/* Required Headers */
-#define UID_WRAPPER_NOT_REPLACE
#include "replace.h"
#include "libwbclient.h"
#include "../winbind_client.h"
/* Authenticate a username/password pair */
-wbcErr wbcAuthenticateUser(const char *username,
- const char *password)
+wbcErr wbcCtxAuthenticateUser(struct wbcContext *ctx,
+ const char *username, const char *password)
{
wbcErr wbc_status = WBC_ERR_SUCCESS;
struct wbcAuthUserParams params;
params.level = WBC_AUTH_USER_LEVEL_PLAIN;
params.password.plaintext = password;
- wbc_status = wbcAuthenticateUserEx(¶ms, NULL, NULL);
+ wbc_status = wbcCtxAuthenticateUserEx(ctx, ¶ms, NULL, NULL);
BAIL_ON_WBC_ERROR(wbc_status);
done:
return wbc_status;
}
+wbcErr wbcAuthenticateUser(const char *username, const char *password)
+{
+ return wbcCtxAuthenticateUser(NULL, username, password);
+}
+
static bool sid_attr_compose(struct wbcSidWithAttr *s,
const struct wbcDomainSid *d,
uint32_t rid, uint32_t attr)
i->account_name = strdup(resp->data.auth.info3.user_name);
BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
- i->user_principal= NULL;
+ if (resp->data.auth.validation_level == 6) {
+ i->user_principal = strdup(resp->data.auth.info6.principal_name);
+ BAIL_ON_PTR_ERROR(i->user_principal, wbc_status);
+ } else {
+ i->user_principal = NULL;
+ }
i->full_name = strdup(resp->data.auth.info3.full_name);
BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
i->domain_name = strdup(resp->data.auth.info3.logon_dom);
BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
- i->dns_domain_name= NULL;
+ if (resp->data.auth.validation_level == 6) {
+ i->dns_domain_name = strdup(resp->data.auth.info6.dns_domainname);
+ BAIL_ON_PTR_ERROR(i->dns_domain_name, wbc_status);
+ } else {
+ i->dns_domain_name = NULL;
+ }
i->acct_flags = resp->data.auth.info3.acct_flags;
memcpy(i->user_session_key,
e->nt_status = resp->data.auth.nt_status;
e->pam_error = resp->data.auth.pam_error;
+ e->authoritative = resp->data.auth.authoritative;
e->nt_string = strdup(resp->data.auth.nt_status_string);
BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
/* Authenticate with more detailed information */
-wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
- struct wbcAuthUserInfo **info,
- struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxAuthenticateUserEx(struct wbcContext *ctx,
+ const struct wbcAuthUserParams *params,
+ struct wbcAuthUserInfo **info,
+ struct wbcAuthErrorInfo **error)
{
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
int cmd = 0;
BAIL_ON_WBC_ERROR(wbc_status);
}
- if (!params->account_name) {
+ if (params->level != WBC_AUTH_USER_LEVEL_PAC && !params->account_name) {
wbc_status = WBC_ERR_INVALID_PARAM;
BAIL_ON_WBC_ERROR(wbc_status);
}
ZERO_STRUCT(sep_response);
- wbc_status = wbcRequestResponse(WINBINDD_INFO,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_INFO,
NULL, &sep_response);
BAIL_ON_WBC_ERROR(wbc_status);
request.data.auth_crap.nt_resp_len);
}
break;
+
+ case WBC_AUTH_USER_LEVEL_PAC:
+ cmd = WINBINDD_PAM_AUTH_CRAP;
+ request.flags = WBFLAG_PAM_AUTH_PAC | WBFLAG_PAM_INFO3_TEXT;
+ request.extra_data.data = malloc(params->password.pac.length);
+ if (request.extra_data.data == NULL) {
+ wbc_status = WBC_ERR_NO_MEMORY;
+ BAIL_ON_WBC_ERROR(wbc_status);
+ }
+ memcpy(request.extra_data.data, params->password.pac.data,
+ params->password.pac.length);
+ request.extra_len = params->password.pac.length;
+ break;
+
default:
break;
}
}
if (cmd == WINBINDD_PAM_AUTH_CRAP) {
- wbc_status = wbcRequestResponsePriv(cmd, &request, &response);
+ wbc_status = wbcRequestResponsePriv(ctx, cmd,
+ &request, &response);
} else {
- wbc_status = wbcRequestResponse(cmd, &request, &response);
+ wbc_status = wbcRequestResponse(ctx, cmd,
+ &request, &response);
}
if (response.data.auth.nt_status != 0) {
if (error) {
return wbc_status;
}
+wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
+ struct wbcAuthUserInfo **info,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxAuthenticateUserEx(NULL, params, info, error);
+}
+
/* Trigger a verification of the trust credentials of a specific domain */
-wbcErr wbcCheckTrustCredentials(const char *domain,
- struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxCheckTrustCredentials(struct wbcContext *ctx, const char *domain,
+ struct wbcAuthErrorInfo **error)
{
struct winbindd_request request;
struct winbindd_response response;
/* Send request */
- wbc_status = wbcRequestResponsePriv(WINBINDD_CHECK_MACHACC,
+ wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_CHECK_MACHACC,
&request, &response);
if (response.data.auth.nt_status != 0) {
if (error) {
return wbc_status;
}
+wbcErr wbcCheckTrustCredentials(const char *domain,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxCheckTrustCredentials(NULL, domain, error);
+}
+
/* Trigger a change of the trust credentials for a specific domain */
-wbcErr wbcChangeTrustCredentials(const char *domain,
- struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxChangeTrustCredentials(struct wbcContext *ctx, const char *domain,
+ struct wbcAuthErrorInfo **error)
{
struct winbindd_request request;
struct winbindd_response response;
/* Send request */
- wbc_status = wbcRequestResponsePriv(WINBINDD_CHANGE_MACHACC,
- &request, &response);
+ wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_CHANGE_MACHACC,
+ &request, &response);
if (response.data.auth.nt_status != 0) {
if (error) {
wbc_status = wbc_create_error_info(&response,
return wbc_status;
}
+wbcErr wbcChangeTrustCredentials(const char *domain,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxChangeTrustCredentials(NULL, domain, error);
+}
+
/*
* Trigger a no-op NETLOGON call. Lightweight version of
* wbcCheckTrustCredentials
*/
+wbcErr wbcCtxPingDc(struct wbcContext *ctx, const char *domain,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxPingDc2(ctx, domain, error, NULL);
+}
+
wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
{
return wbcPingDc2(domain, error, NULL);
* Trigger a no-op NETLOGON call. Lightweight version of
* wbcCheckTrustCredentials, optionally return attempted DC
*/
-wbcErr wbcPingDc2(const char *domain, struct wbcAuthErrorInfo **error,
- char **dcname)
+wbcErr wbcCtxPingDc2(struct wbcContext *ctx, const char *domain,
+ struct wbcAuthErrorInfo **error, char **dcname)
{
struct winbindd_request request;
struct winbindd_response response;
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
- if (domain) {
- /*
- * the current protocol doesn't support
- * specifying a domain
- */
- wbc_status = WBC_ERR_NOT_IMPLEMENTED;
- BAIL_ON_WBC_ERROR(wbc_status);
- }
-
ZERO_STRUCT(request);
ZERO_STRUCT(response);
+ if (domain) {
+ strncpy(request.domain_name, domain,
+ sizeof(request.domain_name)-1);
+ }
+
/* Send request */
- wbc_status = wbcRequestResponse(WINBINDD_PING_DC,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_PING_DC,
&request,
&response);
return wbc_status;
}
+wbcErr wbcPingDc2(const char *domain, struct wbcAuthErrorInfo **error,
+ char **dcname)
+{
+ return wbcCtxPingDc2(NULL, domain, error, dcname);
+}
+
/* Trigger an extended logoff notification to Winbind for a specific user */
-wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
- struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxLogoffUserEx(struct wbcContext *ctx,
+ const struct wbcLogoffUserParams *params,
+ struct wbcAuthErrorInfo **error)
{
struct winbindd_request request;
struct winbindd_response response;
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
- int i;
+ size_t i;
/* validate input */
/* Send request */
- wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_LOGOFF,
&request,
&response);
return wbc_status;
}
+wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxLogoffUserEx(NULL, params, error);
+}
+
/* Trigger a logoff notification to Winbind for a specific user */
-wbcErr wbcLogoffUser(const char *username,
- uid_t uid,
- const char *ccfilename)
+wbcErr wbcCtxLogoffUser(struct wbcContext *ctx,
+ const char *username, uid_t uid,
+ const char *ccfilename)
{
struct winbindd_request request;
struct winbindd_response response;
/* Send request */
- wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_LOGOFF,
&request,
&response);
return wbc_status;
}
+wbcErr wbcLogoffUser(const char *username,
+ uid_t uid,
+ const char *ccfilename)
+{
+ return wbcCtxLogoffUser(NULL, username, uid, ccfilename);
+}
+
/* Change a password for a user with more detailed information upon failure */
-wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
- struct wbcAuthErrorInfo **error,
- enum wbcPasswordChangeRejectReason *reject_reason,
- struct wbcUserPasswordPolicyInfo **policy)
+wbcErr wbcCtxChangeUserPasswordEx(struct wbcContext *ctx,
+ const struct wbcChangePasswordParams *params,
+ struct wbcAuthErrorInfo **error,
+ enum wbcPasswordChangeRejectReason *reject_reason,
+ struct wbcUserPasswordPolicyInfo **policy)
{
struct winbindd_request request;
struct winbindd_response response;
/* Send request */
- wbc_status = wbcRequestResponse(cmd,
+ wbc_status = wbcRequestResponse(ctx, cmd,
&request,
&response);
if (WBC_ERROR_IS_OK(wbc_status)) {
return wbc_status;
}
+wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
+ struct wbcAuthErrorInfo **error,
+ enum wbcPasswordChangeRejectReason *reject_reason,
+ struct wbcUserPasswordPolicyInfo **policy)
+{
+ return wbcCtxChangeUserPasswordEx(NULL, params, error,
+ reject_reason, policy);
+}
+
/* Change a password for a user */
-wbcErr wbcChangeUserPassword(const char *username,
- const char *old_password,
- const char *new_password)
+wbcErr wbcCtxChangeUserPassword(struct wbcContext *ctx,
+ const char *username,
+ const char *old_password,
+ const char *new_password)
{
wbcErr wbc_status = WBC_ERR_SUCCESS;
struct wbcChangePasswordParams params;
params.old_password.plaintext = old_password;
params.new_password.plaintext = new_password;
- wbc_status = wbcChangeUserPasswordEx(¶ms,
- NULL,
- NULL,
- NULL);
+ wbc_status = wbcCtxChangeUserPasswordEx(ctx, ¶ms,
+ NULL,
+ NULL,
+ NULL);
BAIL_ON_WBC_ERROR(wbc_status);
done:
return wbc_status;
}
+wbcErr wbcChangeUserPassword(const char *username,
+ const char *old_password,
+ const char *new_password)
+{
+ return wbcCtxChangeUserPassword(NULL, username,
+ old_password, new_password);
+}
+
/* Logon a User */
-wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
- struct wbcLogonUserInfo **info,
- struct wbcAuthErrorInfo **error,
- struct wbcUserPasswordPolicyInfo **policy)
+wbcErr wbcCtxLogonUser(struct wbcContext *ctx,
+ const struct wbcLogonUserParams *params,
+ struct wbcLogonUserInfo **info,
+ struct wbcAuthErrorInfo **error,
+ struct wbcUserPasswordPolicyInfo **policy)
{
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
struct winbindd_request request;
}
}
- wbc_status = wbcRequestResponse(WINBINDD_PAM_AUTH,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_AUTH,
&request,
&response);
return wbc_status;
}
+wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
+ struct wbcLogonUserInfo **info,
+ struct wbcAuthErrorInfo **error,
+ struct wbcUserPasswordPolicyInfo **policy)
+{
+ return wbcCtxLogonUser(NULL, params, info, error, policy);
+}
+
static void wbcCredentialCacheInfoDestructor(void *ptr)
{
struct wbcCredentialCacheInfo *i =
}
/* Authenticate a user with cached credentials */
-wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
- struct wbcCredentialCacheInfo **info,
- struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxCredentialCache(struct wbcContext *ctx,
+ struct wbcCredentialCacheParams *params,
+ struct wbcCredentialCacheInfo **info,
+ struct wbcAuthErrorInfo **error)
{
wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
struct wbcCredentialCacheInfo *result = NULL;
struct winbindd_response response;
struct wbcNamedBlob *initial_blob = NULL;
struct wbcNamedBlob *challenge_blob = NULL;
- int i;
+ size_t i;
ZERO_STRUCT(request);
ZERO_STRUCT(response);
goto fail;
}
+ for (i=0; i<params->num_blobs; i++) {
+ /*
+ * Older callers may used to provide the NEGOTIATE request
+ * as "initial_blob", but it was completely ignored by winbindd.
+ *
+ * So we keep ignoring it.
+ *
+ * A new callers that is capable to support "new_spnego",
+ * will provide the NEGOTIATE request as "negotiate_blob"
+ * instead.
+ */
+ if (strcasecmp(params->blobs[i].name, "negotiate_blob") == 0) {
+ if (initial_blob != NULL) {
+ status = WBC_ERR_INVALID_PARAM;
+ goto fail;
+ }
+ initial_blob = ¶ms->blobs[i];
+ continue;
+ }
+ if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
+ if (challenge_blob != NULL) {
+ status = WBC_ERR_INVALID_PARAM;
+ goto fail;
+ }
+ challenge_blob = ¶ms->blobs[i];
+ continue;
+ }
+ }
+
if (params->domain_name != NULL) {
- status = wbcRequestResponse(WINBINDD_INFO, NULL, &response);
+ status = wbcRequestResponse(ctx, WINBINDD_INFO,
+ NULL, &response);
if (!WBC_ERROR_IS_OK(status)) {
goto fail;
}
}
request.data.ccache_ntlm_auth.uid = getuid();
- for (i=0; i<params->num_blobs; i++) {
- if (strcasecmp(params->blobs[i].name, "initial_blob") == 0) {
- initial_blob = ¶ms->blobs[i];
- break;
- }
- if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
- challenge_blob = ¶ms->blobs[i];
- break;
- }
- }
-
request.data.ccache_ntlm_auth.initial_blob_len = 0;
request.data.ccache_ntlm_auth.challenge_blob_len = 0;
request.extra_len = 0;
challenge_blob->blob.length);
}
- status = wbcRequestResponse(WINBINDD_CCACHE_NTLMAUTH, &request,
- &response);
+ status = wbcRequestResponse(ctx, WINBINDD_CCACHE_NTLMAUTH,
+ &request, &response);
if (!WBC_ERROR_IS_OK(status)) {
goto fail;
}
if (!WBC_ERROR_IS_OK(status)) {
goto fail;
}
+ if (response.data.ccache_ntlm_auth.new_spnego) {
+ status = wbcAddNamedBlob(
+ &result->num_blobs, &result->blobs, "new_spnego", 0,
+ &response.data.ccache_ntlm_auth.new_spnego,
+ sizeof(response.data.ccache_ntlm_auth.new_spnego));
+ if (!WBC_ERROR_IS_OK(status)) {
+ goto fail;
+ }
+ }
*info = result;
result = NULL;
return status;
}
+wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
+ struct wbcCredentialCacheInfo **info,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxCredentialCache(NULL, params, info, error);
+}
+
/* Authenticate a user with cached credentials */
-wbcErr wbcCredentialSave(const char *user, const char *password)
+wbcErr wbcCtxCredentialSave(struct wbcContext *ctx,
+ const char *user, const char *password)
{
struct winbindd_request request;
struct winbindd_response response;
sizeof(request.data.ccache_save.pass)-1);
request.data.ccache_save.uid = getuid();
- return wbcRequestResponse(WINBINDD_CCACHE_SAVE, &request, &response);
+ return wbcRequestResponse(ctx, WINBINDD_CCACHE_SAVE, &request, &response);
+}
+
+wbcErr wbcCredentialSave(const char *user, const char *password)
+{
+ return wbcCtxCredentialSave(NULL, user, password);
}
git.samba.org / samba.git / blobdiff