2 Unix SMB/CIFS implementation.
4 PAC Glue between Samba and the KDC
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
7 Copyright (C) Simo Sorce <idra@samba.org> 2010
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "system/kerberos.h"
25 #include "auth/kerberos/kerberos.h"
26 #include <krb5/krb5.h>
28 #include "lib/util/data_blob.h"
29 #include "lib/util/time.h"
30 #include "libcli/util/ntstatus.h"
31 #include "libcli/util/werror.h"
32 #include "librpc/gen_ndr/auth.h"
33 #include "kdc/samba_kdc.h"
34 #include "lib/krb5_wrap/krb5_samba.h"
35 #include "auth/session.h"
37 enum samba_asserted_identity {
38 SAMBA_ASSERTED_IDENTITY_IGNORE = 0,
39 SAMBA_ASSERTED_IDENTITY_SERVICE,
40 SAMBA_ASSERTED_IDENTITY_AUTHENTICATION_AUTHORITY,
44 SAMBA_KDC_FLAG_PROTOCOL_TRANSITION = 0x00000001,
45 SAMBA_KDC_FLAG_CONSTRAINED_DELEGATION = 0x00000002,
48 bool samba_kdc_entry_is_trust(const struct samba_kdc_entry *entry);
50 struct samba_kdc_entry_pac {
51 struct samba_kdc_entry *entry;
52 krb5_const_pac pac; /* NULL indicates that no PAC is present. */
53 bool is_from_trust : 1;
54 #ifndef HAVE_KRB5_PAC_IS_TRUSTED /* MIT */
55 bool pac_is_trusted : 1;
56 #endif /* HAVE_KRB5_PAC_IS_TRUSTED */
60 * Return true if this entry has an associated PAC issued or signed by a KDC
61 * that our KDC trusts. We trust the main krbtgt account, but we don’t trust any
62 * RODC krbtgt besides ourselves.
64 bool samba_krb5_pac_is_trusted(const struct samba_kdc_entry_pac pac);
66 #ifdef HAVE_KRB5_PAC_IS_TRUSTED /* Heimdal */
67 struct samba_kdc_entry_pac samba_kdc_entry_pac(krb5_const_pac pac,
68 struct samba_kdc_entry *entry,
71 struct samba_kdc_entry_pac samba_kdc_entry_pac_from_trusted(krb5_const_pac pac,
72 struct samba_kdc_entry *entry,
75 #endif /* HAVE_KRB5_PAC_IS_TRUSTED */
77 krb5_error_code samba_kdc_encrypt_pac_credentials(krb5_context context,
78 const krb5_keyblock *pkreplykey,
79 const DATA_BLOB *cred_ndr_blob,
81 DATA_BLOB *cred_info_blob);
83 krb5_error_code samba_make_krb5_pac(krb5_context context,
84 const DATA_BLOB *logon_blob,
85 const DATA_BLOB *cred_blob,
86 const DATA_BLOB *upn_blob,
87 const DATA_BLOB *pac_attrs_blob,
88 const DATA_BLOB *requester_sid_blob,
89 const DATA_BLOB *deleg_blob,
90 const DATA_BLOB *client_claims_blob,
91 const DATA_BLOB *device_info_blob,
92 const DATA_BLOB *device_claims_blob,
95 bool samba_princ_needs_pac(const struct samba_kdc_entry *skdc_entry);
97 krb5_error_code samba_krbtgt_is_in_db(const struct samba_kdc_entry *skdc_entry,
101 krb5_error_code samba_kdc_get_user_info_from_db(TALLOC_CTX *mem_ctx,
102 struct ldb_context *samdb,
103 struct samba_kdc_entry *entry,
104 const struct ldb_message *msg,
105 const struct auth_user_info_dc **info_out);
107 krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status);
109 NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry,
110 const char *client_name,
111 const char *workstation,
112 bool password_change);
114 krb5_error_code samba_kdc_verify_pac(TALLOC_CTX *mem_ctx,
115 krb5_context context,
116 struct ldb_context *samdb,
118 const struct samba_kdc_entry_pac client,
119 const struct samba_kdc_entry *krbtgt);
121 struct authn_audit_info;
122 krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
123 krb5_context context,
124 struct ldb_context *samdb,
125 struct loadparm_context *lp_ctx,
127 const struct samba_kdc_entry_pac client,
128 const krb5_const_principal server_principal,
129 const struct samba_kdc_entry *server,
130 const krb5_const_principal delegated_proxy_principal,
131 const struct samba_kdc_entry_pac delegated_proxy,
132 const struct samba_kdc_entry_pac device,
134 struct authn_audit_info **server_audit_info_out,
135 NTSTATUS *status_out);
137 NTSTATUS samba_kdc_get_logon_info_blob(TALLOC_CTX *mem_ctx,
138 const struct auth_user_info_dc *user_info_dc,
139 enum auth_group_inclusion group_inclusion,
140 DATA_BLOB **_logon_info_blob);
141 NTSTATUS samba_kdc_get_cred_ndr_blob(TALLOC_CTX *mem_ctx,
142 const struct samba_kdc_entry *p,
143 DATA_BLOB **_cred_ndr_blob);
144 NTSTATUS samba_kdc_get_upn_info_blob(TALLOC_CTX *mem_ctx,
145 const struct auth_user_info_dc *user_info_dc,
146 DATA_BLOB **_upn_info_blob);
147 NTSTATUS samba_kdc_get_pac_attrs_blob(TALLOC_CTX *mem_ctx,
148 uint64_t pac_attributes,
149 DATA_BLOB **_pac_attrs_blob);
150 NTSTATUS samba_kdc_get_requester_sid_blob(TALLOC_CTX *mem_ctx,
151 const struct auth_user_info_dc *user_info_dc,
152 DATA_BLOB **_requester_sid_blob);
153 NTSTATUS samba_kdc_get_claims_blob(TALLOC_CTX *mem_ctx,
154 struct samba_kdc_entry *p,
155 const DATA_BLOB **_claims_blob);
157 krb5_error_code samba_kdc_allowed_to_authenticate_to(TALLOC_CTX *mem_ctx,
158 struct ldb_context *samdb,
159 struct loadparm_context *lp_ctx,
160 const struct samba_kdc_entry *client,
161 const struct auth_user_info_dc *client_info,
162 const struct samba_kdc_entry *server,
163 struct authn_audit_info **server_audit_info_out,
164 NTSTATUS *status_out);
166 krb5_error_code samba_kdc_check_device(TALLOC_CTX *mem_ctx,
167 krb5_context context,
168 struct ldb_context *samdb,
169 struct loadparm_context *lp_ctx,
170 const struct samba_kdc_entry_pac device,
171 const struct authn_kerberos_client_policy *client_policy,
172 struct authn_audit_info **client_audit_info_out,
173 NTSTATUS *status_out);
175 krb5_error_code samba_kdc_get_claims_data(TALLOC_CTX *mem_ctx,
176 krb5_context context,
177 struct ldb_context *samdb,
178 struct samba_kdc_entry_pac entry,
179 struct claims_data **claims_data_out);
181 krb5_error_code samba_kdc_get_claims_data_from_pac(TALLOC_CTX *mem_ctx,
182 krb5_context context,
183 struct samba_kdc_entry_pac entry,
184 struct claims_data **claims_data_out);
186 krb5_error_code samba_kdc_get_claims_data_from_db(struct ldb_context *samdb,
187 struct samba_kdc_entry *entry,
188 struct claims_data **claims_data_out);
190 NTSTATUS samba_kdc_add_asserted_identity(enum samba_asserted_identity ai,
191 struct auth_user_info_dc *user_info_dc);
193 NTSTATUS samba_kdc_add_claims_valid(struct auth_user_info_dc *user_info_dc);