source3/auth/auth_sam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Password and authentication handling
   4    Copyright (C) Andrew Tridgell              1992-2000
   5    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
   6    Copyright (C) Andrew Bartlett              2001
   7    Copyright (C) Gerald Carter                2003
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_AUTH
  28
  29 /****************************************************************************
  30  Core of smb password checking routine.
  31 ****************************************************************************/
  32
  33 static BOOL smb_pwd_check_ntlmv1(const DATA_BLOB *nt_response,
  34                                  const uchar *part_passwd,
  35                                  const DATA_BLOB *sec_blob,
  36                                  uint8 user_sess_key[16])
  37 {
  38         /* Finish the encryption of part_passwd. */
  39         uchar p24[24];
  40
  41         if (part_passwd == NULL) {
  42                 DEBUG(10,("No password set - DISALLOWING access\n"));
  43                 /* No password set - always false ! */
  44                 return False;
  45         }
  46
  47         if (sec_blob->length != 8) {
  48                 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%lu)\n", (unsigned long)sec_blob->length));
  49                 return False;
  50         }
  51
  52         if (nt_response->length != 24) {
  53                 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%lu)\n", (unsigned long)nt_response->length));
  54                 return False;
  55         }
  56
  57         SMBOWFencrypt(part_passwd, sec_blob->data, p24);
  58         if (user_sess_key != NULL) {
  59                 SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key);
  60         }
  61
  62
  63
  64 #if DEBUG_PASSWORD
  65         DEBUG(100,("Part password (P16) was |\n"));
  66         dump_data(100, part_passwd, 16);
  67         DEBUGADD(100,("Password from client was |\n"));
  68         dump_data(100, nt_response->data, nt_response->length);
  69         DEBUGADD(100,("Given challenge was |\n"));
  70         dump_data(100, sec_blob->data, sec_blob->length);
  71         DEBUGADD(100,("Value from encryption was |\n"));
  72         dump_data(100, p24, 24);
  73 #endif
  74   return (memcmp(p24, nt_response->data, 24) == 0);
  75 }
  76
  77 /****************************************************************************
  78  Core of smb password checking routine. (NTLMv2, LMv2)
  79  Note:  The same code works with both NTLMv2 and LMv2.
  80 ****************************************************************************/
  81
  82 static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB *ntv2_response,
  83                                  const uchar *part_passwd,
  84                                  const DATA_BLOB *sec_blob,
  85                                  const char *user, const char *domain,
  86                                  uint8 user_sess_key[16])
  87 {
  88         /* Finish the encryption of part_passwd. */
  89         uchar kr[16];
  90         uchar value_from_encryption[16];
  91         uchar client_response[16];
  92         DATA_BLOB client_key_data;
  93
  94         if (part_passwd == NULL) {
  95                 DEBUG(10,("No password set - DISALLOWING access\n"));
  96                 /* No password set - always False */
  97                 return False;
  98         }
  99
 100         if (ntv2_response->length < 24) {
 101                 /* We MUST have more than 16 bytes, or the stuff below will go
 102                    crazy.  No known implementation sends less than the 24 bytes
 103                    for LMv2, let alone NTLMv2. */
 104                 DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%lu)\n",
 105                           (unsigned long)ntv2_response->length));
 106                 return False;
 107         }
 108
 109         client_key_data = data_blob(ntv2_response->data+16, ntv2_response->length-16);
 110         /*
 111            todo:  should we be checking this for anything?  We can't for LMv2,
 112            but for NTLMv2 it is meant to contain the current time etc.
 113         */
 114
 115         memcpy(client_response, ntv2_response->data, sizeof(client_response));
 116
 117         if (!ntv2_owf_gen(part_passwd, user, domain, kr)) {
 118                 return False;
 119         }
 120
 121         SMBOWFencrypt_ntv2(kr, sec_blob, &client_key_data, value_from_encryption);
 122         if (user_sess_key != NULL) {
 123                 SMBsesskeygen_ntv2(kr, value_from_encryption, user_sess_key);
 124         }
 125
 126 #if DEBUG_PASSWORD
 127         DEBUG(100,("Part password (P16) was |\n"));
 128         dump_data(100, part_passwd, 16);
 129         DEBUGADD(100,("Password from client was |\n"));
 130         dump_data(100, ntv2_response->data, ntv2_response->length);
 131         DEBUGADD(100,("Variable data from client was |\n"));
 132         dump_data(100, client_key_data.data, client_key_data.length);
 133         DEBUGADD(100,("Given challenge was |\n"));
 134         dump_data(100, sec_blob->data, sec_blob->length);
 135         DEBUGADD(100,("Value from encryption was |\n"));
 136         dump_data(100, value_from_encryption, 16);
 137 #endif
 138         data_blob_clear_free(&client_key_data);
 139         return (memcmp(value_from_encryption, client_response, 16) == 0);
 140 }
 141
 142 /****************************************************************************
 143  Do a specific test for an smb password being correct, given a smb_password and
 144  the lanman and NT responses.
 145 ****************************************************************************/
 146
 147 static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
 148                                 TALLOC_CTX *mem_ctx,
 149                                 SAM_ACCOUNT *sampass,
 150                                 const auth_usersupplied_info *user_info,
 151                                 uint8 user_sess_key[16])
 152 {
 153         uint16 acct_ctrl;
 154         const uint8 *nt_pw, *lm_pw;
 155         uint32 auth_flags;
 156
 157         acct_ctrl = pdb_get_acct_ctrl(sampass);
 158         if (acct_ctrl & ACB_PWNOTREQ) {
 159                 if (lp_null_passwords()) {
 160                         DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", pdb_get_username(sampass)));
 161                         return(NT_STATUS_OK);
 162                 } else {
 163                         DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", pdb_get_username(sampass)));
 164                         return(NT_STATUS_LOGON_FAILURE);
 165                 }
 166         }
 167
 168         auth_flags = user_info->auth_flags;
 169
 170         if (IS_SAM_DEFAULT(sampass, PDB_NTPASSWD)) {
 171                 DEBUG(3,("sam_password_ok: NO NT password stored for user %s.\n",
 172                          pdb_get_username(sampass)));
 173                 /* No return, we want to check the LM hash below in this case */
 174                 auth_flags &= (~(AUTH_FLAG_NTLMv2_RESP |  AUTH_FLAG_NTLM_RESP));
 175         } else {
 176                 /* Check for cleartext netlogon. Used by Exchange 5.5. */
 177                 unsigned char zeros[8];
 178
 179                 memset(zeros,'\0',sizeof(zeros));
 180                 if (auth_context->challenge.length == sizeof(zeros) &&
 181                                 (memcmp(auth_context->challenge.data, zeros, auth_context->challenge.length) == 0 ) &&
 182                                 user_info->nt_resp.length) {
 183                         if ((nt_pw = pdb_get_nt_passwd(sampass)) != NULL) {
 184                                 unsigned char pwhash[16];
 185                                 mdfour(pwhash, user_info->nt_resp.data, user_info->nt_resp.length);
 186                                 if (memcmp(pwhash, nt_pw, sizeof(pwhash)) == 0) {
 187                                         return NT_STATUS_OK;
 188                                 }
 189                         }
 190                 }
 191         }
 192
 193         if (auth_flags & AUTH_FLAG_NTLMv2_RESP) {
 194                 nt_pw = pdb_get_nt_passwd(sampass);
 195                 /* We have the NT MD4 hash challenge available - see if we can
 196                    use it (ie. does it exist in the smbpasswd file).
 197                 */
 198                 DEBUG(4,("sam_password_ok: Checking NTLMv2 password with domain [%s]\n", user_info->client_domain.str));
 199                 if (smb_pwd_check_ntlmv2( &user_info->nt_resp,
 200                                           nt_pw, &auth_context->challenge,
 201                                           user_info->smb_name.str,
 202                                           user_info->client_domain.str,
 203                                           user_sess_key)) {
 204                         return NT_STATUS_OK;
 205                 }
 206
 207                 DEBUG(4,("sam_password_ok: Checking NTLMv2 password without a domain\n"));
 208                 if (smb_pwd_check_ntlmv2( &user_info->nt_resp,
 209                                           nt_pw, &auth_context->challenge,
 210                                           user_info->smb_name.str,
 211                                           "",
 212                                           user_sess_key)) {
 213                         return NT_STATUS_OK;
 214                 } else {
 215                         DEBUG(3,("sam_password_ok: NTLMv2 password check failed\n"));
 216                         return NT_STATUS_WRONG_PASSWORD;
 217                 }
 218         } else if (auth_flags & AUTH_FLAG_NTLM_RESP) {
 219                 if (lp_ntlm_auth()) {
 220                         nt_pw = pdb_get_nt_passwd(sampass);
 221                         /* We have the NT MD4 hash challenge available - see if we can
 222                            use it (ie. does it exist in the smbpasswd file).
 223                         */
 224                         DEBUG(4,("sam_password_ok: Checking NT MD4 password\n"));
 225                         if (smb_pwd_check_ntlmv1(&user_info->nt_resp,
 226                                                  nt_pw, &auth_context->challenge,
 227                                                  user_sess_key)) {
 228                                 return NT_STATUS_OK;
 229                         } else {
 230                                 DEBUG(3,("sam_password_ok: NT MD4 password check failed for user %s\n",pdb_get_username(sampass)));
 231                                 return NT_STATUS_WRONG_PASSWORD;
 232                         }
 233                 } else {
 234                         DEBUG(2,("sam_password_ok: NTLMv1 passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass)));
 235                         /* no return, becouse we might pick up LMv2 in the LM field */
 236                 }
 237         }
 238
 239         if (auth_flags & AUTH_FLAG_LM_RESP) {
 240                 if (user_info->lm_resp.length != 24) {
 241                         DEBUG(2,("sam_password_ok: invalid LanMan password length (%lu) for user %s\n",
 242                                  (unsigned long)user_info->nt_resp.length, pdb_get_username(sampass)));
 243                 }
 244
 245                 if (!lp_lanman_auth()) {
 246                         DEBUG(3,("sam_password_ok: Lanman passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass)));
 247                 } else if (IS_SAM_DEFAULT(sampass, PDB_LMPASSWD)) {
 248                         DEBUG(3,("sam_password_ok: NO LanMan password set for user %s (and no NT password supplied)\n",pdb_get_username(sampass)));
 249                 } else {
 250                         lm_pw = pdb_get_lanman_passwd(sampass);
 251
 252                         DEBUG(4,("sam_password_ok: Checking LM password\n"));
 253                         if (smb_pwd_check_ntlmv1(&user_info->lm_resp,
 254                                                  lm_pw, &auth_context->challenge,
 255                                                  user_sess_key)) {
 256                                 return NT_STATUS_OK;
 257                         }
 258                 }
 259
 260                 if (IS_SAM_DEFAULT(sampass, PDB_NTPASSWD)) {
 261                         DEBUG(4,("sam_password_ok: LM password check failed for user, no NT password %s\n",pdb_get_username(sampass)));
 262                         return NT_STATUS_WRONG_PASSWORD;
 263                 }
 264
 265                 nt_pw = pdb_get_nt_passwd(sampass);
 266
 267                 /* This is for 'LMv2' authentication.  almost NTLMv2 but limited to 24 bytes.
 268                    - related to Win9X, legacy NAS pass-though authentication
 269                 */
 270                 DEBUG(4,("sam_password_ok: Checking LMv2 password with domain %s\n", user_info->client_domain.str));
 271                 if (smb_pwd_check_ntlmv2( &user_info->lm_resp,
 272                                           nt_pw, &auth_context->challenge,
 273                                           user_info->smb_name.str,
 274                                           user_info->client_domain.str,
 275                                           user_sess_key)) {
 276                         return NT_STATUS_OK;
 277                 }
 278
 279                 DEBUG(4,("sam_password_ok: Checking LMv2 password without a domain\n"));
 280                 if (smb_pwd_check_ntlmv2( &user_info->lm_resp,
 281                                           nt_pw, &auth_context->challenge,
 282                                           user_info->smb_name.str,
 283                                           "",
 284                                           user_sess_key)) {
 285                         return NT_STATUS_OK;
 286                 }
 287
 288                 /* Apparently NT accepts NT responses in the LM field
 289                    - I think this is related to Win9X pass-though authentication
 290                 */
 291                 DEBUG(4,("sam_password_ok: Checking NT MD4 password in LM field\n"));
 292                 if (lp_ntlm_auth()) {
 293                         if (smb_pwd_check_ntlmv1(&user_info->lm_resp,
 294                                                  nt_pw, &auth_context->challenge,
 295                                                  user_sess_key)) {
 296                                 return NT_STATUS_OK;
 297                         }
 298                         DEBUG(3,("sam_password_ok: LM password, NT MD4 password in LM field and LMv2 failed for user %s\n",pdb_get_username(sampass)));
 299                         return NT_STATUS_WRONG_PASSWORD;
 300                 } else {
 301                         DEBUG(3,("sam_password_ok: LM password and LMv2 failed for user %s, and NT MD4 password in LM field not permitted\n",pdb_get_username(sampass)));
 302                         return NT_STATUS_WRONG_PASSWORD;
 303                 }
 304
 305         }
 306
 307         /* Should not be reached, but if they send nothing... */
 308         DEBUG(3,("sam_password_ok: NEITHER LanMan nor NT password supplied for user %s\n",pdb_get_username(sampass)));
 309         return NT_STATUS_WRONG_PASSWORD;
 310 }
 311
 312 /****************************************************************************
 313  Do a specific test for a SAM_ACCOUNT being vaild for this connection
 314  (ie not disabled, expired and the like).
 315 ****************************************************************************/
 316
 317 static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
 318                                SAM_ACCOUNT *sampass,
 319                                const auth_usersupplied_info *user_info)
 320 {
 321         uint16  acct_ctrl = pdb_get_acct_ctrl(sampass);
 322         char *workstation_list;
 323         time_t kickoff_time;
 324
 325         DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass)));
 326
 327         /* Quit if the account was disabled. */
 328         if (acct_ctrl & ACB_DISABLED) {
 329                 DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", pdb_get_username(sampass)));
 330                 return NT_STATUS_ACCOUNT_DISABLED;
 331         }
 332
 333         /* Quit if the account was locked out. */
 334         if (acct_ctrl & ACB_AUTOLOCK) {
 335                 DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", pdb_get_username(sampass)));
 336                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
 337         }
 338
 339         /* Test account expire time */
 340
 341         kickoff_time = pdb_get_kickoff_time(sampass);
 342         if (kickoff_time != 0 && time(NULL) > kickoff_time) {
 343                 DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", pdb_get_username(sampass)));
 344                 DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time));
 345                 return NT_STATUS_ACCOUNT_EXPIRED;
 346         }
 347
 348         if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP)) {
 349                 time_t must_change_time = pdb_get_pass_must_change_time(sampass);
 350                 time_t last_set_time = pdb_get_pass_last_set_time(sampass);
 351
 352                 /* check for immediate expiry "must change at next logon" */
 353                 if (must_change_time == 0 && last_set_time != 0) {
 354                         DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", pdb_get_username(sampass)));
 355                         return NT_STATUS_PASSWORD_MUST_CHANGE;
 356                 }
 357
 358                 /* check for expired password */
 359                 if (must_change_time < time(NULL) && must_change_time != 0) {
 360                         DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", pdb_get_username(sampass)));
 361                         DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", http_timestring(must_change_time), (long)must_change_time));
 362                         return NT_STATUS_PASSWORD_EXPIRED;
 363                 }
 364         }
 365
 366         /* Test workstation. Workstation list is comma separated. */
 367
 368         workstation_list = talloc_strdup(mem_ctx, pdb_get_workstations(sampass));
 369         if (!workstation_list)
 370                 return NT_STATUS_NO_MEMORY;
 371
 372         if (*workstation_list) {
 373                 BOOL invalid_ws = True;
 374                 const char *s = workstation_list;
 375
 376                 fstring tok;
 377
 378                 while (next_token(&s, tok, ",", sizeof(tok))) {
 379                         DEBUG(10,("sam_account_ok: checking for workstation match %s and %s (len=%d)\n",
 380                                   tok, user_info->wksta_name.str, user_info->wksta_name.len));
 381                         if(strequal(tok, user_info->wksta_name.str)) {
 382                                 invalid_ws = False;
 383                                 break;
 384                         }
 385                 }
 386
 387                 if (invalid_ws)
 388                         return NT_STATUS_INVALID_WORKSTATION;
 389         }
 390
 391         if (acct_ctrl & ACB_DOMTRUST) {
 392                 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass)));
 393                 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 394         }
 395
 396         if (acct_ctrl & ACB_SVRTRUST) {
 397                 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass)));
 398                 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 399         }
 400
 401         if (acct_ctrl & ACB_WSTRUST) {
 402                 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass)));
 403                 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 404         }
 405
 406         return NT_STATUS_OK;
 407 }
 408
 409 /****************************************************************************
 410 check if a username/password is OK assuming the password is a 24 byte
 411 SMB hash supplied in the user_info structure
 412 return an NT_STATUS constant.
 413 ****************************************************************************/
 414
 415 static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 416                                    void *my_private_data,
 417                                    TALLOC_CTX *mem_ctx,
 418                                    const auth_usersupplied_info *user_info,
 419                                    auth_serversupplied_info **server_info)
 420 {
 421         SAM_ACCOUNT *sampass=NULL;
 422         BOOL ret;
 423         NTSTATUS nt_status;
 424         uint8 user_sess_key[16];
 425         const uint8* lm_hash;
 426
 427         if (!user_info || !auth_context) {
 428                 return NT_STATUS_UNSUCCESSFUL;
 429         }
 430
 431         /* Can't use the talloc version here, because the returned struct gets
 432            kept on the server_info */
 433         if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) {
 434                 return nt_status;
 435         }
 436
 437         /* get the account information */
 438
 439         become_root();
 440         ret = pdb_getsampwnam(sampass, user_info->internal_username.str);
 441         unbecome_root();
 442
 443         if (ret == False) {
 444                 DEBUG(3,("check_sam_security: Couldn't find user '%s' in passdb file.\n", user_info->internal_username.str));
 445                 pdb_free_sam(&sampass);
 446                 return NT_STATUS_NO_SUCH_USER;
 447         }
 448
 449         nt_status = sam_password_ok(auth_context, mem_ctx, sampass, user_info, user_sess_key);
 450
 451         if (!NT_STATUS_IS_OK(nt_status)) {
 452                 pdb_free_sam(&sampass);
 453                 return nt_status;
 454         }
 455
 456         nt_status = sam_account_ok(mem_ctx, sampass, user_info);
 457
 458         if (!NT_STATUS_IS_OK(nt_status)) {
 459                 pdb_free_sam(&sampass);
 460                 return nt_status;
 461         }
 462
 463         if (!NT_STATUS_IS_OK(nt_status = make_server_info_sam(server_info, sampass))) {
 464                 DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
 465                 return nt_status;
 466         }
 467
 468         lm_hash = pdb_get_lanman_passwd((*server_info)->sam_account);
 469         if (lm_hash) {
 470                 memcpy((*server_info)->first_8_lm_hash, lm_hash, 8);
 471         }
 472
 473         memcpy((*server_info)->session_key, user_sess_key, sizeof(user_sess_key));
 474
 475         return nt_status;
 476 }
 477
 478 /* module initialisation */
 479 static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
 480 {
 481         if (!make_auth_methods(auth_context, auth_method)) {
 482                 return NT_STATUS_NO_MEMORY;
 483         }
 484
 485         (*auth_method)->auth = check_sam_security;
 486         (*auth_method)->name = "sam_ignoredomain";
 487         return NT_STATUS_OK;
 488 }
 489
 490
 491 /****************************************************************************
 492 Check SAM security (above) but with a few extra checks.
 493 ****************************************************************************/
 494
 495 static NTSTATUS check_samstrict_security(const struct auth_context *auth_context,
 496                                          void *my_private_data,
 497                                          TALLOC_CTX *mem_ctx,
 498                                          const auth_usersupplied_info *user_info,
 499                                          auth_serversupplied_info **server_info)
 500 {
 501         BOOL is_local_name, is_my_domain;
 502
 503         if (!user_info || !auth_context) {
 504                 return NT_STATUS_LOGON_FAILURE;
 505         }
 506
 507         is_local_name = is_myname(user_info->domain.str);
 508         is_my_domain  = strequal(user_info->domain.str, lp_workgroup());
 509
 510         /* check whether or not we service this domain/workgroup name */
 511
 512         switch ( lp_server_role() ) {
 513                 case ROLE_STANDALONE:
 514                 case ROLE_DOMAIN_MEMBER:
 515                         if ( !is_local_name ) {
 516                                 DEBUG(6,("check_samstrict_security: %s is not one of my local names (%s)\n",
 517                                         user_info->domain.str, (lp_server_role() == ROLE_DOMAIN_MEMBER
 518                                         ? "ROLE_DOMAIN_MEMBER" : "ROLE_STANDALONE") ));
 519                                 return NT_STATUS_NOT_IMPLEMENTED;
 520                         }
 521                 case ROLE_DOMAIN_PDC:
 522                 case ROLE_DOMAIN_BDC:
 523                         if ( !is_local_name && !is_my_domain ) {
 524                                 DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n",
 525                                         user_info->domain.str));
 526                                 return NT_STATUS_NOT_IMPLEMENTED;
 527                         }
 528                 default: /* name is ok */
 529                         break;
 530         }
 531
 532         return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info);
 533 }
 534
 535 /* module initialisation */
 536 static NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
 537 {
 538         if (!make_auth_methods(auth_context, auth_method)) {
 539                 return NT_STATUS_NO_MEMORY;
 540         }
 541
 542         (*auth_method)->auth = check_samstrict_security;
 543         (*auth_method)->name = "sam";
 544         return NT_STATUS_OK;
 545 }
 546
 547 NTSTATUS auth_sam_init(void)
 548 {
 549         smb_register_auth(AUTH_INTERFACE_VERSION, "sam", auth_init_sam);
 550         smb_register_auth(AUTH_INTERFACE_VERSION, "sam_ignoredomain", auth_init_sam_ignoredomain);
 551         return NT_STATUS_OK;
 552 }