nsswitch/libwbclient/wbc_pam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind client API
   5
   6    Copyright (C) Gerald (Jerry) Carter 2007
   7    Copyright (C) Guenther Deschner 2008
   8    Copyright (C) Volker Lendecke 2009
   9
  10    This library is free software; you can redistribute it and/or
  11    modify it under the terms of the GNU Lesser General Public
  12    License as published by the Free Software Foundation; either
  13    version 3 of the License, or (at your option) any later version.
  14
  15    This library is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18    Library General Public License for more details.
  19
  20    You should have received a copy of the GNU Lesser General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 /* Required Headers */
  25
  26 #include "replace.h"
  27 #include "libwbclient.h"
  28 #include "../winbind_client.h"
  29
  30 /* Authenticate a username/password pair */
  31 wbcErr wbcAuthenticateUser(const char *username,
  32                            const char *password)
  33 {
  34         wbcErr wbc_status = WBC_ERR_SUCCESS;
  35         struct wbcAuthUserParams params;
  36
  37         ZERO_STRUCT(params);
  38
  39         params.account_name             = username;
  40         params.level                    = WBC_AUTH_USER_LEVEL_PLAIN;
  41         params.password.plaintext       = password;
  42
  43         wbc_status = wbcAuthenticateUserEx(&params, NULL, NULL);
  44         BAIL_ON_WBC_ERROR(wbc_status);
  45
  46 done:
  47         return wbc_status;
  48 }
  49
  50 static bool sid_attr_compose(struct wbcSidWithAttr *s,
  51                              const struct wbcDomainSid *d,
  52                              uint32_t rid, uint32_t attr)
  53 {
  54         if (d->num_auths >= WBC_MAXSUBAUTHS) {
  55                 return false;
  56         }
  57         s->sid = *d;
  58         s->sid.sub_auths[s->sid.num_auths++] = rid;
  59         s->attributes = attr;
  60         return true;
  61 }
  62
  63 static void wbcAuthUserInfoDestructor(void *ptr)
  64 {
  65         struct wbcAuthUserInfo *i = (struct wbcAuthUserInfo *)ptr;
  66         free(i->account_name);
  67         free(i->user_principal);
  68         free(i->full_name);
  69         free(i->domain_name);
  70         free(i->dns_domain_name);
  71         free(i->logon_server);
  72         free(i->logon_script);
  73         free(i->profile_path);
  74         free(i->home_directory);
  75         free(i->home_drive);
  76         free(i->sids);
  77 }
  78
  79 static wbcErr wbc_create_auth_info(const struct winbindd_response *resp,
  80                                    struct wbcAuthUserInfo **_i)
  81 {
  82         wbcErr wbc_status = WBC_ERR_SUCCESS;
  83         struct wbcAuthUserInfo *i;
  84         struct wbcDomainSid domain_sid;
  85         char *p;
  86         uint32_t sn = 0;
  87         uint32_t j;
  88
  89         i = (struct wbcAuthUserInfo *)wbcAllocateMemory(
  90                 sizeof(struct wbcAuthUserInfo), 1,
  91                 wbcAuthUserInfoDestructor);
  92         BAIL_ON_PTR_ERROR(i, wbc_status);
  93
  94         i->user_flags   = resp->data.auth.info3.user_flgs;
  95
  96         i->account_name = strdup(resp->data.auth.info3.user_name);
  97         BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
  98         i->user_principal= NULL;
  99         i->full_name    = strdup(resp->data.auth.info3.full_name);
 100         BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
 101         i->domain_name  = strdup(resp->data.auth.info3.logon_dom);
 102         BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
 103         i->dns_domain_name= NULL;
 104
 105         i->acct_flags   = resp->data.auth.info3.acct_flags;
 106         memcpy(i->user_session_key,
 107                resp->data.auth.user_session_key,
 108                sizeof(i->user_session_key));
 109         memcpy(i->lm_session_key,
 110                resp->data.auth.first_8_lm_hash,
 111                sizeof(i->lm_session_key));
 112
 113         i->logon_count          = resp->data.auth.info3.logon_count;
 114         i->bad_password_count   = resp->data.auth.info3.bad_pw_count;
 115
 116         i->logon_time           = resp->data.auth.info3.logon_time;
 117         i->logoff_time          = resp->data.auth.info3.logoff_time;
 118         i->kickoff_time         = resp->data.auth.info3.kickoff_time;
 119         i->pass_last_set_time   = resp->data.auth.info3.pass_last_set_time;
 120         i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
 121         i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
 122
 123         i->logon_server = strdup(resp->data.auth.info3.logon_srv);
 124         BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
 125         i->logon_script = strdup(resp->data.auth.info3.logon_script);
 126         BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
 127         i->profile_path = strdup(resp->data.auth.info3.profile_path);
 128         BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
 129         i->home_directory= strdup(resp->data.auth.info3.home_dir);
 130         BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
 131         i->home_drive   = strdup(resp->data.auth.info3.dir_drive);
 132         BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
 133
 134         i->num_sids     = 2;
 135         i->num_sids     += resp->data.auth.info3.num_groups;
 136         i->num_sids     += resp->data.auth.info3.num_other_sids;
 137
 138         i->sids = (struct wbcSidWithAttr *)calloc(
 139                 sizeof(struct wbcSidWithAttr), i->num_sids);
 140         BAIL_ON_PTR_ERROR(i->sids, wbc_status);
 141
 142         wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
 143                                     &domain_sid);
 144         BAIL_ON_WBC_ERROR(wbc_status);
 145
 146         sn = 0;
 147         if (!sid_attr_compose(&i->sids[sn], &domain_sid,
 148                               resp->data.auth.info3.user_rid, 0)) {
 149                 wbc_status = WBC_ERR_INVALID_SID;
 150                 goto done;
 151         }
 152         sn++;
 153         if (!sid_attr_compose(&i->sids[sn], &domain_sid,
 154                               resp->data.auth.info3.group_rid, 0)) {
 155                 wbc_status = WBC_ERR_INVALID_SID;
 156                 goto done;
 157         }
 158         sn++;
 159
 160         p = (char *)resp->extra_data.data;
 161         if (!p) {
 162                 wbc_status = WBC_ERR_INVALID_RESPONSE;
 163                 BAIL_ON_WBC_ERROR(wbc_status);
 164         }
 165
 166         for (j=0; j < resp->data.auth.info3.num_groups; j++) {
 167                 uint32_t rid;
 168                 uint32_t attrs;
 169                 int ret;
 170                 char *s = p;
 171                 char *e = strchr(p, '\n');
 172                 if (!e) {
 173                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 174                         BAIL_ON_WBC_ERROR(wbc_status);
 175                 }
 176                 e[0] = '\0';
 177                 p = &e[1];
 178
 179                 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
 180                 if (ret != 2) {
 181                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 182                         BAIL_ON_WBC_ERROR(wbc_status);
 183                 }
 184
 185                 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
 186                                       rid, attrs)) {
 187                         wbc_status = WBC_ERR_INVALID_SID;
 188                         goto done;
 189                 }
 190                 sn++;
 191         }
 192
 193         for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
 194                 uint32_t attrs;
 195                 int ret;
 196                 char *s = p;
 197                 char *a;
 198                 char *e = strchr(p, '\n');
 199                 if (!e) {
 200                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 201                         BAIL_ON_WBC_ERROR(wbc_status);
 202                 }
 203                 e[0] = '\0';
 204                 p = &e[1];
 205
 206                 e = strchr(s, ':');
 207                 if (!e) {
 208                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 209                         BAIL_ON_WBC_ERROR(wbc_status);
 210                 }
 211                 e[0] = '\0';
 212                 a = &e[1];
 213
 214                 ret = sscanf(a, "0x%08X",
 215                              &attrs);
 216                 if (ret != 1) {
 217                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 218                         BAIL_ON_WBC_ERROR(wbc_status);
 219                 }
 220
 221                 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
 222                 BAIL_ON_WBC_ERROR(wbc_status);
 223
 224                 i->sids[sn].attributes = attrs;
 225                 sn++;
 226         }
 227
 228         i->num_sids = sn;
 229
 230         *_i = i;
 231         i = NULL;
 232 done:
 233         wbcFreeMemory(i);
 234         return wbc_status;
 235 }
 236
 237 static void wbcAuthErrorInfoDestructor(void *ptr)
 238 {
 239         struct wbcAuthErrorInfo *e = (struct wbcAuthErrorInfo *)ptr;
 240         free(e->nt_string);
 241         free(e->display_string);
 242 }
 243
 244 static wbcErr wbc_create_error_info(const struct winbindd_response *resp,
 245                                     struct wbcAuthErrorInfo **_e)
 246 {
 247         wbcErr wbc_status = WBC_ERR_SUCCESS;
 248         struct wbcAuthErrorInfo *e;
 249
 250         e = (struct wbcAuthErrorInfo *)wbcAllocateMemory(
 251                 sizeof(struct wbcAuthErrorInfo), 1,
 252                 wbcAuthErrorInfoDestructor);
 253         BAIL_ON_PTR_ERROR(e, wbc_status);
 254
 255         e->nt_status = resp->data.auth.nt_status;
 256         e->pam_error = resp->data.auth.pam_error;
 257         e->nt_string = strdup(resp->data.auth.nt_status_string);
 258         BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
 259
 260         e->display_string = strdup(resp->data.auth.error_string);
 261         BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
 262
 263         *_e = e;
 264         e = NULL;
 265
 266 done:
 267         wbcFreeMemory(e);
 268         return wbc_status;
 269 }
 270
 271 static wbcErr wbc_create_password_policy_info(const struct winbindd_response *resp,
 272                                               struct wbcUserPasswordPolicyInfo **_i)
 273 {
 274         wbcErr wbc_status = WBC_ERR_SUCCESS;
 275         struct wbcUserPasswordPolicyInfo *i;
 276
 277         i = (struct wbcUserPasswordPolicyInfo *)wbcAllocateMemory(
 278                 sizeof(struct wbcUserPasswordPolicyInfo), 1, NULL);
 279         BAIL_ON_PTR_ERROR(i, wbc_status);
 280
 281         i->min_passwordage      = resp->data.auth.policy.min_passwordage;
 282         i->min_length_password  = resp->data.auth.policy.min_length_password;
 283         i->password_history     = resp->data.auth.policy.password_history;
 284         i->password_properties  = resp->data.auth.policy.password_properties;
 285         i->expire               = resp->data.auth.policy.expire;
 286
 287         *_i = i;
 288         i = NULL;
 289
 290 done:
 291         wbcFreeMemory(i);
 292         return wbc_status;
 293 }
 294
 295 static void wbcLogonUserInfoDestructor(void *ptr)
 296 {
 297         struct wbcLogonUserInfo *i = (struct wbcLogonUserInfo *)ptr;
 298         wbcFreeMemory(i->info);
 299         wbcFreeMemory(i->blobs);
 300 }
 301
 302 static wbcErr wbc_create_logon_info(struct winbindd_response *resp,
 303                                     struct wbcLogonUserInfo **_i)
 304 {
 305         wbcErr wbc_status = WBC_ERR_SUCCESS;
 306         struct wbcLogonUserInfo *i;
 307
 308         i = (struct wbcLogonUserInfo *)wbcAllocateMemory(
 309                 sizeof(struct wbcLogonUserInfo), 1,
 310                 wbcLogonUserInfoDestructor);
 311         BAIL_ON_PTR_ERROR(i, wbc_status);
 312
 313         wbc_status = wbc_create_auth_info(resp, &i->info);
 314         BAIL_ON_WBC_ERROR(wbc_status);
 315
 316         if (resp->data.auth.krb5ccname[0] != '\0') {
 317                 wbc_status = wbcAddNamedBlob(&i->num_blobs,
 318                                              &i->blobs,
 319                                              "krb5ccname",
 320                                              0,
 321                                              (uint8_t *)resp->data.auth.krb5ccname,
 322                                              strlen(resp->data.auth.krb5ccname)+1);
 323                 BAIL_ON_WBC_ERROR(wbc_status);
 324         }
 325
 326         if (resp->data.auth.unix_username[0] != '\0') {
 327                 wbc_status = wbcAddNamedBlob(&i->num_blobs,
 328                                              &i->blobs,
 329                                              "unix_username",
 330                                              0,
 331                                              (uint8_t *)resp->data.auth.unix_username,
 332                                              strlen(resp->data.auth.unix_username)+1);
 333                 BAIL_ON_WBC_ERROR(wbc_status);
 334         }
 335
 336         *_i = i;
 337         i = NULL;
 338 done:
 339         wbcFreeMemory(i);
 340         return wbc_status;
 341 }
 342
 343
 344 /* Authenticate with more detailed information */
 345 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
 346                              struct wbcAuthUserInfo **info,
 347                              struct wbcAuthErrorInfo **error)
 348 {
 349         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 350         int cmd = 0;
 351         struct winbindd_request request;
 352         struct winbindd_response response;
 353
 354         ZERO_STRUCT(request);
 355         ZERO_STRUCT(response);
 356
 357         if (error) {
 358                 *error = NULL;
 359         }
 360
 361         if (!params) {
 362                 wbc_status = WBC_ERR_INVALID_PARAM;
 363                 BAIL_ON_WBC_ERROR(wbc_status);
 364         }
 365
 366         if (!params->account_name) {
 367                 wbc_status = WBC_ERR_INVALID_PARAM;
 368                 BAIL_ON_WBC_ERROR(wbc_status);
 369         }
 370
 371         /* Initialize request */
 372
 373         switch (params->level) {
 374         case WBC_AUTH_USER_LEVEL_PLAIN:
 375                 cmd = WINBINDD_PAM_AUTH;
 376                 request.flags = WBFLAG_PAM_INFO3_TEXT |
 377                                 WBFLAG_PAM_USER_SESSION_KEY |
 378                                 WBFLAG_PAM_LMKEY;
 379
 380                 if (!params->password.plaintext) {
 381                         wbc_status = WBC_ERR_INVALID_PARAM;
 382                         BAIL_ON_WBC_ERROR(wbc_status);
 383                 }
 384
 385                 if (params->domain_name && params->domain_name[0]) {
 386                         /* We need to get the winbind separator :-( */
 387                         struct winbindd_response sep_response;
 388
 389                         ZERO_STRUCT(sep_response);
 390
 391                         wbc_status = wbcRequestResponse(WINBINDD_INFO,
 392                                                         NULL, &sep_response);
 393                         BAIL_ON_WBC_ERROR(wbc_status);
 394
 395                         snprintf(request.data.auth.user,
 396                                  sizeof(request.data.auth.user)-1,
 397                                  "%s%c%s",
 398                                  params->domain_name,
 399                                  sep_response.data.info.winbind_separator,
 400                                  params->account_name);
 401                 } else {
 402                         strncpy(request.data.auth.user,
 403                                 params->account_name,
 404                                 sizeof(request.data.auth.user)-1);
 405                 }
 406
 407                 strncpy(request.data.auth.pass,
 408                         params->password.plaintext,
 409                         sizeof(request.data.auth.pass)-1);
 410                 break;
 411
 412         case WBC_AUTH_USER_LEVEL_HASH:
 413                 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
 414                 BAIL_ON_WBC_ERROR(wbc_status);
 415                 break;
 416
 417         case WBC_AUTH_USER_LEVEL_RESPONSE:
 418                 cmd = WINBINDD_PAM_AUTH_CRAP;
 419                 request.flags = WBFLAG_PAM_INFO3_TEXT |
 420                                 WBFLAG_PAM_USER_SESSION_KEY |
 421                                 WBFLAG_PAM_LMKEY;
 422
 423                 if (params->password.response.lm_length &&
 424                     !params->password.response.lm_data) {
 425                         wbc_status = WBC_ERR_INVALID_PARAM;
 426                         BAIL_ON_WBC_ERROR(wbc_status);
 427                 }
 428                 if (params->password.response.lm_length == 0 &&
 429                     params->password.response.lm_data) {
 430                         wbc_status = WBC_ERR_INVALID_PARAM;
 431                         BAIL_ON_WBC_ERROR(wbc_status);
 432                 }
 433
 434                 if (params->password.response.nt_length &&
 435                     !params->password.response.nt_data) {
 436                         wbc_status = WBC_ERR_INVALID_PARAM;
 437                         BAIL_ON_WBC_ERROR(wbc_status);
 438                 }
 439                 if (params->password.response.nt_length == 0&&
 440                     params->password.response.nt_data) {
 441                         wbc_status = WBC_ERR_INVALID_PARAM;
 442                         BAIL_ON_WBC_ERROR(wbc_status);
 443                 }
 444
 445                 strncpy(request.data.auth_crap.user,
 446                         params->account_name,
 447                         sizeof(request.data.auth_crap.user)-1);
 448                 if (params->domain_name) {
 449                         strncpy(request.data.auth_crap.domain,
 450                                 params->domain_name,
 451                                 sizeof(request.data.auth_crap.domain)-1);
 452                 }
 453                 if (params->workstation_name) {
 454                         strncpy(request.data.auth_crap.workstation,
 455                                 params->workstation_name,
 456                                 sizeof(request.data.auth_crap.workstation)-1);
 457                 }
 458
 459                 request.data.auth_crap.logon_parameters =
 460                                 params->parameter_control;
 461
 462                 memcpy(request.data.auth_crap.chal,
 463                        params->password.response.challenge,
 464                        sizeof(request.data.auth_crap.chal));
 465
 466                 request.data.auth_crap.lm_resp_len =
 467                                 MIN(params->password.response.lm_length,
 468                                     sizeof(request.data.auth_crap.lm_resp));
 469                 if (params->password.response.lm_data) {
 470                         memcpy(request.data.auth_crap.lm_resp,
 471                                params->password.response.lm_data,
 472                                request.data.auth_crap.lm_resp_len);
 473                 }
 474                 request.data.auth_crap.nt_resp_len = params->password.response.nt_length;
 475                 if (params->password.response.nt_length > sizeof(request.data.auth_crap.nt_resp)) {
 476                         request.flags |= WBFLAG_BIG_NTLMV2_BLOB;
 477                         request.extra_len = params->password.response.nt_length;
 478                         request.extra_data.data = (char *)malloc(
 479                                 request.extra_len);
 480                         if (request.extra_data.data == NULL) {
 481                                 wbc_status = WBC_ERR_NO_MEMORY;
 482                                 BAIL_ON_WBC_ERROR(wbc_status);
 483                         }
 484                         memcpy(request.extra_data.data,
 485                                params->password.response.nt_data,
 486                                request.data.auth_crap.nt_resp_len);
 487                 } else if (params->password.response.nt_data) {
 488                         memcpy(request.data.auth_crap.nt_resp,
 489                                params->password.response.nt_data,
 490                                request.data.auth_crap.nt_resp_len);
 491                 }
 492                 break;
 493         default:
 494                 break;
 495         }
 496
 497         if (cmd == 0) {
 498                 wbc_status = WBC_ERR_INVALID_PARAM;
 499                 BAIL_ON_WBC_ERROR(wbc_status);
 500         }
 501
 502         if (params->flags) {
 503                 request.flags |= params->flags;
 504         }
 505
 506         if (cmd == WINBINDD_PAM_AUTH_CRAP) {
 507                 wbc_status = wbcRequestResponsePriv(cmd, &request, &response);
 508         } else {
 509                 wbc_status = wbcRequestResponse(cmd, &request, &response);
 510         }
 511         if (response.data.auth.nt_status != 0) {
 512                 if (error) {
 513                         wbc_status = wbc_create_error_info(&response,
 514                                                            error);
 515                         BAIL_ON_WBC_ERROR(wbc_status);
 516                 }
 517
 518                 wbc_status = WBC_ERR_AUTH_ERROR;
 519                 BAIL_ON_WBC_ERROR(wbc_status);
 520         }
 521         BAIL_ON_WBC_ERROR(wbc_status);
 522
 523         if (info) {
 524                 wbc_status = wbc_create_auth_info(&response, info);
 525                 BAIL_ON_WBC_ERROR(wbc_status);
 526         }
 527
 528 done:
 529         winbindd_free_response(&response);
 530
 531         free(request.extra_data.data);
 532
 533         return wbc_status;
 534 }
 535
 536 /* Trigger a verification of the trust credentials of a specific domain */
 537 wbcErr wbcCheckTrustCredentials(const char *domain,
 538                                 struct wbcAuthErrorInfo **error)
 539 {
 540         struct winbindd_request request;
 541         struct winbindd_response response;
 542         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 543
 544         ZERO_STRUCT(request);
 545         ZERO_STRUCT(response);
 546
 547         if (domain) {
 548                 strncpy(request.domain_name, domain,
 549                         sizeof(request.domain_name)-1);
 550         }
 551
 552         /* Send request */
 553
 554         wbc_status = wbcRequestResponsePriv(WINBINDD_CHECK_MACHACC,
 555                                             &request, &response);
 556         if (response.data.auth.nt_status != 0) {
 557                 if (error) {
 558                         wbc_status = wbc_create_error_info(&response,
 559                                                            error);
 560                         BAIL_ON_WBC_ERROR(wbc_status);
 561                 }
 562
 563                 wbc_status = WBC_ERR_AUTH_ERROR;
 564                 BAIL_ON_WBC_ERROR(wbc_status);
 565         }
 566         BAIL_ON_WBC_ERROR(wbc_status);
 567
 568  done:
 569         return wbc_status;
 570 }
 571
 572 /* Trigger a change of the trust credentials for a specific domain */
 573 wbcErr wbcChangeTrustCredentials(const char *domain,
 574                                  struct wbcAuthErrorInfo **error)
 575 {
 576         struct winbindd_request request;
 577         struct winbindd_response response;
 578         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 579
 580         ZERO_STRUCT(request);
 581         ZERO_STRUCT(response);
 582
 583         if (domain) {
 584                 strncpy(request.domain_name, domain,
 585                         sizeof(request.domain_name)-1);
 586         }
 587
 588         /* Send request */
 589
 590         wbc_status = wbcRequestResponsePriv(WINBINDD_CHANGE_MACHACC,
 591                                         &request, &response);
 592         if (response.data.auth.nt_status != 0) {
 593                 if (error) {
 594                         wbc_status = wbc_create_error_info(&response,
 595                                                            error);
 596                         BAIL_ON_WBC_ERROR(wbc_status);
 597                 }
 598
 599                 wbc_status = WBC_ERR_AUTH_ERROR;
 600                 BAIL_ON_WBC_ERROR(wbc_status);
 601         }
 602         BAIL_ON_WBC_ERROR(wbc_status);
 603
 604  done:
 605         return wbc_status;
 606 }
 607
 608 /*
 609  * Trigger a no-op NETLOGON call. Lightweight version of
 610  * wbcCheckTrustCredentials
 611  */
 612 wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
 613 {
 614         struct winbindd_request request;
 615         struct winbindd_response response;
 616         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 617
 618         if (domain) {
 619                 /*
 620                  * the current protocol doesn't support
 621                  * specifying a domain
 622                  */
 623                 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
 624                 BAIL_ON_WBC_ERROR(wbc_status);
 625         }
 626
 627         ZERO_STRUCT(request);
 628         ZERO_STRUCT(response);
 629
 630         /* Send request */
 631
 632         wbc_status = wbcRequestResponse(WINBINDD_PING_DC,
 633                                         &request,
 634                                         &response);
 635         if (response.data.auth.nt_status != 0) {
 636                 if (error) {
 637                         wbc_status = wbc_create_error_info(&response,
 638                                                            error);
 639                         BAIL_ON_WBC_ERROR(wbc_status);
 640                 }
 641
 642                 wbc_status = WBC_ERR_AUTH_ERROR;
 643                 BAIL_ON_WBC_ERROR(wbc_status);
 644         }
 645         BAIL_ON_WBC_ERROR(wbc_status);
 646
 647  done:
 648         return wbc_status;
 649 }
 650
 651 /* Trigger an extended logoff notification to Winbind for a specific user */
 652 wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
 653                        struct wbcAuthErrorInfo **error)
 654 {
 655         struct winbindd_request request;
 656         struct winbindd_response response;
 657         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 658         int i;
 659
 660         /* validate input */
 661
 662         if (!params || !params->username) {
 663                 wbc_status = WBC_ERR_INVALID_PARAM;
 664                 BAIL_ON_WBC_ERROR(wbc_status);
 665         }
 666
 667         if ((params->num_blobs > 0) && (params->blobs == NULL)) {
 668                 wbc_status = WBC_ERR_INVALID_PARAM;
 669                 BAIL_ON_WBC_ERROR(wbc_status);
 670         }
 671         if ((params->num_blobs == 0) && (params->blobs != NULL)) {
 672                 wbc_status = WBC_ERR_INVALID_PARAM;
 673                 BAIL_ON_WBC_ERROR(wbc_status);
 674         }
 675
 676         ZERO_STRUCT(request);
 677         ZERO_STRUCT(response);
 678
 679         strncpy(request.data.logoff.user, params->username,
 680                 sizeof(request.data.logoff.user)-1);
 681
 682         for (i=0; i<params->num_blobs; i++) {
 683
 684                 if (strcasecmp(params->blobs[i].name, "ccfilename") == 0) {
 685                         if (params->blobs[i].blob.data) {
 686                                 strncpy(request.data.logoff.krb5ccname,
 687                                         (const char *)params->blobs[i].blob.data,
 688                                         sizeof(request.data.logoff.krb5ccname) - 1);
 689                         }
 690                         continue;
 691                 }
 692
 693                 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
 694                         if (params->blobs[i].blob.data) {
 695                                 memcpy(&request.data.logoff.uid,
 696                                         params->blobs[i].blob.data,
 697                                         MIN(params->blobs[i].blob.length,
 698                                             sizeof(request.data.logoff.uid)));
 699                         }
 700                         continue;
 701                 }
 702
 703                 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
 704                         if (params->blobs[i].blob.data) {
 705                                 memcpy(&request.flags,
 706                                         params->blobs[i].blob.data,
 707                                         MIN(params->blobs[i].blob.length,
 708                                             sizeof(request.flags)));
 709                         }
 710                         continue;
 711                 }
 712         }
 713
 714         /* Send request */
 715
 716         wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
 717                                         &request,
 718                                         &response);
 719
 720         /* Take the response above and return it to the caller */
 721         if (response.data.auth.nt_status != 0) {
 722                 if (error) {
 723                         wbc_status = wbc_create_error_info(&response,
 724                                                            error);
 725                         BAIL_ON_WBC_ERROR(wbc_status);
 726                 }
 727
 728                 wbc_status = WBC_ERR_AUTH_ERROR;
 729                 BAIL_ON_WBC_ERROR(wbc_status);
 730         }
 731         BAIL_ON_WBC_ERROR(wbc_status);
 732
 733  done:
 734         return wbc_status;
 735 }
 736
 737 /* Trigger a logoff notification to Winbind for a specific user */
 738 wbcErr wbcLogoffUser(const char *username,
 739                      uid_t uid,
 740                      const char *ccfilename)
 741 {
 742         struct winbindd_request request;
 743         struct winbindd_response response;
 744         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 745
 746         /* validate input */
 747
 748         if (!username) {
 749                 wbc_status = WBC_ERR_INVALID_PARAM;
 750                 BAIL_ON_WBC_ERROR(wbc_status);
 751         }
 752
 753         ZERO_STRUCT(request);
 754         ZERO_STRUCT(response);
 755
 756         strncpy(request.data.logoff.user, username,
 757                 sizeof(request.data.logoff.user)-1);
 758         request.data.logoff.uid = uid;
 759
 760         if (ccfilename) {
 761                 strncpy(request.data.logoff.krb5ccname, ccfilename,
 762                         sizeof(request.data.logoff.krb5ccname)-1);
 763         }
 764
 765         /* Send request */
 766
 767         wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
 768                                         &request,
 769                                         &response);
 770
 771         /* Take the response above and return it to the caller */
 772
 773  done:
 774         return wbc_status;
 775 }
 776
 777 /* Change a password for a user with more detailed information upon failure */
 778 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
 779                                struct wbcAuthErrorInfo **error,
 780                                enum wbcPasswordChangeRejectReason *reject_reason,
 781                                struct wbcUserPasswordPolicyInfo **policy)
 782 {
 783         struct winbindd_request request;
 784         struct winbindd_response response;
 785         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 786         int cmd = 0;
 787
 788         /* validate input */
 789
 790         if (!params->account_name) {
 791                 wbc_status = WBC_ERR_INVALID_PARAM;
 792                 goto done;
 793         }
 794
 795         if (error) {
 796                 *error = NULL;
 797         }
 798
 799         if (policy) {
 800                 *policy = NULL;
 801         }
 802
 803         if (reject_reason) {
 804                 *reject_reason = -1;
 805         }
 806
 807         ZERO_STRUCT(request);
 808         ZERO_STRUCT(response);
 809
 810         switch (params->level) {
 811         case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
 812                 cmd = WINBINDD_PAM_CHAUTHTOK;
 813
 814                 if (!params->account_name) {
 815                         wbc_status = WBC_ERR_INVALID_PARAM;
 816                         goto done;
 817                 }
 818
 819                 strncpy(request.data.chauthtok.user, params->account_name,
 820                         sizeof(request.data.chauthtok.user) - 1);
 821
 822                 if (params->old_password.plaintext) {
 823                         strncpy(request.data.chauthtok.oldpass,
 824                                 params->old_password.plaintext,
 825                                 sizeof(request.data.chauthtok.oldpass) - 1);
 826                 }
 827
 828                 if (params->new_password.plaintext) {
 829                         strncpy(request.data.chauthtok.newpass,
 830                                 params->new_password.plaintext,
 831                                 sizeof(request.data.chauthtok.newpass) - 1);
 832                 }
 833                 break;
 834
 835         case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
 836                 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
 837
 838                 if (!params->account_name || !params->domain_name) {
 839                         wbc_status = WBC_ERR_INVALID_PARAM;
 840                         goto done;
 841                 }
 842
 843                 if (params->old_password.response.old_lm_hash_enc_length &&
 844                     !params->old_password.response.old_lm_hash_enc_data) {
 845                         wbc_status = WBC_ERR_INVALID_PARAM;
 846                         goto done;
 847                 }
 848
 849                 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
 850                     params->old_password.response.old_lm_hash_enc_data) {
 851                         wbc_status = WBC_ERR_INVALID_PARAM;
 852                         goto done;
 853                 }
 854
 855                 if (params->old_password.response.old_nt_hash_enc_length &&
 856                     !params->old_password.response.old_nt_hash_enc_data) {
 857                         wbc_status = WBC_ERR_INVALID_PARAM;
 858                         goto done;
 859                 }
 860
 861                 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
 862                     params->old_password.response.old_nt_hash_enc_data) {
 863                         wbc_status = WBC_ERR_INVALID_PARAM;
 864                         goto done;
 865                 }
 866
 867                 if (params->new_password.response.lm_length &&
 868                     !params->new_password.response.lm_data) {
 869                         wbc_status = WBC_ERR_INVALID_PARAM;
 870                         goto done;
 871                 }
 872
 873                 if (params->new_password.response.lm_length == 0 &&
 874                     params->new_password.response.lm_data) {
 875                         wbc_status = WBC_ERR_INVALID_PARAM;
 876                         goto done;
 877                 }
 878
 879                 if (params->new_password.response.nt_length &&
 880                     !params->new_password.response.nt_data) {
 881                         wbc_status = WBC_ERR_INVALID_PARAM;
 882                         goto done;
 883                 }
 884
 885                 if (params->new_password.response.nt_length == 0 &&
 886                     params->new_password.response.nt_data) {
 887                         wbc_status = WBC_ERR_INVALID_PARAM;
 888                         goto done;
 889                 }
 890
 891                 strncpy(request.data.chng_pswd_auth_crap.user,
 892                         params->account_name,
 893                         sizeof(request.data.chng_pswd_auth_crap.user) - 1);
 894
 895                 strncpy(request.data.chng_pswd_auth_crap.domain,
 896                         params->domain_name,
 897                         sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
 898
 899                 if (params->new_password.response.nt_data) {
 900                         request.data.chng_pswd_auth_crap.new_nt_pswd_len =
 901                                 params->new_password.response.nt_length;
 902                         memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
 903                                params->new_password.response.nt_data,
 904                                request.data.chng_pswd_auth_crap.new_nt_pswd_len);
 905                 }
 906
 907                 if (params->new_password.response.lm_data) {
 908                         request.data.chng_pswd_auth_crap.new_lm_pswd_len =
 909                                 params->new_password.response.lm_length;
 910                         memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
 911                                params->new_password.response.lm_data,
 912                                request.data.chng_pswd_auth_crap.new_lm_pswd_len);
 913                 }
 914
 915                 if (params->old_password.response.old_nt_hash_enc_data) {
 916                         request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
 917                                 params->old_password.response.old_nt_hash_enc_length;
 918                         memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
 919                                params->old_password.response.old_nt_hash_enc_data,
 920                                request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
 921                 }
 922
 923                 if (params->old_password.response.old_lm_hash_enc_data) {
 924                         request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
 925                                 params->old_password.response.old_lm_hash_enc_length;
 926                         memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
 927                                params->old_password.response.old_lm_hash_enc_data,
 928                                request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
 929                 }
 930
 931                 break;
 932         default:
 933                 wbc_status = WBC_ERR_INVALID_PARAM;
 934                 goto done;
 935                 break;
 936         }
 937
 938         /* Send request */
 939
 940         wbc_status = wbcRequestResponse(cmd,
 941                                         &request,
 942                                         &response);
 943         if (WBC_ERROR_IS_OK(wbc_status)) {
 944                 goto done;
 945         }
 946
 947         /* Take the response above and return it to the caller */
 948
 949         if (response.data.auth.nt_status != 0) {
 950                 if (error) {
 951                         wbc_status = wbc_create_error_info(&response,
 952                                                            error);
 953                         BAIL_ON_WBC_ERROR(wbc_status);
 954                 }
 955
 956         }
 957
 958         if (policy) {
 959                 wbc_status = wbc_create_password_policy_info(&response,
 960                                                              policy);
 961                 BAIL_ON_WBC_ERROR(wbc_status);
 962         }
 963
 964         if (reject_reason) {
 965                 *reject_reason = response.data.auth.reject_reason;
 966         }
 967
 968         wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
 969         BAIL_ON_WBC_ERROR(wbc_status);
 970
 971  done:
 972         return wbc_status;
 973 }
 974
 975 /* Change a password for a user */
 976 wbcErr wbcChangeUserPassword(const char *username,
 977                              const char *old_password,
 978                              const char *new_password)
 979 {
 980         wbcErr wbc_status = WBC_ERR_SUCCESS;
 981         struct wbcChangePasswordParams params;
 982
 983         ZERO_STRUCT(params);
 984
 985         params.account_name             = username;
 986         params.level                    = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
 987         params.old_password.plaintext   = old_password;
 988         params.new_password.plaintext   = new_password;
 989
 990         wbc_status = wbcChangeUserPasswordEx(&params,
 991                                              NULL,
 992                                              NULL,
 993                                              NULL);
 994         BAIL_ON_WBC_ERROR(wbc_status);
 995
 996 done:
 997         return wbc_status;
 998 }
 999
1000 /* Logon a User */
1001 wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
1002                     struct wbcLogonUserInfo **info,
1003                     struct wbcAuthErrorInfo **error,
1004                     struct wbcUserPasswordPolicyInfo **policy)
1005 {
1006         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1007         struct winbindd_request request;
1008         struct winbindd_response response;
1009         uint32_t i;
1010
1011         ZERO_STRUCT(request);
1012         ZERO_STRUCT(response);
1013
1014         if (info) {
1015                 *info = NULL;
1016         }
1017         if (error) {
1018                 *error = NULL;
1019         }
1020         if (policy) {
1021                 *policy = NULL;
1022         }
1023
1024         if (!params) {
1025                 wbc_status = WBC_ERR_INVALID_PARAM;
1026                 BAIL_ON_WBC_ERROR(wbc_status);
1027         }
1028
1029         if (!params->username) {
1030                 wbc_status = WBC_ERR_INVALID_PARAM;
1031                 BAIL_ON_WBC_ERROR(wbc_status);
1032         }
1033
1034         if ((params->num_blobs > 0) && (params->blobs == NULL)) {
1035                 wbc_status = WBC_ERR_INVALID_PARAM;
1036                 BAIL_ON_WBC_ERROR(wbc_status);
1037         }
1038         if ((params->num_blobs == 0) && (params->blobs != NULL)) {
1039                 wbc_status = WBC_ERR_INVALID_PARAM;
1040                 BAIL_ON_WBC_ERROR(wbc_status);
1041         }
1042
1043         /* Initialize request */
1044
1045         request.flags = WBFLAG_PAM_INFO3_TEXT |
1046                         WBFLAG_PAM_USER_SESSION_KEY |
1047                         WBFLAG_PAM_LMKEY;
1048
1049         if (!params->password) {
1050                 wbc_status = WBC_ERR_INVALID_PARAM;
1051                 BAIL_ON_WBC_ERROR(wbc_status);
1052         }
1053
1054         strncpy(request.data.auth.user,
1055                 params->username,
1056                 sizeof(request.data.auth.user)-1);
1057
1058         strncpy(request.data.auth.pass,
1059                 params->password,
1060                 sizeof(request.data.auth.pass)-1);
1061
1062         for (i=0; i<params->num_blobs; i++) {
1063
1064                 if (strcasecmp(params->blobs[i].name, "krb5_cc_type") == 0) {
1065                         if (params->blobs[i].blob.data) {
1066                                 strncpy(request.data.auth.krb5_cc_type,
1067                                         (const char *)params->blobs[i].blob.data,
1068                                         sizeof(request.data.auth.krb5_cc_type) - 1);
1069                         }
1070                         continue;
1071                 }
1072
1073                 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
1074                         if (params->blobs[i].blob.data) {
1075                                 memcpy(&request.data.auth.uid,
1076                                         params->blobs[i].blob.data,
1077                                         MIN(sizeof(request.data.auth.uid),
1078                                             params->blobs[i].blob.length));
1079                         }
1080                         continue;
1081                 }
1082
1083                 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
1084                         if (params->blobs[i].blob.data) {
1085                                 uint32_t flags;
1086                                 memcpy(&flags,
1087                                         params->blobs[i].blob.data,
1088                                         MIN(sizeof(flags),
1089                                             params->blobs[i].blob.length));
1090                                 request.flags |= flags;
1091                         }
1092                         continue;
1093                 }
1094
1095                 if (strcasecmp(params->blobs[i].name, "membership_of") == 0) {
1096                         if (params->blobs[i].blob.data &&
1097                             params->blobs[i].blob.data[0] > 0) {
1098                                 strncpy(request.data.auth.require_membership_of_sid,
1099                                         (const char *)params->blobs[i].blob.data,
1100                                         sizeof(request.data.auth.require_membership_of_sid) - 1);
1101                         }
1102                         continue;
1103                 }
1104         }
1105
1106         wbc_status = wbcRequestResponse(WINBINDD_PAM_AUTH,
1107                                         &request,
1108                                         &response);
1109
1110         if (response.data.auth.nt_status != 0) {
1111                 if (error) {
1112                         wbc_status = wbc_create_error_info(&response,
1113                                                            error);
1114                         BAIL_ON_WBC_ERROR(wbc_status);
1115                 }
1116
1117                 wbc_status = WBC_ERR_AUTH_ERROR;
1118                 BAIL_ON_WBC_ERROR(wbc_status);
1119         }
1120         BAIL_ON_WBC_ERROR(wbc_status);
1121
1122         if (info) {
1123                 wbc_status = wbc_create_logon_info(&response,
1124                                                    info);
1125                 BAIL_ON_WBC_ERROR(wbc_status);
1126         }
1127
1128         if (policy) {
1129                 wbc_status = wbc_create_password_policy_info(&response,
1130                                                              policy);
1131                 BAIL_ON_WBC_ERROR(wbc_status);
1132         }
1133
1134 done:
1135         winbindd_free_response(&response);
1136
1137         return wbc_status;
1138 }
1139
1140 static void wbcCredentialCacheInfoDestructor(void *ptr)
1141 {
1142         struct wbcCredentialCacheInfo *i =
1143                 (struct wbcCredentialCacheInfo *)ptr;
1144         wbcFreeMemory(i->blobs);
1145 }
1146
1147 /* Authenticate a user with cached credentials */
1148 wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
1149                           struct wbcCredentialCacheInfo **info,
1150                           struct wbcAuthErrorInfo **error)
1151 {
1152         wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
1153         struct wbcCredentialCacheInfo *result = NULL;
1154         struct winbindd_request request;
1155         struct winbindd_response response;
1156         struct wbcNamedBlob *initial_blob = NULL;
1157         struct wbcNamedBlob *challenge_blob = NULL;
1158         int i;
1159
1160         ZERO_STRUCT(request);
1161         ZERO_STRUCT(response);
1162
1163         if (info != NULL) {
1164                 *info = NULL;
1165         }
1166         if (error != NULL) {
1167                 *error = NULL;
1168         }
1169         if ((params == NULL)
1170             || (params->account_name == NULL)
1171             || (params->level != WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP)) {
1172                 status = WBC_ERR_INVALID_PARAM;
1173                 goto fail;
1174         }
1175
1176         if (params->domain_name != NULL) {
1177                 status = wbcRequestResponse(WINBINDD_INFO, NULL, &response);
1178                 if (!WBC_ERROR_IS_OK(status)) {
1179                         goto fail;
1180                 }
1181                 snprintf(request.data.ccache_ntlm_auth.user,
1182                          sizeof(request.data.ccache_ntlm_auth.user)-1,
1183                          "%s%c%s", params->domain_name,
1184                          response.data.info.winbind_separator,
1185                          params->account_name);
1186         } else {
1187                 strncpy(request.data.ccache_ntlm_auth.user,
1188                         params->account_name,
1189                         sizeof(request.data.ccache_ntlm_auth.user)-1);
1190         }
1191         request.data.ccache_ntlm_auth.uid = getuid();
1192
1193         for (i=0; i<params->num_blobs; i++) {
1194                 if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) {
1195                         initial_blob = &params->blobs[i];
1196                         break;
1197                 }
1198                 if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
1199                         challenge_blob = &params->blobs[i];
1200                         break;
1201                 }
1202         }
1203
1204         request.data.ccache_ntlm_auth.initial_blob_len = 0;
1205         request.data.ccache_ntlm_auth.challenge_blob_len = 0;
1206         request.extra_len = 0;
1207
1208         if (initial_blob != NULL) {
1209                 request.data.ccache_ntlm_auth.initial_blob_len =
1210                         initial_blob->blob.length;
1211                 request.extra_len += initial_blob->blob.length;
1212         }
1213         if (challenge_blob != NULL) {
1214                 request.data.ccache_ntlm_auth.challenge_blob_len =
1215                         challenge_blob->blob.length;
1216                 request.extra_len += challenge_blob->blob.length;
1217         }
1218
1219         if (request.extra_len != 0) {
1220                 request.extra_data.data = (char *)malloc(request.extra_len);
1221                 if (request.extra_data.data == NULL) {
1222                         status = WBC_ERR_NO_MEMORY;
1223                         goto fail;
1224                 }
1225         }
1226         if (initial_blob != NULL) {
1227                 memcpy(request.extra_data.data,
1228                        initial_blob->blob.data, initial_blob->blob.length);
1229         }
1230         if (challenge_blob != NULL) {
1231                 memcpy(request.extra_data.data
1232                        + request.data.ccache_ntlm_auth.initial_blob_len,
1233                        challenge_blob->blob.data,
1234                        challenge_blob->blob.length);
1235         }
1236
1237         status = wbcRequestResponse(WINBINDD_CCACHE_NTLMAUTH, &request,
1238                                     &response);
1239         if (!WBC_ERROR_IS_OK(status)) {
1240                 goto fail;
1241         }
1242
1243         result = (struct wbcCredentialCacheInfo *)wbcAllocateMemory(
1244                 sizeof(struct wbcCredentialCacheInfo), 1,
1245                 wbcCredentialCacheInfoDestructor);
1246         if (result == NULL) {
1247                 status = WBC_ERR_NO_MEMORY;
1248                 goto fail;
1249         }
1250         result->num_blobs = 0;
1251         result->blobs = NULL;
1252         status = wbcAddNamedBlob(&result->num_blobs, &result->blobs,
1253                                  "auth_blob", 0,
1254                                  (uint8_t *)response.extra_data.data,
1255                                  response.data.ccache_ntlm_auth.auth_blob_len);
1256         if (!WBC_ERROR_IS_OK(status)) {
1257                 goto fail;
1258         }
1259         status = wbcAddNamedBlob(
1260                 &result->num_blobs, &result->blobs, "session_key", 0,
1261                 response.data.ccache_ntlm_auth.session_key,
1262                 sizeof(response.data.ccache_ntlm_auth.session_key));
1263         if (!WBC_ERROR_IS_OK(status)) {
1264                 goto fail;
1265         }
1266
1267         *info = result;
1268         result = NULL;
1269         status = WBC_ERR_SUCCESS;
1270 fail:
1271         free(request.extra_data.data);
1272         winbindd_free_response(&response);
1273         wbcFreeMemory(result);
1274         return status;
1275 }
1276
1277 /* Authenticate a user with cached credentials */
1278 wbcErr wbcCredentialSave(const char *user, const char *password)
1279 {
1280         struct winbindd_request request;
1281         struct winbindd_response response;
1282
1283         ZERO_STRUCT(request);
1284         ZERO_STRUCT(response);
1285
1286         strncpy(request.data.ccache_save.user, user,
1287                 sizeof(request.data.ccache_save.user)-1);
1288         strncpy(request.data.ccache_save.pass, password,
1289                 sizeof(request.data.ccache_save.pass)-1);
1290         request.data.ccache_save.uid = getuid();
1291
1292         return wbcRequestResponse(WINBINDD_CCACHE_SAVE, &request, &response);
1293 }