}
/*
- * Create the token to use from server_info->sam_account and
+ * Create the token to use from server_info->info3 and
* server_info->sids (the info3/sam groups). Find the unix gids.
*/
NTSTATUS status;
size_t i;
struct dom_sid tmp_sid;
+ struct dom_sid user_sid;
/*
* If winbind is not around, we can not make much use of the SIDs the
&server_info->ptok);
} else {
+ sid_compose(&user_sid,
+ server_info->info3->base.domain_sid,
+ server_info->info3->base.rid);
+
server_info->ptok = create_local_nt_token(
server_info,
- pdb_get_user_sid(server_info->sam_account),
+ &user_sid,
server_info->guest,
server_info->num_sids, server_info->sids);
status = server_info->ptok ?
return NT_STATUS_NO_MEMORY;
}
- result->sam_account = sampass;
+ status = samu_to_SamInfo3(result, sampass,
+ global_myname(), &result->info3);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(10, ("Failed to convert samu to info3: %s\n",
+ nt_errstr(status)));
+ TALLOC_FREE(sampass);
+ TALLOC_FREE(result);
+ return status;
+ }
+
result->unix_name = talloc_strdup(result, unix_username);
result->sanitized_username = sanitize_username(result, unix_username);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
nt_errstr(status)));
+ TALLOC_FREE(sampass);
TALLOC_FREE(result);
return status;
}
+ TALLOC_FREE(sampass);
+
/*
* The SID returned in server_info->sam_account is based
* on our SAM sid even though for a pure UNIX account this should
return NT_STATUS_NO_SUCH_USER;
}
+ /* FIXME: add to info3 too ? */
status = add_sid_to_array_unique(result, &u_sid,
&result->sids,
&result->num_sids);
dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
src->lm_session_key.length);
- dst->sam_account = samu_new(NULL);
- if (!dst->sam_account) {
- TALLOC_FREE(dst);
- return NULL;
- }
-
- if (!pdb_copy_sam_account(dst->sam_account, src->sam_account)) {
+ dst->info3 = copy_netr_SamInfo3(dst, src->info3);
+ if (!dst->info3) {
TALLOC_FREE(dst);
return NULL;
}
/***************************************************************************
Purely internal function for make_server_info_info3
- Fill the sam account from getpwnam
***************************************************************************/
-static NTSTATUS fill_sam_account(TALLOC_CTX *mem_ctx,
- const char *domain,
- const char *username,
- char **found_username,
- uid_t *uid, gid_t *gid,
- struct samu *account,
- bool *username_was_mapped)
+
+static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
+ const char *username, char **found_username,
+ uid_t *uid, gid_t *gid,
+ bool *username_was_mapped)
{
struct smbd_server_connection *sconn = smbd_server_conn;
NTSTATUS nt_status;
fstr_sprintf(dom_user, "%s%c%s", domain, *lp_winbind_separator(),
lower_username);
- /* Get the passwd struct. Try to create the account is necessary. */
+ /* Get the passwd struct. Try to create the account if necessary. */
*username_was_mapped = map_username(sconn, dom_user);
*found_username = talloc_strdup( mem_ctx, real_username );
- DEBUG(5,("fill_sam_account: located username was [%s]\n", *found_username));
-
- nt_status = samu_set_unix( account, passwd );
-
TALLOC_FREE(passwd);
return nt_status;
char *found_username = NULL;
const char *nt_domain;
const char *nt_username;
- struct samu *sam_account = NULL;
struct dom_sid user_sid;
struct dom_sid group_sid;
bool username_was_mapped;
nt_domain = domain;
}
- /* try to fill the SAM account.. If getpwnam() fails, then try the
- add user script (2.2.x behavior).
+ /* If getpwnam() fails try the add user script (2.2.x behavior).
We use the _unmapped_ username here in an attempt to provide
consistent username mapping behavior between kerberos and NTLM[SSP]
that is how the current code is designed. Making the change here
is the least disruptive place. -- jerry */
- if ( !(sam_account = samu_new( NULL )) ) {
- return NT_STATUS_NO_MEMORY;
- }
-
/* this call will try to create the user if necessary */
- nt_status = fill_sam_account(mem_ctx, nt_domain, sent_nt_username,
- &found_username, &uid, &gid, sam_account,
+ nt_status = check_account(mem_ctx, nt_domain, sent_nt_username,
+ &found_username, &uid, &gid,
&username_was_mapped);
-
- /* if we still don't have a valid unix account check for
- 'map to guest = bad uid' */
-
- if (!NT_STATUS_IS_OK(nt_status)) {
- TALLOC_FREE( sam_account );
- if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
- make_server_info_guest(NULL, server_info);
- return NT_STATUS_OK;
- }
- return nt_status;
- }
-
- if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (!pdb_set_fullname(sam_account,
- info3->base.full_name.string,
- PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_logon_script(sam_account,
- info3->base.logon_script.string,
- PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_profile_path(sam_account,
- info3->base.profile_path.string,
- PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_homedir(sam_account,
- info3->base.home_directory.string,
- PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_dir_drive(sam_account,
- info3->base.home_drive.string,
- PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_acct_ctrl(sam_account, info3->base.acct_flags, PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_pass_last_set_time(
- sam_account,
- nt_time_to_unix(info3->base.last_password_change),
- PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_pass_can_change_time(
- sam_account,
- nt_time_to_unix(info3->base.allow_password_change),
- PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_pass_must_change_time(
- sam_account,
- nt_time_to_unix(info3->base.force_password_change),
- PDB_CHANGED)) {
- TALLOC_FREE(sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
result = make_server_info(NULL);
if (result == NULL) {
DEBUG(4, ("make_server_info failed!\n"));
- TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
- /* save this here to _net_sam_logon() doesn't fail (it assumes a
- valid struct samu) */
-
- result->sam_account = sam_account;
result->unix_name = talloc_strdup(result, found_username);
result->sanitized_username = sanitize_username(result,
return NT_STATUS_NO_MEMORY;
}
+ /* copy in the info3 */
+ result->info3 = copy_netr_SamInfo3(result, info3);
+
/* Fill in the unix info we found on the way */
result->utok.uid = uid;
const struct wbcAuthUserInfo *info,
struct auth_serversupplied_info **server_info)
{
- static const char zeros[16] = {0, };
-
- NTSTATUS nt_status = NT_STATUS_OK;
- char *found_username = NULL;
- const char *nt_domain;
- const char *nt_username;
- struct samu *sam_account = NULL;
- struct dom_sid user_sid;
- struct dom_sid group_sid;
- bool username_was_mapped;
- uint32_t i;
-
- uid_t uid = (uid_t)-1;
- gid_t gid = (gid_t)-1;
-
- struct auth_serversupplied_info *result;
-
- result = make_server_info(NULL);
- if (result == NULL) {
- DEBUG(4, ("make_server_info failed!\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- /*
- Here is where we should check the list of
- trusted domains, and verify that the SID
- matches.
- */
-
- memcpy(&user_sid, &info->sids[0].sid, sizeof(user_sid));
- memcpy(&group_sid, &info->sids[1].sid, sizeof(group_sid));
+ struct netr_SamInfo3 *info3;
- if (info->account_name) {
- nt_username = talloc_strdup(result, info->account_name);
- } else {
- /* If the server didn't give us one, just use the one we sent
- * them */
- nt_username = talloc_strdup(result, sent_nt_username);
- }
- if (!nt_username) {
- TALLOC_FREE(result);
+ info3 = wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx, info);
+ if (!info3) {
return NT_STATUS_NO_MEMORY;
}
- if (info->domain_name) {
- nt_domain = talloc_strdup(result, info->domain_name);
- } else {
- /* If the server didn't give us one, just use the one we sent
- * them */
- nt_domain = talloc_strdup(result, domain);
- }
- if (!nt_domain) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- /* try to fill the SAM account.. If getpwnam() fails, then try the
- add user script (2.2.x behavior).
-
- We use the _unmapped_ username here in an attempt to provide
- consistent username mapping behavior between kerberos and NTLM[SSP]
- authentication in domain mode security. I.E. Username mapping
- should be applied to the fully qualified username
- (e.g. DOMAIN\user) and not just the login name. Yes this means we
- called map_username() unnecessarily in make_user_info_map() but
- that is how the current code is designed. Making the change here
- is the least disruptive place. -- jerry */
-
- if ( !(sam_account = samu_new( result )) ) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- /* this call will try to create the user if necessary */
-
- nt_status = fill_sam_account(result, nt_domain, sent_nt_username,
- &found_username, &uid, &gid, sam_account,
- &username_was_mapped);
-
- /* if we still don't have a valid unix account check for
- 'map to guest = bad uid' */
-
- if (!NT_STATUS_IS_OK(nt_status)) {
- TALLOC_FREE( result );
- if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
- make_server_info_guest(NULL, server_info);
- return NT_STATUS_OK;
- }
- return nt_status;
- }
-
- if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (!pdb_set_fullname(sam_account, info->full_name, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_logon_script(sam_account, info->logon_script, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_profile_path(sam_account, info->profile_path, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_homedir(sam_account, info->home_directory, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_dir_drive(sam_account, info->home_drive, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_acct_ctrl(sam_account, info->acct_flags, PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_pass_last_set_time(
- sam_account,
- nt_time_to_unix(info->pass_last_set_time),
- PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_pass_can_change_time(
- sam_account,
- nt_time_to_unix(info->pass_can_change_time),
- PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_pass_must_change_time(
- sam_account,
- nt_time_to_unix(info->pass_must_change_time),
- PDB_CHANGED)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- /* save this here to _net_sam_logon() doesn't fail (it assumes a
- valid struct samu) */
-
- result->sam_account = sam_account;
- result->unix_name = talloc_strdup(result, found_username);
-
- result->sanitized_username = sanitize_username(result,
- result->unix_name);
- result->login_server = talloc_strdup(result, info->logon_server);
-
- if ((result->unix_name == NULL)
- || (result->sanitized_username == NULL)
- || (result->login_server == NULL)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- /* Fill in the unix info we found on the way */
-
- result->utok.uid = uid;
- result->utok.gid = gid;
-
- /* Create a 'combined' list of all SIDs we might want in the SD */
-
- result->num_sids = info->num_sids - 2;
- result->sids = talloc_array(result, struct dom_sid, result->num_sids);
- if (result->sids == NULL) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
-
- for (i=0; i < result->num_sids; i++) {
- memcpy(&result->sids[i], &info->sids[i+2].sid, sizeof(result->sids[i]));
- }
-
- /* Ensure the primary group sid is at position 0. */
- sort_sid_array_for_smbd(result, &group_sid);
-
- /* ensure we are never given NULL session keys */
-
- if (memcmp(info->user_session_key, zeros, sizeof(zeros)) == 0) {
- result->user_session_key = data_blob_null;
- } else {
- result->user_session_key = data_blob_talloc(
- result, info->user_session_key,
- sizeof(info->user_session_key));
- }
-
- if (memcmp(info->lm_session_key, zeros, 8) == 0) {
- result->lm_session_key = data_blob_null;
- } else {
- result->lm_session_key = data_blob_talloc(
- result, info->lm_session_key,
- sizeof(info->lm_session_key));
- }
-
- result->nss_token |= username_was_mapped;
-
- *server_info = result;
-
- return NT_STATUS_OK;
+ return make_server_info_info3(mem_ctx,
+ sent_nt_username, domain,
+ server_info, info3);
}
/**
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
+/* FIXME: do we really still need this ? */
static int server_info_dtor(struct auth_serversupplied_info *server_info)
{
- TALLOC_FREE(server_info->sam_account);
+ TALLOC_FREE(server_info->info3);
ZERO_STRUCTP(server_info);
return 0;
}
return result;
}
-/*******************************************************************
- gets a domain user's groups from their already-calculated NT_USER_TOKEN
- ********************************************************************/
-
-static NTSTATUS nt_token_to_group_list(TALLOC_CTX *mem_ctx,
- const struct dom_sid *domain_sid,
- size_t num_sids,
- const struct dom_sid *sids,
- int *numgroups,
- struct samr_RidWithAttribute **pgids)
-{
- int i;
-
- *numgroups=0;
- *pgids = NULL;
-
- for (i=0; i<num_sids; i++) {
- struct samr_RidWithAttribute gid;
- if (!sid_peek_check_rid(domain_sid, &sids[i], &gid.rid)) {
- continue;
- }
- gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
- SE_GROUP_ENABLED);
- ADD_TO_ARRAY(mem_ctx, struct samr_RidWithAttribute,
- gid, pgids, numgroups);
- if (*pgids == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- }
- return NT_STATUS_OK;
-}
-
/****************************************************************************
- inits a netr_SamBaseInfo structure from an auth_serversupplied_info.
+ inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
+ already be initialized and is used as the talloc parent for its members.
*****************************************************************************/
-static NTSTATUS serverinfo_to_SamInfo_base(TALLOC_CTX *mem_ctx,
- struct auth_serversupplied_info *server_info,
- uint8_t *pipe_session_key,
- size_t pipe_session_key_len,
- struct netr_SamBaseInfo *base)
+NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
+ uint8_t *pipe_session_key,
+ size_t pipe_session_key_len,
+ struct netr_SamInfo2 *sam2)
{
- struct samu *sampw;
- struct samr_RidWithAttribute *gids = NULL;
- const struct dom_sid *user_sid = NULL;
- const struct dom_sid *group_sid = NULL;
- struct dom_sid domain_sid;
- uint32 user_rid, group_rid;
- NTSTATUS status;
-
- int num_gids = 0;
- const char *my_name;
-
- struct netr_UserSessionKey user_session_key;
- struct netr_LMSessionKey lm_session_key;
-
- NTTIME last_logon, last_logoff, acct_expiry, last_password_change;
- NTTIME allow_password_change, force_password_change;
- struct samr_RidWithAttributeArray groups;
- int i;
- struct dom_sid2 *sid = NULL;
-
- ZERO_STRUCT(user_session_key);
- ZERO_STRUCT(lm_session_key);
-
- sampw = server_info->sam_account;
-
- user_sid = pdb_get_user_sid(sampw);
- group_sid = pdb_get_group_sid(sampw);
-
- if (pipe_session_key && pipe_session_key_len != 16) {
- DEBUG(0,("serverinfo_to_SamInfo3: invalid "
- "pipe_session_key_len[%zu] != 16\n",
- pipe_session_key_len));
- return NT_STATUS_INTERNAL_ERROR;
- }
-
- if ((user_sid == NULL) || (group_sid == NULL)) {
- DEBUG(1, ("_netr_LogonSamLogon: User without group or user SID\n"));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- sid_copy(&domain_sid, user_sid);
- sid_split_rid(&domain_sid, &user_rid);
+ struct netr_SamInfo3 *info3;
- sid = sid_dup_talloc(mem_ctx, &domain_sid);
- if (!sid) {
+ info3 = copy_netr_SamInfo3(sam2, server_info->info3);
+ if (!info3) {
return NT_STATUS_NO_MEMORY;
}
- if (!sid_peek_check_rid(&domain_sid, group_sid, &group_rid)) {
- DEBUG(1, ("_netr_LogonSamLogon: user %s\\%s has user sid "
- "%s\n but group sid %s.\n"
- "The conflicting domain portions are not "
- "supported for NETLOGON calls\n",
- pdb_get_domain(sampw),
- pdb_get_username(sampw),
- sid_string_dbg(user_sid),
- sid_string_dbg(group_sid)));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if(server_info->login_server) {
- my_name = server_info->login_server;
- } else {
- my_name = global_myname();
- }
-
- status = nt_token_to_group_list(mem_ctx, &domain_sid,
- server_info->num_sids,
- server_info->sids,
- &num_gids, &gids);
-
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
-
if (server_info->user_session_key.length) {
- memcpy(user_session_key.key,
+ memcpy(info3->base.key.key,
server_info->user_session_key.data,
- MIN(sizeof(user_session_key.key),
+ MIN(sizeof(info3->base.key.key),
server_info->user_session_key.length));
if (pipe_session_key) {
- arcfour_crypt(user_session_key.key, pipe_session_key, 16);
+ arcfour_crypt(info3->base.key.key,
+ pipe_session_key, 16);
}
}
if (server_info->lm_session_key.length) {
- memcpy(lm_session_key.key,
+ memcpy(info3->base.LMSessKey.key,
server_info->lm_session_key.data,
- MIN(sizeof(lm_session_key.key),
+ MIN(sizeof(info3->base.LMSessKey.key),
server_info->lm_session_key.length));
if (pipe_session_key) {
- arcfour_crypt(lm_session_key.key, pipe_session_key, 8);
+ arcfour_crypt(info3->base.LMSessKey.key,
+ pipe_session_key, 8);
}
}
- groups.count = num_gids;
- groups.rids = TALLOC_ARRAY(mem_ctx, struct samr_RidWithAttribute, groups.count);
- if (!groups.rids) {
- return NT_STATUS_NO_MEMORY;
- }
-
- for (i=0; i < groups.count; i++) {
- groups.rids[i].rid = gids[i].rid;
- groups.rids[i].attributes = gids[i].attributes;
- }
-
- unix_to_nt_time(&last_logon, pdb_get_logon_time(sampw));
- unix_to_nt_time(&last_logoff, get_time_t_max());
- unix_to_nt_time(&acct_expiry, get_time_t_max());
- unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(sampw));
- unix_to_nt_time(&allow_password_change, pdb_get_pass_can_change_time(sampw));
- unix_to_nt_time(&force_password_change, pdb_get_pass_must_change_time(sampw));
-
- base->last_logon = last_logon;
- base->last_logoff = last_logoff;
- base->acct_expiry = acct_expiry;
- base->last_password_change = last_password_change;
- base->allow_password_change = allow_password_change;
- base->force_password_change = force_password_change;
- base->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(sampw));
- base->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(sampw));
- base->logon_script.string = talloc_strdup(mem_ctx, pdb_get_logon_script(sampw));
- base->profile_path.string = talloc_strdup(mem_ctx, pdb_get_profile_path(sampw));
- base->home_directory.string = talloc_strdup(mem_ctx, pdb_get_homedir(sampw));
- base->home_drive.string = talloc_strdup(mem_ctx, pdb_get_dir_drive(sampw));
- base->logon_count = 0; /* ?? */
- base->bad_password_count = 0; /* ?? */
- base->rid = user_rid;
- base->primary_gid = group_rid;
- base->groups = groups;
- base->user_flags = NETLOGON_EXTRA_SIDS;
- base->key = user_session_key;
- base->logon_server.string = talloc_strdup(mem_ctx, my_name);
- base->domain.string = talloc_strdup(mem_ctx, pdb_get_domain(sampw));
- base->domain_sid = sid;
- base->LMSessKey = lm_session_key;
- base->acct_flags = pdb_get_acct_ctrl(sampw);
-
- ZERO_STRUCT(user_session_key);
- ZERO_STRUCT(lm_session_key);
-
- return NT_STATUS_OK;
-}
-
-/****************************************************************************
- inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
- already be initialized and is used as the talloc parent for its members.
-*****************************************************************************/
-
-NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
- uint8_t *pipe_session_key,
- size_t pipe_session_key_len,
- struct netr_SamInfo2 *sam2)
-{
- NTSTATUS status;
-
- status = serverinfo_to_SamInfo_base(sam2,
- server_info,
- pipe_session_key,
- pipe_session_key_len,
- &sam2->base);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
+ sam2->base = info3->base;
return NT_STATUS_OK;
}
size_t pipe_session_key_len,
struct netr_SamInfo3 *sam3)
{
- NTSTATUS status;
+ struct netr_SamInfo3 *info3;
- status = serverinfo_to_SamInfo_base(sam3,
- server_info,
- pipe_session_key,
- pipe_session_key_len,
- &sam3->base);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
+ info3 = copy_netr_SamInfo3(sam3, server_info->info3);
+ if (!info3) {
+ return NT_STATUS_NO_MEMORY;
}
+ if (server_info->user_session_key.length) {
+ memcpy(info3->base.key.key,
+ server_info->user_session_key.data,
+ MIN(sizeof(info3->base.key.key),
+ server_info->user_session_key.length));
+ if (pipe_session_key) {
+ arcfour_crypt(info3->base.key.key,
+ pipe_session_key, 16);
+ }
+ }
+ if (server_info->lm_session_key.length) {
+ memcpy(info3->base.LMSessKey.key,
+ server_info->lm_session_key.data,
+ MIN(sizeof(info3->base.LMSessKey.key),
+ server_info->lm_session_key.length));
+ if (pipe_session_key) {
+ arcfour_crypt(info3->base.LMSessKey.key,
+ pipe_session_key, 8);
+ }
+ }
+
+ sam3->base = info3->base;
+
sam3->sidcount = 0;
sam3->sids = NULL;
size_t pipe_session_key_len,
struct netr_SamInfo6 *sam6)
{
- NTSTATUS status;
struct pdb_domain_info *dominfo;
+ struct netr_SamInfo3 *info3;
if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
DEBUG(10,("Not adding validation info level 6 "
return NT_STATUS_NO_MEMORY;
}
- status = serverinfo_to_SamInfo_base(sam6,
- server_info,
- pipe_session_key,
- pipe_session_key_len,
- &sam6->base);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
+ info3 = copy_netr_SamInfo3(sam6, server_info->info3);
+ if (!info3) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (server_info->user_session_key.length) {
+ memcpy(info3->base.key.key,
+ server_info->user_session_key.data,
+ MIN(sizeof(info3->base.key.key),
+ server_info->user_session_key.length));
+ if (pipe_session_key) {
+ arcfour_crypt(info3->base.key.key,
+ pipe_session_key, 16);
+ }
}
+ if (server_info->lm_session_key.length) {
+ memcpy(info3->base.LMSessKey.key,
+ server_info->lm_session_key.data,
+ MIN(sizeof(info3->base.LMSessKey.key),
+ server_info->lm_session_key.length));
+ if (pipe_session_key) {
+ arcfour_crypt(info3->base.LMSessKey.key,
+ pipe_session_key, 8);
+ }
+ }
+
+ sam6->base = info3->base;
sam6->sidcount = 0;
sam6->sids = NULL;
}
sam6->principle.string = talloc_asprintf(sam6, "%s@%s",
- pdb_get_username(server_info->sam_account),
+ sam6->base.account_name.string,
sam6->dns_domainname.string);
if (sam6->principle.string == NULL) {
return NT_STATUS_NO_MEMORY;
return NT_STATUS_NO_SUCH_USER;
}
- result->sam_account = sampass;
+ status = samu_to_SamInfo3(result, sampass,
+ global_myname(), &result->info3);
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(result);
+ return status;
+ }
+
result->unix_name = pwd->pw_name;
/* Ensure that we keep pwd->pw_name, because we will free pwd below */
talloc_steal(result, pwd->pw_name);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
nt_errstr(status)));
- result->sam_account = NULL; /* Don't free on error exit. */
TALLOC_FREE(result);
return status;
}
char *login_server; /* which server authorized the login? */
- struct samu *sam_account;
+ struct netr_SamInfo3 *info3;
void *pam_handle;
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
targethost);
DEBUG(10, ("Expanded targethost to %s\n", targethost));
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
prefix);
TALLOC_FREE(prefix);
return result;
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
recycle_repository(handle));
ALLOC_CHECK(repository, done);
/* shouldn't we allow absolute path names here? --metze */
(unsigned int) strlen(handle->conn->connectpath),
handle->conn->connectpath,
(unsigned int)
- strlen(pdb_get_domain(handle->conn->server_info->sam_account)),
- pdb_get_domain(handle->conn->server_info->sam_account),
+ strlen(handle->conn->server_info->info3->base.domain.string),
+ handle->conn->server_info->info3->base.domain.string,
(unsigned int) strlen(timestr),
timestr);
"\"%04d-%02d-%02d %02d:%02d:%02d.%03d\"\n",
(unsigned int) s_data->len,
username,
- pdb_get_domain(handle->conn->server_info->sam_account),
+ handle->conn->server_info->info3->base.domain.string,
Write ? 'W' : 'R',
handle->conn->connectpath,
s_data->filename,
standard_sub_advanced(sharename, server_info->sanitized_username,
path, server_info->utok.gid,
server_info->sanitized_username,
- pdb_get_domain(server_info->sam_account),
+ server_info->info3->base.domain.string,
pjob.user, sizeof(pjob.user)-1);
/* ensure NULL termination */
pjob.user[sizeof(pjob.user)-1] = '\0';
}
} else {
username = p->server_info->sanitized_username;
- domname = pdb_get_domain(p->server_info->sam_account);
+ domname = p->server_info->info3->base.domain.string;
}
account_name = TALLOC_P(p->mem_ctx, struct lsa_String);
return WERR_INVALID_PARAM;
}
- acct_ctrl = pdb_get_acct_ctrl(p->server_info->sam_account);
+ acct_ctrl = p->server_info->info3->base.acct_flags;
switch (r->in.function_code) {
case NETLOGON_CONTROL_TC_VERIFY:
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
buf);
if (!buf) {
*p_space_remaining = 0;
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
buf);
if (!buf) {
return 0;
}
PACKS(&desc,"z",lp_workgroup());/* domain */
- PACKS(&desc,"z", vuser ? pdb_get_logon_script(
- vuser->server_info->sam_account) : ""); /* script path */
+ PACKS(&desc,"z", vuser ?
+ vuser->server_info->info3->base.logon_script.string
+ : ""); /* script path */
PACKI(&desc,"D",0x00000000); /* reserved */
}
(unsigned int)vuser->server_info->utok.gid,
vuser->server_info->unix_name,
vuser->server_info->sanitized_username,
- pdb_get_domain(vuser->server_info->sam_account),
+ vuser->server_info->info3->base.domain.string,
vuser->server_info->guest ));
DEBUG(3, ("register_existing_vuid: User name: %s\t"
"Real name: %s\n", vuser->server_info->unix_name,
- pdb_get_fullname(vuser->server_info->sam_account)));
+ vuser->server_info->info3->base.full_name.string));
if (!vuser->server_info->ptok) {
DEBUG(1, ("register_existing_vuid: server_info does not "
set_current_user_info(
vuser->server_info->sanitized_username,
vuser->server_info->unix_name,
- pdb_get_domain(vuser->server_info->sam_account));
+ vuser->server_info->info3->base.domain.string);
return vuser->vuid;
set_current_user_info(
vuser->server_info->sanitized_username,
vuser->server_info->unix_name,
- pdb_get_domain(vuser->server_info
- ->sam_account));
+ vuser->server_info->info3->base.domain.string);
}
}
}
}
} else {
if (!user_ok_token(vuid_serverinfo->unix_name,
- pdb_get_domain(vuid_serverinfo->sam_account),
+ vuid_serverinfo->info3->base.domain.string,
vuid_serverinfo->ptok, snum)) {
DEBUG(2, ("user '%s' (from session setup) not "
"permitted to access this share "
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
lp_pathname(snum));
if (!s) {
*pstatus = NT_STATUS_NO_MEMORY;
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
lp_rootpreexec(snum));
DEBUG(5,("cmd=%s\n",cmd));
ret = smbrun(cmd,NULL);
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
lp_preexec(snum));
ret = smbrun(cmd,NULL);
TALLOC_FREE(cmd);
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
lp_postexec(SNUM(conn)));
smbrun(cmd,NULL);
TALLOC_FREE(cmd);
conn->connectpath,
conn->server_info->utok.gid,
conn->server_info->sanitized_username,
- pdb_get_domain(conn->server_info->sam_account),
+ conn->server_info->info3->base.domain.string,
lp_rootpostexec(SNUM(conn)));
smbrun(cmd,NULL);
TALLOC_FREE(cmd);
* we end up with the local netbios name in substitutions for
* %D. */
- if (server_info->sam_account != NULL) {
- pdb_set_domain(server_info->sam_account,
- domain, PDB_SET);
+ if (server_info->info3 != NULL) {
+ server_info->info3->base.domain.string =
+ talloc_strdup(server_info->info3, domain);
}
}
* we end up with the local netbios name in substitutions for
* %D. */
- if (session->server_info->sam_account != NULL) {
- pdb_set_domain(session->server_info->sam_account,
- domain, PDB_SET);
+ if (session->server_info->info3 != NULL) {
+ session->server_info->info3->base.domain.string =
+ talloc_strdup(session->server_info->info3, domain);
}
}
set_current_user_info(session->server_info->sanitized_username,
session->server_info->unix_name,
- pdb_get_domain(session->server_info->sam_account));
+ session->server_info->info3->base.domain.string);
req->session = session;
}
if (!user_ok_token(server_info->unix_name,
- pdb_get_domain(server_info->sam_account),
+ server_info->info3->base.domain.string,
server_info->ptok, snum))
return(False);
readonly_share = is_share_read_only_for_token(
server_info->unix_name,
- pdb_get_domain(server_info->sam_account),
+ server_info->info3->base.domain.string,
server_info->ptok,
conn);
admin_user = token_contains_name_in_list(
server_info->unix_name,
- pdb_get_domain(server_info->sam_account),
+ server_info->info3->base.domain.string,
NULL, server_info->ptok, lp_admin_users(snum));
if (valid_vuid) {
git.samba.org / amitay / samba.git / commitdiff