2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2004
5 Copyright (C) Gerald Carter 2003
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 #include "librpc/gen_ndr/ndr_samr.h"
26 #define DBGC_CLASS DBGC_AUTH
28 /****************************************************************************
29 Do a specific test for an smb password being correct, given a smb_password and
30 the lanman and NT responses.
31 ****************************************************************************/
33 static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
37 const struct samr_Password *lm_pwd,
38 const struct samr_Password *nt_pwd,
39 const struct auth_usersupplied_info *user_info,
40 DATA_BLOB *user_sess_key,
41 DATA_BLOB *lm_sess_key)
45 if (acct_flags & ACB_PWNOTREQ) {
46 if (lp_null_passwords()) {
47 DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n",
51 DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n",
53 return NT_STATUS_LOGON_FAILURE;
57 status = ntlm_password_check(mem_ctx, &auth_context->challenge,
58 &user_info->lm_resp, &user_info->nt_resp,
59 &user_info->lm_interactive_password,
60 &user_info->nt_interactive_password,
62 user_info->smb_name.str,
63 user_info->client_domain.str,
64 lm_pwd->hash, nt_pwd->hash, user_sess_key, lm_sess_key);
66 if (NT_STATUS_IS_OK(status)) {
67 if (user_sess_key && user_sess_key->data) {
68 talloc_steal(auth_context, user_sess_key->data);
70 if (lm_sess_key && lm_sess_key->data) {
71 talloc_steal(auth_context, lm_sess_key->data);
79 /****************************************************************************
80 Do a specific test for a SAM_ACCOUNT being vaild for this connection
81 (ie not disabled, expired and the like).
82 ****************************************************************************/
84 static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
88 NTTIME *must_change_time,
89 NTTIME *last_set_time,
90 const char *workstation_list,
91 const struct auth_usersupplied_info *user_info)
93 DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n", username));
95 /* Quit if the account was disabled. */
96 if (acct_flags & ACB_DISABLED) {
97 DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", username));
98 return NT_STATUS_ACCOUNT_DISABLED;
101 /* Quit if the account was locked out. */
102 if (acct_flags & ACB_AUTOLOCK) {
103 DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", username));
104 return NT_STATUS_ACCOUNT_LOCKED_OUT;
107 /* Test account expire time */
108 if ((*acct_expiry) != -1 && time(NULL) > nt_time_to_unix(*acct_expiry)) {
109 DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", username));
110 DEBUG(3,("sam_account_ok: Account expired at '%s'.\n",
111 nt_time_string(mem_ctx, *acct_expiry)));
112 return NT_STATUS_ACCOUNT_EXPIRED;
115 if (!(acct_flags & ACB_PWNOEXP)) {
117 /* check for immediate expiry "must change at next logon" */
118 if (*must_change_time == 0 && *last_set_time != 0) {
119 DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n",
121 return NT_STATUS_PASSWORD_MUST_CHANGE;
124 /* check for expired password */
125 if ((*must_change_time) != 0 && nt_time_to_unix(*must_change_time) < time(NULL)) {
126 DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n",
128 DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n",
129 nt_time_string(mem_ctx, *must_change_time)));
130 return NT_STATUS_PASSWORD_EXPIRED;
134 /* Test workstation. Workstation list is comma separated. */
136 if (workstation_list && *workstation_list) {
137 BOOL invalid_ws = True;
138 const char *s = workstation_list;
142 while (next_token(&s, tok, ",", sizeof(tok))) {
143 DEBUG(10,("sam_account_ok: checking for workstation match %s and %s (len=%d)\n",
144 tok, user_info->wksta_name.str, user_info->wksta_name.len));
146 if(strequal(tok, user_info->wksta_name.str)) {
154 return NT_STATUS_INVALID_WORKSTATION;
157 if (acct_flags & ACB_DOMTRUST) {
158 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", username));
159 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
162 if (acct_flags & ACB_SVRTRUST) {
163 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", username));
164 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
167 if (acct_flags & ACB_WSTRUST) {
168 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", username));
169 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
175 /****************************************************************************
176 Look for the specified user in the sam, return ldb result structures
177 ****************************************************************************/
179 static NTSTATUS sam_search_user(const char *username, const char *domain,
180 TALLOC_CTX *mem_ctx, void *sam_ctx,
181 struct ldb_message ***ret_msgs,
182 struct ldb_message ***ret_msgs_domain)
184 struct ldb_message **msgs;
185 struct ldb_message **msgs_domain;
190 const char *domain_dn = NULL;
191 const char *domain_sid;
193 const char *attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash",
194 "userAccountControl",
200 /* required for server_info, not access control: */
216 const char *domain_attrs[] = {"name", "objectSid"};
219 /* find the domain's DN */
220 ret_domain = samdb_search(sam_ctx, mem_ctx, NULL, &msgs_domain, domain_attrs,
221 "(&(|(realm=%s)(name=%s))(objectclass=domain))",
224 if (ret_domain == 0) {
225 DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n",
227 return NT_STATUS_NO_SUCH_USER;
230 if (ret_domain > 1) {
231 DEBUG(0,("Found %d records matching domain [%s]\n",
232 ret_domain, domain));
233 return NT_STATUS_INTERNAL_DB_CORRUPTION;
236 domain_dn = msgs_domain[0]->dn;
239 /* pull the user attributes */
240 ret = samdb_search(sam_ctx, mem_ctx, domain_dn, &msgs, attrs,
241 "(&(sAMAccountName=%s)(objectclass=user))",
245 DEBUG(3,("check_sam_security: Couldn't find user [%s] in passdb file.\n",
247 return NT_STATUS_NO_SUCH_USER;
251 DEBUG(0,("Found %d records matching user [%s]\n", ret, username));
252 return NT_STATUS_INTERNAL_DB_CORRUPTION;
256 domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
258 return NT_STATUS_INTERNAL_DB_CORRUPTION;
261 /* find the domain's DN */
262 ret_domain = samdb_search(sam_ctx, mem_ctx, NULL, &msgs_domain, domain_attrs,
263 "(&(objectSid=%s)(objectclass=domain))",
266 if (ret_domain == 0) {
267 DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n",
269 return NT_STATUS_NO_SUCH_USER;
272 if (ret_domain > 1) {
273 DEBUG(0,("Found %d records matching domain [%s]\n",
274 ret_domain, domain_sid));
275 return NT_STATUS_INTERNAL_DB_CORRUPTION;
278 domain_dn = msgs_domain[0]->dn;
281 *ret_msgs_domain = msgs_domain;
286 NTSTATUS sam_check_password(const struct auth_context *auth_context,
287 const char *username,
288 TALLOC_CTX *mem_ctx, void *sam_ctx,
289 struct ldb_message **msgs,
290 const char *domain_dn,
291 const struct auth_usersupplied_info *user_info,
292 DATA_BLOB *user_sess_key, DATA_BLOB *lm_sess_key)
296 const char *workstation_list;
298 NTTIME must_change_time;
299 NTTIME last_set_time;
300 struct samr_Password *lm_pwd, *nt_pwd;
305 acct_flags = samdb_result_acct_flags(msgs[0], "sAMAcctFlags");
307 /* Quit if the account was locked out. */
308 if (acct_flags & ACB_AUTOLOCK) {
309 DEBUG(3,("check_sam_security: Account for user %s was locked out.\n",
311 return NT_STATUS_ACCOUNT_LOCKED_OUT;
314 if (!NT_STATUS_IS_OK(nt_status = samdb_result_passwords(mem_ctx, msgs[0],
315 &lm_pwd, &nt_pwd))) {
319 nt_status = sam_password_ok(auth_context, mem_ctx,
320 username, acct_flags,
322 user_info, user_sess_key, lm_sess_key);
324 if (!NT_STATUS_IS_OK(nt_status)) {
328 acct_expiry = samdb_result_nttime(msgs[0], "accountExpires", 0);
329 must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx,
332 last_set_time = samdb_result_nttime(msgs[0], "pwdLastSet", 0);
334 workstation_list = samdb_result_string(msgs[0], "userWorkstations", NULL);
336 nt_status = sam_account_ok(mem_ctx, username, acct_flags,
346 NTSTATUS sam_make_server_info(TALLOC_CTX *mem_ctx, void *sam_ctx,
347 struct ldb_message **msgs, struct ldb_message **msgs_domain,
348 struct auth_serversupplied_info **server_info)
351 struct ldb_message **group_msgs;
353 const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL };
354 /* find list of sids */
355 struct dom_sid **groupSIDs = NULL;
356 struct dom_sid *user_sid;
357 struct dom_sid *primary_group_sid;
364 if (!NT_STATUS_IS_OK(nt_status = make_server_info(mem_ctx, server_info,
365 samdb_result_string(msgs[0], "sAMAccountName", "")))) {
366 DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
370 group_ret = samdb_search(sam_ctx,
371 mem_ctx, NULL, &group_msgs, group_attrs,
372 "(&(member=%s)(sAMAccountType=*))",
374 if (group_ret == -1) {
375 return NT_STATUS_INTERNAL_DB_CORRUPTION;
379 !(groupSIDs = talloc_array_p(*server_info, struct dom_sid *, group_ret))) {
380 talloc_free(*server_info);
381 return NT_STATUS_NO_MEMORY;
384 /* Need to unroll some nested groups, but not aliases */
385 for (i = 0; i < group_ret; i++) {
386 sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
387 groupSIDs[i] = dom_sid_parse_talloc(*server_info, sidstr);
390 sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
391 user_sid = dom_sid_parse_talloc(*server_info, sidstr);
392 primary_group_sid = dom_sid_parse_talloc(*server_info, sidstr);
393 rid = samdb_result_uint(msgs[0], "primaryGroupID", ~0);
396 primary_group_sid = groupSIDs[0];
398 primary_group_sid = NULL;
401 primary_group_sid->sub_auths[primary_group_sid->num_auths-1] = rid;
404 (*server_info)->user_sid = user_sid;
405 (*server_info)->primary_group_sid = primary_group_sid;
407 (*server_info)->n_domain_groups = group_ret;
408 (*server_info)->domain_groups = groupSIDs;
410 (*server_info)->account_name
411 = talloc_strdup(*server_info,
412 samdb_result_string(msgs[0], "sAMAccountName", ""));
414 (*server_info)->domain
415 = talloc_strdup(*server_info,
416 samdb_result_string(msgs_domain[0], "name", ""));
418 (*server_info)->full_name
419 = talloc_strdup(*server_info,
420 samdb_result_string(msgs[0], "displayName", ""));
422 (*server_info)->logon_script
423 = talloc_strdup(*server_info,
424 samdb_result_string(msgs[0], "scriptPath", ""));
425 (*server_info)->profile_path
426 = talloc_strdup(*server_info,
427 samdb_result_string(msgs[0], "profilePath", ""));
428 (*server_info)->home_directory
429 = talloc_strdup(*server_info,
430 samdb_result_string(msgs[0], "homeDirectory", ""));
432 (*server_info)->home_drive
433 = talloc_strdup(*server_info,
434 samdb_result_string(msgs[0], "homeDrive", ""));
436 (*server_info)->last_logon = samdb_result_nttime(msgs[0], "lastLogon", 0);
437 (*server_info)->last_logoff = samdb_result_nttime(msgs[0], "lastLogoff", 0);
438 (*server_info)->acct_expiry = samdb_result_nttime(msgs[0], "accountExpires", 0);
439 (*server_info)->last_password_change = samdb_result_nttime(msgs[0], "pwdLastSet", 0);
440 (*server_info)->allow_password_change
441 = samdb_result_allow_password_change(sam_ctx, mem_ctx,
442 msgs_domain[0]->dn, msgs[0], "pwdLastSet");
443 (*server_info)->force_password_change
444 = samdb_result_force_password_change(sam_ctx, mem_ctx,
445 msgs_domain[0]->dn, msgs[0], "pwdLastSet");
447 (*server_info)->logon_count = samdb_result_uint(msgs[0], "logonCount", 0);
448 (*server_info)->bad_password_count = samdb_result_uint(msgs[0], "badPwdCount", 0);
450 (*server_info)->acct_flags = samdb_result_acct_flags(msgs[0], "userAccountControl");
452 (*server_info)->guest = False;
454 if (!(*server_info)->account_name
455 || !(*server_info)->full_name
456 || !(*server_info)->logon_script
457 || !(*server_info)->profile_path
458 || !(*server_info)->home_directory
459 || !(*server_info)->home_drive) {
460 talloc_destroy(*server_info);
461 return NT_STATUS_NO_MEMORY;
467 NTSTATUS sam_get_server_info(const char *username, const char *domain, TALLOC_CTX *mem_ctx,
468 struct auth_serversupplied_info **server_info)
472 struct ldb_message **msgs;
473 struct ldb_message **domain_msgs;
476 sam_ctx = samdb_connect(mem_ctx);
477 if (sam_ctx == NULL) {
478 return NT_STATUS_INVALID_SYSTEM_SERVICE;
481 nt_status = sam_search_user(username, domain, mem_ctx, sam_ctx, &msgs, &domain_msgs);
482 if (!NT_STATUS_IS_OK(nt_status)) {
486 nt_status = sam_make_server_info(mem_ctx, sam_ctx, msgs, domain_msgs, server_info);
487 if (!NT_STATUS_IS_OK(nt_status)) {
494 static NTSTATUS check_sam_security_internals(const struct auth_context *auth_context,
497 const struct auth_usersupplied_info *user_info,
498 struct auth_serversupplied_info **server_info)
502 const char *username = user_info->internal_username.str;
503 struct ldb_message **msgs;
504 struct ldb_message **domain_msgs;
506 DATA_BLOB user_sess_key, lm_sess_key;
508 sam_ctx = samdb_connect(mem_ctx);
509 if (sam_ctx == NULL) {
510 return NT_STATUS_INVALID_SYSTEM_SERVICE;
513 nt_status = sam_search_user(username, domain, mem_ctx, sam_ctx, &msgs, &domain_msgs);
514 if (!NT_STATUS_IS_OK(nt_status)) {
518 nt_status = sam_check_password(auth_context, username, mem_ctx, sam_ctx, msgs, domain_msgs[0]->dn, user_info,
519 &user_sess_key, &lm_sess_key);
520 if (!NT_STATUS_IS_OK(nt_status)) {
524 nt_status = sam_make_server_info(mem_ctx, sam_ctx, msgs, domain_msgs, server_info);
525 if (!NT_STATUS_IS_OK(nt_status)) {
529 talloc_reference(auth_context, *server_info);
531 (*server_info)->user_session_key = user_sess_key;
532 (*server_info)->lm_session_key = lm_sess_key;
536 static NTSTATUS check_sam_security(const struct auth_context *auth_context,
537 void *my_private_data,
539 const struct auth_usersupplied_info *user_info,
540 struct auth_serversupplied_info **server_info)
542 return check_sam_security_internals(auth_context, NULL,
543 mem_ctx, user_info, server_info);
546 /* module initialisation */
547 static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context,
549 struct auth_methods **auth_method)
551 if (!make_auth_methods(auth_context, auth_method)) {
552 return NT_STATUS_NO_MEMORY;
555 (*auth_method)->auth = check_sam_security;
556 (*auth_method)->name = "sam_ignoredomain";
561 /****************************************************************************
562 Check SAM security (above) but with a few extra checks.
563 ****************************************************************************/
565 static NTSTATUS check_samstrict_security(const struct auth_context *auth_context,
566 void *my_private_data,
568 const struct auth_usersupplied_info *user_info,
569 struct auth_serversupplied_info **server_info)
572 BOOL is_local_name, is_my_domain;
574 if (!user_info || !auth_context) {
575 return NT_STATUS_LOGON_FAILURE;
578 is_local_name = is_myname(user_info->domain.str);
579 is_my_domain = strequal(user_info->domain.str, lp_workgroup());
581 /* check whether or not we service this domain/workgroup name */
583 switch ( lp_server_role() ) {
584 case ROLE_STANDALONE:
585 case ROLE_DOMAIN_MEMBER:
586 if ( !is_local_name ) {
587 DEBUG(6,("check_samstrict_security: %s is not one of my local names (%s)\n",
588 user_info->domain.str, (lp_server_role() == ROLE_DOMAIN_MEMBER
589 ? "ROLE_DOMAIN_MEMBER" : "ROLE_STANDALONE") ));
590 return NT_STATUS_NOT_IMPLEMENTED;
592 domain = lp_netbios_name();
594 case ROLE_DOMAIN_PDC:
595 case ROLE_DOMAIN_BDC:
596 if ( !is_local_name && !is_my_domain ) {
597 DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n",
598 user_info->domain.str));
599 return NT_STATUS_NOT_IMPLEMENTED;
601 domain = lp_workgroup();
603 default: /* name is ok */
604 domain = user_info->domain.str;
608 return check_sam_security_internals(auth_context, domain, mem_ctx, user_info, server_info);
611 /* module initialisation */
612 static NTSTATUS auth_init_sam(struct auth_context *auth_context,
614 struct auth_methods **auth_method)
616 if (!make_auth_methods(auth_context, auth_method)) {
617 return NT_STATUS_NO_MEMORY;
620 (*auth_method)->auth = check_samstrict_security;
621 (*auth_method)->name = "sam";
625 NTSTATUS auth_sam_init(void)
628 struct auth_operations ops;
631 ops.init = auth_init_sam;
632 ret = register_backend("auth", &ops);
633 if (!NT_STATUS_IS_OK(ret)) {
634 DEBUG(0,("Failed to register '%s' auth backend!\n",
639 ops.name = "sam_ignoredomain";
640 ops.init = auth_init_sam_ignoredomain;
641 ret = register_backend("auth", &ops);
642 if (!NT_STATUS_IS_OK(ret)) {
643 DEBUG(0,("Failed to register '%s' auth backend!\n",