auth: Split out make_user_info_SamBaseInfo and add authenticated argument

This will allow the source3 auth code to call this without needing to
double-parse the SIDs

Andrew Bartlett

Signed-off-by: Andrew Tridgell <tridge@samba.org>

diff --git a/auth/auth_sam_reply.c b/auth/auth_sam_reply.c
index 5cd4530effe908e75f5f2a371026b92f1f23c552..1644278bf0435efc8a6c3f60bcd5b1ed4be86694 100644 (file)
--- a/auth/auth_sam_reply.c
+++ b/auth/auth_sam_reply.c
@@ -174,6 +174,53 @@ NTSTATUS auth_convert_user_info_dc_saminfo3(TALLOC_CTX *mem_ctx,
        return NT_STATUS_OK;
 }
 
+/**
+ * Make a user_info struct from the info3 or similar returned by a domain logon.
+ *
+ * The netr_SamInfo3 is also a key structure in the source3 auth subsystem
+ */
+
+NTSTATUS make_user_info_SamBaseInfo(TALLOC_CTX *mem_ctx,
+                                   const char *account_name,
+                                   struct netr_SamBaseInfo *base,
+                                   bool authenticated,
+                                   struct auth_user_info **_user_info)
+{
+       struct auth_user_info *info;
+
+       info = talloc_zero(mem_ctx, struct auth_user_info);
+       NT_STATUS_HAVE_NO_MEMORY(info);
+
+       if (base->account_name.string) {
+               info->account_name = talloc_reference(info, base->account_name.string);
+       } else {
+               info->account_name = talloc_strdup(info, account_name);
+               NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+       }
+
+       info->domain_name = talloc_reference(info, base->domain.string);
+       info->full_name = talloc_reference(info, base->full_name.string);
+       info->logon_script = talloc_reference(info, base->logon_script.string);
+       info->profile_path = talloc_reference(info, base->profile_path.string);
+       info->home_directory = talloc_reference(info, base->home_directory.string);
+       info->home_drive = talloc_reference(info, base->home_drive.string);
+       info->logon_server = talloc_reference(info, base->logon_server.string);
+       info->last_logon = base->last_logon;
+       info->last_logoff = base->last_logoff;
+       info->acct_expiry = base->acct_expiry;
+       info->last_password_change = base->last_password_change;
+       info->allow_password_change = base->allow_password_change;
+       info->force_password_change = base->force_password_change;
+       info->logon_count = base->logon_count;
+       info->bad_password_count = base->bad_password_count;
+       info->acct_flags = base->acct_flags;
+
+       info->authenticated = authenticated;
+
+       *_user_info = info;
+       return NT_STATUS_OK;
+}
+
 /**
  * Make a user_info_dc struct from the info3 returned by a domain logon
  */
@@ -181,10 +228,11 @@ NTSTATUS make_user_info_dc_netlogon_validation(TALLOC_CTX *mem_ctx,
                                              const char *account_name,
                                              uint16_t validation_level,
                                              union netr_Validation *validation,
+                                              bool authenticated,
                                              struct auth_user_info_dc **_user_info_dc)
 {
+       NTSTATUS status;
        struct auth_user_info_dc *user_info_dc;
-       struct auth_user_info *info;
        struct netr_SamBaseInfo *base = NULL;
        uint32_t i;
 
@@ -287,35 +335,11 @@ NTSTATUS make_user_info_dc_netlogon_validation(TALLOC_CTX *mem_ctx,
                /* Where are the 'global' sids?... */
        }
 
-       user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
-       NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
-
-       if (base->account_name.string) {
-               info->account_name = talloc_reference(info, base->account_name.string);
-       } else {
-               info->account_name = talloc_strdup(info, account_name);
-               NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+       status = make_user_info_SamBaseInfo(user_info_dc, account_name, base, authenticated, &user_info_dc->info);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
        }
 
-       info->domain_name = talloc_reference(info, base->domain.string);
-       info->full_name = talloc_reference(info, base->full_name.string);
-       info->logon_script = talloc_reference(info, base->logon_script.string);
-       info->profile_path = talloc_reference(info, base->profile_path.string);
-       info->home_directory = talloc_reference(info, base->home_directory.string);
-       info->home_drive = talloc_reference(info, base->home_drive.string);
-       info->logon_server = talloc_reference(info, base->logon_server.string);
-       info->last_logon = base->last_logon;
-       info->last_logoff = base->last_logoff;
-       info->acct_expiry = base->acct_expiry;
-       info->last_password_change = base->last_password_change;
-       info->allow_password_change = base->allow_password_change;
-       info->force_password_change = base->force_password_change;
-       info->logon_count = base->logon_count;
-       info->bad_password_count = base->bad_password_count;
-       info->acct_flags = base->acct_flags;
-
-       info->authenticated = true;
-
        /* ensure we are never given NULL session keys */
 
        if (all_zero(base->key.key, sizeof(base->key.key))) {
@@ -350,7 +374,9 @@ NTSTATUS make_user_info_dc_pac(TALLOC_CTX *mem_ctx,
 
        validation.sam3 = &pac_logon_info->info3;
 
-       nt_status = make_user_info_dc_netlogon_validation(mem_ctx, "", 3, &validation, &user_info_dc);
+       nt_status = make_user_info_dc_netlogon_validation(mem_ctx, "", 3, &validation,
+                                                         true, /* This user was authenticated */
+                                                         &user_info_dc);
        if (!NT_STATUS_IS_OK(nt_status)) {
                return nt_status;
        }

diff --git a/auth/auth_sam_reply.h b/auth/auth_sam_reply.h
index bd92872009db313cbea4cbfc0cf48577776e3d64..c782c1c5cc21ad2edb18df7d1bf001e5ce4f6d4e 100644 (file)
--- a/auth/auth_sam_reply.h
+++ b/auth/auth_sam_reply.h
@@ -32,6 +32,12 @@
 
 /* The following definitions come from auth/auth_sam_reply.c  */
 
+NTSTATUS make_user_info_SamBaseInfo(TALLOC_CTX *mem_ctx,
+                                   const char *account_name,
+                                   struct netr_SamBaseInfo *base,
+                                   bool authenticated,
+                                   struct auth_user_info **_user_info);
+
 NTSTATUS auth_convert_user_info_dc_sambaseinfo(TALLOC_CTX *mem_ctx,
                                              struct auth_user_info_dc *user_info_dc,
                                              struct netr_SamBaseInfo **_sam);
@@ -46,6 +52,7 @@ NTSTATUS make_user_info_dc_netlogon_validation(TALLOC_CTX *mem_ctx,
                                              const char *account_name,
                                              uint16_t validation_level,
                                              union netr_Validation *validation,
+                                              bool authenticated,
                                              struct auth_user_info_dc **_user_info_dc);
 
 /**

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 0ef7df88b3a723974fa473d954fff4a2b5035a88..0627911aeb445290b83e70a4204c41bdc596f159 100644 (file)
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -465,8 +465,6 @@ NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
        struct dom_sid tmp_sid;
        struct auth_session_info *session_info;
        struct wbcUnixId *ids;
-       struct auth_user_info_dc *user_info_dc;
-       union netr_Validation val;
 
        /* Ensure we can't possible take a code path leading to a
         * null defref. */
@@ -547,22 +545,16 @@ NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
                return NT_STATUS_OK;
        }
 
-       val.sam3 = server_info->info3;
-
-       /* Convert into something we can build a struct
-        * auth_session_info from.  Most of the work here
-        * will be to convert the SIDS, which we will then ignore, but
-        * this is the easier way to handle it */
-       status = make_user_info_dc_netlogon_validation(talloc_tos(), "", 3, &val, &user_info_dc);
+       /* We need to populate session_info->info with the information found in server_info->info3 */
+       status = make_user_info_SamBaseInfo(session_info, "", &server_info->info3->base,
+                                           server_info->guest == false,
+                                           &session_info->info);
        if (!NT_STATUS_IS_OK(status)) {
-               DEBUG(0, ("conversion of info3 into user_info_dc failed!\n"));
+               DEBUG(0, ("conversion of info3 into auth_user_info failed!\n"));
                TALLOC_FREE(session_info);
                return status;
        }
 
-       session_info->info = talloc_move(session_info, &user_info_dc->info);
-       talloc_free(user_info_dc);
-
        /*
         * If winbind is not around, we can not make much use of the SIDs the
         * domain controller provided us with. Likewise if the user name was

diff --git a/source4/auth/gensec/gensec_krb5.c b/source4/auth/gensec/gensec_krb5.c
index c3e3b98f74373d77f814691a53c5cec2f171c16e..d47bc7709c9e2b78939af12a009486a5ab9b27e1 100644 (file)
--- a/source4/auth/gensec/gensec_krb5.c
+++ b/source4/auth/gensec/gensec_krb5.c
@@ -714,6 +714,7 @@ static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security
                nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
                                                                 NULL,
                                                                 3, &validation,
+                                                                 true, /* This user was authenticated */
                                                                 &user_info_dc);
                if (!NT_STATUS_IS_OK(nt_status)) {
                        free(principal_string);

diff --git a/source4/auth/ntlm/auth_winbind.c b/source4/auth/ntlm/auth_winbind.c
index da152e718a85ab63caaa9657c76a680a7c9b2df4..63827ef75508743103783b48156459fcd6991f35 100644 (file)
--- a/source4/auth/ntlm/auth_winbind.c
+++ b/source4/auth/ntlm/auth_winbind.c
@@ -220,6 +220,7 @@ static NTSTATUS winbind_check_password(struct auth_method_context *ctx,
                                                      user_info->client.account_name,
                                                      s->req.in.validation_level,
                                                      &s->req.out.validation,
+                                                      true, /* This user was authenticated */
                                                      user_info_dc);
        NT_STATUS_NOT_OK_RETURN(status);
 
@@ -304,8 +305,10 @@ static NTSTATUS winbind_check_password_wbclient(struct auth_method_context *ctx,
 
        validation.sam3 = &info3;
        nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
-                                       user_info->client.account_name,
-                                       3, &validation, user_info_dc);
+                                                         user_info->client.account_name,
+                                                         3, &validation,
+                                                         true, /* This user was authenticated */
+                                                         user_info_dc);
        return nt_status;
 
 }

diff --git a/source4/torture/auth/pac.c b/source4/torture/auth/pac.c
index f09e039964e0858926541c86435e9f62b0416502..4840a79b7fd835c874d81013e90870e1f1c164c8 100644 (file)
--- a/source4/torture/auth/pac.c
+++ b/source4/torture/auth/pac.c
@@ -223,7 +223,8 @@ static bool torture_pac_self_check(struct torture_context *tctx)
        nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
                                                         "",
                                                         3, &validation,
-                                                        &user_info_dc_out);
+                                                         true, /* This user was authenticated */
+                                                &user_info_dc_out);
        if (!NT_STATUS_IS_OK(nt_status)) {
                torture_fail(tctx, 
                             talloc_asprintf(tctx, 
@@ -487,6 +488,7 @@ static bool torture_pac_saved_check(struct torture_context *tctx)
        nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
                                                         "",
                                                         3, &validation,
+                                                         true, /* This user was authenticated */
                                                         &user_info_dc_out);
        if (!NT_STATUS_IS_OK(nt_status)) {
                krb5_free_keyblock_contents(smb_krb5_context->krb5_context, 

diff --git a/source4/torture/rpc/remote_pac.c b/source4/torture/rpc/remote_pac.c
index 70912781a82b9292dba8f25fe2f6d86ec6c3d257..37fb8af1478af83a3b6e35d714e59e9f13306667 100644 (file)
--- a/source4/torture/rpc/remote_pac.c
+++ b/source4/torture/rpc/remote_pac.c
@@ -598,6 +598,7 @@ static bool test_S2U4Self(struct torture_context *tctx,
                                                      ninfo.identity_info.account_name.string,
                                                      r.in.validation_level,
                                                      r.out.validation,
+                                                         true, /* This user was authenticated */
                                                      &netlogon_user_info_dc);
 
        torture_assert_ntstatus_ok(tctx, status, "make_user_info_dc_netlogon_validation failed");