1289 ******************************************************************************/
1290
1291 NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
1292                                           const char *sent_nt_username,
1293                                           const char *domain,
1294                                           const struct wbcAuthUserInfo *info,
1295                                           struct auth_serversupplied_info **server_info)
1296 {
1297         static const char zeros[16] = {0, };
1298
1299         NTSTATUS nt_status = NT_STATUS_OK;
1300         char *found_username = NULL;
1301         const char *nt_domain;
1302         const char *nt_username;
1303         struct samu *sam_account = NULL;
1304         struct dom_sid user_sid;
1305         struct dom_sid group_sid;
1306         bool username_was_mapped;
1307         uint32_t i;
1308
1309         uid_t uid = (uid_t)-1;
1310         gid_t gid = (gid_t)-1;
1311
1312         struct auth_serversupplied_info *result;
1313
1314         result = make_server_info(NULL);
1315         if (result == NULL) {
1316                 DEBUG(4, ("make_server_info failed!\n"));
1317                 return NT_STATUS_NO_MEMORY;
1318         }
1319
1320         /*
1321            Here is where we should check the list of
1322            trusted domains, and verify that the SID
1323            matches.
1324         */
1325
1326         memcpy(&user_sid, &info->sids[0].sid, sizeof(user_sid));
1327         memcpy(&group_sid, &info->sids[1].sid, sizeof(group_sid));
1328
1329         if (info->account_name) {
1330                 nt_username = talloc_strdup(result, info->account_name);
1331         } else {
1332                 /* If the server didn't give us one, just use the one we sent
1333                  * them */
1334                 nt_username = talloc_strdup(result, sent_nt_username);
1335         }
1336         if (!nt_username) {
1337                 TALLOC_FREE(result);
1338                 return NT_STATUS_NO_MEMORY;
1339         }
1340
1341         if (info->domain_name) {
1342                 nt_domain = talloc_strdup(result, info->domain_name);
1343         } else {
1344                 /* If the server didn't give us one, just use the one we sent
1345                  * them */
1346                 nt_domain = talloc_strdup(result, domain);
1347         }
1348         if (!nt_domain) {
1349                 TALLOC_FREE(result);
1350                 return NT_STATUS_NO_MEMORY;
1351         }
1352
1353         /* try to fill the SAM account..  If getpwnam() fails, then try the
1354            add user script (2.2.x behavior).
1355
1356            We use the _unmapped_ username here in an attempt to provide
1357            consistent username mapping behavior between kerberos and NTLM[SSP]
1358            authentication in domain mode security.  I.E. Username mapping
1359            should be applied to the fully qualified username
1360            (e.g. DOMAIN\user) and not just the login name.  Yes this means we
1361            called map_username() unnecessarily in make_user_info_map() but
1362            that is how the current code is designed.  Making the change here
1363            is the least disruptive place.  -- jerry */
1364
1365         if ( !(sam_account = samu_new( result )) ) {
1366                 TALLOC_FREE(result);
1367                 return NT_STATUS_NO_MEMORY;
1368         }
1369
1370         /* this call will try to create the user if necessary */
1371
1372         nt_status = fill_sam_account(result, nt_domain, sent_nt_username,
1373                                      &found_username, &uid, &gid, sam_account,
1374                                      &username_was_mapped);
1375
1376         /* if we still don't have a valid unix account check for
1377           'map to guest = bad uid' */
1378
1379         if (!NT_STATUS_IS_OK(nt_status)) {
1380                 TALLOC_FREE( result );
1381                 if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
1382                         make_server_info_guest(NULL, server_info);
1383                         return NT_STATUS_OK;
1384                 }
1385                 return nt_status;
1386         }
1387
1388         if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
1389                 TALLOC_FREE(result);
1390                 return NT_STATUS_NO_MEMORY;
1391         }
1392
1393         if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
1394                 TALLOC_FREE(result);
1395                 return NT_STATUS_NO_MEMORY;
1396         }
1397
1398         if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
1399                 TALLOC_FREE(result);
1400                 return NT_STATUS_NO_MEMORY;
1401         }
1402
1403         if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
1404                 TALLOC_FREE(result);
1405                 return NT_STATUS_UNSUCCESSFUL;
1406         }
1407
1408         if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
1409                 TALLOC_FREE(result);
1410                 return NT_STATUS_UNSUCCESSFUL;
1411         }
1412
1413         if (!pdb_set_fullname(sam_account, info->full_name, PDB_CHANGED)) {
1414                 TALLOC_FREE(result);
1415                 return NT_STATUS_NO_MEMORY;
1416         }
1417
1418         if (!pdb_set_logon_script(sam_account, info->logon_script, PDB_CHANGED)) {
1419                 TALLOC_FREE(result);
1420                 return NT_STATUS_NO_MEMORY;
1421         }
1422
1423         if (!pdb_set_profile_path(sam_account, info->profile_path, PDB_CHANGED)) {
1424                 TALLOC_FREE(result);
1425                 return NT_STATUS_NO_MEMORY;
1426         }
1427
1428         if (!pdb_set_homedir(sam_account, info->home_directory, PDB_CHANGED)) {
1429                 TALLOC_FREE(result);
1430                 return NT_STATUS_NO_MEMORY;
1431         }
1432
1433         if (!pdb_set_dir_drive(sam_account, info->home_drive, PDB_CHANGED)) {
1434                 TALLOC_FREE(result);
1435                 return NT_STATUS_NO_MEMORY;
1436         }
1437
1438         if (!pdb_set_acct_ctrl(sam_account, info->acct_flags, PDB_CHANGED)) {
1439                 TALLOC_FREE(result);
1440                 return NT_STATUS_NO_MEMORY;
1441         }
1442
1443         if (!pdb_set_pass_last_set_time(
1444                     sam_account,
1445                     nt_time_to_unix(info->pass_last_set_time),
1446                     PDB_CHANGED)) {
1447                 TALLOC_FREE(result);
1448                 return NT_STATUS_NO_MEMORY;
1449         }
1450
1451         if (!pdb_set_pass_can_change_time(
1452                     sam_account,
1453                     nt_time_to_unix(info->pass_can_change_time),
1454                     PDB_CHANGED)) {
1455                 TALLOC_FREE(result);
1456                 return NT_STATUS_NO_MEMORY;
1457         }
1458
1459         if (!pdb_set_pass_must_change_time(
1460                     sam_account,
1461                     nt_time_to_unix(info->pass_must_change_time),
1462                     PDB_CHANGED)) {
1463                 TALLOC_FREE(result);
1464                 return NT_STATUS_NO_MEMORY;
1465         }
1466
1467         /* save this here to _net_sam_logon() doesn't fail (it assumes a
1468            valid struct samu) */
1469
1470         result->sam_account = sam_account;
1471         result->unix_name = talloc_strdup(result, found_username);
1472
1473         result->sanitized_username = sanitize_username(result,
1474                                                        result->unix_name);
1475         result->login_server = talloc_strdup(result, info->logon_server);
1476
1477         if ((result->unix_name == NULL)
1478             || (result->sanitized_username == NULL)
1479             || (result->login_server == NULL)) {
1480                 TALLOC_FREE(result);
1481                 return NT_STATUS_NO_MEMORY;
1482         }
1483
1484         /* Fill in the unix info we found on the way */
1485
1486         result->utok.uid = uid;
1487         result->utok.gid = gid;
1488
1489         /* Create a 'combined' list of all SIDs we might want in the SD */
1490
1491         result->num_sids = info->num_sids - 2;
1492         result->sids = talloc_array(result, struct dom_sid, result->num_sids);
1493         if (result->sids == NULL) {
1494                 TALLOC_FREE(result);
1495                 return NT_STATUS_NO_MEMORY;
1496         }
1497
1498         for (i=0; i < result->num_sids; i++) {
1499                 memcpy(&result->sids[i], &info->sids[i+2].sid, sizeof(result->sids[i]));
1500         }
1501
1502         /* Ensure the primary group sid is at position 0. */
1503         sort_sid_array_for_smbd(result, &group_sid);
1504
1505         /* ensure we are never given NULL session keys */
1506
1507         if (memcmp(info->user_session_key, zeros, sizeof(zeros)) == 0) {
1508                 result->user_session_key = data_blob_null;
1509         } else {
1510                 result->user_session_key = data_blob_talloc(
1511                         result, info->user_session_key,
1512                         sizeof(info->user_session_key));
1513         }
1514
1515         if (memcmp(info->lm_session_key, zeros, 8) == 0) {
1516                 result->lm_session_key = data_blob_null;
1517         } else {
1518                 result->lm_session_key = data_blob_talloc(
1519                         result, info->lm_session_key,
1520                         sizeof(info->lm_session_key));
1521         }
1522
1523         result->nss_token |= username_was_mapped;
1524
1525         *server_info = result;
1526
1527         return NT_STATUS_OK;
1528 }
1529
1530 /**
1531  * Verify whether or not given domain is trusted.
1532  *
1533  * @param domain_name name of the domain to be verified
1534  * @return true if domain is one of the trusted ones or
1535  *         false if otherwise
1536  **/
1537
1538 bool is_trusted_domain(const char* dom_name)
1539 {
1540         struct dom_sid trustdom_sid;
1541         bool ret;
1542
1543         /* no trusted domains for a standalone server */
1544
1545         if ( lp_server_role() == ROLE_STANDALONE )
1546                 return False;
1547
1548         if (dom_name == NULL || dom_name[0] == '\0') {
1549                 return false;
1550         }
1551
1552         if (strequal(dom_name, get_global_sam_name())) {
1553                 return false;
1554         }
1555
1556         /* if we are a DC, then check for a direct trust relationships */
1557
1558         if ( IS_DC ) {
1559                 become_root();
1560                 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1561                           "[%s]\n", dom_name ));
1562                 ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
1563                 unbecome_root();
1564                 if (ret)
1565                         return True;
1566         }
1567         else {
1568                 wbcErr result;
1569
1570                 /* If winbind is around, ask it */
1571
1572                 result = wb_is_trusted_domain(dom_name);
1573
1574                 if (result == WBC_ERR_SUCCESS) {
1575                         return True;
1576                 }
1577
1578                 if (result == WBC_ERR_DOMAIN_NOT_FOUND) {
1579                         /* winbind could not find the domain */
1580                         return False;
1581                 }
1582
1583                 /* The only other possible result is that winbind is not up
1584                    and running. We need to update the trustdom_cache
1585                    ourselves */
1586
1587                 update_trustdom_cache();
1588         }
1589
1590         /* now the trustdom cache should be available a DC could still
1591          * have a transitive trust so fall back to the cache of trusted
1592          * domains (like a domain member would use  */
1593
1594         if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) {
1595                 return True;
1596         }
1597
1598         return False;
1599 }
1600