source3/winbindd/winbindd_pam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - pam auth funcions
   5
   6    Copyright (C) Andrew Tridgell 2000
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett 2001-2002
   9    Copyright (C) Guenther Deschner 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #include "../libcli/auth/libcli_auth.h"
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_WINBIND
  30
  31 #define LOGON_KRB5_FAIL_CLOCK_SKEW      0x02000000
  32
  33 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
  34                                     struct winbindd_cli_state *state,
  35                                     struct netr_SamInfo3 *info3)
  36 {
  37         char *ex;
  38         uint32_t i;
  39
  40         state->response.data.auth.info3.logon_time =
  41                 nt_time_to_unix(info3->base.last_logon);
  42         state->response.data.auth.info3.logoff_time =
  43                 nt_time_to_unix(info3->base.last_logoff);
  44         state->response.data.auth.info3.kickoff_time =
  45                 nt_time_to_unix(info3->base.acct_expiry);
  46         state->response.data.auth.info3.pass_last_set_time =
  47                 nt_time_to_unix(info3->base.last_password_change);
  48         state->response.data.auth.info3.pass_can_change_time =
  49                 nt_time_to_unix(info3->base.allow_password_change);
  50         state->response.data.auth.info3.pass_must_change_time =
  51                 nt_time_to_unix(info3->base.force_password_change);
  52
  53         state->response.data.auth.info3.logon_count = info3->base.logon_count;
  54         state->response.data.auth.info3.bad_pw_count = info3->base.bad_password_count;
  55
  56         state->response.data.auth.info3.user_rid = info3->base.rid;
  57         state->response.data.auth.info3.group_rid = info3->base.primary_gid;
  58         sid_to_fstring(state->response.data.auth.info3.dom_sid, info3->base.domain_sid);
  59
  60         state->response.data.auth.info3.num_groups = info3->base.groups.count;
  61         state->response.data.auth.info3.user_flgs = info3->base.user_flags;
  62
  63         state->response.data.auth.info3.acct_flags = info3->base.acct_flags;
  64         state->response.data.auth.info3.num_other_sids = info3->sidcount;
  65
  66         fstrcpy(state->response.data.auth.info3.user_name,
  67                 info3->base.account_name.string);
  68         fstrcpy(state->response.data.auth.info3.full_name,
  69                 info3->base.full_name.string);
  70         fstrcpy(state->response.data.auth.info3.logon_script,
  71                 info3->base.logon_script.string);
  72         fstrcpy(state->response.data.auth.info3.profile_path,
  73                 info3->base.profile_path.string);
  74         fstrcpy(state->response.data.auth.info3.home_dir,
  75                 info3->base.home_directory.string);
  76         fstrcpy(state->response.data.auth.info3.dir_drive,
  77                 info3->base.home_drive.string);
  78
  79         fstrcpy(state->response.data.auth.info3.logon_srv,
  80                 info3->base.logon_server.string);
  81         fstrcpy(state->response.data.auth.info3.logon_dom,
  82                 info3->base.domain.string);
  83
  84         ex = talloc_strdup(state->mem_ctx, "");
  85         NT_STATUS_HAVE_NO_MEMORY(ex);
  86
  87         for (i=0; i < info3->base.groups.count; i++) {
  88                 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
  89                                                    info3->base.groups.rids[i].rid,
  90                                                    info3->base.groups.rids[i].attributes);
  91                 NT_STATUS_HAVE_NO_MEMORY(ex);
  92         }
  93
  94         for (i=0; i < info3->sidcount; i++) {
  95                 char *sid;
  96
  97                 sid = dom_sid_string(mem_ctx, info3->sids[i].sid);
  98                 NT_STATUS_HAVE_NO_MEMORY(sid);
  99
 100                 ex = talloc_asprintf_append_buffer(ex, "%s:0x%08X\n",
 101                                                    sid,
 102                                                    info3->sids[i].attributes);
 103                 NT_STATUS_HAVE_NO_MEMORY(ex);
 104
 105                 talloc_free(sid);
 106         }
 107
 108         state->response.extra_data.data = ex;
 109         state->response.length += talloc_get_size(ex);
 110
 111         return NT_STATUS_OK;
 112 }
 113
 114 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
 115                                     struct winbindd_cli_state *state,
 116                                     struct netr_SamInfo3 *info3)
 117 {
 118         DATA_BLOB blob;
 119         enum ndr_err_code ndr_err;
 120
 121         ndr_err = ndr_push_struct_blob(&blob, mem_ctx, NULL, info3,
 122                                        (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
 123         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 124                 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
 125                 return ndr_map_error2ntstatus(ndr_err);
 126         }
 127
 128         state->response.extra_data.data = blob.data;
 129         state->response.length += blob.length;
 130
 131         return NT_STATUS_OK;
 132 }
 133
 134 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
 135                                      struct winbindd_cli_state *state,
 136                                      const struct netr_SamInfo3 *info3,
 137                                      const char *name_domain,
 138                                      const char *name_user)
 139 {
 140         /* We've been asked to return the unix username, per
 141            'winbind use default domain' settings and the like */
 142
 143         const char *nt_username, *nt_domain;
 144
 145         nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
 146         if (!nt_domain) {
 147                 /* If the server didn't give us one, just use the one
 148                  * we sent them */
 149                 nt_domain = name_domain;
 150         }
 151
 152         nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
 153         if (!nt_username) {
 154                 /* If the server didn't give us one, just use the one
 155                  * we sent them */
 156                 nt_username = name_user;
 157         }
 158
 159         fill_domain_username(state->response.data.auth.unix_username,
 160                              nt_domain, nt_username, true);
 161
 162         DEBUG(5,("Setting unix username to [%s]\n",
 163                 state->response.data.auth.unix_username));
 164
 165         return NT_STATUS_OK;
 166 }
 167
 168 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 169                                  struct winbindd_cli_state *state,
 170                                  const struct netr_SamInfo3 *info3,
 171                                  const char *name_domain,
 172                                  const char *name_user)
 173 {
 174         char *afsname = NULL;
 175         char *cell;
 176         char *token;
 177
 178         afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
 179         if (afsname == NULL) {
 180                 return NT_STATUS_NO_MEMORY;
 181         }
 182
 183         afsname = talloc_string_sub(mem_ctx,
 184                                     lp_afs_username_map(),
 185                                     "%D", name_domain);
 186         afsname = talloc_string_sub(mem_ctx, afsname,
 187                                     "%u", name_user);
 188         afsname = talloc_string_sub(mem_ctx, afsname,
 189                                     "%U", name_user);
 190
 191         {
 192                 DOM_SID user_sid;
 193                 fstring sidstr;
 194
 195                 sid_copy(&user_sid, info3->base.domain_sid);
 196                 sid_append_rid(&user_sid, info3->base.rid);
 197                 sid_to_fstring(sidstr, &user_sid);
 198                 afsname = talloc_string_sub(mem_ctx, afsname,
 199                                             "%s", sidstr);
 200         }
 201
 202         if (afsname == NULL) {
 203                 return NT_STATUS_NO_MEMORY;
 204         }
 205
 206         strlower_m(afsname);
 207
 208         DEBUG(10, ("Generating token for user %s\n", afsname));
 209
 210         cell = strchr(afsname, '@');
 211
 212         if (cell == NULL) {
 213                 return NT_STATUS_NO_MEMORY;
 214         }
 215
 216         *cell = '\0';
 217         cell += 1;
 218
 219         token = afs_createtoken_str(afsname, cell);
 220         if (token == NULL) {
 221                 return NT_STATUS_OK;
 222         }
 223         state->response.extra_data.data = talloc_strdup(state->mem_ctx, token);
 224         if (state->response.extra_data.data == NULL) {
 225                 return NT_STATUS_NO_MEMORY;
 226         }
 227         state->response.length +=
 228                 strlen((const char *)state->response.extra_data.data)+1;
 229
 230         return NT_STATUS_OK;
 231 }
 232
 233 static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 234                                      struct netr_SamInfo3 *info3,
 235                                      const char *group_sid)
 236 /**
 237  * Check whether a user belongs to a group or list of groups.
 238  *
 239  * @param mem_ctx talloc memory context.
 240  * @param info3 user information, including group membership info.
 241  * @param group_sid One or more groups , separated by commas.
 242  *
 243  * @return NT_STATUS_OK on success,
 244  *    NT_STATUS_LOGON_FAILURE if the user does not belong,
 245  *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
 246  */
 247 {
 248         DOM_SID *require_membership_of_sid;
 249         size_t num_require_membership_of_sid;
 250         char *req_sid;
 251         const char *p;
 252         DOM_SID sid;
 253         size_t i;
 254         struct nt_user_token *token;
 255         TALLOC_CTX *frame = NULL;
 256         NTSTATUS status;
 257
 258         /* Parse the 'required group' SID */
 259
 260         if (!group_sid || !group_sid[0]) {
 261                 /* NO sid supplied, all users may access */
 262                 return NT_STATUS_OK;
 263         }
 264
 265         if (!(token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
 266                 DEBUG(0, ("talloc failed\n"));
 267                 return NT_STATUS_NO_MEMORY;
 268         }
 269
 270         num_require_membership_of_sid = 0;
 271         require_membership_of_sid = NULL;
 272
 273         p = group_sid;
 274
 275         frame = talloc_stackframe();
 276         while (next_token_talloc(frame, &p, &req_sid, ",")) {
 277                 if (!string_to_sid(&sid, req_sid)) {
 278                         DEBUG(0, ("check_info3_in_group: could not parse %s "
 279                                   "as a SID!", req_sid));
 280                         TALLOC_FREE(frame);
 281                         return NT_STATUS_INVALID_PARAMETER;
 282                 }
 283
 284                 status = add_sid_to_array(mem_ctx, &sid,
 285                                           &require_membership_of_sid,
 286                                           &num_require_membership_of_sid);
 287                 if (!NT_STATUS_IS_OK(status)) {
 288                         DEBUG(0, ("add_sid_to_array failed\n"));
 289                         TALLOC_FREE(frame);
 290                         return status;
 291                 }
 292         }
 293
 294         TALLOC_FREE(frame);
 295
 296         status = sid_array_from_info3(mem_ctx, info3,
 297                                       &token->user_sids,
 298                                       &token->num_sids,
 299                                       true, false);
 300         if (!NT_STATUS_IS_OK(status)) {
 301                 return status;
 302         }
 303
 304         if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
 305                                                   token))
 306             || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
 307                                                      token))) {
 308                 DEBUG(3, ("could not add aliases: %s\n",
 309                           nt_errstr(status)));
 310                 return status;
 311         }
 312
 313         debug_nt_user_token(DBGC_CLASS, 10, token);
 314
 315         for (i=0; i<num_require_membership_of_sid; i++) {
 316                 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
 317                                    &require_membership_of_sid[i])));
 318                 if (nt_token_check_sid(&require_membership_of_sid[i],
 319                                        token)) {
 320                         DEBUG(10, ("Access ok\n"));
 321                         return NT_STATUS_OK;
 322                 }
 323         }
 324
 325         /* Do not distinguish this error from a wrong username/pw */
 326
 327         return NT_STATUS_LOGON_FAILURE;
 328 }
 329
 330 struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
 331                                         const char *domain_name)
 332 {
 333         struct winbindd_domain *domain;
 334
 335         if (IS_DC) {
 336                 domain = find_domain_from_name_noinit(domain_name);
 337                 if (domain == NULL) {
 338                         DEBUG(3, ("Authentication for domain [%s] refused "
 339                                   "as it is not a trusted domain\n",
 340                                   domain_name));
 341                 }
 342                 return domain;
 343         }
 344
 345         if (is_myname(domain_name)) {
 346                 DEBUG(3, ("Authentication for domain %s (local domain "
 347                           "to this server) not supported at this "
 348                           "stage\n", domain_name));
 349                 return NULL;
 350         }
 351
 352         /* we can auth against trusted domains */
 353         if (state->request->flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
 354                 domain = find_domain_from_name_noinit(domain_name);
 355                 if (domain == NULL) {
 356                         DEBUG(3, ("Authentication for domain [%s] skipped "
 357                                   "as it is not a trusted domain\n",
 358                                   domain_name));
 359                 } else {
 360                         return domain;
 361                 }
 362         }
 363
 364         return find_our_domain();
 365 }
 366
 367 static void fill_in_password_policy(struct winbindd_response *r,
 368                                     const struct samr_DomInfo1 *p)
 369 {
 370         r->data.auth.policy.min_length_password =
 371                 p->min_password_length;
 372         r->data.auth.policy.password_history =
 373                 p->password_history_length;
 374         r->data.auth.policy.password_properties =
 375                 p->password_properties;
 376         r->data.auth.policy.expire      =
 377                 nt_time_to_unix_abs((NTTIME *)&(p->max_password_age));
 378         r->data.auth.policy.min_passwordage =
 379                 nt_time_to_unix_abs((NTTIME *)&(p->min_password_age));
 380 }
 381
 382 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
 383                                        struct winbindd_cli_state *state)
 384 {
 385         struct winbindd_methods *methods;
 386         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 387         struct samr_DomInfo1 password_policy;
 388
 389         if ( !winbindd_can_contact_domain( domain ) ) {
 390                 DEBUG(5,("fillup_password_policy: No inbound trust to "
 391                          "contact domain %s\n", domain->name));
 392                 return NT_STATUS_NOT_SUPPORTED;
 393         }
 394
 395         methods = domain->methods;
 396
 397         status = methods->password_policy(domain, state->mem_ctx, &password_policy);
 398         if (NT_STATUS_IS_ERR(status)) {
 399                 return status;
 400         }
 401
 402         fill_in_password_policy(&state->response, &password_policy);
 403
 404         return NT_STATUS_OK;
 405 }
 406
 407 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
 408                                                          TALLOC_CTX *mem_ctx,
 409                                                          uint16 *lockout_threshold)
 410 {
 411         struct winbindd_methods *methods;
 412         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 413         struct samr_DomInfo12 lockout_policy;
 414
 415         *lockout_threshold = 0;
 416
 417         methods = domain->methods;
 418
 419         status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
 420         if (NT_STATUS_IS_ERR(status)) {
 421                 return status;
 422         }
 423
 424         *lockout_threshold = lockout_policy.lockout_threshold;
 425
 426         return NT_STATUS_OK;
 427 }
 428
 429 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
 430                                    TALLOC_CTX *mem_ctx,
 431                                    uint32 *password_properties)
 432 {
 433         struct winbindd_methods *methods;
 434         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 435         struct samr_DomInfo1 password_policy;
 436
 437         *password_properties = 0;
 438
 439         methods = domain->methods;
 440
 441         status = methods->password_policy(domain, mem_ctx, &password_policy);
 442         if (NT_STATUS_IS_ERR(status)) {
 443                 return status;
 444         }
 445
 446         *password_properties = password_policy.password_properties;
 447
 448         return NT_STATUS_OK;
 449 }
 450
 451 #ifdef HAVE_KRB5
 452
 453 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 454                                         const char *type,
 455                                         uid_t uid,
 456                                         bool *internal_ccache)
 457 {
 458         /* accept FILE and WRFILE as krb5_cc_type from the client and then
 459          * build the full ccname string based on the user's uid here -
 460          * Guenther*/
 461
 462         const char *gen_cc = NULL;
 463
 464         *internal_ccache = true;
 465
 466         if (uid == -1) {
 467                 goto memory_ccache;
 468         }
 469
 470         if (!type || type[0] == '\0') {
 471                 goto memory_ccache;
 472         }
 473
 474         if (strequal(type, "FILE")) {
 475                 gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
 476         } else if (strequal(type, "WRFILE")) {
 477                 gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
 478         } else {
 479                 DEBUG(10,("we don't allow to set a %s type ccache\n", type));
 480                 goto memory_ccache;
 481         }
 482
 483         *internal_ccache = false;
 484         goto done;
 485
 486   memory_ccache:
 487         gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
 488
 489   done:
 490         if (gen_cc == NULL) {
 491                 DEBUG(0,("out of memory\n"));
 492                 return NULL;
 493         }
 494
 495         DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
 496
 497         return gen_cc;
 498 }
 499
 500 static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
 501 {
 502         const char *type = state->request->data.auth.krb5_cc_type;
 503
 504         state->response.data.auth.krb5ccname[0] = '\0';
 505
 506         if (type[0] == '\0') {
 507                 return;
 508         }
 509
 510         if (!strequal(type, "FILE") &&
 511             !strequal(type, "WRFILE")) {
 512                 DEBUG(10,("won't return krbccname for a %s type ccache\n",
 513                         type));
 514                 return;
 515         }
 516
 517         fstrcpy(state->response.data.auth.krb5ccname, cc);
 518 }
 519
 520 #endif
 521
 522 static uid_t get_uid_from_state(struct winbindd_cli_state *state)
 523 {
 524         uid_t uid = -1;
 525
 526         uid = state->request->data.auth.uid;
 527
 528         if (uid < 0) {
 529                 DEBUG(1,("invalid uid: '%u'\n", (unsigned int)uid));
 530                 return -1;
 531         }
 532         return uid;
 533 }
 534
 535 /**********************************************************************
 536  Authenticate a user with a clear text password using Kerberos and fill up
 537  ccache if required
 538  **********************************************************************/
 539
 540 static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 541                                             struct winbindd_cli_state *state,
 542                                             struct netr_SamInfo3 **info3)
 543 {
 544 #ifdef HAVE_KRB5
 545         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 546         krb5_error_code krb5_ret;
 547         const char *cc = NULL;
 548         const char *principal_s = NULL;
 549         const char *service = NULL;
 550         char *realm = NULL;
 551         fstring name_domain, name_user;
 552         time_t ticket_lifetime = 0;
 553         time_t renewal_until = 0;
 554         uid_t uid = -1;
 555         ADS_STRUCT *ads;
 556         time_t time_offset = 0;
 557         bool internal_ccache = true;
 558
 559         ZERO_STRUCTP(info3);
 560
 561         *info3 = NULL;
 562
 563         /* 1st step:
 564          * prepare a krb5_cc_cache string for the user */
 565
 566         uid = get_uid_from_state(state);
 567         if (uid == -1) {
 568                 DEBUG(0,("no valid uid\n"));
 569         }
 570
 571         cc = generate_krb5_ccache(state->mem_ctx,
 572                                   state->request->data.auth.krb5_cc_type,
 573                                   state->request->data.auth.uid,
 574                                   &internal_ccache);
 575         if (cc == NULL) {
 576                 return NT_STATUS_NO_MEMORY;
 577         }
 578
 579
 580         /* 2nd step:
 581          * get kerberos properties */
 582
 583         if (domain->private_data) {
 584                 ads = (ADS_STRUCT *)domain->private_data;
 585                 time_offset = ads->auth.time_offset;
 586         }
 587
 588
 589         /* 3rd step:
 590          * do kerberos auth and setup ccache as the user */
 591
 592         parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 593
 594         realm = domain->alt_name;
 595         strupper_m(realm);
 596
 597         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
 598         if (principal_s == NULL) {
 599                 return NT_STATUS_NO_MEMORY;
 600         }
 601
 602         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
 603         if (service == NULL) {
 604                 return NT_STATUS_NO_MEMORY;
 605         }
 606
 607         /* if this is a user ccache, we need to act as the user to let the krb5
 608          * library handle the chown, etc. */
 609
 610         /************************ ENTERING NON-ROOT **********************/
 611
 612         if (!internal_ccache) {
 613                 set_effective_uid(uid);
 614                 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
 615         }
 616
 617         result = kerberos_return_info3_from_pac(state->mem_ctx,
 618                                                 principal_s,
 619                                                 state->request->data.auth.pass,
 620                                                 time_offset,
 621                                                 &ticket_lifetime,
 622                                                 &renewal_until,
 623                                                 cc,
 624                                                 true,
 625                                                 true,
 626                                                 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 627                                                 info3);
 628         if (!internal_ccache) {
 629                 gain_root_privilege();
 630         }
 631
 632         /************************ RETURNED TO ROOT **********************/
 633
 634         if (!NT_STATUS_IS_OK(result)) {
 635                 goto failed;
 636         }
 637
 638         DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
 639                 principal_s));
 640
 641         /* if we had a user's ccache then return that string for the pam
 642          * environment */
 643
 644         if (!internal_ccache) {
 645
 646                 setup_return_cc_name(state, cc);
 647
 648                 result = add_ccache_to_list(principal_s,
 649                                             cc,
 650                                             service,
 651                                             state->request->data.auth.user,
 652                                             realm,
 653                                             uid,
 654                                             time(NULL),
 655                                             ticket_lifetime,
 656                                             renewal_until,
 657                                             false);
 658
 659                 if (!NT_STATUS_IS_OK(result)) {
 660                         DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
 661                                 nt_errstr(result)));
 662                 }
 663         } else {
 664
 665                 /* need to delete the memory cred cache, it is not used anymore */
 666
 667                 krb5_ret = ads_kdestroy(cc);
 668                 if (krb5_ret) {
 669                         DEBUG(3,("winbindd_raw_kerberos_login: "
 670                                  "could not destroy krb5 credential cache: "
 671                                  "%s\n", error_message(krb5_ret)));
 672                 }
 673
 674         }
 675
 676         return NT_STATUS_OK;
 677
 678 failed:
 679
 680         /* we could have created a new credential cache with a valid tgt in it
 681          * but we werent able to get or verify the service ticket for this
 682          * local host and therefor didn't get the PAC, we need to remove that
 683          * cache entirely now */
 684
 685         krb5_ret = ads_kdestroy(cc);
 686         if (krb5_ret) {
 687                 DEBUG(3,("winbindd_raw_kerberos_login: "
 688                          "could not destroy krb5 credential cache: "
 689                          "%s\n", error_message(krb5_ret)));
 690         }
 691
 692         if (!NT_STATUS_IS_OK(remove_ccache(state->request->data.auth.user))) {
 693                 DEBUG(3,("winbindd_raw_kerberos_login: "
 694                           "could not remove ccache for user %s\n",
 695                         state->request->data.auth.user));
 696         }
 697
 698         return result;
 699 #else
 700         return NT_STATUS_NOT_SUPPORTED;
 701 #endif /* HAVE_KRB5 */
 702 }
 703
 704 /****************************************************************
 705 ****************************************************************/
 706
 707 static bool check_request_flags(uint32_t flags)
 708 {
 709         uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
 710                                WBFLAG_PAM_INFO3_TEXT |
 711                                WBFLAG_PAM_INFO3_NDR;
 712
 713         if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
 714              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
 715              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
 716               !(flags & flags_edata) ) {
 717                 return true;
 718         }
 719
 720         DEBUG(1,("check_request_flags: invalid request flags[0x%08X]\n",flags));
 721
 722         return false;
 723 }
 724
 725 /****************************************************************
 726 ****************************************************************/
 727
 728 static NTSTATUS append_data(struct winbindd_cli_state *state,
 729                             struct netr_SamInfo3 *info3,
 730                             const char *name_domain,
 731                             const char *name_user)
 732 {
 733         NTSTATUS result;
 734         uint32_t flags = state->request->flags;
 735
 736         if (flags & WBFLAG_PAM_USER_SESSION_KEY) {
 737                 memcpy(state->response.data.auth.user_session_key,
 738                        info3->base.key.key,
 739                        sizeof(state->response.data.auth.user_session_key)
 740                        /* 16 */);
 741         }
 742
 743         if (flags & WBFLAG_PAM_LMKEY) {
 744                 memcpy(state->response.data.auth.first_8_lm_hash,
 745                        info3->base.LMSessKey.key,
 746                        sizeof(state->response.data.auth.first_8_lm_hash)
 747                        /* 8 */);
 748         }
 749
 750         if (flags & WBFLAG_PAM_INFO3_TEXT) {
 751                 result = append_info3_as_txt(state->mem_ctx, state, info3);
 752                 if (!NT_STATUS_IS_OK(result)) {
 753                         DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
 754                                 nt_errstr(result)));
 755                         return result;
 756                 }
 757         }
 758
 759         /* currently, anything from here on potentially overwrites extra_data. */
 760
 761         if (flags & WBFLAG_PAM_INFO3_NDR) {
 762                 result = append_info3_as_ndr(state->mem_ctx, state, info3);
 763                 if (!NT_STATUS_IS_OK(result)) {
 764                         DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
 765                                 nt_errstr(result)));
 766                         return result;
 767                 }
 768         }
 769
 770         if (flags & WBFLAG_PAM_UNIX_NAME) {
 771                 result = append_unix_username(state->mem_ctx, state, info3,
 772                                               name_domain, name_user);
 773                 if (!NT_STATUS_IS_OK(result)) {
 774                         DEBUG(10,("Failed to append Unix Username: %s\n",
 775                                 nt_errstr(result)));
 776                         return result;
 777                 }
 778         }
 779
 780         if (flags & WBFLAG_PAM_AFS_TOKEN) {
 781                 result = append_afs_token(state->mem_ctx, state, info3,
 782                                           name_domain, name_user);
 783                 if (!NT_STATUS_IS_OK(result)) {
 784                         DEBUG(10,("Failed to append AFS token: %s\n",
 785                                 nt_errstr(result)));
 786                         return result;
 787                 }
 788         }
 789
 790         return NT_STATUS_OK;
 791 }
 792
 793 void winbindd_pam_auth(struct winbindd_cli_state *state)
 794 {
 795         struct winbindd_domain *domain;
 796         fstring name_domain, name_user;
 797         char *mapped_user = NULL;
 798         NTSTATUS result;
 799         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
 800
 801         /* Ensure null termination */
 802         state->request->data.auth.user
 803                 [sizeof(state->request->data.auth.user)-1]='\0';
 804
 805         /* Ensure null termination */
 806         state->request->data.auth.pass
 807                 [sizeof(state->request->data.auth.pass)-1]='\0';
 808
 809         DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
 810                   state->request->data.auth.user));
 811
 812         if (!check_request_flags(state->request->flags)) {
 813                 result = NT_STATUS_INVALID_PARAMETER_MIX;
 814                 goto done;
 815         }
 816
 817         /* Parse domain and username */
 818
 819         name_map_status = normalize_name_unmap(state->mem_ctx,
 820                                                state->request->data.auth.user,
 821                                                &mapped_user);
 822
 823         /* If the name normalization didnt' actually do anything,
 824            just use the original name */
 825
 826         if (!NT_STATUS_IS_OK(name_map_status) &&
 827             !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
 828         {
 829                 mapped_user = state->request->data.auth.user;
 830         }
 831
 832         if (!canonicalize_username(mapped_user, name_domain, name_user)) {
 833                 result = NT_STATUS_NO_SUCH_USER;
 834                 goto done;
 835         }
 836
 837         domain = find_auth_domain(state, name_domain);
 838
 839         if (domain == NULL) {
 840                 result = NT_STATUS_NO_SUCH_USER;
 841                 goto done;
 842         }
 843
 844         sendto_domain(state, domain);
 845         return;
 846  done:
 847         set_auth_errors(&state->response, result);
 848         DEBUG(5, ("Plain text authentication for %s returned %s "
 849                   "(PAM: %d)\n",
 850                   state->request->data.auth.user,
 851                   state->response.data.auth.nt_status_string,
 852                   state->response.data.auth.pam_error));
 853         request_error(state);
 854 }
 855
 856 NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 857                                        struct winbindd_cli_state *state,
 858                                        struct netr_SamInfo3 **info3)
 859 {
 860         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
 861         uint16 max_allowed_bad_attempts;
 862         fstring name_domain, name_user;
 863         DOM_SID sid;
 864         enum lsa_SidType type;
 865         uchar new_nt_pass[NT_HASH_LEN];
 866         const uint8 *cached_nt_pass;
 867         const uint8 *cached_salt;
 868         struct netr_SamInfo3 *my_info3;
 869         time_t kickoff_time, must_change_time;
 870         bool password_good = false;
 871 #ifdef HAVE_KRB5
 872         struct winbindd_tdc_domain *tdc_domain = NULL;
 873 #endif
 874
 875         *info3 = NULL;
 876
 877         ZERO_STRUCTP(info3);
 878
 879         DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
 880
 881         /* Parse domain and username */
 882
 883         parse_domain_user(state->request->data.auth.user, name_domain, name_user);
 884
 885
 886         if (!lookup_cached_name(state->mem_ctx,
 887                                 name_domain,
 888                                 name_user,
 889                                 &sid,
 890                                 &type)) {
 891                 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
 892                 return NT_STATUS_NO_SUCH_USER;
 893         }
 894
 895         if (type != SID_NAME_USER) {
 896                 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
 897                 return NT_STATUS_LOGON_FAILURE;
 898         }
 899
 900         result = winbindd_get_creds(domain,
 901                                     state->mem_ctx,
 902                                     &sid,
 903                                     &my_info3,
 904                                     &cached_nt_pass,
 905                                     &cached_salt);
 906         if (!NT_STATUS_IS_OK(result)) {
 907                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
 908                 return result;
 909         }
 910
 911         *info3 = my_info3;
 912
 913         E_md4hash(state->request->data.auth.pass, new_nt_pass);
 914
 915         dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
 916         dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
 917         if (cached_salt) {
 918                 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
 919         }
 920
 921         if (cached_salt) {
 922                 /* In this case we didn't store the nt_hash itself,
 923                    but the MD5 combination of salt + nt_hash. */
 924                 uchar salted_hash[NT_HASH_LEN];
 925                 E_md5hash(cached_salt, new_nt_pass, salted_hash);
 926
 927                 password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
 928                         true : false;
 929         } else {
 930                 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
 931                 password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
 932                         true : false;
 933         }
 934
 935         if (password_good) {
 936
 937                 /* User *DOES* know the password, update logon_time and reset
 938                  * bad_pw_count */
 939
 940                 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
 941
 942                 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
 943                         return NT_STATUS_ACCOUNT_LOCKED_OUT;
 944                 }
 945
 946                 if (my_info3->base.acct_flags & ACB_DISABLED) {
 947                         return NT_STATUS_ACCOUNT_DISABLED;
 948                 }
 949
 950                 if (my_info3->base.acct_flags & ACB_WSTRUST) {
 951                         return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 952                 }
 953
 954                 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
 955                         return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 956                 }
 957
 958                 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
 959                         return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 960                 }
 961
 962                 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
 963                         DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
 964                                 my_info3->base.acct_flags));
 965                         return NT_STATUS_LOGON_FAILURE;
 966                 }
 967
 968                 kickoff_time = nt_time_to_unix(my_info3->base.acct_expiry);
 969                 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
 970                         return NT_STATUS_ACCOUNT_EXPIRED;
 971                 }
 972
 973                 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
 974                 if (must_change_time != 0 && must_change_time < time(NULL)) {
 975                         /* we allow grace logons when the password has expired */
 976                         my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
 977                         /* return NT_STATUS_PASSWORD_EXPIRED; */
 978                         goto success;
 979                 }
 980
 981 #ifdef HAVE_KRB5
 982                 if ((state->request->flags & WBFLAG_PAM_KRB5) &&
 983                     ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
 984                     (tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL)) {
 985
 986                         uid_t uid = -1;
 987                         const char *cc = NULL;
 988                         char *realm = NULL;
 989                         const char *principal_s = NULL;
 990                         const char *service = NULL;
 991                         bool internal_ccache = false;
 992
 993                         uid = get_uid_from_state(state);
 994                         if (uid == -1) {
 995                                 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
 996                                 return NT_STATUS_INVALID_PARAMETER;
 997                         }
 998
 999                         cc = generate_krb5_ccache(state->mem_ctx,
1000                                                 state->request->data.auth.krb5_cc_type,
1001                                                 state->request->data.auth.uid,
1002                                                 &internal_ccache);
1003                         if (cc == NULL) {
1004                                 return NT_STATUS_NO_MEMORY;
1005                         }
1006
1007                         realm = domain->alt_name;
1008                         strupper_m(realm);
1009
1010                         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
1011                         if (principal_s == NULL) {
1012                                 return NT_STATUS_NO_MEMORY;
1013                         }
1014
1015                         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
1016                         if (service == NULL) {
1017                                 return NT_STATUS_NO_MEMORY;
1018                         }
1019
1020                         if (!internal_ccache) {
1021
1022                                 setup_return_cc_name(state, cc);
1023
1024                                 result = add_ccache_to_list(principal_s,
1025                                                             cc,
1026                                                             service,
1027                                                             state->request->data.auth.user,
1028                                                             domain->alt_name,
1029                                                             uid,
1030                                                             time(NULL),
1031                                                             time(NULL) + lp_winbind_cache_time(),
1032                                                             time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
1033                                                             true);
1034
1035                                 if (!NT_STATUS_IS_OK(result)) {
1036                                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
1037                                                 "to add ccache to list: %s\n",
1038                                                 nt_errstr(result)));
1039                                 }
1040                         }
1041                 }
1042 #endif /* HAVE_KRB5 */
1043  success:
1044                 /* FIXME: we possibly should handle logon hours as well (does xp when
1045                  * offline?) see auth/auth_sam.c:sam_account_ok for details */
1046
1047                 unix_to_nt_time(&my_info3->base.last_logon, time(NULL));
1048                 my_info3->base.bad_password_count = 0;
1049
1050                 result = winbindd_update_creds_by_info3(domain,
1051                                                         state->mem_ctx,
1052                                                         state->request->data.auth.user,
1053                                                         state->request->data.auth.pass,
1054                                                         my_info3);
1055                 if (!NT_STATUS_IS_OK(result)) {
1056                         DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1057                                 nt_errstr(result)));
1058                         return result;
1059                 }
1060
1061                 return NT_STATUS_OK;
1062
1063         }
1064
1065         /* User does *NOT* know the correct password, modify info3 accordingly */
1066
1067         /* failure of this is not critical */
1068         result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1069         if (!NT_STATUS_IS_OK(result)) {
1070                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1071                           "Won't be able to honour account lockout policies\n"));
1072         }
1073
1074         /* increase counter */
1075         my_info3->base.bad_password_count++;
1076
1077         if (max_allowed_bad_attempts == 0) {
1078                 goto failed;
1079         }
1080
1081         /* lockout user */
1082         if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1083
1084                 uint32 password_properties;
1085
1086                 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1087                 if (!NT_STATUS_IS_OK(result)) {
1088                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1089                 }
1090
1091                 if ((my_info3->base.rid != DOMAIN_USER_RID_ADMIN) ||
1092                     (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1093                         my_info3->base.acct_flags |= ACB_AUTOLOCK;
1094                 }
1095         }
1096
1097 failed:
1098         result = winbindd_update_creds_by_info3(domain,
1099                                                 state->mem_ctx,
1100                                                 state->request->data.auth.user,
1101                                                 NULL,
1102                                                 my_info3);
1103
1104         if (!NT_STATUS_IS_OK(result)) {
1105                 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1106                         nt_errstr(result)));
1107         }
1108
1109         return NT_STATUS_LOGON_FAILURE;
1110 }
1111
1112 NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1113                                          struct winbindd_cli_state *state,
1114                                          struct netr_SamInfo3 **info3)
1115 {
1116         struct winbindd_domain *contact_domain;
1117         fstring name_domain, name_user;
1118         NTSTATUS result;
1119
1120         DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1121
1122         /* Parse domain and username */
1123
1124         parse_domain_user(state->request->data.auth.user, name_domain, name_user);
1125
1126         /* what domain should we contact? */
1127
1128         if ( IS_DC ) {
1129                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1130                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1131                                   state->request->data.auth.user, name_domain, name_user, name_domain));
1132                         result = NT_STATUS_NO_SUCH_USER;
1133                         goto done;
1134                 }
1135
1136         } else {
1137                 if (is_myname(name_domain)) {
1138                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1139                         result =  NT_STATUS_NO_SUCH_USER;
1140                         goto done;
1141                 }
1142
1143                 contact_domain = find_domain_from_name(name_domain);
1144                 if (contact_domain == NULL) {
1145                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1146                                   state->request->data.auth.user, name_domain, name_user, name_domain));
1147
1148                         contact_domain = find_our_domain();
1149                 }
1150         }
1151
1152         if (contact_domain->initialized &&
1153             contact_domain->active_directory) {
1154                 goto try_login;
1155         }
1156
1157         if (!contact_domain->initialized) {
1158                 init_dc_connection(contact_domain);
1159         }
1160
1161         if (!contact_domain->active_directory) {
1162                 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1163                 return NT_STATUS_INVALID_LOGON_TYPE;
1164         }
1165 try_login:
1166         result = winbindd_raw_kerberos_login(contact_domain, state, info3);
1167 done:
1168         return result;
1169 }
1170
1171 typedef NTSTATUS (*netlogon_fn_t)(struct rpc_pipe_client *cli,
1172                                   TALLOC_CTX *mem_ctx,
1173                                   uint32 logon_parameters,
1174                                   const char *server,
1175                                   const char *username,
1176                                   const char *domain,
1177                                   const char *workstation,
1178                                   const uint8 chal[8],
1179                                   DATA_BLOB lm_response,
1180                                   DATA_BLOB nt_response,
1181                                   struct netr_SamInfo3 **info3);
1182
1183 NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
1184                                          struct winbindd_cli_state *state,
1185                                          struct netr_SamInfo3 **info3)
1186 {
1187
1188         struct rpc_pipe_client *netlogon_pipe;
1189         uchar chal[8];
1190         DATA_BLOB lm_resp;
1191         DATA_BLOB nt_resp;
1192         int attempts = 0;
1193         unsigned char local_lm_response[24];
1194         unsigned char local_nt_response[24];
1195         struct winbindd_domain *contact_domain;
1196         fstring name_domain, name_user;
1197         bool retry;
1198         NTSTATUS result;
1199         struct netr_SamInfo3 *my_info3 = NULL;
1200
1201         *info3 = NULL;
1202
1203         DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1204
1205         /* Parse domain and username */
1206
1207         parse_domain_user(state->request->data.auth.user, name_domain, name_user);
1208
1209         /* do password magic */
1210
1211
1212         generate_random_buffer(chal, 8);
1213         if (lp_client_ntlmv2_auth()) {
1214                 DATA_BLOB server_chal;
1215                 DATA_BLOB names_blob;
1216                 DATA_BLOB nt_response;
1217                 DATA_BLOB lm_response;
1218                 server_chal = data_blob_talloc(state->mem_ctx, chal, 8);
1219
1220                 /* note that the 'workgroup' here is a best guess - we don't know
1221                    the server's domain at this point.  The 'server name' is also
1222                    dodgy...
1223                 */
1224                 names_blob = NTLMv2_generate_names_blob(state->mem_ctx, global_myname(), lp_workgroup());
1225
1226                 if (!SMBNTLMv2encrypt(NULL, name_user, name_domain,
1227                                       state->request->data.auth.pass,
1228                                       &server_chal,
1229                                       &names_blob,
1230                                       &lm_response, &nt_response, NULL, NULL)) {
1231                         data_blob_free(&names_blob);
1232                         data_blob_free(&server_chal);
1233                         DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1234                         result = NT_STATUS_NO_MEMORY;
1235                         goto done;
1236                 }
1237                 data_blob_free(&names_blob);
1238                 data_blob_free(&server_chal);
1239                 lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data,
1240                                            lm_response.length);
1241                 nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data,
1242                                            nt_response.length);
1243                 data_blob_free(&lm_response);
1244                 data_blob_free(&nt_response);
1245
1246         } else {
1247                 if (lp_client_lanman_auth()
1248                     && SMBencrypt(state->request->data.auth.pass,
1249                                   chal,
1250                                   local_lm_response)) {
1251                         lm_resp = data_blob_talloc(state->mem_ctx,
1252                                                    local_lm_response,
1253                                                    sizeof(local_lm_response));
1254                 } else {
1255                         lm_resp = data_blob_null;
1256                 }
1257                 SMBNTencrypt(state->request->data.auth.pass,
1258                              chal,
1259                              local_nt_response);
1260
1261                 nt_resp = data_blob_talloc(state->mem_ctx,
1262                                            local_nt_response,
1263                                            sizeof(local_nt_response));
1264         }
1265
1266         /* what domain should we contact? */
1267
1268         if ( IS_DC ) {
1269                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1270                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1271                                   state->request->data.auth.user, name_domain, name_user, name_domain));
1272                         result = NT_STATUS_NO_SUCH_USER;
1273                         goto done;
1274                 }
1275
1276         } else {
1277                 if (is_myname(name_domain)) {
1278                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1279                         result =  NT_STATUS_NO_SUCH_USER;
1280                         goto done;
1281                 }
1282
1283                 contact_domain = find_our_domain();
1284         }
1285
1286         /* check authentication loop */
1287
1288         do {
1289                 netlogon_fn_t logon_fn;
1290
1291                 ZERO_STRUCTP(my_info3);
1292                 retry = false;
1293
1294                 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1295
1296                 if (!NT_STATUS_IS_OK(result)) {
1297                         DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1298                         goto done;
1299                 }
1300
1301                 /* It is really important to try SamLogonEx here,
1302                  * because in a clustered environment, we want to use
1303                  * one machine account from multiple physical
1304                  * computers.
1305                  *
1306                  * With a normal SamLogon call, we must keep the
1307                  * credentials chain updated and intact between all
1308                  * users of the machine account (which would imply
1309                  * cross-node communication for every NTLM logon).
1310                  *
1311                  * (The credentials chain is not per NETLOGON pipe
1312                  * connection, but globally on the server/client pair
1313                  * by machine name).
1314                  *
1315                  * When using SamLogonEx, the credentials are not
1316                  * supplied, but the session key is implied by the
1317                  * wrapping SamLogon context.
1318                  *
1319                  *  -- abartlet 21 April 2008
1320                  */
1321
1322                 logon_fn = contact_domain->can_do_samlogon_ex
1323                         ? rpccli_netlogon_sam_network_logon_ex
1324                         : rpccli_netlogon_sam_network_logon;
1325
1326                 result = logon_fn(netlogon_pipe,
1327                                   state->mem_ctx,
1328                                   0,
1329                                   contact_domain->dcname, /* server name */
1330                                   name_user,              /* user name */
1331                                   name_domain,            /* target domain */
1332                                   global_myname(),        /* workstation */
1333                                   chal,
1334                                   lm_resp,
1335                                   nt_resp,
1336                                   &my_info3);
1337                 attempts += 1;
1338
1339                 if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
1340                     && contact_domain->can_do_samlogon_ex) {
1341                         DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1342                                   "retrying with NetSamLogon\n"));
1343                         contact_domain->can_do_samlogon_ex = false;
1344                         retry = true;
1345                         continue;
1346                 }
1347
1348                 /* We have to try a second time as cm_connect_netlogon
1349                    might not yet have noticed that the DC has killed
1350                    our connection. */
1351
1352                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1353                         retry = true;
1354                         continue;
1355                 }
1356
1357                 /* if we get access denied, a possible cause was that we had
1358                    and open connection to the DC, but someone changed our
1359                    machine account password out from underneath us using 'net
1360                    rpc changetrustpw' */
1361
1362                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1363                         DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1364                                  "ACCESS_DENIED.  Maybe the trust account "
1365                                 "password was changed and we didn't know it. "
1366                                  "Killing connections to domain %s\n",
1367                                 name_domain));
1368                         invalidate_cm_connection(&contact_domain->conn);
1369                         retry = true;
1370                 }
1371
1372         } while ( (attempts < 2) && retry );
1373
1374         /* handle the case where a NT4 DC does not fill in the acct_flags in
1375          * the samlogon reply info3. When accurate info3 is required by the
1376          * caller, we look up the account flags ourselve - gd */
1377
1378         if ((state->request->flags & WBFLAG_PAM_INFO3_TEXT) &&
1379             NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
1380
1381                 struct rpc_pipe_client *samr_pipe;
1382                 struct policy_handle samr_domain_handle, user_pol;
1383                 union samr_UserInfo *info = NULL;
1384                 NTSTATUS status_tmp;
1385                 uint32 acct_flags;
1386
1387                 status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
1388                                             &samr_pipe, &samr_domain_handle);
1389
1390                 if (!NT_STATUS_IS_OK(status_tmp)) {
1391                         DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1392                                 nt_errstr(status_tmp)));
1393                         goto done;
1394                 }
1395
1396                 status_tmp = rpccli_samr_OpenUser(samr_pipe, state->mem_ctx,
1397                                                   &samr_domain_handle,
1398                                                   MAXIMUM_ALLOWED_ACCESS,
1399                                                   my_info3->base.rid,
1400                                                   &user_pol);
1401
1402                 if (!NT_STATUS_IS_OK(status_tmp)) {
1403                         DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1404                                 nt_errstr(status_tmp)));
1405                         goto done;
1406                 }
1407
1408                 status_tmp = rpccli_samr_QueryUserInfo(samr_pipe, state->mem_ctx,
1409                                                        &user_pol,
1410                                                        16,
1411                                                        &info);
1412
1413                 if (!NT_STATUS_IS_OK(status_tmp)) {
1414                         DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1415                                 nt_errstr(status_tmp)));
1416                         rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1417                         goto done;
1418                 }
1419
1420                 acct_flags = info->info16.acct_flags;
1421
1422                 if (acct_flags == 0) {
1423                         rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1424                         goto done;
1425                 }
1426
1427                 my_info3->base.acct_flags = acct_flags;
1428
1429                 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1430
1431                 rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1432         }
1433
1434         *info3 = my_info3;
1435 done:
1436         return result;
1437 }
1438
1439 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1440                                             struct winbindd_cli_state *state)
1441 {
1442         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1443         NTSTATUS krb5_result = NT_STATUS_OK;
1444         fstring name_domain, name_user;
1445         char *mapped_user;
1446         fstring domain_user;
1447         struct netr_SamInfo3 *info3 = NULL;
1448         NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
1449
1450         /* Ensure null termination */
1451         state->request->data.auth.user[sizeof(state->request->data.auth.user)-1]='\0';
1452
1453         /* Ensure null termination */
1454         state->request->data.auth.pass[sizeof(state->request->data.auth.pass)-1]='\0';
1455
1456         DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1457                   state->request->data.auth.user));
1458
1459         if (!check_request_flags(state->request->flags)) {
1460                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1461                 goto done;
1462         }
1463
1464         /* Parse domain and username */
1465
1466         name_map_status = normalize_name_unmap(state->mem_ctx,
1467                                                state->request->data.auth.user,
1468                                                &mapped_user);
1469
1470         /* If the name normalization didnt' actually do anything,
1471            just use the original name */
1472
1473         if (!NT_STATUS_IS_OK(name_map_status) &&
1474             !NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
1475         {
1476                 mapped_user = state->request->data.auth.user;
1477         }
1478
1479         parse_domain_user(mapped_user, name_domain, name_user);
1480
1481         if ( mapped_user != state->request->data.auth.user ) {
1482                 fstr_sprintf( domain_user, "%s\\%s", name_domain, name_user );
1483                 safe_strcpy( state->request->data.auth.user, domain_user,
1484                              sizeof(state->request->data.auth.user)-1 );
1485         }
1486
1487         if (domain->online == false) {
1488                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1489                 if (domain->startup) {
1490                         /* Logons are very important to users. If we're offline and
1491                            we get a request within the first 30 seconds of startup,
1492                            try very hard to find a DC and go online. */
1493
1494                         DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1495                                 "request in startup mode.\n", domain->name ));
1496
1497                         winbindd_flush_negative_conn_cache(domain);
1498                         result = init_dc_connection(domain);
1499                 }
1500         }
1501
1502         DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1503
1504         /* Check for Kerberos authentication */
1505         if (domain->online && (state->request->flags & WBFLAG_PAM_KRB5)) {
1506
1507                 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1508                 /* save for later */
1509                 krb5_result = result;
1510
1511
1512                 if (NT_STATUS_IS_OK(result)) {
1513                         DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1514                         goto process_result;
1515                 } else {
1516                         DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1517                 }
1518
1519                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1520                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1521                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1522                         DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1523                         set_domain_offline( domain );
1524                         goto cached_logon;
1525                 }
1526
1527                 /* there are quite some NT_STATUS errors where there is no
1528                  * point in retrying with a samlogon, we explictly have to take
1529                  * care not to increase the bad logon counter on the DC */
1530
1531                 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1532                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1533                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1534                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1535                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1536                     NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1537                     NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1538                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1539                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1540                     NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1541                         goto process_result;
1542                 }
1543
1544                 if (state->request->flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1545                         DEBUG(3,("falling back to samlogon\n"));
1546                         goto sam_logon;
1547                 } else {
1548                         goto cached_logon;
1549                 }
1550         }
1551
1552 sam_logon:
1553         /* Check for Samlogon authentication */
1554         if (domain->online) {
1555                 result = winbindd_dual_pam_auth_samlogon(domain, state, &info3);
1556
1557                 if (NT_STATUS_IS_OK(result)) {
1558                         DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1559                         /* add the Krb5 err if we have one */
1560                         if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1561                                 info3->base.user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1562                         }
1563                         goto process_result;
1564                 }
1565
1566                 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1567                           nt_errstr(result)));
1568
1569                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1570                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1571                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1572                 {
1573                         DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1574                         set_domain_offline( domain );
1575                         goto cached_logon;
1576                 }
1577
1578                         if (domain->online) {
1579                                 /* We're still online - fail. */
1580                                 goto done;
1581                         }
1582         }
1583
1584 cached_logon:
1585         /* Check for Cached logons */
1586         if (!domain->online && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN) &&
1587             lp_winbind_offline_logon()) {
1588
1589                 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1590
1591                 if (NT_STATUS_IS_OK(result)) {
1592                         DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1593                         goto process_result;
1594                 } else {
1595                         DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1596                         goto done;
1597                 }
1598         }
1599
1600 process_result:
1601
1602         if (NT_STATUS_IS_OK(result)) {
1603
1604                 DOM_SID user_sid;
1605
1606                 /* In all codepaths where result == NT_STATUS_OK info3 must have
1607                    been initialized. */
1608                 if (!info3) {
1609                         result = NT_STATUS_INTERNAL_ERROR;
1610                         goto done;
1611                 }
1612
1613                 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1614                 netsamlogon_cache_store(name_user, info3);
1615
1616                 /* save name_to_sid info as early as possible (only if
1617                    this is our primary domain so we don't invalidate
1618                    the cache entry by storing the seq_num for the wrong
1619                    domain). */
1620                 if ( domain->primary ) {
1621                         sid_compose(&user_sid, info3->base.domain_sid,
1622                                     info3->base.rid);
1623                         cache_name2sid(domain, name_domain, name_user,
1624                                        SID_NAME_USER, &user_sid);
1625                 }
1626
1627                 /* Check if the user is in the right group */
1628
1629                 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1630                                         state->request->data.auth.require_membership_of_sid))) {
1631                         DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1632                                   state->request->data.auth.user,
1633                                   state->request->data.auth.require_membership_of_sid));
1634                         goto done;
1635                 }
1636
1637                 result = append_data(state, info3, name_domain, name_user);
1638                 if (!NT_STATUS_IS_OK(result)) {
1639                         goto done;
1640                 }
1641
1642                 if ((state->request->flags & WBFLAG_PAM_CACHED_LOGIN)) {
1643
1644                         /* Store in-memory creds for single-signon using ntlm_auth. */
1645                         result = winbindd_add_memory_creds(state->request->data.auth.user,
1646                                                         get_uid_from_state(state),
1647                                                         state->request->data.auth.pass);
1648
1649                         if (!NT_STATUS_IS_OK(result)) {
1650                                 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
1651                                 goto done;
1652                         }
1653
1654                         if (lp_winbind_offline_logon()) {
1655                                 result = winbindd_store_creds(domain,
1656                                                       state->mem_ctx,
1657                                                       state->request->data.auth.user,
1658                                                       state->request->data.auth.pass,
1659                                                       info3, NULL);
1660                                 if (!NT_STATUS_IS_OK(result)) {
1661
1662                                         /* Release refcount. */
1663                                         winbindd_delete_memory_creds(state->request->data.auth.user);
1664
1665                                         DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
1666                                         goto done;
1667                                 }
1668                         }
1669                 }
1670
1671
1672                 if (state->request->flags & WBFLAG_PAM_GET_PWD_POLICY) {
1673                         struct winbindd_domain *our_domain = find_our_domain();
1674
1675                         /* This is not entirely correct I believe, but it is
1676                            consistent.  Only apply the password policy settings
1677                            too warn users for our own domain.  Cannot obtain these
1678                            from trusted DCs all the  time so don't do it at all.
1679                            -- jerry */
1680
1681                         result = NT_STATUS_NOT_SUPPORTED;
1682                         if (our_domain == domain ) {
1683                                 result = fillup_password_policy(our_domain, state);
1684                         }
1685
1686                         if (!NT_STATUS_IS_OK(result)
1687                             && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1688                         {
1689                                 DEBUG(10,("Failed to get password policies for domain %s: %s\n",
1690                                           domain->name, nt_errstr(result)));
1691                                 goto done;
1692                         }
1693                 }
1694
1695                 result = NT_STATUS_OK;
1696         }
1697
1698 done:
1699         /* give us a more useful (more correct?) error code */
1700         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1701             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1702                 result = NT_STATUS_NO_LOGON_SERVERS;
1703         }
1704
1705         set_auth_errors(&state->response, result);
1706
1707         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1708               state->request->data.auth.user,
1709               state->response.data.auth.nt_status_string,
1710               state->response.data.auth.pam_error));
1711
1712         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1713 }
1714
1715
1716 /**********************************************************************
1717  Challenge Response Authentication Protocol
1718 **********************************************************************/
1719
1720 void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
1721 {
1722         struct winbindd_domain *domain = NULL;
1723         const char *domain_name = NULL;
1724         NTSTATUS result;
1725
1726         if (!check_request_flags(state->request->flags)) {
1727                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1728                 goto done;
1729         }
1730
1731         if (!state->privileged) {
1732                 char *error_string = NULL;
1733                 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1734                           "denied.  !\n"));
1735                 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1736                              "on %s are set correctly.\n",
1737                              get_winbind_priv_pipe_dir()));
1738                 /* send a better message than ACCESS_DENIED */
1739                 error_string = talloc_asprintf(state->mem_ctx,
1740                                                "winbind client not authorized "
1741                                                "to use winbindd_pam_auth_crap."
1742                                                " Ensure permissions on %s "
1743                                                "are set correctly.",
1744                                                get_winbind_priv_pipe_dir());
1745                 fstrcpy(state->response.data.auth.error_string, error_string);
1746                 result = NT_STATUS_ACCESS_DENIED;
1747                 goto done;
1748         }
1749
1750         /* Ensure null termination */
1751         state->request->data.auth_crap.user
1752                 [sizeof(state->request->data.auth_crap.user)-1]=0;
1753         state->request->data.auth_crap.domain
1754                 [sizeof(state->request->data.auth_crap.domain)-1]=0;
1755
1756         DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1757                   (unsigned long)state->pid,
1758                   state->request->data.auth_crap.domain,
1759                   state->request->data.auth_crap.user));
1760
1761         if (*state->request->data.auth_crap.domain != '\0') {
1762                 domain_name = state->request->data.auth_crap.domain;
1763         } else if (lp_winbind_use_default_domain()) {
1764                 domain_name = lp_workgroup();
1765         }
1766
1767         if (domain_name != NULL)
1768                 domain = find_auth_domain(state, domain_name);
1769
1770         if (domain != NULL) {
1771                 sendto_domain(state, domain);
1772                 return;
1773         }
1774
1775         result = NT_STATUS_NO_SUCH_USER;
1776
1777  done:
1778         set_auth_errors(&state->response, result);
1779         DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1780                   state->request->data.auth_crap.domain,
1781                   state->request->data.auth_crap.user,
1782                   state->response.data.auth.nt_status_string,
1783                   state->response.data.auth.pam_error));
1784         request_error(state);
1785         return;
1786 }
1787
1788
1789 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1790                                                  struct winbindd_cli_state *state)
1791 {
1792         NTSTATUS result;
1793         struct netr_SamInfo3 *info3 = NULL;
1794         struct rpc_pipe_client *netlogon_pipe;
1795         const char *name_user = NULL;
1796         const char *name_domain = NULL;
1797         const char *workstation;
1798         struct winbindd_domain *contact_domain;
1799         int attempts = 0;
1800         bool retry;
1801
1802         DATA_BLOB lm_resp, nt_resp;
1803
1804         /* This is child-only, so no check for privileged access is needed
1805            anymore */
1806
1807         /* Ensure null termination */
1808         state->request->data.auth_crap.user[sizeof(state->request->data.auth_crap.user)-1]=0;
1809         state->request->data.auth_crap.domain[sizeof(state->request->data.auth_crap.domain)-1]=0;
1810
1811         if (!check_request_flags(state->request->flags)) {
1812                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1813                 goto done;
1814         }
1815
1816         name_user = state->request->data.auth_crap.user;
1817
1818         if (*state->request->data.auth_crap.domain) {
1819                 name_domain = state->request->data.auth_crap.domain;
1820         } else if (lp_winbind_use_default_domain()) {
1821                 name_domain = lp_workgroup();
1822         } else {
1823                 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1824                          name_user));
1825                 result = NT_STATUS_NO_SUCH_USER;
1826                 goto done;
1827         }
1828
1829         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1830                   name_domain, name_user));
1831
1832         if (*state->request->data.auth_crap.workstation) {
1833                 workstation = state->request->data.auth_crap.workstation;
1834         } else {
1835                 workstation = global_myname();
1836         }
1837
1838         if (state->request->data.auth_crap.lm_resp_len > sizeof(state->request->data.auth_crap.lm_resp)
1839                 || state->request->data.auth_crap.nt_resp_len > sizeof(state->request->data.auth_crap.nt_resp)) {
1840                 if (!(state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) ||
1841                      state->request->extra_len != state->request->data.auth_crap.nt_resp_len) {
1842                         DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1843                                   state->request->data.auth_crap.lm_resp_len,
1844                                   state->request->data.auth_crap.nt_resp_len));
1845                         result = NT_STATUS_INVALID_PARAMETER;
1846                         goto done;
1847                 }
1848         }
1849
1850         lm_resp = data_blob_talloc(state->mem_ctx, state->request->data.auth_crap.lm_resp,
1851                                         state->request->data.auth_crap.lm_resp_len);
1852
1853         if (state->request->flags & WBFLAG_BIG_NTLMV2_BLOB) {
1854                 nt_resp = data_blob_talloc(state->mem_ctx,
1855                                            state->request->extra_data.data,
1856                                            state->request->data.auth_crap.nt_resp_len);
1857         } else {
1858                 nt_resp = data_blob_talloc(state->mem_ctx,
1859                                            state->request->data.auth_crap.nt_resp,
1860                                            state->request->data.auth_crap.nt_resp_len);
1861         }
1862
1863         /* what domain should we contact? */
1864
1865         if ( IS_DC ) {
1866                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1867                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1868                                   state->request->data.auth_crap.user, name_domain, name_user, name_domain));
1869                         result = NT_STATUS_NO_SUCH_USER;
1870                         goto done;
1871                 }
1872         } else {
1873                 if (is_myname(name_domain)) {
1874                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1875                         result =  NT_STATUS_NO_SUCH_USER;
1876                         goto done;
1877                 }
1878                 contact_domain = find_our_domain();
1879         }
1880
1881         do {
1882                 netlogon_fn_t logon_fn;
1883
1884                 retry = false;
1885
1886                 netlogon_pipe = NULL;
1887                 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1888
1889                 if (!NT_STATUS_IS_OK(result)) {
1890                         DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1891                                   nt_errstr(result)));
1892                         goto done;
1893                 }
1894
1895                 logon_fn = contact_domain->can_do_samlogon_ex
1896                         ? rpccli_netlogon_sam_network_logon_ex
1897                         : rpccli_netlogon_sam_network_logon;
1898
1899                 result = logon_fn(netlogon_pipe,
1900                                   state->mem_ctx,
1901                                   state->request->data.auth_crap.logon_parameters,
1902                                   contact_domain->dcname,
1903                                   name_user,
1904                                   name_domain,
1905                                   /* Bug #3248 - found by Stefan Burkei. */
1906                                   workstation, /* We carefully set this above so use it... */
1907                                   state->request->data.auth_crap.chal,
1908                                   lm_resp,
1909                                   nt_resp,
1910                                   &info3);
1911
1912                 if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
1913                     && contact_domain->can_do_samlogon_ex) {
1914                         DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1915                                   "retrying with NetSamLogon\n"));
1916                         contact_domain->can_do_samlogon_ex = false;
1917                         retry = true;
1918                         continue;
1919                 }
1920
1921                 attempts += 1;
1922
1923                 /* We have to try a second time as cm_connect_netlogon
1924                    might not yet have noticed that the DC has killed
1925                    our connection. */
1926
1927                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1928                         retry = true;
1929                         continue;
1930                 }
1931
1932                 /* if we get access denied, a possible cause was that we had and open
1933                    connection to the DC, but someone changed our machine account password
1934                    out from underneath us using 'net rpc changetrustpw' */
1935
1936                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1937                         DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1938                                  "ACCESS_DENIED.  Maybe the trust account "
1939                                 "password was changed and we didn't know it. "
1940                                  "Killing connections to domain %s\n",
1941                                 name_domain));
1942                         invalidate_cm_connection(&contact_domain->conn);
1943                         retry = true;
1944                 }
1945
1946         } while ( (attempts < 2) && retry );
1947
1948         if (NT_STATUS_IS_OK(result)) {
1949
1950                 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1951                 netsamlogon_cache_store(name_user, info3);
1952
1953                 /* Check if the user is in the right group */
1954
1955                 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1956                                                         state->request->data.auth_crap.require_membership_of_sid))) {
1957                         DEBUG(3, ("User %s is not in the required group (%s), so "
1958                                   "crap authentication is rejected\n",
1959                                   state->request->data.auth_crap.user,
1960                                   state->request->data.auth_crap.require_membership_of_sid));
1961                         goto done;
1962                 }
1963
1964                 result = append_data(state, info3, name_domain, name_user);
1965                 if (!NT_STATUS_IS_OK(result)) {
1966                         goto done;
1967                 }
1968         }
1969
1970 done:
1971
1972         /* give us a more useful (more correct?) error code */
1973         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1974             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1975                 result = NT_STATUS_NO_LOGON_SERVERS;
1976         }
1977
1978         if (state->request->flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1979                 result = nt_status_squash(result);
1980         }
1981
1982         set_auth_errors(&state->response, result);
1983
1984         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1985               ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1986                name_domain,
1987                name_user,
1988                state->response.data.auth.nt_status_string,
1989                state->response.data.auth.pam_error));
1990
1991         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1992 }
1993
1994 /* Change a user password */
1995
1996 void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
1997 {
1998         fstring domain, user;
1999         char *mapped_user;
2000         struct winbindd_domain *contact_domain;
2001         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
2002
2003         DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
2004                 state->request->data.chauthtok.user));
2005
2006         /* Setup crap */
2007
2008         nt_status = normalize_name_unmap(state->mem_ctx,
2009                                          state->request->data.chauthtok.user,
2010                                          &mapped_user);
2011
2012         /* Update the chauthtok name if we did any mapping */
2013
2014         if (NT_STATUS_IS_OK(nt_status) ||
2015             NT_STATUS_EQUAL(nt_status, NT_STATUS_FILE_RENAMED))
2016         {
2017                 fstrcpy(state->request->data.chauthtok.user, mapped_user);
2018         }
2019
2020         /* Must pass in state->...chauthtok.user because
2021            canonicalize_username() assumes an fstring().  Since
2022            we have already copied it (if necessary), this is ok. */
2023
2024         if (!canonicalize_username(state->request->data.chauthtok.user, domain, user)) {
2025                 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2026                 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
2027                           "(PAM: %d)\n",
2028                           state->request->data.auth.user,
2029                           state->response.data.auth.nt_status_string,
2030                           state->response.data.auth.pam_error));
2031                 request_error(state);
2032                 return;
2033         }
2034
2035         contact_domain = find_domain_from_name(domain);
2036         if (!contact_domain) {
2037                 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2038                 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
2039                           state->request->data.chauthtok.user, domain, user, domain));
2040                 request_error(state);
2041                 return;
2042         }
2043
2044         sendto_domain(state, contact_domain);
2045 }
2046
2047 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
2048                                                  struct winbindd_cli_state *state)
2049 {
2050         char *oldpass;
2051         char *newpass = NULL;
2052         struct policy_handle dom_pol;
2053         struct rpc_pipe_client *cli;
2054         bool got_info = false;
2055         struct samr_DomInfo1 *info = NULL;
2056         struct samr_ChangeReject *reject = NULL;
2057         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2058         fstring domain, user;
2059
2060         DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
2061                   state->request->data.auth.user));
2062
2063         if (!parse_domain_user(state->request->data.chauthtok.user, domain, user)) {
2064                 goto done;
2065         }
2066
2067         /* Change password */
2068
2069         oldpass = state->request->data.chauthtok.oldpass;
2070         newpass = state->request->data.chauthtok.newpass;
2071
2072         /* Initialize reject reason */
2073         state->response.data.auth.reject_reason = Undefined;
2074
2075         /* Get sam handle */
2076
2077         result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
2078                                 &dom_pol);
2079         if (!NT_STATUS_IS_OK(result)) {
2080                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2081                 goto done;
2082         }
2083
2084         result = rpccli_samr_chgpasswd_user3(cli, state->mem_ctx,
2085                                              user,
2086                                              newpass,
2087                                              oldpass,
2088                                              &info,
2089                                              &reject);
2090
2091         /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2092
2093         if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2094
2095                 fill_in_password_policy(&state->response, info);
2096
2097                 state->response.data.auth.reject_reason =
2098                         reject->reason;
2099
2100                 got_info = true;
2101         }
2102
2103         /* atm the pidl generated rpccli_samr_ChangePasswordUser3 function will
2104          * return with NT_STATUS_BUFFER_TOO_SMALL for w2k dcs as w2k just
2105          * returns with 4byte error code (NT_STATUS_NOT_SUPPORTED) which is too
2106          * short to comply with the samr_ChangePasswordUser3 idl - gd */
2107
2108         /* only fallback when the chgpasswd_user3 call is not supported */
2109         if ((NT_STATUS_EQUAL(result, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR))) ||
2110                    (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) ||
2111                    (NT_STATUS_EQUAL(result, NT_STATUS_BUFFER_TOO_SMALL)) ||
2112                    (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED))) {
2113
2114                 DEBUG(10,("Password change with chgpasswd_user3 failed with: %s, retrying chgpasswd_user2\n",
2115                         nt_errstr(result)));
2116
2117                 result = rpccli_samr_chgpasswd_user2(cli, state->mem_ctx, user, newpass, oldpass);
2118
2119                 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2120                    Map to the same status code as Windows 2003. */
2121
2122                 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2123                         result = NT_STATUS_PASSWORD_RESTRICTION;
2124                 }
2125         }
2126
2127 done:
2128
2129         if (NT_STATUS_IS_OK(result) && (state->request->flags & WBFLAG_PAM_CACHED_LOGIN)) {
2130
2131                 /* Update the single sign-on memory creds. */
2132                 result = winbindd_replace_memory_creds(state->request->data.chauthtok.user,
2133                                                         newpass);
2134
2135                 /* When we login from gdm or xdm and password expires,
2136                  * we change password, but there are no memory crendentials
2137                  * So, winbindd_replace_memory_creds() returns
2138                  * NT_STATUS_OBJECT_NAME_NOT_FOUND. This is not a failure.
2139                  * --- BoYang
2140                  * */
2141                 if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
2142                         result = NT_STATUS_OK;
2143                 }
2144
2145                 if (!NT_STATUS_IS_OK(result)) {
2146                         DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
2147                         goto process_result;
2148                 }
2149
2150                 if (lp_winbind_offline_logon()) {
2151                         result = winbindd_update_creds_by_name(contact_domain,
2152                                                          state->mem_ctx, user,
2153                                                          newpass);
2154                         /* Again, this happens when we login from gdm or xdm
2155                          * and the password expires, *BUT* cached crendentials
2156                          * doesn't exist. winbindd_update_creds_by_name()
2157                          * returns NT_STATUS_NO_SUCH_USER.
2158                          * This is not a failure.
2159                          * --- BoYang
2160                          * */
2161                         if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
2162                                 result = NT_STATUS_OK;
2163                         }
2164
2165                         if (!NT_STATUS_IS_OK(result)) {
2166                                 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
2167                                 goto process_result;
2168                         }
2169                 }
2170         }
2171
2172         if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2173
2174                 NTSTATUS policy_ret;
2175
2176                 policy_ret = fillup_password_policy(contact_domain, state);
2177
2178                 /* failure of this is non critical, it will just provide no
2179                  * additional information to the client why the change has
2180                  * failed - Guenther */
2181
2182                 if (!NT_STATUS_IS_OK(policy_ret)) {
2183                         DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2184                         goto process_result;
2185                 }
2186         }
2187
2188 process_result:
2189
2190         set_auth_errors(&state->response, result);
2191
2192         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2193               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2194                domain,
2195                user,
2196                state->response.data.auth.nt_status_string,
2197                state->response.data.auth.pam_error));
2198
2199         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2200 }
2201
2202 void winbindd_pam_logoff(struct winbindd_cli_state *state)
2203 {
2204         struct winbindd_domain *domain;
2205         fstring name_domain, user;
2206         uid_t caller_uid = (uid_t)-1;
2207         uid_t request_uid = state->request->data.logoff.uid;
2208
2209         DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
2210                 state->request->data.logoff.user));
2211
2212         /* Ensure null termination */
2213         state->request->data.logoff.user
2214                 [sizeof(state->request->data.logoff.user)-1]='\0';
2215
2216         state->request->data.logoff.krb5ccname
2217                 [sizeof(state->request->data.logoff.krb5ccname)-1]='\0';
2218
2219         if (request_uid == (gid_t)-1) {
2220                 goto failed;
2221         }
2222
2223         if (!canonicalize_username(state->request->data.logoff.user, name_domain, user)) {
2224                 goto failed;
2225         }
2226
2227         if ((domain = find_auth_domain(state, name_domain)) == NULL) {
2228                 goto failed;
2229         }
2230
2231         if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
2232                 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2233                         strerror(errno)));
2234                 goto failed;
2235         }
2236
2237         switch (caller_uid) {
2238                 case -1:
2239                         goto failed;
2240                 case 0:
2241                         /* root must be able to logoff any user - gd */
2242                         state->request->data.logoff.uid = request_uid;
2243                         break;
2244                 default:
2245                         if (caller_uid != request_uid) {
2246                                 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2247                                 goto failed;
2248                         }
2249                         state->request->data.logoff.uid = caller_uid;
2250                         break;
2251         }
2252
2253         sendto_domain(state, domain);
2254         return;
2255
2256  failed:
2257         set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2258         DEBUG(5, ("Pam Logoff for %s returned %s "
2259                   "(PAM: %d)\n",
2260                   state->request->data.logoff.user,
2261                   state->response.data.auth.nt_status_string,
2262                   state->response.data.auth.pam_error));
2263         request_error(state);
2264         return;
2265 }
2266
2267 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2268                                               struct winbindd_cli_state *state)
2269 {
2270         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2271
2272         DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2273                 state->request->data.logoff.user));
2274
2275         if (!(state->request->flags & WBFLAG_PAM_KRB5)) {
2276                 result = NT_STATUS_OK;
2277                 goto process_result;
2278         }
2279
2280         if (state->request->data.logoff.krb5ccname[0] == '\0') {
2281                 result = NT_STATUS_OK;
2282                 goto process_result;
2283         }
2284
2285 #ifdef HAVE_KRB5
2286
2287         if (state->request->data.logoff.uid < 0) {
2288                 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2289                 goto process_result;
2290         }
2291
2292         /* what we need here is to find the corresponding krb5 ccache name *we*
2293          * created for a given username and destroy it */
2294
2295         if (!ccache_entry_exists(state->request->data.logoff.user)) {
2296                 result = NT_STATUS_OK;
2297                 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2298                 goto process_result;
2299         }
2300
2301         if (!ccache_entry_identical(state->request->data.logoff.user,
2302                                         state->request->data.logoff.uid,
2303                                         state->request->data.logoff.krb5ccname)) {
2304                 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2305                 goto process_result;
2306         }
2307
2308         result = remove_ccache(state->request->data.logoff.user);
2309         if (!NT_STATUS_IS_OK(result)) {
2310                 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2311                         nt_errstr(result)));
2312                 goto process_result;
2313         }
2314
2315 #else
2316         result = NT_STATUS_NOT_SUPPORTED;
2317 #endif
2318
2319 process_result:
2320
2321         winbindd_delete_memory_creds(state->request->data.logoff.user);
2322
2323         set_auth_errors(&state->response, result);
2324
2325         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2326 }
2327
2328 /* Change user password with auth crap*/
2329
2330 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
2331 {
2332         struct winbindd_domain *domain = NULL;
2333         const char *domain_name = NULL;
2334
2335         /* Ensure null termination */
2336         state->request->data.chng_pswd_auth_crap.user[
2337                 sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
2338         state->request->data.chng_pswd_auth_crap.domain[
2339                 sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
2340
2341         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2342                   (unsigned long)state->pid,
2343                   state->request->data.chng_pswd_auth_crap.domain,
2344                   state->request->data.chng_pswd_auth_crap.user));
2345
2346         if (*state->request->data.chng_pswd_auth_crap.domain != '\0') {
2347                 domain_name = state->request->data.chng_pswd_auth_crap.domain;
2348         } else if (lp_winbind_use_default_domain()) {
2349                 domain_name = lp_workgroup();
2350         }
2351
2352         if (domain_name != NULL)
2353                 domain = find_domain_from_name(domain_name);
2354
2355         if (domain != NULL) {
2356                 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2357                           "%s\n", (unsigned long)state->pid,domain->name));
2358                 sendto_domain(state, domain);
2359                 return;
2360         }
2361
2362         set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2363         DEBUG(5, ("CRAP change password  for %s\\%s returned %s (PAM: %d)\n",
2364                   state->request->data.chng_pswd_auth_crap.domain,
2365                   state->request->data.chng_pswd_auth_crap.user,
2366                   state->response.data.auth.nt_status_string,
2367                   state->response.data.auth.pam_error));
2368         request_error(state);
2369         return;
2370 }
2371
2372 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2373 {
2374         NTSTATUS result;
2375         DATA_BLOB new_nt_password;
2376         DATA_BLOB old_nt_hash_enc;
2377         DATA_BLOB new_lm_password;
2378         DATA_BLOB old_lm_hash_enc;
2379         fstring  domain,user;
2380         struct policy_handle dom_pol;
2381         struct winbindd_domain *contact_domain = domainSt;
2382         struct rpc_pipe_client *cli;
2383
2384         /* Ensure null termination */
2385         state->request->data.chng_pswd_auth_crap.user[
2386                 sizeof(state->request->data.chng_pswd_auth_crap.user)-1]=0;
2387         state->request->data.chng_pswd_auth_crap.domain[
2388                 sizeof(state->request->data.chng_pswd_auth_crap.domain)-1]=0;
2389         *domain = 0;
2390         *user = 0;
2391
2392         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2393                   (unsigned long)state->pid,
2394                   state->request->data.chng_pswd_auth_crap.domain,
2395                   state->request->data.chng_pswd_auth_crap.user));
2396
2397         if (lp_winbind_offline_logon()) {
2398                 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2399                 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2400                 result = NT_STATUS_ACCESS_DENIED;
2401                 goto done;
2402         }
2403
2404         if (*state->request->data.chng_pswd_auth_crap.domain) {
2405                 fstrcpy(domain,state->request->data.chng_pswd_auth_crap.domain);
2406         } else {
2407                 parse_domain_user(state->request->data.chng_pswd_auth_crap.user,
2408                                   domain, user);
2409
2410                 if(!*domain) {
2411                         DEBUG(3,("no domain specified with username (%s) - "
2412                                  "failing auth\n",
2413                                  state->request->data.chng_pswd_auth_crap.user));
2414                         result = NT_STATUS_NO_SUCH_USER;
2415                         goto done;
2416                 }
2417         }
2418
2419         if (!*domain && lp_winbind_use_default_domain()) {
2420                 fstrcpy(domain,(char *)lp_workgroup());
2421         }
2422
2423         if(!*user) {
2424                 fstrcpy(user, state->request->data.chng_pswd_auth_crap.user);
2425         }
2426
2427         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2428                   (unsigned long)state->pid, domain, user));
2429
2430         /* Change password */
2431         new_nt_password = data_blob_talloc(
2432                 state->mem_ctx,
2433                 state->request->data.chng_pswd_auth_crap.new_nt_pswd,
2434                 state->request->data.chng_pswd_auth_crap.new_nt_pswd_len);
2435
2436         old_nt_hash_enc = data_blob_talloc(
2437                 state->mem_ctx,
2438                 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc,
2439                 state->request->data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2440
2441         if(state->request->data.chng_pswd_auth_crap.new_lm_pswd_len > 0)        {
2442                 new_lm_password = data_blob_talloc(
2443                         state->mem_ctx,
2444                         state->request->data.chng_pswd_auth_crap.new_lm_pswd,
2445                         state->request->data.chng_pswd_auth_crap.new_lm_pswd_len);
2446
2447                 old_lm_hash_enc = data_blob_talloc(
2448                         state->mem_ctx,
2449                         state->request->data.chng_pswd_auth_crap.old_lm_hash_enc,
2450                         state->request->data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2451         } else {
2452                 new_lm_password.length = 0;
2453                 old_lm_hash_enc.length = 0;
2454         }
2455
2456         /* Get sam handle */
2457
2458         result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2459         if (!NT_STATUS_IS_OK(result)) {
2460                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2461                 goto done;
2462         }
2463
2464         result = rpccli_samr_chng_pswd_auth_crap(
2465                 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2466                 new_lm_password, old_lm_hash_enc);
2467
2468  done:
2469
2470         set_auth_errors(&state->response, result);
2471
2472         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2473               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2474                domain, user,
2475                state->response.data.auth.nt_status_string,
2476                state->response.data.auth.pam_error));
2477
2478         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2479 }