2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2004
5 Copyright (C) Gerald Carter 2003
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #define DBGC_CLASS DBGC_AUTH
27 /****************************************************************************
28 Do a specific test for an smb password being correct, given a smb_password and
29 the lanman and NT responses.
30 ****************************************************************************/
32 static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
36 const uint8 lm_pw[16], const uint8 nt_pw[16],
37 const auth_usersupplied_info *user_info,
38 DATA_BLOB *user_sess_key,
39 DATA_BLOB *lm_sess_key)
41 if (acct_flags & ACB_PWNOTREQ) {
42 if (lp_null_passwords()) {
43 DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n",
47 DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n",
49 return NT_STATUS_LOGON_FAILURE;
53 return ntlm_password_check(mem_ctx, &auth_context->challenge,
54 &user_info->lm_resp, &user_info->nt_resp,
55 &user_info->lm_interactive_pwd,
56 &user_info->nt_interactive_pwd,
58 user_info->smb_name.str,
59 user_info->client_domain.str,
60 lm_pw, nt_pw, user_sess_key, lm_sess_key);
64 /****************************************************************************
65 Do a specific test for a SAM_ACCOUNT being vaild for this connection
66 (ie not disabled, expired and the like).
67 ****************************************************************************/
69 static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
73 NTTIME *must_change_time,
74 NTTIME *last_set_time,
75 const char *workstation_list,
76 const auth_usersupplied_info *user_info)
78 DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n", username));
80 /* Quit if the account was disabled. */
81 if (acct_flags & ACB_DISABLED) {
82 DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", username));
83 return NT_STATUS_ACCOUNT_DISABLED;
86 /* Quit if the account was locked out. */
87 if (acct_flags & ACB_AUTOLOCK) {
88 DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", username));
89 return NT_STATUS_ACCOUNT_LOCKED_OUT;
92 /* Test account expire time */
94 if ((*acct_expiry) != 0 && time(NULL) > nt_time_to_unix(*acct_expiry)) {
95 DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", username));
96 DEBUG(3,("sam_account_ok: Account expired at '%s'.\n",
97 nt_time_string(mem_ctx, *acct_expiry)));
98 return NT_STATUS_ACCOUNT_EXPIRED;
101 if (!(acct_flags & ACB_PWNOEXP)) {
103 /* check for immediate expiry "must change at next logon" */
104 if (*must_change_time == 0 && *last_set_time != 0) {
105 DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n",
107 return NT_STATUS_PASSWORD_MUST_CHANGE;
110 /* check for expired password */
111 if ((*must_change_time) != 0 && nt_time_to_unix(*must_change_time) < time(NULL)) {
112 DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n",
114 DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n",
115 nt_time_string(mem_ctx, *must_change_time)));
116 return NT_STATUS_PASSWORD_EXPIRED;
120 /* Test workstation. Workstation list is comma separated. */
122 if (workstation_list && *workstation_list) {
123 BOOL invalid_ws = True;
124 const char *s = workstation_list;
128 while (next_token(&s, tok, ",", sizeof(tok))) {
129 DEBUG(10,("sam_account_ok: checking for workstation match %s and %s (len=%d)\n",
130 tok, user_info->wksta_name.str, user_info->wksta_name.len));
132 if(strequal(tok, user_info->wksta_name.str)) {
139 return NT_STATUS_INVALID_WORKSTATION;
142 if (acct_flags & ACB_DOMTRUST) {
143 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", username));
144 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
147 if (acct_flags & ACB_SVRTRUST) {
148 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", username));
149 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
152 if (acct_flags & ACB_WSTRUST) {
153 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", username));
154 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
160 /****************************************************************************
161 check if a username/password is OK assuming the password is a 24 byte
162 SMB hash supplied in the user_info structure
163 return an NT_STATUS constant.
164 ****************************************************************************/
166 static NTSTATUS check_sam_security(const struct auth_context *auth_context,
167 void *my_private_data,
169 const auth_usersupplied_info *user_info,
170 auth_serversupplied_info **server_info)
172 struct ldb_message **msgs;
173 struct ldb_message **msgs_domain;
175 char *username = user_info->internal_username.str;
177 const char *workstation_list;
179 NTTIME must_change_time;
180 NTTIME last_set_time;
185 const char *domain_dn;
186 const char *domain_sid;
189 DATA_BLOB user_sess_key = data_blob(NULL, 0);
190 DATA_BLOB lm_sess_key = data_blob(NULL, 0);
191 uint8 *lm_pwd, *nt_pwd;
193 const char *attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash",
194 "userAccountControl",
202 const char *domain_attrs[] = {"name"};
204 if (!user_info || !auth_context) {
205 return NT_STATUS_UNSUCCESSFUL;
208 sam_ctx = samdb_connect();
209 if (sam_ctx == NULL) {
210 return NT_STATUS_INVALID_SYSTEM_SERVICE;
212 /* pull the user attributes */
213 ret = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
214 "(&(sAMAccountName=%s)(objectclass=user))",
218 DEBUG(3,("check_sam_security: Couldn't find user [%s] in passdb file.\n",
220 samdb_close(sam_ctx);
221 return NT_STATUS_NO_SUCH_USER;
225 DEBUG(1,("Found %d records matching user [%s]\n", ret, username));
226 samdb_close(sam_ctx);
227 return NT_STATUS_INTERNAL_DB_CORRUPTION;
230 domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
232 samdb_close(sam_ctx);
233 return NT_STATUS_INTERNAL_DB_CORRUPTION;
236 /* find the domain's DN */
237 ret_domain = samdb_search(sam_ctx, mem_ctx, NULL, &msgs_domain, domain_attrs,
238 "(&(objectSid=%s)(objectclass=domain))",
241 if (ret_domain == 0) {
242 DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n",
244 samdb_close(sam_ctx);
245 return NT_STATUS_NO_SUCH_USER;
248 if (ret_domain > 1) {
249 DEBUG(1,("Found %d records matching domain [%s]\n",
250 ret_domain, domain_sid));
251 samdb_close(sam_ctx);
252 return NT_STATUS_INTERNAL_DB_CORRUPTION;
255 domain_dn = msgs_domain[0]->dn;
257 acct_flags = samdb_result_acct_flags(msgs[0], "sAMAcctFlags");
259 /* Quit if the account was locked out. */
260 if (acct_flags & ACB_AUTOLOCK) {
261 DEBUG(3,("check_sam_security: Account for user %s was locked out.\n",
263 samdb_close(sam_ctx);
264 return NT_STATUS_ACCOUNT_LOCKED_OUT;
267 if (!NT_STATUS_IS_OK(nt_status = samdb_result_passwords(mem_ctx, msgs[0],
268 &lm_pwd, &nt_pwd))) {
272 nt_status = sam_password_ok(auth_context, mem_ctx,
273 username, acct_flags,
275 user_info, &user_sess_key, &lm_sess_key);
277 if (!NT_STATUS_IS_OK(nt_status)) {
278 samdb_close(sam_ctx);
282 acct_expiry = samdb_result_nttime(msgs[0], "accountExpires", 0);
283 must_change_time = samdb_result_force_pwd_change(sam_ctx, mem_ctx,
284 domain_dn, msgs[0], "pwdLastSet");
285 last_set_time = samdb_result_nttime(msgs[0], "pwdLastSet", 0);
287 workstation_list = samdb_result_string(msgs[0], "userWorkstations", NULL);
289 nt_status = sam_account_ok(mem_ctx, username, acct_flags,
296 if (!NT_STATUS_IS_OK(nt_status)) {
297 samdb_close(sam_ctx);
301 if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, username))) {
302 DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
303 samdb_close(sam_ctx);
308 struct ldb_message **group_msgs;
309 char *dn = msgs[0]->dn;
311 const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL };
312 /* find list of sids */
313 struct dom_sid **groupSIDs = NULL;
314 struct dom_sid *user_sid;
315 struct dom_sid *group_sid;
319 group_ret = samdb_search(sam_ctx,
320 mem_ctx, NULL, &group_msgs, group_attrs,
321 "(&(member=%s)(sAMAccountType=*))",
324 if (!(groupSIDs = talloc_realloc_p((*server_info)->mem_ctx, groupSIDs,
325 struct dom_sid *, group_ret))) {
326 talloc_destroy((*server_info)->mem_ctx);
327 samdb_close(sam_ctx);
328 return NT_STATUS_NO_MEMORY;
331 /* Need to unroll some nested groups, but not aliases */
332 for (i = 0; i < group_ret; i++) {
333 sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
334 groupSIDs[i] = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
337 sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
338 user_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
339 group_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
340 group_sid->sub_auths[group_sid->num_auths-1]
341 = samdb_result_uint(msgs[0], "primaryGroupID", 0);
343 if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx,
345 group_ret, groupSIDs,
346 False, &(*server_info)->ptok))) {
347 DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
348 free_server_info(server_info);
349 samdb_close(sam_ctx);
354 (*server_info)->guest = False;
356 (*server_info)->user_session_key = user_sess_key;
357 (*server_info)->lm_session_key = lm_sess_key;
362 /* module initialisation */
363 static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
365 if (!make_auth_methods(auth_context, auth_method)) {
366 return NT_STATUS_NO_MEMORY;
369 (*auth_method)->auth = check_sam_security;
370 (*auth_method)->name = "sam_ignoredomain";
375 /****************************************************************************
376 Check SAM security (above) but with a few extra checks.
377 ****************************************************************************/
379 static NTSTATUS check_samstrict_security(const struct auth_context *auth_context,
380 void *my_private_data,
382 const auth_usersupplied_info *user_info,
383 auth_serversupplied_info **server_info)
386 if (!user_info || !auth_context) {
387 return NT_STATUS_LOGON_FAILURE;
390 /* If we are a domain member, we must not
391 attempt to check the password locally,
392 unless it is one of our aliases. */
394 if (!is_myname(user_info->domain.str)) {
395 DEBUG(7,("The requested user domain is not the local server name. [%s]\\[%s]\n",
396 user_info->domain.str,user_info->internal_username.str));
397 return NT_STATUS_NO_SUCH_USER;
400 return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info);
403 /* module initialisation */
404 static NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
406 if (!make_auth_methods(auth_context, auth_method)) {
407 return NT_STATUS_NO_MEMORY;
410 (*auth_method)->auth = check_samstrict_security;
411 (*auth_method)->name = "sam";
415 NTSTATUS auth_sam_init(void)
418 struct auth_operations ops;
421 ops.init = auth_init_sam;
422 ret = register_backend("auth", &ops);
423 if (!NT_STATUS_IS_OK(ret)) {
424 DEBUG(0,("Failed to register '%s' auth backend!\n",
429 ops.name = "sam_ignoredomain";
430 ops.init = auth_init_sam_ignoredomain;
431 ret = register_backend("auth", &ops);
432 if (!NT_STATUS_IS_OK(ret)) {
433 DEBUG(0,("Failed to register '%s' auth backend!\n",