2 Unix SMB/CIFS implementation.
4 User credentials handling
6 Copyright (C) Jelmer Vernooij 2005
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
26 #include "auth/credentials/credentials.h"
27 #include "auth/credentials/credentials_internal.h"
28 #include "libcli/auth/libcli_auth.h"
30 #include "param/param.h"
31 #include "system/filesys.h"
34 * Create a new credentials structure
35 * @param mem_ctx TALLOC_CTX parent for credentials structure
37 _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
39 struct cli_credentials *cred = talloc(mem_ctx, struct cli_credentials);
44 cred->workstation_obtained = CRED_UNINITIALISED;
45 cred->username_obtained = CRED_UNINITIALISED;
46 cred->password_obtained = CRED_UNINITIALISED;
47 cred->domain_obtained = CRED_UNINITIALISED;
48 cred->realm_obtained = CRED_UNINITIALISED;
49 cred->ccache_obtained = CRED_UNINITIALISED;
50 cred->client_gss_creds_obtained = CRED_UNINITIALISED;
51 cred->principal_obtained = CRED_UNINITIALISED;
52 cred->keytab_obtained = CRED_UNINITIALISED;
53 cred->server_gss_creds_obtained = CRED_UNINITIALISED;
55 cred->ccache_threshold = CRED_UNINITIALISED;
56 cred->client_gss_creds_threshold = CRED_UNINITIALISED;
58 cred->workstation = NULL;
59 cred->username = NULL;
60 cred->password = NULL;
61 cred->old_password = NULL;
64 cred->principal = NULL;
65 cred->salt_principal = NULL;
66 cred->impersonate_principal = NULL;
67 cred->self_service = NULL;
68 cred->target_service = NULL;
73 cred->old_nt_hash = NULL;
75 cred->lm_response.data = NULL;
76 cred->lm_response.length = 0;
77 cred->nt_response.data = NULL;
78 cred->nt_response.length = 0;
81 cred->client_gss_creds = NULL;
83 cred->server_gss_creds = NULL;
85 cred->workstation_cb = NULL;
86 cred->password_cb = NULL;
87 cred->username_cb = NULL;
88 cred->domain_cb = NULL;
89 cred->realm_cb = NULL;
90 cred->principal_cb = NULL;
92 cred->priv_data = NULL;
94 cred->netlogon_creds = NULL;
95 cred->secure_channel_type = SEC_CHAN_NULL;
99 cred->password_last_changed_time = 0;
101 cred->smb_krb5_context = NULL;
103 cred->machine_account_pending = false;
104 cred->machine_account_pending_lp_ctx = NULL;
106 cred->machine_account = false;
108 cred->password_tries = 0;
110 cred->callback_running = false;
112 cli_credentials_set_kerberos_state(cred, CRED_AUTO_USE_KERBEROS);
113 cli_credentials_set_gensec_features(cred, 0);
114 cli_credentials_set_krb_forwardable(cred, CRED_AUTO_KRB_FORWARDABLE);
116 cred->forced_sasl_mech = NULL;
118 cred->winbind_separator = '\\';
123 _PUBLIC_ void cli_credentials_set_callback_data(struct cli_credentials *cred,
126 cred->priv_data = callback_data;
129 _PUBLIC_ void *_cli_credentials_callback_data(struct cli_credentials *cred)
131 return cred->priv_data;
135 * Create a new anonymous credential
136 * @param mem_ctx TALLOC_CTX parent for credentials structure
138 _PUBLIC_ struct cli_credentials *cli_credentials_init_anon(TALLOC_CTX *mem_ctx)
140 struct cli_credentials *anon_credentials;
142 anon_credentials = cli_credentials_init(mem_ctx);
143 cli_credentials_set_anonymous(anon_credentials);
145 return anon_credentials;
148 _PUBLIC_ void cli_credentials_set_kerberos_state(struct cli_credentials *creds,
149 enum credentials_use_kerberos use_kerberos)
151 creds->use_kerberos = use_kerberos;
154 _PUBLIC_ void cli_credentials_set_forced_sasl_mech(struct cli_credentials *creds,
155 const char *sasl_mech)
157 TALLOC_FREE(creds->forced_sasl_mech);
158 creds->forced_sasl_mech = talloc_strdup(creds, sasl_mech);
161 _PUBLIC_ void cli_credentials_set_krb_forwardable(struct cli_credentials *creds,
162 enum credentials_krb_forwardable krb_forwardable)
164 creds->krb_forwardable = krb_forwardable;
167 _PUBLIC_ enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds)
169 return creds->use_kerberos;
172 _PUBLIC_ const char *cli_credentials_get_forced_sasl_mech(struct cli_credentials *creds)
174 return creds->forced_sasl_mech;
177 _PUBLIC_ enum credentials_krb_forwardable cli_credentials_get_krb_forwardable(struct cli_credentials *creds)
179 return creds->krb_forwardable;
182 _PUBLIC_ void cli_credentials_set_gensec_features(struct cli_credentials *creds, uint32_t gensec_features)
184 creds->gensec_features = gensec_features;
187 _PUBLIC_ uint32_t cli_credentials_get_gensec_features(struct cli_credentials *creds)
189 return creds->gensec_features;
194 * Obtain the username for this credentials context.
195 * @param cred credentials context
196 * @retval The username set on this context.
197 * @note Return value will never be NULL except by programmer error.
199 _PUBLIC_ const char *cli_credentials_get_username(struct cli_credentials *cred)
201 if (cred->machine_account_pending) {
202 cli_credentials_set_machine_account(cred,
203 cred->machine_account_pending_lp_ctx);
206 if (cred->username_obtained == CRED_CALLBACK &&
207 !cred->callback_running) {
208 cred->callback_running = true;
209 cred->username = cred->username_cb(cred);
210 cred->callback_running = false;
211 if (cred->username_obtained == CRED_CALLBACK) {
212 cred->username_obtained = CRED_CALLBACK_RESULT;
213 cli_credentials_invalidate_ccache(cred, cred->username_obtained);
217 return cred->username;
220 _PUBLIC_ bool cli_credentials_set_username(struct cli_credentials *cred,
221 const char *val, enum credentials_obtained obtained)
223 if (obtained >= cred->username_obtained) {
224 cred->username = talloc_strdup(cred, val);
225 cred->username_obtained = obtained;
226 cli_credentials_invalidate_ccache(cred, cred->username_obtained);
233 _PUBLIC_ bool cli_credentials_set_username_callback(struct cli_credentials *cred,
234 const char *(*username_cb) (struct cli_credentials *))
236 if (cred->username_obtained < CRED_CALLBACK) {
237 cred->username_cb = username_cb;
238 cred->username_obtained = CRED_CALLBACK;
245 _PUBLIC_ bool cli_credentials_set_bind_dn(struct cli_credentials *cred,
248 cred->bind_dn = talloc_strdup(cred, bind_dn);
253 * Obtain the BIND DN for this credentials context.
254 * @param cred credentials context
255 * @retval The username set on this context.
256 * @note Return value will be NULL if not specified explictly
258 _PUBLIC_ const char *cli_credentials_get_bind_dn(struct cli_credentials *cred)
260 return cred->bind_dn;
265 * Obtain the client principal for this credentials context.
266 * @param cred credentials context
267 * @retval The username set on this context.
268 * @note Return value will never be NULL except by programmer error.
270 _PUBLIC_ const char *cli_credentials_get_principal_and_obtained(struct cli_credentials *cred, TALLOC_CTX *mem_ctx, enum credentials_obtained *obtained)
272 if (cred->machine_account_pending) {
273 cli_credentials_set_machine_account(cred,
274 cred->machine_account_pending_lp_ctx);
277 if (cred->principal_obtained == CRED_CALLBACK &&
278 !cred->callback_running) {
279 cred->callback_running = true;
280 cred->principal = cred->principal_cb(cred);
281 cred->callback_running = false;
282 if (cred->principal_obtained == CRED_CALLBACK) {
283 cred->principal_obtained = CRED_CALLBACK_RESULT;
284 cli_credentials_invalidate_ccache(cred, cred->principal_obtained);
288 if (cred->principal_obtained < cred->username_obtained
289 || cred->principal_obtained < MAX(cred->domain_obtained, cred->realm_obtained)) {
290 if (cred->domain_obtained > cred->realm_obtained) {
291 *obtained = MIN(cred->domain_obtained, cred->username_obtained);
292 return talloc_asprintf(mem_ctx, "%s@%s",
293 cli_credentials_get_username(cred),
294 cli_credentials_get_domain(cred));
296 *obtained = MIN(cred->domain_obtained, cred->username_obtained);
297 return talloc_asprintf(mem_ctx, "%s@%s",
298 cli_credentials_get_username(cred),
299 cli_credentials_get_realm(cred));
302 *obtained = cred->principal_obtained;
303 return talloc_strdup(mem_ctx, cred->principal);
307 * Obtain the client principal for this credentials context.
308 * @param cred credentials context
309 * @retval The username set on this context.
310 * @note Return value will never be NULL except by programmer error.
312 _PUBLIC_ const char *cli_credentials_get_principal(struct cli_credentials *cred, TALLOC_CTX *mem_ctx)
314 enum credentials_obtained obtained;
315 return cli_credentials_get_principal_and_obtained(cred, mem_ctx, &obtained);
318 _PUBLIC_ bool cli_credentials_set_principal(struct cli_credentials *cred,
320 enum credentials_obtained obtained)
322 if (obtained >= cred->principal_obtained) {
323 cred->principal = talloc_strdup(cred, val);
324 cred->principal_obtained = obtained;
325 cli_credentials_invalidate_ccache(cred, cred->principal_obtained);
332 /* Set a callback to get the principal. This could be a popup dialog,
333 * a terminal prompt or similar. */
334 _PUBLIC_ bool cli_credentials_set_principal_callback(struct cli_credentials *cred,
335 const char *(*principal_cb) (struct cli_credentials *))
337 if (cred->principal_obtained < CRED_CALLBACK) {
338 cred->principal_cb = principal_cb;
339 cred->principal_obtained = CRED_CALLBACK;
346 /* Some of our tools are 'anonymous by default'. This is a single
347 * function to determine if authentication has been explicitly
350 _PUBLIC_ bool cli_credentials_authentication_requested(struct cli_credentials *cred)
357 * If we forced the mech we clearly want authentication. E.g. to use
358 * SASL/EXTERNAL which has no credentials.
360 if (cred->forced_sasl_mech) {
364 if (cli_credentials_is_anonymous(cred)){
368 if (cred->principal_obtained >= CRED_SPECIFIED) {
371 if (cred->username_obtained >= CRED_SPECIFIED) {
375 if (cli_credentials_get_kerberos_state(cred) == CRED_MUST_USE_KERBEROS) {
383 * Obtain the password for this credentials context.
384 * @param cred credentials context
385 * @retval If set, the cleartext password, otherwise NULL
387 _PUBLIC_ const char *cli_credentials_get_password(struct cli_credentials *cred)
389 if (cred->machine_account_pending) {
390 cli_credentials_set_machine_account(cred,
391 cred->machine_account_pending_lp_ctx);
394 if (cred->password_obtained == CRED_CALLBACK &&
395 !cred->callback_running) {
396 cred->callback_running = true;
397 cred->password = cred->password_cb(cred);
398 cred->callback_running = false;
399 if (cred->password_obtained == CRED_CALLBACK) {
400 cred->password_obtained = CRED_CALLBACK_RESULT;
401 cli_credentials_invalidate_ccache(cred, cred->password_obtained);
405 return cred->password;
408 /* Set a password on the credentials context, including an indication
409 * of 'how' the password was obtained */
411 _PUBLIC_ bool cli_credentials_set_password(struct cli_credentials *cred,
413 enum credentials_obtained obtained)
415 if (obtained >= cred->password_obtained) {
416 cred->password_tries = 0;
417 cred->password = talloc_strdup(cred, val);
418 if (cred->password) {
419 /* Don't print the actual password in talloc memory dumps */
420 talloc_set_name_const(cred->password, "password set via cli_credentials_set_password");
422 cred->password_obtained = obtained;
423 cli_credentials_invalidate_ccache(cred, cred->password_obtained);
425 cred->nt_hash = NULL;
426 cred->lm_response = data_blob(NULL, 0);
427 cred->nt_response = data_blob(NULL, 0);
434 _PUBLIC_ bool cli_credentials_set_password_callback(struct cli_credentials *cred,
435 const char *(*password_cb) (struct cli_credentials *))
437 if (cred->password_obtained < CRED_CALLBACK) {
438 cred->password_tries = 3;
439 cred->password_cb = password_cb;
440 cred->password_obtained = CRED_CALLBACK;
441 cli_credentials_invalidate_ccache(cred, cred->password_obtained);
449 * Obtain the 'old' password for this credentials context (used for join accounts).
450 * @param cred credentials context
451 * @retval If set, the cleartext password, otherwise NULL
453 _PUBLIC_ const char *cli_credentials_get_old_password(struct cli_credentials *cred)
455 if (cred->machine_account_pending) {
456 cli_credentials_set_machine_account(cred,
457 cred->machine_account_pending_lp_ctx);
460 return cred->old_password;
463 _PUBLIC_ bool cli_credentials_set_old_password(struct cli_credentials *cred,
465 enum credentials_obtained obtained)
467 cred->old_password = talloc_strdup(cred, val);
468 if (cred->old_password) {
469 /* Don't print the actual password in talloc memory dumps */
470 talloc_set_name_const(cred->old_password, "password set via cli_credentials_set_old_password");
472 cred->old_nt_hash = NULL;
477 * Obtain the password, in the form MD4(unicode(password)) for this credentials context.
479 * Sometimes we only have this much of the password, while the rest of
480 * the time this call avoids calling E_md4hash themselves.
482 * @param cred credentials context
483 * @retval If set, the cleartext password, otherwise NULL
485 _PUBLIC_ struct samr_Password *cli_credentials_get_nt_hash(struct cli_credentials *cred,
488 const char *password = NULL;
490 if (cred->nt_hash != NULL) {
491 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
496 *nt_hash = *cred->nt_hash;
501 password = cli_credentials_get_password(cred);
503 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
508 E_md4hash(password, nt_hash->hash);
517 * Obtain the old password, in the form MD4(unicode(password)) for this credentials context.
519 * Sometimes we only have this much of the password, while the rest of
520 * the time this call avoids calling E_md4hash themselves.
522 * @param cred credentials context
523 * @retval If set, the cleartext password, otherwise NULL
525 _PUBLIC_ struct samr_Password *cli_credentials_get_old_nt_hash(struct cli_credentials *cred,
528 const char *old_password = NULL;
530 if (cred->old_nt_hash != NULL) {
531 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
536 *nt_hash = *cred->old_nt_hash;
541 old_password = cli_credentials_get_old_password(cred);
543 struct samr_Password *nt_hash = talloc(mem_ctx, struct samr_Password);
548 E_md4hash(old_password, nt_hash->hash);
557 * Obtain the 'short' or 'NetBIOS' domain for this credentials context.
558 * @param cred credentials context
559 * @retval The domain set on this context.
560 * @note Return value will never be NULL except by programmer error.
562 _PUBLIC_ const char *cli_credentials_get_domain(struct cli_credentials *cred)
564 if (cred->machine_account_pending) {
565 cli_credentials_set_machine_account(cred,
566 cred->machine_account_pending_lp_ctx);
569 if (cred->domain_obtained == CRED_CALLBACK &&
570 !cred->callback_running) {
571 cred->callback_running = true;
572 cred->domain = cred->domain_cb(cred);
573 cred->callback_running = false;
574 if (cred->domain_obtained == CRED_CALLBACK) {
575 cred->domain_obtained = CRED_CALLBACK_RESULT;
576 cli_credentials_invalidate_ccache(cred, cred->domain_obtained);
584 _PUBLIC_ bool cli_credentials_set_domain(struct cli_credentials *cred,
586 enum credentials_obtained obtained)
588 if (obtained >= cred->domain_obtained) {
589 /* it is important that the domain be in upper case,
590 * particularly for the sensitive NTLMv2
592 cred->domain = strupper_talloc(cred, val);
593 cred->domain_obtained = obtained;
594 /* setting domain does not mean we have to invalidate ccache
595 * because domain in not used for Kerberos operations.
596 * If ccache invalidation is required, one will anyway specify
597 * a password to kinit, and that will force invalidation of the ccache
605 bool cli_credentials_set_domain_callback(struct cli_credentials *cred,
606 const char *(*domain_cb) (struct cli_credentials *))
608 if (cred->domain_obtained < CRED_CALLBACK) {
609 cred->domain_cb = domain_cb;
610 cred->domain_obtained = CRED_CALLBACK;
618 * Obtain the Kerberos realm for this credentials context.
619 * @param cred credentials context
620 * @retval The realm set on this context.
621 * @note Return value will never be NULL except by programmer error.
623 _PUBLIC_ const char *cli_credentials_get_realm(struct cli_credentials *cred)
625 if (cred->machine_account_pending) {
626 cli_credentials_set_machine_account(cred,
627 cred->machine_account_pending_lp_ctx);
630 if (cred->realm_obtained == CRED_CALLBACK &&
631 !cred->callback_running) {
632 cred->callback_running = true;
633 cred->realm = cred->realm_cb(cred);
634 cred->callback_running = false;
635 if (cred->realm_obtained == CRED_CALLBACK) {
636 cred->realm_obtained = CRED_CALLBACK_RESULT;
637 cli_credentials_invalidate_ccache(cred, cred->realm_obtained);
645 * Set the realm for this credentials context, and force it to
646 * uppercase for the sainity of our local kerberos libraries
648 _PUBLIC_ bool cli_credentials_set_realm(struct cli_credentials *cred,
650 enum credentials_obtained obtained)
652 if (obtained >= cred->realm_obtained) {
653 cred->realm = strupper_talloc(cred, val);
654 cred->realm_obtained = obtained;
655 cli_credentials_invalidate_ccache(cred, cred->realm_obtained);
662 bool cli_credentials_set_realm_callback(struct cli_credentials *cred,
663 const char *(*realm_cb) (struct cli_credentials *))
665 if (cred->realm_obtained < CRED_CALLBACK) {
666 cred->realm_cb = realm_cb;
667 cred->realm_obtained = CRED_CALLBACK;
675 * Obtain the 'short' or 'NetBIOS' workstation name for this credentials context.
677 * @param cred credentials context
678 * @retval The workstation name set on this context.
679 * @note Return value will never be NULL except by programmer error.
681 _PUBLIC_ const char *cli_credentials_get_workstation(struct cli_credentials *cred)
683 if (cred->workstation_obtained == CRED_CALLBACK &&
684 !cred->callback_running) {
685 cred->callback_running = true;
686 cred->workstation = cred->workstation_cb(cred);
687 cred->callback_running = false;
688 if (cred->workstation_obtained == CRED_CALLBACK) {
689 cred->workstation_obtained = CRED_CALLBACK_RESULT;
693 return cred->workstation;
696 _PUBLIC_ bool cli_credentials_set_workstation(struct cli_credentials *cred,
698 enum credentials_obtained obtained)
700 if (obtained >= cred->workstation_obtained) {
701 cred->workstation = talloc_strdup(cred, val);
702 cred->workstation_obtained = obtained;
709 bool cli_credentials_set_workstation_callback(struct cli_credentials *cred,
710 const char *(*workstation_cb) (struct cli_credentials *))
712 if (cred->workstation_obtained < CRED_CALLBACK) {
713 cred->workstation_cb = workstation_cb;
714 cred->workstation_obtained = CRED_CALLBACK;
722 * Given a string, typically obtained from a -U argument, parse it into domain, username, realm and password fields
724 * The format accepted is [domain\\]user[%password] or user[@realm][%password]
726 * @param credentials Credentials structure on which to set the password
727 * @param data the string containing the username, password etc
728 * @param obtained This enum describes how 'specified' this password is
731 _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials, const char *data, enum credentials_obtained obtained)
735 if (strcmp("%",data) == 0) {
736 cli_credentials_set_anonymous(credentials);
740 uname = talloc_strdup(credentials, data);
741 if ((p = strchr_m(uname,'%'))) {
743 cli_credentials_set_password(credentials, p+1, obtained);
746 if ((p = strchr_m(uname,'@'))) {
747 cli_credentials_set_principal(credentials, uname, obtained);
749 cli_credentials_set_realm(credentials, p+1, obtained);
751 } else if ((p = strchr_m(uname,'\\'))
752 || (p = strchr_m(uname, '/'))
753 || (p = strchr_m(uname, credentials->winbind_separator)))
756 cli_credentials_set_domain(credentials, uname, obtained);
759 cli_credentials_set_username(credentials, uname, obtained);
763 * Given a a credentials structure, print it as a string
765 * The format output is [domain\\]user[%password] or user[@realm][%password]
767 * @param credentials Credentials structure on which to set the password
768 * @param mem_ctx The memory context to place the result on
771 _PUBLIC_ const char *cli_credentials_get_unparsed_name(struct cli_credentials *credentials, TALLOC_CTX *mem_ctx)
773 const char *bind_dn = cli_credentials_get_bind_dn(credentials);
775 const char *username;
779 name = talloc_strdup(mem_ctx, bind_dn);
781 cli_credentials_get_ntlm_username_domain(credentials, mem_ctx, &username, &domain);
782 if (domain && domain[0]) {
783 name = talloc_asprintf(mem_ctx, "%s\\%s",
786 name = talloc_asprintf(mem_ctx, "%s",
794 * Specifies default values for domain, workstation and realm
795 * from the smb.conf configuration file
797 * @param cred Credentials structure to fill in
799 _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
800 struct loadparm_context *lp_ctx)
802 const char *sep = NULL;
804 cli_credentials_set_username(cred, "", CRED_UNINITIALISED);
805 if (lpcfg_parm_is_cmdline(lp_ctx, "workgroup")) {
806 cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_SPECIFIED);
808 cli_credentials_set_domain(cred, lpcfg_workgroup(lp_ctx), CRED_UNINITIALISED);
810 if (lpcfg_parm_is_cmdline(lp_ctx, "netbios name")) {
811 cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_SPECIFIED);
813 cli_credentials_set_workstation(cred, lpcfg_netbios_name(lp_ctx), CRED_UNINITIALISED);
815 if (lpcfg_parm_is_cmdline(lp_ctx, "realm")) {
816 cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_SPECIFIED);
818 cli_credentials_set_realm(cred, lpcfg_realm(lp_ctx), CRED_UNINITIALISED);
821 sep = lpcfg_winbind_separator(lp_ctx);
822 if (sep != NULL && sep[0] != '\0') {
823 cred->winbind_separator = *lpcfg_winbind_separator(lp_ctx);
828 * Guess defaults for credentials from environment variables,
829 * and from the configuration file
831 * @param cred Credentials structure to fill in
833 _PUBLIC_ void cli_credentials_guess(struct cli_credentials *cred,
834 struct loadparm_context *lp_ctx)
837 const char *error_string;
839 if (lp_ctx != NULL) {
840 cli_credentials_set_conf(cred, lp_ctx);
843 if (getenv("LOGNAME")) {
844 cli_credentials_set_username(cred, getenv("LOGNAME"), CRED_GUESS_ENV);
847 if (getenv("USER")) {
848 cli_credentials_parse_string(cred, getenv("USER"), CRED_GUESS_ENV);
849 if ((p = strchr_m(getenv("USER"),'%'))) {
850 memset(p,0,strlen(cred->password));
854 if (getenv("PASSWD")) {
855 cli_credentials_set_password(cred, getenv("PASSWD"), CRED_GUESS_ENV);
858 if (getenv("PASSWD_FD")) {
859 cli_credentials_parse_password_fd(cred, atoi(getenv("PASSWD_FD")),
863 p = getenv("PASSWD_FILE");
865 cli_credentials_parse_password_file(cred, p, CRED_GUESS_FILE);
868 if (cli_credentials_get_kerberos_state(cred) != CRED_DONT_USE_KERBEROS) {
869 cli_credentials_set_ccache(cred, lp_ctx, NULL, CRED_GUESS_FILE,
875 * Attach NETLOGON credentials for use with SCHANNEL
878 _PUBLIC_ void cli_credentials_set_netlogon_creds(struct cli_credentials *cred,
879 struct netlogon_creds_CredentialState *netlogon_creds)
881 TALLOC_FREE(cred->netlogon_creds);
882 if (netlogon_creds == NULL) {
885 cred->netlogon_creds = netlogon_creds_copy(cred, netlogon_creds);
889 * Return attached NETLOGON credentials
892 _PUBLIC_ struct netlogon_creds_CredentialState *cli_credentials_get_netlogon_creds(struct cli_credentials *cred)
894 return cred->netlogon_creds;
898 * Set NETLOGON secure channel type
901 _PUBLIC_ void cli_credentials_set_secure_channel_type(struct cli_credentials *cred,
902 enum netr_SchannelType secure_channel_type)
904 cred->secure_channel_type = secure_channel_type;
908 * Return NETLOGON secure chanel type
911 _PUBLIC_ time_t cli_credentials_get_password_last_changed_time(struct cli_credentials *cred)
913 return cred->password_last_changed_time;
917 * Set NETLOGON secure channel type
920 _PUBLIC_ void cli_credentials_set_password_last_changed_time(struct cli_credentials *cred,
921 time_t last_changed_time)
923 cred->password_last_changed_time = last_changed_time;
927 * Return NETLOGON secure chanel type
930 _PUBLIC_ enum netr_SchannelType cli_credentials_get_secure_channel_type(struct cli_credentials *cred)
932 return cred->secure_channel_type;
936 * Fill in a credentials structure as the anonymous user
938 _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred)
940 cli_credentials_set_username(cred, "", CRED_SPECIFIED);
941 cli_credentials_set_domain(cred, "", CRED_SPECIFIED);
942 cli_credentials_set_password(cred, NULL, CRED_SPECIFIED);
943 cli_credentials_set_principal(cred, NULL, CRED_SPECIFIED);
944 cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED);
945 cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED);
946 cli_credentials_set_kerberos_state(cred, CRED_DONT_USE_KERBEROS);
950 * Describe a credentials context as anonymous or authenticated
951 * @retval true if anonymous, false if a username is specified
954 _PUBLIC_ bool cli_credentials_is_anonymous(struct cli_credentials *cred)
956 const char *username;
958 /* if bind dn is set it's not anonymous */
963 if (cred->machine_account_pending) {
964 cli_credentials_set_machine_account(cred,
965 cred->machine_account_pending_lp_ctx);
968 /* if principal is set, it's not anonymous */
969 if ((cred->principal != NULL) && cred->principal_obtained >= cred->username_obtained) {
973 username = cli_credentials_get_username(cred);
975 /* Yes, it is deliberate that we die if we have a NULL pointer
976 * here - anonymous is "", not NULL, which is 'never specified,
977 * never guessed', ie programmer bug */
986 * Mark the current password for a credentials struct as wrong. This will
987 * cause the password to be prompted again (if a callback is set).
989 * This will decrement the number of times the password can be tried.
991 * @retval whether the credentials struct is finished
993 _PUBLIC_ bool cli_credentials_wrong_password(struct cli_credentials *cred)
995 if (cred->password_obtained != CRED_CALLBACK_RESULT) {
999 if (cred->password_tries == 0) {
1003 cred->password_tries--;
1005 if (cred->password_tries == 0) {
1009 cred->password_obtained = CRED_CALLBACK;
1013 _PUBLIC_ void cli_credentials_get_ntlm_username_domain(struct cli_credentials *cred, TALLOC_CTX *mem_ctx,
1014 const char **username,
1015 const char **domain)
1017 if (cred->principal_obtained > cred->username_obtained) {
1018 *domain = talloc_strdup(mem_ctx, "");
1019 *username = cli_credentials_get_principal(cred, mem_ctx);
1021 *domain = cli_credentials_get_domain(cred);
1022 *username = cli_credentials_get_username(cred);
1027 * Read a named file, and parse it for username, domain, realm and password
1029 * @param credentials Credentials structure on which to set the password
1030 * @param file a named file to read the details from
1031 * @param obtained This enum describes how 'specified' this password is
1034 _PUBLIC_ bool cli_credentials_parse_file(struct cli_credentials *cred, const char *file, enum credentials_obtained obtained)
1037 char *ptr, *val, *param;
1041 lines = file_lines_load(file, &numlines, 0, NULL);
1045 /* fail if we can't open the credentials file */
1046 d_printf("ERROR: Unable to open credentials file!\n");
1050 for (i = 0; i < numlines; i++) {
1051 len = strlen(lines[i]);
1056 /* break up the line into parameter & value.
1057 * will need to eat a little whitespace possibly */
1059 if (!(ptr = strchr_m (lines[i], '=')))
1065 /* eat leading white space */
1066 while ((*val!='\0') && ((*val==' ') || (*val=='\t')))
1069 if (strwicmp("password", param) == 0) {
1070 cli_credentials_set_password(cred, val, obtained);
1071 } else if (strwicmp("username", param) == 0) {
1072 cli_credentials_set_username(cred, val, obtained);
1073 } else if (strwicmp("domain", param) == 0) {
1074 cli_credentials_set_domain(cred, val, obtained);
1075 } else if (strwicmp("realm", param) == 0) {
1076 cli_credentials_set_realm(cred, val, obtained);
1078 memset(lines[i], 0, len);
1087 * Read a named file, and parse it for a password
1089 * @param credentials Credentials structure on which to set the password
1090 * @param file a named file to read the password from
1091 * @param obtained This enum describes how 'specified' this password is
1094 _PUBLIC_ bool cli_credentials_parse_password_file(struct cli_credentials *credentials, const char *file, enum credentials_obtained obtained)
1096 int fd = open(file, O_RDONLY, 0);
1100 fprintf(stderr, "Error opening password file %s: %s\n",
1101 file, strerror(errno));
1105 ret = cli_credentials_parse_password_fd(credentials, fd, obtained);
1114 * Read a file descriptor, and parse it for a password (eg from a file or stdin)
1116 * @param credentials Credentials structure on which to set the password
1117 * @param fd open file descriptor to read the password from
1118 * @param obtained This enum describes how 'specified' this password is
1121 _PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credentials,
1122 int fd, enum credentials_obtained obtained)
1127 for(p = pass, *p = '\0'; /* ensure that pass is null-terminated */
1128 p && p - pass < sizeof(pass);) {
1129 switch (read(fd, p, 1)) {
1131 if (*p != '\n' && *p != '\0') {
1132 *++p = '\0'; /* advance p, and null-terminate pass */
1138 *p = '\0'; /* null-terminate it, just in case... */
1139 p = NULL; /* then force the loop condition to become false */
1142 fprintf(stderr, "Error reading password from file descriptor %d: %s\n", fd, "empty password\n");
1147 fprintf(stderr, "Error reading password from file descriptor %d: %s\n",
1148 fd, strerror(errno));
1153 cli_credentials_set_password(credentials, pass, obtained);