2 Unix SMB/CIFS implementation.
6 Copyright (C) Volker Lendecke 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/composite/composite.h"
25 #include "winbind/wb_server.h"
26 #include "smbd/service_task.h"
27 #include "auth/credentials/credentials.h"
28 #include "libcli/auth/libcli_auth.h"
29 #include "librpc/gen_ndr/ndr_netlogon.h"
30 #include "librpc/gen_ndr/ndr_netlogon_c.h"
31 #include "librpc/gen_ndr/winbind.h"
32 #include "param/param.h"
34 /* Oh, there is so much to keep an eye on when authenticating a user. Oh my! */
35 struct pam_auth_crap_state {
36 struct composite_context *ctx;
37 struct event_context *event_ctx;
39 struct winbind_SamLogon *req;
42 struct netr_NetworkInfo ninfo;
43 struct netr_LogonSamLogon r;
45 const char *user_name;
46 const char *domain_name;
48 struct netr_UserSessionKey user_session_key;
49 struct netr_LMSessionKey lm_key;
54 * NTLM authentication.
57 static void pam_auth_crap_recv_logon(struct composite_context *ctx);
59 struct composite_context *wb_cmd_pam_auth_crap_send(TALLOC_CTX *mem_ctx,
60 struct wbsrv_service *service,
61 uint32_t logon_parameters,
64 const char *workstation,
69 struct composite_context *result, *ctx;
70 struct pam_auth_crap_state *state;
71 struct netr_NetworkInfo *ninfo;
72 DATA_BLOB tmp_nt_resp, tmp_lm_resp;
74 result = composite_create(mem_ctx, service->task->event_ctx);
75 if (result == NULL) goto failed;
77 state = talloc(result, struct pam_auth_crap_state);
78 if (state == NULL) goto failed;
80 result->private_data = state;
82 state->req = talloc(state, struct winbind_SamLogon);
84 state->req->in.logon_level = 2;
85 state->req->in.validation_level = 3;
86 ninfo = state->req->in.logon.network = talloc(state, struct netr_NetworkInfo);
87 if (ninfo == NULL) goto failed;
89 ninfo->identity_info.account_name.string = talloc_strdup(state, user);
90 ninfo->identity_info.domain_name.string = talloc_strdup(state, domain);
91 ninfo->identity_info.parameter_control = logon_parameters;
92 ninfo->identity_info.logon_id_low = 0;
93 ninfo->identity_info.logon_id_high = 0;
94 ninfo->identity_info.workstation.string = talloc_strdup(state, workstation);
96 SMB_ASSERT(chal.length == sizeof(ninfo->challenge));
97 memcpy(ninfo->challenge, chal.data,
98 sizeof(ninfo->challenge));
100 tmp_nt_resp = data_blob_talloc(ninfo, nt_resp.data, nt_resp.length);
101 if ((nt_resp.data != NULL) &&
102 (tmp_nt_resp.data == NULL)) goto failed;
104 tmp_lm_resp = data_blob_talloc(ninfo, lm_resp.data, lm_resp.length);
105 if ((lm_resp.data != NULL) &&
106 (tmp_lm_resp.data == NULL)) goto failed;
108 ninfo->nt.length = tmp_nt_resp.length;
109 ninfo->nt.data = tmp_nt_resp.data;
110 ninfo->lm.length = tmp_lm_resp.length;
111 ninfo->lm.data = tmp_lm_resp.data;
113 state->unix_username = NULL;
115 ctx = wb_sam_logon_send(mem_ctx, service, state->req);
116 if (ctx == NULL) goto failed;
118 composite_continue(result, ctx, pam_auth_crap_recv_logon, state);
129 Send of a SamLogon request to authenticate a user.
131 static void pam_auth_crap_recv_logon(struct composite_context *ctx)
134 enum ndr_err_code ndr_err;
135 struct netr_SamBaseInfo *base;
136 struct pam_auth_crap_state *state =
137 talloc_get_type(ctx->async.private_data,
138 struct pam_auth_crap_state);
140 state->ctx->status = wb_sam_logon_recv(ctx, state, state->req);
141 if (!composite_is_ok(state->ctx)) return;
143 ndr_err = ndr_push_struct_blob(
144 &tmp_blob, state, state->req->out.validation.sam3,
145 (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
146 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
147 state->ctx->status = ndr_map_error2ntstatus(ndr_err);
148 if (!composite_is_ok(state->ctx)) return;
151 /* The Samba3 protocol is a bit broken (due to non-IDL
152 * heritage, so for compatability we must add a non-zero 4
153 * bytes to the info3 */
154 state->info3 = data_blob_talloc(state, NULL, tmp_blob.length+4);
155 if (composite_nomem(state->info3.data, state->ctx)) return;
157 SIVAL(state->info3.data, 0, 1);
158 memcpy(state->info3.data+4, tmp_blob.data, tmp_blob.length);
160 base = &state->req->out.validation.sam3->base;
162 state->user_session_key = base->key;
163 state->lm_key = base->LMSessKey;
165 /* Give the caller the most accurate username possible.
166 * Assists where case sensitive comparisons may be done by our
167 * ntlm_auth callers */
168 if (base->account_name.string) {
169 state->user_name = base->account_name.string;
170 talloc_steal(state, base->account_name.string);
172 if (base->domain.string) {
173 state->domain_name = base->domain.string;
174 talloc_steal(state, base->domain.string);
177 state->unix_username = talloc_asprintf(state, "%s%s%s",
179 lp_winbind_separator(global_loadparm),
181 if (composite_nomem(state->unix_username, state->ctx)) return;
183 composite_done(state->ctx);
186 /* Having received a NTLM authentication reply, parse out the useful
187 * reply data for the caller */
188 NTSTATUS wb_cmd_pam_auth_crap_recv(struct composite_context *c,
191 struct netr_UserSessionKey *user_session_key,
192 struct netr_LMSessionKey *lm_key,
193 char **unix_username)
195 struct pam_auth_crap_state *state =
196 talloc_get_type(c->private_data, struct pam_auth_crap_state);
197 NTSTATUS status = composite_wait(c);
198 if (NT_STATUS_IS_OK(status)) {
199 info3->length = state->info3.length;
200 info3->data = talloc_steal(mem_ctx, state->info3.data);
201 *user_session_key = state->user_session_key;
202 *lm_key = state->lm_key;
203 *unix_username = talloc_steal(mem_ctx, state->unix_username);
209 /* Handle plaintext authentication, by encrypting the password and
210 * then sending via the NTLM calls */
212 struct composite_context *wb_cmd_pam_auth_send(TALLOC_CTX *mem_ctx,
213 struct wbsrv_service *service,
216 const char *password)
218 struct cli_credentials *credentials;
219 const char *workstation;
222 DATA_BLOB chal, nt_resp, lm_resp, names_blob;
223 int flags = CLI_CRED_NTLM_AUTH;
224 if (lp_client_lanman_auth(service->task->lp_ctx)) {
225 flags |= CLI_CRED_LANMAN_AUTH;
228 if (lp_client_ntlmv2_auth(service->task->lp_ctx)) {
229 flags |= CLI_CRED_NTLMv2_AUTH;
232 DEBUG(5, ("wbsrv_samba3_pam_auth called\n"));
234 credentials = cli_credentials_init(mem_ctx);
238 cli_credentials_set_conf(credentials, service->task->lp_ctx);
239 cli_credentials_set_domain(credentials, domain, CRED_SPECIFIED);
240 cli_credentials_set_username(credentials, user, CRED_SPECIFIED);
242 cli_credentials_set_password(credentials, password, CRED_SPECIFIED);
244 chal = data_blob_talloc(mem_ctx, NULL, 8);
248 generate_random_buffer(chal.data, chal.length);
249 cli_credentials_get_ntlm_username_domain(credentials, mem_ctx,
251 /* for best compatability with multiple vitual netbios names
252 * on the host, this should be generated from the
253 * cli_credentials associated with the machine account */
254 workstation = cli_credentials_get_workstation(credentials);
256 names_blob = NTLMv2_generate_names_blob(
258 cli_credentials_get_workstation(credentials),
259 cli_credentials_get_domain(credentials));
261 status = cli_credentials_get_ntlm_response(
262 credentials, mem_ctx, &flags, chal, names_blob,
263 &lm_resp, &nt_resp, NULL, NULL);
264 if (!NT_STATUS_IS_OK(status)) {
267 return wb_cmd_pam_auth_crap_send(mem_ctx, service,
268 0 /* logon parameters */,
269 domain, user, workstation,
270 chal, nt_resp, lm_resp);
273 NTSTATUS wb_cmd_pam_auth_recv(struct composite_context *c)
275 struct pam_auth_crap_state *state =
276 talloc_get_type(c->private_data, struct pam_auth_crap_state);
277 NTSTATUS status = composite_wait(c);