2 Unix SMB/CIFS implementation.
6 Copyright (C) Gerald (Jerry) Carter 2007
8 This library is free software; you can redistribute it and/or
9 modify it under the terms of the GNU Lesser General Public
10 License as published by the Free Software Foundation; either
11 version 3 of the License, or (at your option) any later version.
13 This library is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Library General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 /* Required Headers */
24 #include "libwbclient.h"
26 /** @brief Authenticate a username/password pair
28 * @param username Name of user to authenticate
29 * @param password Clear text password os user
34 wbcErr wbcAuthenticateUser(const char *username,
37 wbcErr wbc_status = WBC_ERR_SUCCESS;
38 struct wbcAuthUserParams params;
42 params.account_name = username;
43 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
44 params.password.plaintext = password;
46 wbc_status = wbcAuthenticateUserEx(¶ms, NULL, NULL);
47 BAIL_ON_WBC_ERROR(wbc_status);
53 static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
54 const struct winbindd_response *resp,
55 struct wbcAuthUserInfo **_i)
57 wbcErr wbc_status = WBC_ERR_SUCCESS;
58 struct wbcAuthUserInfo *i;
59 struct wbcDomainSid domain_sid;
64 i = talloc(mem_ctx, struct wbcAuthUserInfo);
65 BAIL_ON_PTR_ERROR(i, wbc_status);
67 i->user_flags = resp->data.auth.info3.user_flgs;
69 i->account_name = talloc_strdup(i, resp->data.auth.info3.user_name);
70 BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
71 i->user_principal= NULL;
72 i->full_name = talloc_strdup(i, resp->data.auth.info3.full_name);
73 BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
74 i->domain_name = talloc_strdup(i, resp->data.auth.info3.logon_dom);
75 BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
76 i->dns_domain_name= NULL;
78 i->acct_flags = resp->data.auth.info3.acct_flags;
79 memcpy(i->user_session_key,
80 resp->data.auth.user_session_key,
81 sizeof(i->user_session_key));
82 memcpy(i->lm_session_key,
83 resp->data.auth.first_8_lm_hash,
84 sizeof(i->lm_session_key));
86 i->logon_count = resp->data.auth.info3.logon_count;
87 i->bad_password_count = resp->data.auth.info3.bad_pw_count;
89 i->logon_time = resp->data.auth.info3.logon_time;
90 i->logoff_time = resp->data.auth.info3.logoff_time;
91 i->kickoff_time = resp->data.auth.info3.kickoff_time;
92 i->pass_last_set_time = resp->data.auth.info3.pass_last_set_time;
93 i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
94 i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
96 i->logon_server = talloc_strdup(i, resp->data.auth.info3.logon_srv);
97 BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
98 i->logon_script = talloc_strdup(i, resp->data.auth.info3.logon_script);
99 BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
100 i->profile_path = talloc_strdup(i, resp->data.auth.info3.profile_path);
101 BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
102 i->home_directory= talloc_strdup(i, resp->data.auth.info3.home_dir);
103 BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
104 i->home_drive = talloc_strdup(i, resp->data.auth.info3.dir_drive);
105 BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
108 i->num_sids += resp->data.auth.info3.num_groups;
109 i->num_sids += resp->data.auth.info3.num_other_sids;
111 i->sids = talloc_array(i, struct wbcSidWithAttr, i->num_sids);
112 BAIL_ON_PTR_ERROR(i->sids, wbc_status);
114 wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
116 BAIL_ON_WBC_ERROR(wbc_status);
118 #define _SID_COMPOSE(s, d, r, a) { \
120 if ((s).sid.num_auths < WBC_MAXSUBAUTHS) { \
121 (s).sid.sub_auths[(s).sid.num_auths++] = r; \
123 wbc_status = WBC_ERR_INVALID_SID; \
124 BAIL_ON_WBC_ERROR(wbc_status); \
126 (s).attributes = a; \
130 _SID_COMPOSE(i->sids[sn], domain_sid,
131 resp->data.auth.info3.user_rid,
134 _SID_COMPOSE(i->sids[sn], domain_sid,
135 resp->data.auth.info3.group_rid,
139 p = (char *)resp->extra_data.data;
141 wbc_status = WBC_ERR_INVALID_RESPONSE;
142 BAIL_ON_WBC_ERROR(wbc_status);
145 for (j=0; j < resp->data.auth.info3.num_groups; j++) {
150 char *e = strchr(p, '\n');
152 wbc_status = WBC_ERR_INVALID_RESPONSE;
153 BAIL_ON_WBC_ERROR(wbc_status);
158 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
160 wbc_status = WBC_ERR_INVALID_RESPONSE;
161 BAIL_ON_WBC_ERROR(wbc_status);
164 _SID_COMPOSE(i->sids[sn], domain_sid,
169 for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
174 char *e = strchr(p, '\n');
176 wbc_status = WBC_ERR_INVALID_RESPONSE;
177 BAIL_ON_WBC_ERROR(wbc_status);
184 wbc_status = WBC_ERR_INVALID_RESPONSE;
185 BAIL_ON_WBC_ERROR(wbc_status);
190 ret = sscanf(a, "0x%08X",
193 wbc_status = WBC_ERR_INVALID_RESPONSE;
194 BAIL_ON_WBC_ERROR(wbc_status);
197 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
198 BAIL_ON_WBC_ERROR(wbc_status);
200 i->sids[sn].attributes = attrs;
213 static wbcErr wbc_create_error_info(TALLOC_CTX *mem_ctx,
214 const struct winbindd_response *resp,
215 struct wbcAuthErrorInfo **_e)
217 wbcErr wbc_status = WBC_ERR_SUCCESS;
218 struct wbcAuthErrorInfo *e;
220 e = talloc(mem_ctx, struct wbcAuthErrorInfo);
221 BAIL_ON_PTR_ERROR(e, wbc_status);
223 e->nt_status = resp->data.auth.nt_status;
224 e->pam_error = resp->data.auth.pam_error;
225 e->nt_string = talloc_strdup(e, resp->data.auth.nt_status_string);
226 BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
228 e->display_string = talloc_strdup(e, resp->data.auth.error_string);
229 BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
239 static wbcErr wbc_create_password_policy_info(TALLOC_CTX *mem_ctx,
240 const struct winbindd_response *resp,
241 struct wbcUserPasswordPolicyInfo **_i)
243 wbcErr wbc_status = WBC_ERR_SUCCESS;
244 struct wbcUserPasswordPolicyInfo *i;
246 i = talloc(mem_ctx, struct wbcUserPasswordPolicyInfo);
247 BAIL_ON_PTR_ERROR(i, wbc_status);
249 i->min_passwordage = resp->data.auth.policy.min_passwordage;
250 i->min_length_password = resp->data.auth.policy.min_length_password;
251 i->password_history = resp->data.auth.policy.password_history;
252 i->password_properties = resp->data.auth.policy.password_properties;
253 i->expire = resp->data.auth.policy.expire;
263 /** @brief Authenticate with more detailed information
265 * @param params Input parameters, WBC_AUTH_USER_LEVEL_HASH
266 * is not supported yet
267 * @param info Output details on WBC_ERR_SUCCESS
268 * @param error Output details on WBC_ERR_AUTH_ERROR
273 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
274 struct wbcAuthUserInfo **info,
275 struct wbcAuthErrorInfo **error)
277 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
279 struct winbindd_request request;
280 struct winbindd_response response;
282 ZERO_STRUCT(request);
283 ZERO_STRUCT(response);
290 wbc_status = WBC_ERR_INVALID_PARAM;
291 BAIL_ON_WBC_ERROR(wbc_status);
294 if (!params->account_name) {
295 wbc_status = WBC_ERR_INVALID_PARAM;
296 BAIL_ON_WBC_ERROR(wbc_status);
299 /* Initialize request */
301 switch (params->level) {
302 case WBC_AUTH_USER_LEVEL_PLAIN:
303 cmd = WINBINDD_PAM_AUTH;
304 request.flags = WBFLAG_PAM_INFO3_TEXT |
305 WBFLAG_PAM_USER_SESSION_KEY |
308 if (!params->password.plaintext) {
309 wbc_status = WBC_ERR_INVALID_PARAM;
310 BAIL_ON_WBC_ERROR(wbc_status);
313 if (params->domain_name && params->domain_name[0]) {
314 /* We need to get the winbind separator :-( */
315 struct winbindd_response sep_response;
317 ZERO_STRUCT(sep_response);
319 wbc_status = wbcRequestResponse(WINBINDD_INFO,
320 NULL, &sep_response);
321 BAIL_ON_WBC_ERROR(wbc_status);
323 snprintf(request.data.auth.user,
324 sizeof(request.data.auth.user)-1,
327 sep_response.data.info.winbind_separator,
328 params->account_name);
330 strncpy(request.data.auth.user,
331 params->account_name,
332 sizeof(request.data.auth.user)-1);
334 strncpy(request.data.auth.pass,
335 params->password.plaintext,
336 sizeof(request.data.auth.pass)-1);
339 case WBC_AUTH_USER_LEVEL_HASH:
340 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
341 BAIL_ON_WBC_ERROR(wbc_status);
344 case WBC_AUTH_USER_LEVEL_RESPONSE:
345 cmd = WINBINDD_PAM_AUTH_CRAP;
346 request.flags = WBFLAG_PAM_INFO3_TEXT |
347 WBFLAG_PAM_USER_SESSION_KEY |
350 if (params->password.response.lm_length &&
351 !params->password.response.lm_data) {
352 wbc_status = WBC_ERR_INVALID_PARAM;
353 BAIL_ON_WBC_ERROR(wbc_status);
355 if (params->password.response.lm_length == 0 &&
356 params->password.response.lm_data) {
357 wbc_status = WBC_ERR_INVALID_PARAM;
358 BAIL_ON_WBC_ERROR(wbc_status);
361 if (params->password.response.nt_length &&
362 !params->password.response.nt_data) {
363 wbc_status = WBC_ERR_INVALID_PARAM;
364 BAIL_ON_WBC_ERROR(wbc_status);
366 if (params->password.response.nt_length == 0&&
367 params->password.response.nt_data) {
368 wbc_status = WBC_ERR_INVALID_PARAM;
369 BAIL_ON_WBC_ERROR(wbc_status);
372 strncpy(request.data.auth_crap.user,
373 params->account_name,
374 sizeof(request.data.auth_crap.user)-1);
375 if (params->domain_name) {
376 strncpy(request.data.auth_crap.domain,
378 sizeof(request.data.auth_crap.domain)-1);
380 if (params->workstation_name) {
381 strncpy(request.data.auth_crap.workstation,
382 params->workstation_name,
383 sizeof(request.data.auth_crap.workstation)-1);
386 request.data.auth_crap.logon_parameters =
387 params->parameter_control;
389 memcpy(request.data.auth_crap.chal,
390 params->password.response.challenge,
391 sizeof(request.data.auth_crap.chal));
393 request.data.auth_crap.lm_resp_len =
394 MIN(params->password.response.lm_length,
395 sizeof(request.data.auth_crap.lm_resp));
396 request.data.auth_crap.nt_resp_len =
397 MIN(params->password.response.nt_length,
398 sizeof(request.data.auth_crap.nt_resp));
399 if (params->password.response.lm_data) {
400 memcpy(request.data.auth_crap.lm_resp,
401 params->password.response.lm_data,
402 request.data.auth_crap.lm_resp_len);
404 if (params->password.response.nt_data) {
405 memcpy(request.data.auth_crap.nt_resp,
406 params->password.response.nt_data,
407 request.data.auth_crap.nt_resp_len);
415 wbc_status = WBC_ERR_INVALID_PARAM;
416 BAIL_ON_WBC_ERROR(wbc_status);
419 wbc_status = wbcRequestResponse(cmd,
422 if (response.data.auth.nt_status != 0) {
424 wbc_status = wbc_create_error_info(NULL,
427 BAIL_ON_WBC_ERROR(wbc_status);
430 wbc_status = WBC_ERR_AUTH_ERROR;
431 BAIL_ON_WBC_ERROR(wbc_status);
433 BAIL_ON_WBC_ERROR(wbc_status);
436 wbc_status = wbc_create_auth_info(NULL,
439 BAIL_ON_WBC_ERROR(wbc_status);
443 if (response.extra_data.data)
444 free(response.extra_data.data);
449 /** @brief Trigger a verification of the trust credentials of a specific domain
451 * @param *domain The name of the domain, only NULL for the default domain is
452 * supported yet. Other values than NULL will result in
453 * WBC_ERR_NOT_IMPLEMENTED.
454 * @param error Output details on WBC_ERR_AUTH_ERROR
459 wbcErr wbcCheckTrustCredentials(const char *domain,
460 struct wbcAuthErrorInfo **error)
462 struct winbindd_request request;
463 struct winbindd_response response;
464 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
468 * the current protocol doesn't support
469 * specifying a domain
471 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
472 BAIL_ON_WBC_ERROR(wbc_status);
475 ZERO_STRUCT(request);
476 ZERO_STRUCT(response);
480 wbc_status = wbcRequestResponse(WINBINDD_CHECK_MACHACC,
483 if (response.data.auth.nt_status != 0) {
485 wbc_status = wbc_create_error_info(NULL,
488 BAIL_ON_WBC_ERROR(wbc_status);
491 wbc_status = WBC_ERR_AUTH_ERROR;
492 BAIL_ON_WBC_ERROR(wbc_status);
494 BAIL_ON_WBC_ERROR(wbc_status);
500 /** @brief Trigger a logoff notification to Winbind for a specific user
502 * @param username Name of user to remove from Winbind's list of
504 * @param uid Uid assigned to the username
505 * @param ccfilename Absolute path to the Krb5 credentials cache to
512 wbcErr wbcLogoffUser(const char *username,
514 const char *ccfilename)
516 struct winbindd_request request;
517 struct winbindd_response response;
518 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
523 wbc_status = WBC_ERR_INVALID_PARAM;
524 BAIL_ON_WBC_ERROR(wbc_status);
527 ZERO_STRUCT(request);
528 ZERO_STRUCT(response);
530 strncpy(request.data.logoff.user, username,
531 sizeof(request.data.logoff.user)-1);
532 request.data.logoff.uid = uid;
535 strncpy(request.data.logoff.krb5ccname, ccfilename,
536 sizeof(request.data.logoff.krb5ccname)-1);
541 wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
545 /* Take the response above and return it to the caller */
551 /** @brief Change a password for a user with more detailed information upon
553 * @param params Input parameters
554 * @param error User output details on WBC_ERR_PWD_CHANGE_FAILED
555 * @param reject_reason New password reject reason on WBC_ERR_PWD_CHANGE_FAILED
556 * @param policy Password policy output details on WBC_ERR_PWD_CHANGE_FAILED
561 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
562 struct wbcAuthErrorInfo **error,
563 enum wbcPasswordChangeRejectReason *reject_reason,
564 struct wbcUserPasswordPolicyInfo **policy)
566 struct winbindd_request request;
567 struct winbindd_response response;
568 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
573 if (!params->account_name) {
574 wbc_status = WBC_ERR_INVALID_PARAM;
575 BAIL_ON_WBC_ERROR(wbc_status);
590 ZERO_STRUCT(request);
591 ZERO_STRUCT(response);
593 switch (params->level) {
594 case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
595 cmd = WINBINDD_PAM_CHAUTHTOK;
597 if (!params->account_name) {
598 wbc_status = WBC_ERR_INVALID_PARAM;
599 BAIL_ON_WBC_ERROR(wbc_status);
602 strncpy(request.data.chauthtok.user, params->account_name,
603 sizeof(request.data.chauthtok.user) - 1);
605 if (params->old_password.plaintext) {
606 strncpy(request.data.chauthtok.oldpass,
607 params->old_password.plaintext,
608 sizeof(request.data.chauthtok.oldpass) - 1);
611 if (params->new_password.plaintext) {
612 strncpy(request.data.chauthtok.newpass,
613 params->new_password.plaintext,
614 sizeof(request.data.chauthtok.newpass) - 1);
618 case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
619 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
621 if (!params->account_name || !params->domain_name) {
622 wbc_status = WBC_ERR_INVALID_PARAM;
623 BAIL_ON_WBC_ERROR(wbc_status);
626 if (params->old_password.response.old_lm_hash_enc_length &&
627 !params->old_password.response.old_lm_hash_enc_data) {
628 wbc_status = WBC_ERR_INVALID_PARAM;
629 BAIL_ON_WBC_ERROR(wbc_status);
632 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
633 params->old_password.response.old_lm_hash_enc_data) {
634 wbc_status = WBC_ERR_INVALID_PARAM;
635 BAIL_ON_WBC_ERROR(wbc_status);
638 if (params->old_password.response.old_nt_hash_enc_length &&
639 !params->old_password.response.old_nt_hash_enc_data) {
640 wbc_status = WBC_ERR_INVALID_PARAM;
641 BAIL_ON_WBC_ERROR(wbc_status);
644 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
645 params->old_password.response.old_nt_hash_enc_data) {
646 wbc_status = WBC_ERR_INVALID_PARAM;
647 BAIL_ON_WBC_ERROR(wbc_status);
650 if (params->new_password.response.lm_length &&
651 !params->new_password.response.lm_data) {
652 wbc_status = WBC_ERR_INVALID_PARAM;
653 BAIL_ON_WBC_ERROR(wbc_status);
656 if (params->new_password.response.lm_length == 0 &&
657 params->new_password.response.lm_data) {
658 wbc_status = WBC_ERR_INVALID_PARAM;
659 BAIL_ON_WBC_ERROR(wbc_status);
662 if (params->new_password.response.nt_length &&
663 !params->new_password.response.nt_data) {
664 wbc_status = WBC_ERR_INVALID_PARAM;
665 BAIL_ON_WBC_ERROR(wbc_status);
668 if (params->new_password.response.nt_length == 0 &&
669 params->new_password.response.nt_data) {
670 wbc_status = WBC_ERR_INVALID_PARAM;
671 BAIL_ON_WBC_ERROR(wbc_status);
674 strncpy(request.data.chng_pswd_auth_crap.user,
675 params->account_name,
676 sizeof(request.data.chng_pswd_auth_crap.user) - 1);
678 strncpy(request.data.chng_pswd_auth_crap.domain,
680 sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
682 if (params->new_password.response.nt_data) {
683 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
684 params->new_password.response.nt_data,
685 request.data.chng_pswd_auth_crap.new_nt_pswd_len);
686 request.data.chng_pswd_auth_crap.new_nt_pswd_len =
687 params->new_password.response.nt_length;
690 if (params->new_password.response.lm_data) {
691 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
692 params->new_password.response.lm_data,
693 request.data.chng_pswd_auth_crap.new_lm_pswd_len);
694 request.data.chng_pswd_auth_crap.new_lm_pswd_len =
695 params->new_password.response.lm_length;
698 if (params->old_password.response.old_nt_hash_enc_data) {
699 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
700 params->old_password.response.old_nt_hash_enc_data,
701 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
702 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
703 params->old_password.response.old_nt_hash_enc_length;
706 if (params->old_password.response.old_lm_hash_enc_data) {
707 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
708 params->old_password.response.old_lm_hash_enc_data,
709 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
710 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
711 params->old_password.response.old_lm_hash_enc_length;
716 wbc_status = WBC_ERR_INVALID_PARAM;
717 BAIL_ON_WBC_ERROR(wbc_status);
722 wbc_status = WBC_ERR_INVALID_PARAM;
723 BAIL_ON_WBC_ERROR(wbc_status);
728 wbc_status = wbcRequestResponse(cmd,
731 if (WBC_ERROR_IS_OK(wbc_status)) {
735 /* Take the response above and return it to the caller */
737 if (response.data.auth.nt_status != 0) {
739 wbc_status = wbc_create_error_info(NULL,
742 BAIL_ON_WBC_ERROR(wbc_status);
748 wbc_status = wbc_create_password_policy_info(NULL,
751 BAIL_ON_WBC_ERROR(wbc_status);
755 *reject_reason = response.data.auth.reject_reason;
758 wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
759 BAIL_ON_WBC_ERROR(wbc_status);
765 /** @brief Change a password for a user
767 * @param username Name of user to authenticate
768 * @param old_password Old clear text password of user
769 * @param new_password New clear text password of user
774 wbcErr wbcChangeUserPassword(const char *username,
775 const char *old_password,
776 const char *new_password)
778 wbcErr wbc_status = WBC_ERR_SUCCESS;
779 struct wbcChangePasswordParams params;
783 params.account_name = username;
784 params.level = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
785 params.old_password.plaintext = old_password;
786 params.new_password.plaintext = new_password;
788 wbc_status = wbcChangeUserPasswordEx(¶ms,
792 BAIL_ON_WBC_ERROR(wbc_status);