2 Unix SMB/CIFS implementation.
4 A localauth plugin for MIT Kerberos
6 Copyright (C) 2018 Andreas Schneider <asn@samba.org>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include <krb5/localauth_plugin.h>
29 struct krb5_localauth_moddata_st {
30 struct wbcContext *wbc_ctx;
34 * Initialize the module data.
36 * This creates the wbclient context.
38 static krb5_error_code winbind_init(krb5_context context,
39 krb5_localauth_moddata *data)
41 krb5_localauth_moddata d;
44 d = malloc(sizeof(struct krb5_localauth_moddata_st));
49 d->wbc_ctx = wbcCtxCreate();
50 if (d->wbc_ctx == NULL) {
55 wbcSetClientProcessName("krb5_localauth_plugin");
63 * Release resources used by module data.
65 static void winbind_fini(krb5_context context, krb5_localauth_moddata data)
67 wbcCtxFree(data->wbc_ctx);
73 * Determine whether aname is authorized to log in as the local account lname.
75 * Return 0 if aname is authorized, EPERM if aname is authoritatively not
76 * authorized, KRB5_PLUGIN_NO_HANDLE if the module cannot determine whether
77 * aname is authorized, and any other error code for a serious failure to
78 * process the request. aname will be considered authorized if at least one
79 * module returns 0 and all other modules return KRB5_PLUGIN_NO_HANDLE.
81 static krb5_error_code winbind_userok(krb5_context context,
82 krb5_localauth_moddata data,
83 krb5_const_principal aname,
86 krb5_error_code code = 0;
87 char *princ_str = NULL;
88 struct passwd *pwd = NULL;
89 uid_t princ_uid = (uid_t)-1;
90 uid_t lname_uid = (uid_t)-1;
94 code = krb5_unparse_name(context, aname, &princ_str);
99 cmp = strcasecmp(princ_str, lname);
101 krb5_free_unparsed_name(context, princ_str);
105 wbc_status = wbcCtxGetpwnam(data->wbc_ctx,
108 krb5_free_unparsed_name(context, princ_str);
109 switch (wbc_status) {
110 case WBC_ERR_SUCCESS:
111 princ_uid = pwd->pw_uid;
114 case WBC_ERR_UNKNOWN_USER:
115 /* match other insane libwbclient return codes */
116 case WBC_ERR_WINBIND_NOT_AVAILABLE:
117 case WBC_ERR_DOMAIN_NOT_FOUND:
118 code = KRB5_PLUGIN_NO_HANDLE;
129 wbc_status = wbcCtxGetpwnam(data->wbc_ctx,
132 switch (wbc_status) {
133 case WBC_ERR_SUCCESS:
134 lname_uid = pwd->pw_uid;
136 case WBC_ERR_UNKNOWN_USER:
137 /* match other insane libwbclient return codes */
138 case WBC_ERR_WINBIND_NOT_AVAILABLE:
139 case WBC_ERR_DOMAIN_NOT_FOUND:
140 code = KRB5_PLUGIN_NO_HANDLE;
151 if (princ_uid != lname_uid) {
159 * Determine the local account name corresponding to aname.
161 * Return 0 and set *lname_out if a mapping can be determined; the contents of
162 * *lname_out will later be released with a call to the module's free_string
163 * method. Return KRB5_LNAME_NOTRANS if no mapping can be determined. Return
164 * any other error code for a serious failure to process the request; this will
165 * halt the krb5_aname_to_localname operation.
167 * If the module's an2ln_types field is set, this method will only be invoked
168 * when a profile "auth_to_local" value references one of the module's types.
169 * type and residual will be set to the type and residual of the auth_to_local
172 * If the module's an2ln_types field is not set but the an2ln method is
173 * implemented, this method will be invoked independently of the profile's
174 * auth_to_local settings, with type and residual set to NULL. If multiple
175 * modules are registered with an2ln methods but no an2ln_types field, the
176 * order of invocation is not defined, but all such modules will be consulted
177 * before the built-in mechanisms are tried.
179 static krb5_error_code winbind_an2ln(krb5_context context,
180 krb5_localauth_moddata data,
182 const char *residual,
183 krb5_const_principal aname,
186 krb5_error_code code = 0;
187 char *princ_str = NULL;
189 struct passwd *pwd = NULL;
192 code = krb5_unparse_name(context, aname, &princ_str);
197 wbc_status = wbcCtxGetpwnam(data->wbc_ctx,
200 krb5_free_unparsed_name(context, princ_str);
201 switch (wbc_status) {
202 case WBC_ERR_SUCCESS:
203 name = strdup(pwd->pw_name);
206 case WBC_ERR_UNKNOWN_USER:
207 /* match other insane libwbclient return codes */
208 case WBC_ERR_WINBIND_NOT_AVAILABLE:
209 case WBC_ERR_DOMAIN_NOT_FOUND:
210 code = KRB5_LNAME_NOTRANS;
231 * Release the memory returned by an invocation of an2ln.
233 static void winbind_free_string(krb5_context context,
234 krb5_localauth_moddata data,
241 localauth_winbind_initvt(krb5_context context,
244 krb5_plugin_vtable vtable);
247 localauth_winbind_initvt(krb5_context context,
250 krb5_plugin_vtable vtable)
252 krb5_localauth_vtable vt = (krb5_localauth_vtable)vtable;
255 com_err("winbind_localauth",
257 "Failed to load, plugin API changed.");
258 return KRB5_PLUGIN_VER_NOTSUPP;
261 vt->init = winbind_init;
262 vt->fini = winbind_fini;
263 vt->name = "winbind";
264 vt->an2ln = winbind_an2ln;
265 vt->userok = winbind_userok;
266 vt->free_string = winbind_free_string;