WIP s4-kdc/mit-kdb: implement kdb password change routine in MIT backend.

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>

diff --git a/source4/kdc/mit-kdb/kdb_samba.c b/source4/kdc/mit-kdb/kdb_samba.c
index 1f3fb7300ae7b652b5d3832839ed8ea065ad225c..dc80a2291c1fb410b4329e55647f1e908b4aca58 100644 (file)
--- a/source4/kdc/mit-kdb/kdb_samba.c
+++ b/source4/kdc/mit-kdb/kdb_samba.c
@@ -170,7 +170,7 @@ kdb_vftabl kdb_function_table = {
        kdb_samba_fetch_master_key_list,   /* fetch_master_key_list */
        NULL,                              /* store_master_key_list */
        NULL,                              /* dbe_search_enctype */
-       NULL,                              /* change_pwd */
+       kdb_samba_change_pwd,              /* change_pwd */
        NULL,                              /* promote_db */
        kdb_samba_dbekd_decrypt_key_data,  /* decrypt_key_data */
        kdb_samba_dbekd_encrypt_key_data,  /* encrypt_key_data */

diff --git a/source4/kdc/mit-kdb/kdb_samba.h b/source4/kdc/mit-kdb/kdb_samba.h
index 32c8d843548f4af0cd70b254af0863ce3054bb65..b2273c3efcc6671c3313c3e7cc39c95f794bbd0f 100644 (file)
--- a/source4/kdc/mit-kdb/kdb_samba.h
+++ b/source4/kdc/mit-kdb/kdb_samba.h
@@ -145,5 +145,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,
                                                       krb5_const_principal client,
                                                       const krb5_db_entry *server,
                                                       krb5_const_principal proxy);
+/* from kdb_samba_change_pwd.c */
+
+krb5_error_code kdb_samba_change_pwd(krb5_context context,
+                                    krb5_keyblock *master_key,
+                                    krb5_key_salt_tuple *ks_tuple,
+                                    int ks_tuple_count, char *passwd,
+                                    int new_kvno, krb5_boolean keepold,
+                                    krb5_db_entry *db_entry);
 
 #endif /* _KDB_SAMBA_H_ */

diff --git a/source4/kdc/mit-kdb/kdb_samba_change_pwd.c b/source4/kdc/mit-kdb/kdb_samba_change_pwd.c
new file mode 100644 (file)
index 0000000..e0264cb
--- /dev/null
+++ b/source4/kdc/mit-kdb/kdb_samba_change_pwd.c
@@ -0,0 +1,56 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Samba KDB plugin for MIT Kerberos
+
+   Copyright (c) 2010      Simo Sorce <idra@samba.org>.
+   Copyright (c) 2014      Andreas Schneider <asn@samba.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+
+#include "system/kerberos.h"
+
+#include <profile.h>
+#include <kdb.h>
+
+#include "kdc/mit_samba.h"
+#include "kdb_samba.h"
+
+krb5_error_code kdb_samba_change_pwd(krb5_context context,
+                                    krb5_keyblock *master_key,
+                                    krb5_key_salt_tuple *ks_tuple,
+                                    int ks_tuple_count, char *passwd,
+                                    int new_kvno, krb5_boolean keepold,
+                                    krb5_db_entry *db_entry)
+{
+       struct mit_samba_context *mit_ctx;
+       krb5_error_code code;
+
+       mit_ctx = ks_get_context(context);
+       if (mit_ctx == NULL) {
+               return KRB5_KDB_DBNOTINITED;
+       }
+
+       code = mit_samba_kpasswd_change_password(mit_ctx, passwd, db_entry);
+       if (code != 0) {
+               goto cleanup;
+       }
+
+cleanup:
+
+       return code;
+}

diff --git a/source4/kdc/mit-kdb/wscript_build b/source4/kdc/mit-kdb/wscript_build
index 68f086649c2175d8c29994a4385b183cbd7db4b0..82cea4a1bc325389ef4848112e0b63ee90cc3409 100644 (file)
--- a/source4/kdc/mit-kdb/wscript_build
+++ b/source4/kdc/mit-kdb/wscript_build
@@ -8,6 +8,7 @@ bld.SAMBA_LIBRARY('mit-kdb-samba',
                          kdb_samba_pac.c
                          kdb_samba_policies.c
                          kdb_samba_principals.c
+                         kdb_samba_change_pwd.c
                          ''',
                   private_library=True,
                   realname='samba.so',

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 73acce8c6136816212218f0cc777d42d45007e97..8edc9a38f019940ea77b38c1fd8ea452086de256 100644 (file)
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -30,6 +30,8 @@
 #include "kdc/samba_kdc.h"
 #include "kdc/pac-glue.h"
 #include "kdc/db-glue.h"
+#include "auth/auth.h"
+#include "kdc/kpasswd_glue.h"
 
 #include "mit_samba.h"
 
@@ -500,3 +502,88 @@ int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
        return ret;
 #endif
 }
+
+int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
+                                     char *pwd,
+                                     krb5_db_entry *db_entry)
+{
+       NTSTATUS status;
+       TALLOC_CTX *tmp_ctx;
+       DATA_BLOB password;
+       enum samPwdChangeReason reject_reason;
+       struct samr_DomInfo1 *dominfo;
+       const char *error_string = NULL;
+       struct auth_user_info_dc *user_info_dc;
+       struct samba_kdc_entry *p;
+
+#ifdef DEBUG_PASSWORD
+       DEBUG(1,("mit_samba_kpasswd_change_password called with: %s\n", pwd));
+#endif
+
+       tmp_ctx = talloc_named(ctx, 0, "mit_samba_kpasswd_change_password");
+       if (tmp_ctx == NULL) {
+               return ENOMEM;
+       }
+
+       p = db_entry->e_data;
+
+       status = authsam_make_user_info_dc(tmp_ctx,
+                                          ctx->db_ctx->samdb,
+                                          lpcfg_netbios_name(ctx->db_ctx->lp_ctx),
+                                          lpcfg_sam_name(ctx->db_ctx->lp_ctx),
+                                          p->realm_dn,
+                                          p->msg,
+                                          data_blob(NULL, 0),
+                                          data_blob(NULL, 0),
+                                          &user_info_dc);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1,("authsam_make_user_info_dc failed: %s\n",
+                       nt_errstr(status)));
+               talloc_free(tmp_ctx);
+               return EINVAL;
+       }
+
+       status = auth_generate_session_info(tmp_ctx,
+                                           ctx->db_ctx->lp_ctx,
+                                           ctx->db_ctx->samdb,
+                                           user_info_dc,
+                                           0, /* session_info_flags */
+                                           &ctx->session_info);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1,("auth_generate_session_info failed: %s\n",
+                       nt_errstr(status)));
+               talloc_free(tmp_ctx);
+               return EINVAL;
+       }
+
+       /* password is expected as UTF16 */
+
+       if (!convert_string_talloc(tmp_ctx, CH_UTF8, CH_UTF16,
+                                  pwd, strlen(pwd),
+                                  &password.data, &password.length)) {
+               DEBUG(1,("convert_string_talloc failed\n"));
+               talloc_free(tmp_ctx);
+               return EINVAL;
+       }
+
+       status = samdb_kpasswd_change_password(tmp_ctx,
+                                              ctx->db_ctx->lp_ctx,
+                                              ctx->db_ctx->ev_ctx,
+                                              ctx->db_ctx->samdb,
+                                              ctx->session_info,
+                                              &password,
+                                              &reject_reason,
+                                              &dominfo,
+                                              &error_string);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1,("samdb_kpasswd_change_password failed: %s\n",
+                       nt_errstr(status)));
+               talloc_free(tmp_ctx);
+               return EINVAL;
+       }
+
+       talloc_free(tmp_ctx);
+
+       return 0;
+}

diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h
index fd54dc56611186941e2259bd321ee7035e8b3a62..b38bd573db460378051841cb998e19117b8e71b7 100644 (file)
--- a/source4/kdc/mit_samba.h
+++ b/source4/kdc/mit_samba.h
@@ -75,4 +75,8 @@ int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
                              const char *target_name,
                              bool is_nt_enterprise_name);
 
+int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
+                                     char *pwd,
+                                     krb5_db_entry *db_entry);
+
 #endif /* _MIT_SAMBA_H */

diff --git a/source4/kdc/wscript_build b/source4/kdc/wscript_build
index 7cd685cf838ecfec3f2821c73d299f82f8ad46ea..f1414d5c31bf3d3e8ceb1517f7d1b9c2e760fbc4 100755 (executable)
--- a/source4/kdc/wscript_build
+++ b/source4/kdc/wscript_build
@@ -116,6 +116,7 @@ bld.SAMBA_SUBSYSTEM('MIT_SAMBA',
              samba-credentials
              db-glue
              PAC_GLUE
+             KPASSWD_GLUE
              samba-hostconfig
              com_err
              sdb_kdb