2 Unix SMB/CIFS implementation.
4 Winbind authentication mechnism
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Andrew Bartlett 2001 - 2002
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "librpc/gen_ndr/ndr_netlogon.h"
27 #include "auth/auth.h"
29 static NTSTATUS get_info3_from_ndr(TALLOC_CTX *mem_ctx, struct winbindd_response *response, struct netr_SamInfo3 *info3)
31 size_t len = response->length - sizeof(struct winbindd_response);
35 blob.length = len - 4;
36 blob.data = (uint8_t *)(((char *)response->extra_data) + 4);
38 status = ndr_pull_struct_blob(&blob, mem_ctx, info3,
39 (ndr_pull_flags_fn_t)ndr_pull_netr_SamInfo3);
43 DEBUG(2, ("get_info3_from_ndr: No info3 struct found!\n"));
44 return NT_STATUS_UNSUCCESSFUL;
48 /* Authenticate a user with a challenge/response */
49 static NTSTATUS winbind_check_password(struct auth_method_context *ctx,
51 const struct auth_usersupplied_info *user_info,
52 struct auth_serversupplied_info **server_info)
54 struct winbindd_request request;
55 struct winbindd_response response;
58 struct netr_SamInfo3 info3;
60 /* Send off request */
63 ZERO_STRUCT(response);
64 request.flags = WBFLAG_PAM_INFO3_NDR;
65 fstrcpy(request.data.auth_crap.user,
66 user_info->account_name);
67 fstrcpy(request.data.auth_crap.domain,
68 user_info->domain_name);
69 fstrcpy(request.data.auth_crap.workstation,
70 user_info->workstation_name);
72 memcpy(request.data.auth_crap.chal, ctx->auth_ctx->challenge.data.data, sizeof(request.data.auth_crap.chal));
74 request.data.auth_crap.lm_resp_len = MIN(user_info->lm_resp.length,
75 sizeof(request.data.auth_crap.lm_resp));
76 request.data.auth_crap.nt_resp_len = MIN(user_info->nt_resp.length,
77 sizeof(request.data.auth_crap.nt_resp));
79 memcpy(request.data.auth_crap.lm_resp, user_info->lm_resp.data,
80 request.data.auth_crap.lm_resp_len);
81 memcpy(request.data.auth_crap.nt_resp, user_info->nt_resp.data,
82 request.data.auth_crap.nt_resp_len);
84 result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response);
86 nt_status = NT_STATUS(response.data.auth.nt_status);
87 NT_STATUS_NOT_OK_RETURN(nt_status);
89 if (result == NSS_STATUS_SUCCESS && response.extra_data) {
90 union netr_Validation validation;
92 nt_status = get_info3_from_ndr(mem_ctx, &response, &info3);
93 SAFE_FREE(response.extra_data);
94 NT_STATUS_NOT_OK_RETURN(nt_status);
96 validation.sam3 = &info3;
97 nt_status = make_server_info_netlogon_validation(mem_ctx,
98 user_info->account_name,
102 } else if (result == NSS_STATUS_SUCCESS && !response.extra_data) {
103 DEBUG(0, ("Winbindd authenticated the user [%s]\\[%s], "
104 "but did not include the required info3 reply!\n",
105 user_info->domain_name, user_info->account_name));
106 return NT_STATUS_INSUFFICIENT_LOGON_INFO;
107 } else if (NT_STATUS_IS_OK(nt_status)) {
108 DEBUG(1, ("Winbindd authentication for [%s]\\[%s] failed, "
109 "but no error code is available!\n",
110 user_info->domain_name, user_info->account_name));
111 return NT_STATUS_NO_LOGON_SERVERS;
117 static const struct auth_operations winbind_ops = {
119 .get_challenge = auth_get_challenge_not_implemented,
120 .check_password = winbind_check_password
123 NTSTATUS auth_winbind_init(void)
127 ret = auth_register(&winbind_ops);
128 if (!NT_STATUS_IS_OK(ret)) {
129 DEBUG(0,("Failed to register 'winbind' auth backend!\n"));