2 Unix SMB/CIFS implementation.
3 krb5 set password implementation
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001 (remuskoos@yahoo.com)
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libads/kerberos_proto.h"
24 #include "../lib/util/asn1.h"
28 /* Those are defined by kerberos-set-passwd-02.txt and are probably
29 * not supported by M$ implementation */
30 #define KRB5_KPASSWD_POLICY_REJECT 8
31 #define KRB5_KPASSWD_BAD_PRINCIPAL 9
32 #define KRB5_KPASSWD_ETYPE_NOSUPP 10
35 * we've got to be able to distinguish KRB_ERRORs from other
36 * requests - valid response for CHPW v2 replies.
39 static krb5_error_code kpasswd_err_to_krb5_err(krb5_error_code res_code)
42 case KRB5_KPASSWD_ACCESSDENIED:
43 return KRB5KDC_ERR_BADOPTION;
44 case KRB5_KPASSWD_INITIAL_FLAG_NEEDED:
45 return KRB5KDC_ERR_BADOPTION;
46 /* return KV5M_ALT_METHOD; MIT-only define */
47 case KRB5_KPASSWD_ETYPE_NOSUPP:
48 return KRB5KDC_ERR_ETYPE_NOSUPP;
49 case KRB5_KPASSWD_BAD_PRINCIPAL:
50 return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
51 case KRB5_KPASSWD_POLICY_REJECT:
52 case KRB5_KPASSWD_SOFTERROR:
53 return KRB5KDC_ERR_POLICY;
55 return KRB5KRB_ERR_GENERIC;
59 ADS_STATUS ads_krb5_set_password(const char *principal,
65 krb5_error_code ret = 0;
66 krb5_context context = NULL;
67 krb5_principal princ = NULL;
68 krb5_ccache ccache = NULL;
70 krb5_data result_code_string = { 0 };
71 krb5_data result_string = { 0 };
74 DBG_ERR("Missing ccache for [%s] and config [%s]\n",
75 principal, getenv("KRB5_CONFIG"));
76 return ADS_ERROR_NT(NT_STATUS_WRONG_CREDENTIAL_HANDLE);
79 ret = smb_krb5_init_context_common(&context);
81 DBG_ERR("kerberos init context failed (%s)\n",
83 return ADS_ERROR_KRB5(ret);
87 ret = smb_krb5_parse_name(context, principal, &princ);
89 krb5_free_context(context);
90 DEBUG(1, ("Failed to parse %s (%s)\n", principal,
92 return ADS_ERROR_KRB5(ret);
96 ret = krb5_cc_resolve(context, ccname, &ccache);
98 krb5_free_principal(context, princ);
99 krb5_free_context(context);
100 DBG_WARNING("Failed to get creds from [%s] (%s)\n",
101 ccname, error_message(ret));
102 return ADS_ERROR_KRB5(ret);
105 ret = krb5_set_password_using_ccache(context,
107 discard_const_p(char, newpw),
113 DEBUG(1, ("krb5_set_password failed (%s)\n", error_message(ret)));
114 aret = ADS_ERROR_KRB5(ret);
118 if (result_code != KRB5_KPASSWD_SUCCESS) {
119 ret = kpasswd_err_to_krb5_err(result_code);
120 DEBUG(1, ("krb5_set_password failed (%s)\n", error_message(ret)));
121 aret = ADS_ERROR_KRB5(ret);
128 smb_krb5_free_data_contents(context, &result_code_string);
129 smb_krb5_free_data_contents(context, &result_string);
130 krb5_free_principal(context, princ);
131 krb5_cc_close(context, ccache);
132 krb5_free_context(context);
138 we use a prompter to avoid a crash bug in the kerberos libs when
139 dealing with empty passwords
140 this prompter is just a string copy ...
142 static krb5_error_code
143 kerb_prompter(krb5_context ctx, void *data,
147 krb5_prompt prompts[])
149 if (num_prompts == 0) return 0;
151 memset(prompts[0].reply->data, 0, prompts[0].reply->length);
152 if (prompts[0].reply->length > 0) {
154 strncpy((char *)prompts[0].reply->data,
156 prompts[0].reply->length-1);
157 prompts[0].reply->length = strlen((const char *)prompts[0].reply->data);
159 prompts[0].reply->length = 0;
165 static ADS_STATUS ads_krb5_chg_password(const char *principal,
171 krb5_context context = NULL;
172 krb5_principal princ;
173 krb5_get_init_creds_opt *opts = NULL;
175 char *chpw_princ = NULL, *password;
178 krb5_data result_code_string = { 0 };
179 krb5_data result_string = { 0 };
180 smb_krb5_addresses *addr = NULL;
182 ret = smb_krb5_init_context_common(&context);
184 DBG_ERR("kerberos init context failed (%s)\n",
186 return ADS_ERROR_KRB5(ret);
189 if ((ret = smb_krb5_parse_name(context, principal, &princ))) {
190 krb5_free_context(context);
191 DEBUG(1,("Failed to parse %s (%s)\n", principal, error_message(ret)));
192 return ADS_ERROR_KRB5(ret);
195 ret = krb5_get_init_creds_opt_alloc(context, &opts);
197 krb5_free_context(context);
198 DBG_WARNING("krb5_get_init_creds_opt_alloc failed: %s\n",
200 return ADS_ERROR_KRB5(ret);
203 krb5_get_init_creds_opt_set_tkt_life(opts, 5 * 60);
204 krb5_get_init_creds_opt_set_renew_life(opts, 0);
205 krb5_get_init_creds_opt_set_forwardable(opts, 0);
206 krb5_get_init_creds_opt_set_proxiable(opts, 0);
207 #ifdef SAMBA4_USES_HEIMDAL
208 krb5_get_init_creds_opt_set_win2k(context, opts, true);
209 krb5_get_init_creds_opt_set_canonicalize(context, opts, true);
215 * Due to an upstream MIT Kerberos bug, this feature is not
216 * not working. Affection versions (2019-10-09): <= 1.17
219 * kinit -C aDmInIsTrAtOr@ACME.COM -S kadmin/changepw@ACME.COM
221 * This is NOT a problem if the service is a krbtgt.
223 * https://bugzilla.samba.org/show_bug.cgi?id=14155
225 krb5_get_init_creds_opt_set_canonicalize(opts, true);
229 /* note that heimdal will fill in the local addresses if the addresses
230 * in the creds_init_opt are all empty and then later fail with invalid
231 * address, sending our local netbios krb5 address - just like windows
232 * - avoids this - gd */
233 ret = smb_krb5_gen_netbios_krb5_address(&addr, lp_netbios_name());
235 krb5_free_principal(context, princ);
236 krb5_get_init_creds_opt_free(context, opts);
237 krb5_free_context(context);
238 return ADS_ERROR_KRB5(ret);
240 krb5_get_init_creds_opt_set_address_list(opts, addr->addrs);
242 realm = smb_krb5_principal_get_realm(NULL, context, princ);
244 /* We have to obtain an INITIAL changepw ticket for changing password */
245 if (asprintf(&chpw_princ, "kadmin/changepw@%s", realm) == -1) {
246 krb5_free_principal(context, princ);
247 krb5_get_init_creds_opt_free(context, opts);
248 smb_krb5_free_addresses(context, addr);
249 krb5_free_context(context);
251 DEBUG(1, ("ads_krb5_chg_password: asprintf fail\n"));
252 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
256 password = SMB_STRDUP(oldpw);
257 ret = krb5_get_init_creds_password(context, &creds, princ, password,
259 0, chpw_princ, opts);
260 krb5_get_init_creds_opt_free(context, opts);
261 smb_krb5_free_addresses(context, addr);
262 SAFE_FREE(chpw_princ);
266 if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY) {
267 DEBUG(1,("Password incorrect while getting initial ticket\n"));
269 DEBUG(1,("krb5_get_init_creds_password failed (%s)\n", error_message(ret)));
271 krb5_free_principal(context, princ);
272 krb5_free_context(context);
273 return ADS_ERROR_KRB5(ret);
276 ret = krb5_set_password(context,
278 discard_const_p(char, newpw),
285 DEBUG(1, ("krb5_change_password failed (%s)\n", error_message(ret)));
286 aret = ADS_ERROR_KRB5(ret);
290 if (result_code != KRB5_KPASSWD_SUCCESS) {
291 ret = kpasswd_err_to_krb5_err(result_code);
292 DEBUG(1, ("krb5_change_password failed (%s)\n", error_message(ret)));
293 aret = ADS_ERROR_KRB5(ret);
300 smb_krb5_free_data_contents(context, &result_code_string);
301 smb_krb5_free_data_contents(context, &result_string);
302 krb5_free_principal(context, princ);
303 krb5_free_context(context);
308 ADS_STATUS kerberos_set_password(const char *auth_principal,
309 const char *auth_password,
310 const char *target_principal,
311 const char *new_password)
313 TALLOC_CTX *frame = NULL;
314 krb5_context ctx = NULL;
315 krb5_ccache ccid = NULL;
320 if (strcmp(auth_principal, target_principal) == 0) {
322 * kinit is done inside of ads_krb5_chg_password()
323 * without any ccache, just with raw krb5_creds.
325 return ads_krb5_chg_password(target_principal,
330 frame = talloc_stackframe();
332 ret = smb_krb5_init_context_common(&ctx);
334 status = ADS_ERROR_KRB5(ret);
338 ret = smb_krb5_cc_new_unique_memory(ctx,
343 status = ADS_ERROR_KRB5(ret);
347 ret = kerberos_kinit_password(auth_principal,
352 DBG_ERR("Failed kinit for principal %s (%s)\n",
353 auth_principal, error_message(ret));
354 status = ADS_ERROR_KRB5(ret);
358 status = ads_krb5_set_password(target_principal,
361 if (!ADS_ERR_OK(status)) {
362 DBG_ERR("Failed to set password for %s as %s: %s\n",
371 krb5_cc_destroy(ctx, ccid);
375 krb5_free_context(ctx);