2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2011
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006-2008
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
28 #include "rpc_client/init_lsa.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/util_pw.h"
31 #include "lib/winbind_util.h"
33 #include "../librpc/gen_ndr/ndr_auth.h"
34 #include "../auth/auth_sam_reply.h"
37 #define DBGC_CLASS DBGC_AUTH
39 /****************************************************************************
40 Create a UNIX user on demand.
41 ****************************************************************************/
43 static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
45 TALLOC_CTX *ctx = talloc_tos();
49 add_script = talloc_strdup(ctx, lp_adduser_script());
50 if (!add_script || !*add_script) {
53 add_script = talloc_all_string_sub(ctx,
61 add_script = talloc_all_string_sub(ctx,
70 add_script = talloc_all_string_sub(ctx,
78 ret = smbrun(add_script,NULL);
81 ("smb_create_user: Running the command `%s' gave %d\n",
86 /****************************************************************************
87 Create an auth_usersupplied_data structure after appropriate mapping.
88 ****************************************************************************/
90 NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info,
92 const char *client_domain,
93 const char *workstation_name,
94 const struct tsocket_address *remote_address,
95 const DATA_BLOB *lm_pwd,
96 const DATA_BLOB *nt_pwd,
97 const struct samr_Password *lm_interactive_pwd,
98 const struct samr_Password *nt_interactive_pwd,
99 const char *plaintext,
100 enum auth_password_state password_state)
105 char *internal_username = NULL;
107 was_mapped = map_username(talloc_tos(), smb_name, &internal_username);
108 if (!internal_username) {
109 return NT_STATUS_NO_MEMORY;
112 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
113 client_domain, smb_name, workstation_name));
115 domain = client_domain;
117 /* If you connect to a Windows domain member using a bogus domain name,
118 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
119 * the Windows box is a DC the name will become DOMAIN\user and be
120 * authenticated against AD, if the Windows box is a member server but
121 * not a DC the name will become WORKSTATION\user. A standalone
122 * non-domain member box will also map to WORKSTATION\user.
123 * This also deals with the client passing in a "" domain */
125 if (!is_trusted_domain(domain) &&
126 !strequal(domain, my_sam_name()))
128 if (lp_map_untrusted_to_domain())
129 domain = my_sam_name();
131 domain = get_global_sam_name();
132 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
133 "workstation [%s]\n",
134 client_domain, domain, smb_name, workstation_name));
137 /* We know that the given domain is trusted (and we are allowing them),
138 * it is our global SAM name, or for legacy behavior it is our
139 * primary domain name */
141 result = make_user_info(user_info, smb_name, internal_username,
142 client_domain, domain, workstation_name,
143 remote_address, lm_pwd, nt_pwd,
144 lm_interactive_pwd, nt_interactive_pwd,
145 plaintext, password_state);
146 if (NT_STATUS_IS_OK(result)) {
147 /* We have tried mapping */
148 (*user_info)->mapped_state = true;
149 /* did we actually map the user to a different name? */
150 (*user_info)->was_mapped = was_mapped;
155 /****************************************************************************
156 Create an auth_usersupplied_data, making the DATA_BLOBs here.
157 Decrypt and encrypt the passwords.
158 ****************************************************************************/
160 bool make_user_info_netlogon_network(struct auth_usersupplied_info **user_info,
161 const char *smb_name,
162 const char *client_domain,
163 const char *workstation_name,
164 const struct tsocket_address *remote_address,
165 uint32 logon_parameters,
166 const uchar *lm_network_pwd,
168 const uchar *nt_network_pwd,
173 DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
174 DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
176 status = make_user_info_map(user_info,
177 smb_name, client_domain,
180 lm_pwd_len ? &lm_blob : NULL,
181 nt_pwd_len ? &nt_blob : NULL,
183 AUTH_PASSWORD_RESPONSE);
185 if (NT_STATUS_IS_OK(status)) {
186 (*user_info)->logon_parameters = logon_parameters;
188 ret = NT_STATUS_IS_OK(status) ? true : false;
190 data_blob_free(&lm_blob);
191 data_blob_free(&nt_blob);
195 /****************************************************************************
196 Create an auth_usersupplied_data, making the DATA_BLOBs here.
197 Decrypt and encrypt the passwords.
198 ****************************************************************************/
200 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info,
201 const char *smb_name,
202 const char *client_domain,
203 const char *workstation_name,
204 const struct tsocket_address *remote_address,
205 uint32 logon_parameters,
207 const uchar lm_interactive_pwd[16],
208 const uchar nt_interactive_pwd[16],
209 const uchar *dc_sess_key)
211 struct samr_Password lm_pwd;
212 struct samr_Password nt_pwd;
213 unsigned char local_lm_response[24];
214 unsigned char local_nt_response[24];
215 unsigned char key[16];
217 memcpy(key, dc_sess_key, 16);
219 if (lm_interactive_pwd)
220 memcpy(lm_pwd.hash, lm_interactive_pwd, sizeof(lm_pwd.hash));
222 if (nt_interactive_pwd)
223 memcpy(nt_pwd.hash, nt_interactive_pwd, sizeof(nt_pwd.hash));
225 #ifdef DEBUG_PASSWORD
227 dump_data(100, key, sizeof(key));
229 DEBUG(100,("lm owf password:"));
230 dump_data(100, lm_pwd.hash, sizeof(lm_pwd.hash));
232 DEBUG(100,("nt owf password:"));
233 dump_data(100, nt_pwd.hash, sizeof(nt_pwd.hash));
236 if (lm_interactive_pwd)
237 arcfour_crypt(lm_pwd.hash, key, sizeof(lm_pwd.hash));
239 if (nt_interactive_pwd)
240 arcfour_crypt(nt_pwd.hash, key, sizeof(nt_pwd.hash));
242 #ifdef DEBUG_PASSWORD
243 DEBUG(100,("decrypt of lm owf password:"));
244 dump_data(100, lm_pwd.hash, sizeof(lm_pwd));
246 DEBUG(100,("decrypt of nt owf password:"));
247 dump_data(100, nt_pwd.hash, sizeof(nt_pwd));
250 if (lm_interactive_pwd)
251 SMBOWFencrypt(lm_pwd.hash, chal,
254 if (nt_interactive_pwd)
255 SMBOWFencrypt(nt_pwd.hash, chal,
258 /* Password info paranoia */
264 DATA_BLOB local_lm_blob;
265 DATA_BLOB local_nt_blob;
267 if (lm_interactive_pwd) {
268 local_lm_blob = data_blob(local_lm_response,
269 sizeof(local_lm_response));
272 if (nt_interactive_pwd) {
273 local_nt_blob = data_blob(local_nt_response,
274 sizeof(local_nt_response));
277 nt_status = make_user_info_map(
279 smb_name, client_domain, workstation_name,
281 lm_interactive_pwd ? &local_lm_blob : NULL,
282 nt_interactive_pwd ? &local_nt_blob : NULL,
283 lm_interactive_pwd ? &lm_pwd : NULL,
284 nt_interactive_pwd ? &nt_pwd : NULL,
285 NULL, AUTH_PASSWORD_HASH);
287 if (NT_STATUS_IS_OK(nt_status)) {
288 (*user_info)->logon_parameters = logon_parameters;
291 ret = NT_STATUS_IS_OK(nt_status) ? true : false;
292 data_blob_free(&local_lm_blob);
293 data_blob_free(&local_nt_blob);
299 /****************************************************************************
300 Create an auth_usersupplied_data structure
301 ****************************************************************************/
303 bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
304 const char *smb_name,
305 const char *client_domain,
306 const struct tsocket_address *remote_address,
308 DATA_BLOB plaintext_password)
311 DATA_BLOB local_lm_blob;
312 DATA_BLOB local_nt_blob;
313 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
314 char *plaintext_password_string;
316 * Not encrypted - do so.
319 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
321 if (plaintext_password.data && plaintext_password.length) {
322 unsigned char local_lm_response[24];
324 #ifdef DEBUG_PASSWORD
325 DEBUG(10,("Unencrypted password (len %d):\n",
326 (int)plaintext_password.length));
327 dump_data(100, plaintext_password.data,
328 plaintext_password.length);
331 SMBencrypt( (const char *)plaintext_password.data,
332 (const uchar*)chal, local_lm_response);
333 local_lm_blob = data_blob(local_lm_response, 24);
335 /* We can't do an NT hash here, as the password needs to be
337 local_nt_blob = data_blob_null;
339 local_lm_blob = data_blob_null;
340 local_nt_blob = data_blob_null;
343 plaintext_password_string = talloc_strndup(talloc_tos(),
344 (const char *)plaintext_password.data,
345 plaintext_password.length);
346 if (!plaintext_password_string) {
350 ret = make_user_info_map(
351 user_info, smb_name, client_domain,
352 get_remote_machine_name(),
354 local_lm_blob.data ? &local_lm_blob : NULL,
355 local_nt_blob.data ? &local_nt_blob : NULL,
357 plaintext_password_string,
358 AUTH_PASSWORD_PLAIN);
360 if (plaintext_password_string) {
361 memset(plaintext_password_string, '\0', strlen(plaintext_password_string));
362 talloc_free(plaintext_password_string);
365 data_blob_free(&local_lm_blob);
366 return NT_STATUS_IS_OK(ret) ? true : false;
369 /****************************************************************************
370 Create an auth_usersupplied_data structure
371 ****************************************************************************/
373 NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info,
374 const char *smb_name,
375 const char *client_domain,
376 const struct tsocket_address *remote_address,
377 DATA_BLOB lm_resp, DATA_BLOB nt_resp)
379 return make_user_info_map(user_info, smb_name,
381 get_remote_machine_name(),
383 lm_resp.data && (lm_resp.length > 0) ? &lm_resp : NULL,
384 nt_resp.data && (nt_resp.length > 0) ? &nt_resp : NULL,
386 AUTH_PASSWORD_RESPONSE);
389 /****************************************************************************
390 Create a guest user_info blob, for anonymous authentication.
391 ****************************************************************************/
393 bool make_user_info_guest(const struct tsocket_address *remote_address,
394 struct auth_usersupplied_info **user_info)
398 nt_status = make_user_info(user_info,
406 AUTH_PASSWORD_RESPONSE);
408 return NT_STATUS_IS_OK(nt_status) ? true : false;
411 static NTSTATUS log_nt_token(struct security_token *token)
413 TALLOC_CTX *frame = talloc_stackframe();
418 if ((lp_log_nt_token_command() == NULL) ||
419 (strlen(lp_log_nt_token_command()) == 0)) {
424 group_sidstr = talloc_strdup(frame, "");
425 for (i=1; i<token->num_sids; i++) {
426 group_sidstr = talloc_asprintf(
427 frame, "%s %s", group_sidstr,
428 sid_string_talloc(frame, &token->sids[i]));
431 command = talloc_string_sub(
432 frame, lp_log_nt_token_command(),
433 "%s", sid_string_talloc(frame, &token->sids[0]));
434 command = talloc_string_sub(frame, command, "%t", group_sidstr);
436 if (command == NULL) {
438 return NT_STATUS_NO_MEMORY;
441 DEBUG(8, ("running command: [%s]\n", command));
442 if (smbrun(command, NULL) != 0) {
443 DEBUG(0, ("Could not log NT token\n"));
445 return NT_STATUS_ACCESS_DENIED;
453 * Create the token to use from server_info->info3 and
454 * server_info->sids (the info3/sam groups). Find the unix gids.
457 NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
458 const struct auth_serversupplied_info *server_info,
459 DATA_BLOB *session_key,
460 const char *smb_username, /* for ->sanitized_username, for %U subs */
461 struct auth_session_info **session_info_out)
463 struct security_token *t;
466 struct dom_sid tmp_sid;
467 struct auth_session_info *session_info;
468 struct wbcUnixId *ids;
471 /* Ensure we can't possible take a code path leading to a
474 return NT_STATUS_LOGON_FAILURE;
477 session_info = talloc_zero(mem_ctx, struct auth_session_info);
479 return NT_STATUS_NO_MEMORY;
482 session_info->unix_token = talloc_zero(session_info, struct security_unix_token);
483 if (!session_info->unix_token) {
484 TALLOC_FREE(session_info);
485 return NT_STATUS_NO_MEMORY;
488 session_info->unix_token->uid = server_info->utok.uid;
489 session_info->unix_token->gid = server_info->utok.gid;
491 session_info->unix_info = talloc_zero(session_info, struct auth_user_info_unix);
492 if (!session_info->unix_info) {
493 TALLOC_FREE(session_info);
494 return NT_STATUS_NO_MEMORY;
497 session_info->unix_info->unix_name = talloc_strdup(session_info, server_info->unix_name);
498 if (!session_info->unix_info->unix_name) {
499 TALLOC_FREE(session_info);
500 return NT_STATUS_NO_MEMORY;
503 /* This is a potentially untrusted username for use in %U */
504 alpha_strcpy(tmp, smb_username, ". _-$", sizeof(tmp));
505 session_info->unix_info->sanitized_username =
506 talloc_strdup(session_info->unix_info, tmp);
508 session_info->unix_info->system = server_info->system;
511 data_blob_free(&session_info->session_key);
512 session_info->session_key = data_blob_talloc(session_info,
514 session_key->length);
515 if (!session_info->session_key.data && session_key->length) {
516 return NT_STATUS_NO_MEMORY;
519 session_info->session_key = data_blob_talloc( session_info, server_info->session_key.data,
520 server_info->session_key.length);
523 /* We need to populate session_info->info with the information found in server_info->info3 */
524 status = make_user_info_SamBaseInfo(session_info, "", &server_info->info3->base,
525 server_info->guest == false,
526 &session_info->info);
527 if (!NT_STATUS_IS_OK(status)) {
528 DEBUG(0, ("conversion of info3 into auth_user_info failed!\n"));
529 TALLOC_FREE(session_info);
533 if (server_info->security_token) {
534 /* Just copy the token, it has already been finalised
535 * (nasty hack to support a cached guest session_info,
536 * and a possible strategy for auth_samba4 to pass in
537 * a finalised session) */
539 session_info->security_token = dup_nt_token(session_info, server_info->security_token);
540 if (!session_info->security_token) {
541 TALLOC_FREE(session_info);
542 return NT_STATUS_NO_MEMORY;
545 session_info->unix_token->ngroups = server_info->utok.ngroups;
546 if (server_info->utok.ngroups != 0) {
547 session_info->unix_token->groups = (gid_t *)talloc_memdup(
548 session_info->unix_token, server_info->utok.groups,
549 sizeof(gid_t)*session_info->unix_token->ngroups);
551 session_info->unix_token->groups = NULL;
554 *session_info_out = session_info;
559 * If winbind is not around, we can not make much use of the SIDs the
560 * domain controller provided us with. Likewise if the user name was
561 * mapped to some local unix user.
564 if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
565 (server_info->nss_token)) {
566 char *found_username = NULL;
567 status = create_token_from_username(session_info,
568 server_info->unix_name,
570 &session_info->unix_token->uid,
571 &session_info->unix_token->gid,
573 &session_info->security_token);
574 if (NT_STATUS_IS_OK(status)) {
575 session_info->unix_info->unix_name = found_username;
578 status = create_local_nt_token_from_info3(session_info,
582 &session_info->security_token);
585 if (!NT_STATUS_IS_OK(status)) {
589 /* Convert the SIDs to gids. */
591 session_info->unix_token->ngroups = 0;
592 session_info->unix_token->groups = NULL;
594 t = session_info->security_token;
596 ids = talloc_array(talloc_tos(), struct wbcUnixId,
599 return NT_STATUS_NO_MEMORY;
602 if (!sids_to_unix_ids(t->sids, t->num_sids, ids)) {
604 return NT_STATUS_NO_MEMORY;
607 for (i=0; i<t->num_sids; i++) {
609 if (i == 0 && ids[i].type != WBC_ID_TYPE_BOTH) {
613 if (ids[i].type != WBC_ID_TYPE_GID &&
614 ids[i].type != WBC_ID_TYPE_BOTH) {
615 DEBUG(10, ("Could not convert SID %s to gid, "
617 sid_string_dbg(&t->sids[i])));
620 if (!add_gid_to_array_unique(session_info, ids[i].id.gid,
621 &session_info->unix_token->groups,
622 &session_info->unix_token->ngroups)) {
623 return NT_STATUS_NO_MEMORY;
628 * Add the "Unix Group" SID for each gid to catch mapped groups
629 * and their Unix equivalent. This is to solve the backwards
630 * compatibility problem of 'valid users = +ntadmin' where
631 * ntadmin has been paired with "Domain Admins" in the group
632 * mapping table. Otherwise smb.conf would need to be changed
633 * to 'valid user = "Domain Admins"'. --jerry
635 * For consistency we also add the "Unix User" SID,
636 * so that the complete unix token is represented within
640 uid_to_unix_users_sid(session_info->unix_token->uid, &tmp_sid);
642 add_sid_to_array_unique(session_info->security_token, &tmp_sid,
643 &session_info->security_token->sids,
644 &session_info->security_token->num_sids);
646 for ( i=0; i<session_info->unix_token->ngroups; i++ ) {
647 gid_to_unix_groups_sid(session_info->unix_token->groups[i], &tmp_sid);
648 add_sid_to_array_unique(session_info->security_token, &tmp_sid,
649 &session_info->security_token->sids,
650 &session_info->security_token->num_sids);
653 security_token_debug(DBGC_AUTH, 10, session_info->security_token);
654 debug_unix_user_token(DBGC_AUTH, 10,
655 session_info->unix_token->uid,
656 session_info->unix_token->gid,
657 session_info->unix_token->ngroups,
658 session_info->unix_token->groups);
660 status = log_nt_token(session_info->security_token);
661 if (!NT_STATUS_IS_OK(status)) {
665 *session_info_out = session_info;
669 /***************************************************************************
670 Make (and fill) a server_info struct from a 'struct passwd' by conversion
672 ***************************************************************************/
674 NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
679 struct samu *sampass = NULL;
680 char *qualified_name = NULL;
681 TALLOC_CTX *mem_ctx = NULL;
682 struct dom_sid u_sid;
683 enum lsa_SidType type;
684 struct auth_serversupplied_info *result;
687 * The SID returned in server_info->sam_account is based
688 * on our SAM sid even though for a pure UNIX account this should
689 * not be the case as it doesn't really exist in the SAM db.
690 * This causes lookups on "[in]valid users" to fail as they
691 * will lookup this name as a "Unix User" SID to check against
692 * the user token. Fix this by adding the "Unix User"\unix_username
693 * SID to the sid array. The correct fix should probably be
694 * changing the server_info->sam_account user SID to be a
695 * S-1-22 Unix SID, but this might break old configs where
696 * plaintext passwords were used with no SAM backend.
699 mem_ctx = talloc_init("make_server_info_pw_tmp");
701 return NT_STATUS_NO_MEMORY;
704 qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
705 unix_users_domain_name(),
707 if (!qualified_name) {
708 TALLOC_FREE(mem_ctx);
709 return NT_STATUS_NO_MEMORY;
712 if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
715 TALLOC_FREE(mem_ctx);
716 return NT_STATUS_NO_SUCH_USER;
719 TALLOC_FREE(mem_ctx);
721 if (type != SID_NAME_USER) {
722 return NT_STATUS_NO_SUCH_USER;
725 if ( !(sampass = samu_new( NULL )) ) {
726 return NT_STATUS_NO_MEMORY;
729 status = samu_set_unix( sampass, pwd );
730 if (!NT_STATUS_IS_OK(status)) {
734 /* In pathological cases the above call can set the account
735 * name to the DOMAIN\username form. Reset the account name
736 * using unix_username */
737 pdb_set_username(sampass, unix_username, PDB_SET);
739 /* set the user sid to be the calculated u_sid */
740 pdb_set_user_sid(sampass, &u_sid, PDB_SET);
742 result = make_server_info(NULL);
743 if (result == NULL) {
744 TALLOC_FREE(sampass);
745 return NT_STATUS_NO_MEMORY;
748 status = samu_to_SamInfo3(result, sampass, lp_netbios_name(),
749 &result->info3, &result->extra);
750 TALLOC_FREE(sampass);
751 if (!NT_STATUS_IS_OK(status)) {
752 DEBUG(10, ("Failed to convert samu to info3: %s\n",
758 result->unix_name = talloc_strdup(result, unix_username);
760 if (result->unix_name == NULL) {
762 return NT_STATUS_NO_MEMORY;
765 result->utok.uid = pwd->pw_uid;
766 result->utok.gid = pwd->pw_gid;
768 *server_info = result;
773 static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,
774 struct netr_SamInfo3 *info3)
776 const char *guest_account = lp_guestaccount();
777 struct dom_sid domain_sid;
781 pwd = Get_Pwnam_alloc(mem_ctx, guest_account);
783 DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
784 "account [%s]!\n", guest_account));
785 return NT_STATUS_NO_SUCH_USER;
788 /* Set account name */
789 tmp = talloc_strdup(mem_ctx, pwd->pw_name);
791 return NT_STATUS_NO_MEMORY;
793 init_lsa_String(&info3->base.account_name, tmp);
795 /* Set domain name */
796 tmp = talloc_strdup(mem_ctx, get_global_sam_name());
798 return NT_STATUS_NO_MEMORY;
800 init_lsa_StringLarge(&info3->base.logon_domain, tmp);
803 sid_copy(&domain_sid, get_global_sam_sid());
805 info3->base.domain_sid = dom_sid_dup(mem_ctx, &domain_sid);
806 if (info3->base.domain_sid == NULL) {
807 return NT_STATUS_NO_MEMORY;
811 info3->base.rid = DOMAIN_RID_GUEST;
814 info3->base.primary_gid = BUILTIN_RID_GUESTS;
817 info3->base.user_flags = NETLOGON_GUEST;
823 /***************************************************************************
824 Make (and fill) a user_info struct for a guest login.
825 This *must* succeed for smbd to start. If there is no mapping entry for
826 the guest gid, then create one.
828 The resulting structure is a 'session_info' because
829 create_local_token() has already been called on it. This is quite
830 nasty, as the auth subsystem isn't expect this, but the behavior is
832 ***************************************************************************/
834 static NTSTATUS make_new_session_info_guest(struct auth_session_info **session_info, struct auth_serversupplied_info **server_info)
836 static const char zeros[16] = {0};
837 const char *guest_account = lp_guestaccount();
838 const char *domain = lp_netbios_name();
839 struct netr_SamInfo3 info3;
843 tmp_ctx = talloc_stackframe();
844 if (tmp_ctx == NULL) {
845 return NT_STATUS_NO_MEMORY;
850 status = get_guest_info3(tmp_ctx, &info3);
851 if (!NT_STATUS_IS_OK(status)) {
852 DEBUG(0, ("get_guest_info3 failed with %s\n",
857 status = make_server_info_info3(tmp_ctx,
862 if (!NT_STATUS_IS_OK(status)) {
863 DEBUG(0, ("make_server_info_info3 failed with %s\n",
868 (*server_info)->guest = true;
870 /* This should not be done here (we should produce a server
871 * info, and later construct a session info from it), but for
872 * now this does not change the previous behavior */
873 status = create_local_token(tmp_ctx, *server_info, NULL,
874 (*server_info)->info3->base.account_name.string,
876 if (!NT_STATUS_IS_OK(status)) {
877 DEBUG(0, ("create_local_token failed: %s\n",
881 talloc_steal(NULL, *session_info);
882 talloc_steal(NULL, *server_info);
884 /* annoying, but the Guest really does have a session key, and it is
886 (*session_info)->session_key = data_blob(zeros, sizeof(zeros));
888 status = NT_STATUS_OK;
890 TALLOC_FREE(tmp_ctx);
894 /****************************************************************************
895 Fake a auth_session_info just from a username (as a
896 session_info structure, with create_local_token() already called on
898 ****************************************************************************/
900 static NTSTATUS make_session_info_from_pw(TALLOC_CTX *mem_ctx,
903 struct auth_session_info **session_info)
905 struct auth_serversupplied_info *result;
908 status = make_server_info_pw(&result, pwd->pw_name, pwd);
910 if (!NT_STATUS_IS_OK(status)) {
914 result->nss_token = true;
915 result->guest = is_guest;
917 /* Now turn the server_info into a session_info with the full token etc */
918 status = create_local_token(mem_ctx, result, NULL, pwd->pw_name, session_info);
923 /***************************************************************************
924 Make (and fill) a auth_session_info struct for a system user login.
925 This *must* succeed for smbd to start.
926 ***************************************************************************/
928 static NTSTATUS make_new_session_info_system(TALLOC_CTX *mem_ctx,
929 struct auth_session_info **session_info)
934 pwd = getpwuid_alloc(mem_ctx, sec_initial_uid());
936 return NT_STATUS_NO_SUCH_USER;
939 status = make_session_info_from_pw(mem_ctx,
944 if (!NT_STATUS_IS_OK(status)) {
948 (*session_info)->unix_info->system = true;
950 status = add_sid_to_array_unique((*session_info)->security_token->sids,
952 &(*session_info)->security_token->sids,
953 &(*session_info)->security_token->num_sids);
954 if (!NT_STATUS_IS_OK(status)) {
955 TALLOC_FREE((*session_info));
962 /****************************************************************************
963 Fake a auth_session_info just from a username (as a
964 session_info structure, with create_local_token() already called on
966 ****************************************************************************/
968 NTSTATUS make_session_info_from_username(TALLOC_CTX *mem_ctx,
969 const char *username,
971 struct auth_session_info **session_info)
976 pwd = Get_Pwnam_alloc(talloc_tos(), username);
978 return NT_STATUS_NO_SUCH_USER;
981 status = make_session_info_from_pw(mem_ctx, pwd, is_guest, session_info);
983 if (!NT_STATUS_IS_OK(status)) {
992 /* This function MUST only used to create the cached server_info for
995 * This is a lossy conversion. Variables known to be lost so far
998 * - nss_token (not needed because the only read doesn't happen
999 * for the GUEST user, as this routine populates ->security_token
1001 * - extra (not needed because the guest account must have valid RIDs per the output of get_guest_info3())
1003 * - The 'server_info' parameter allows the missing 'info3' to be copied across.
1005 static struct auth_serversupplied_info *copy_session_info_serverinfo_guest(TALLOC_CTX *mem_ctx,
1006 const struct auth_session_info *src,
1007 struct auth_serversupplied_info *server_info)
1009 struct auth_serversupplied_info *dst;
1011 dst = make_server_info(mem_ctx);
1016 /* This element must be provided to convert back to an auth_serversupplied_info */
1017 SMB_ASSERT(src->unix_info);
1020 dst->system = false;
1022 /* This element must be provided to convert back to an
1023 * auth_serversupplied_info. This needs to be from the
1024 * auth_session_info because the group values in particular
1025 * may change during create_local_token() processing */
1026 SMB_ASSERT(src->unix_token);
1027 dst->utok.uid = src->unix_token->uid;
1028 dst->utok.gid = src->unix_token->gid;
1029 dst->utok.ngroups = src->unix_token->ngroups;
1030 if (src->unix_token->ngroups != 0) {
1031 dst->utok.groups = (gid_t *)talloc_memdup(
1032 dst, src->unix_token->groups,
1033 sizeof(gid_t)*dst->utok.ngroups);
1035 dst->utok.groups = NULL;
1038 /* We must have a security_token as otherwise the lossy
1039 * conversion without nss_token would cause create_local_token
1040 * to take the wrong path */
1041 SMB_ASSERT(src->security_token);
1043 dst->security_token = dup_nt_token(dst, src->security_token);
1044 if (!dst->security_token) {
1049 dst->session_key = data_blob_talloc( dst, src->session_key.data,
1050 src->session_key.length);
1052 /* This is OK because this functions is only used for the
1053 * GUEST account, which has all-zero keys for both values */
1054 dst->lm_session_key = data_blob_talloc(dst, src->session_key.data,
1055 src->session_key.length);
1057 dst->info3 = copy_netr_SamInfo3(dst, server_info->info3);
1063 dst->unix_name = talloc_strdup(dst, src->unix_info->unix_name);
1064 if (!dst->unix_name) {
1072 struct auth_session_info *copy_session_info(TALLOC_CTX *mem_ctx,
1073 const struct auth_session_info *src)
1075 struct auth_session_info *dst;
1077 enum ndr_err_code ndr_err;
1079 ndr_err = ndr_push_struct_blob(
1080 &blob, talloc_tos(), src,
1081 (ndr_push_flags_fn_t)ndr_push_auth_session_info);
1082 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1083 DEBUG(0, ("copy_session_info(): ndr_push_auth_session_info failed: "
1084 "%s\n", ndr_errstr(ndr_err)));
1088 dst = talloc(mem_ctx, struct auth_session_info);
1090 DEBUG(0, ("talloc failed\n"));
1091 TALLOC_FREE(blob.data);
1095 ndr_err = ndr_pull_struct_blob(
1097 (ndr_pull_flags_fn_t)ndr_pull_auth_session_info);
1098 TALLOC_FREE(blob.data);
1100 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1101 DEBUG(0, ("copy_session_info(): ndr_pull_auth_session_info failed: "
1102 "%s\n", ndr_errstr(ndr_err)));
1111 * Set a new session key. Used in the rpc server where we have to override the
1112 * SMB level session key with SystemLibraryDTC
1115 bool session_info_set_session_key(struct auth_session_info *info,
1116 DATA_BLOB session_key)
1118 TALLOC_FREE(info->session_key.data);
1120 info->session_key = data_blob_talloc(
1121 info, session_key.data, session_key.length);
1123 return (info->session_key.data != NULL);
1126 static struct auth_session_info *guest_info = NULL;
1128 static struct auth_serversupplied_info *guest_server_info = NULL;
1130 bool init_guest_info(void)
1132 if (guest_info != NULL)
1135 return NT_STATUS_IS_OK(make_new_session_info_guest(&guest_info, &guest_server_info));
1138 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
1139 struct auth_serversupplied_info **server_info)
1141 /* This is trickier than it would appear to need to be because
1142 * we are trying to avoid certain costly operations when the
1143 * structure is converted to a 'auth_session_info' again in
1144 * create_local_token() */
1145 *server_info = copy_session_info_serverinfo_guest(mem_ctx, guest_info, guest_server_info);
1146 return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1149 NTSTATUS make_session_info_guest(TALLOC_CTX *mem_ctx,
1150 struct auth_session_info **session_info)
1152 *session_info = copy_session_info(mem_ctx, guest_info);
1153 return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1156 static struct auth_session_info *system_info = NULL;
1158 NTSTATUS init_system_info(void)
1160 if (system_info != NULL)
1161 return NT_STATUS_OK;
1163 return make_new_session_info_system(NULL, &system_info);
1166 NTSTATUS make_session_info_system(TALLOC_CTX *mem_ctx,
1167 struct auth_session_info **session_info)
1169 if (system_info == NULL) return NT_STATUS_UNSUCCESSFUL;
1170 *session_info = copy_session_info(mem_ctx, system_info);
1171 return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1174 const struct auth_session_info *get_session_info_system(void)
1179 bool copy_current_user(struct current_user *dst, struct current_user *src)
1182 struct security_token *nt_token;
1184 groups = (gid_t *)memdup(src->ut.groups,
1185 sizeof(gid_t) * src->ut.ngroups);
1186 if ((src->ut.ngroups != 0) && (groups == NULL)) {
1190 nt_token = dup_nt_token(NULL, src->nt_user_token);
1191 if (nt_token == NULL) {
1196 dst->conn = src->conn;
1197 dst->vuid = src->vuid;
1198 dst->ut.uid = src->ut.uid;
1199 dst->ut.gid = src->ut.gid;
1200 dst->ut.ngroups = src->ut.ngroups;
1201 dst->ut.groups = groups;
1202 dst->nt_user_token = nt_token;
1206 /***************************************************************************
1207 Purely internal function for make_server_info_info3
1208 ***************************************************************************/
1210 static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
1211 const char *username, char **found_username,
1212 struct passwd **pwd,
1213 bool *username_was_mapped)
1215 char *orig_dom_user = NULL;
1216 char *dom_user = NULL;
1217 char *lower_username = NULL;
1218 char *real_username = NULL;
1219 struct passwd *passwd;
1221 lower_username = talloc_strdup(mem_ctx, username);
1222 if (!lower_username) {
1223 return NT_STATUS_NO_MEMORY;
1225 strlower_m( lower_username );
1227 orig_dom_user = talloc_asprintf(mem_ctx,
1230 *lp_winbind_separator(),
1232 if (!orig_dom_user) {
1233 return NT_STATUS_NO_MEMORY;
1236 /* Get the passwd struct. Try to create the account if necessary. */
1238 *username_was_mapped = map_username(mem_ctx, orig_dom_user, &dom_user);
1240 return NT_STATUS_NO_MEMORY;
1243 passwd = smb_getpwnam(mem_ctx, dom_user, &real_username, true );
1245 DEBUG(3, ("Failed to find authenticated user %s via "
1246 "getpwnam(), denying access.\n", dom_user));
1247 return NT_STATUS_NO_SUCH_USER;
1250 if (!real_username) {
1251 return NT_STATUS_NO_MEMORY;
1256 /* This is pointless -- there is no support for differing
1257 unix and windows names. Make sure to always store the
1258 one we actually looked up and succeeded. Have I mentioned
1259 why I hate the 'winbind use default domain' parameter?
1262 *found_username = talloc_strdup( mem_ctx, real_username );
1264 return NT_STATUS_OK;
1267 /****************************************************************************
1268 Wrapper to allow the getpwnam() call to strip the domain name and
1269 try again in case a local UNIX user is already there. Also run through
1270 the username if we fallback to the username only.
1271 ****************************************************************************/
1273 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, const char *domuser,
1274 char **p_save_username, bool create )
1276 struct passwd *pw = NULL;
1278 char *username = NULL;
1280 /* we only save a copy of the username it has been mangled
1281 by winbindd use default domain */
1282 *p_save_username = NULL;
1284 /* don't call map_username() here since it has to be done higher
1285 up the stack so we don't call it multiple times */
1287 username = talloc_strdup(mem_ctx, domuser);
1292 p = strchr_m( username, *lp_winbind_separator() );
1294 /* code for a DOMAIN\user string */
1297 pw = Get_Pwnam_alloc( mem_ctx, domuser );
1299 /* make sure we get the case of the username correct */
1300 /* work around 'winbind use default domain = yes' */
1302 if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
1305 /* split the domain and username into 2 strings */
1309 *p_save_username = talloc_asprintf(mem_ctx,
1312 *lp_winbind_separator(),
1314 if (!*p_save_username) {
1319 *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
1326 /* setup for lookup of just the username */
1327 /* remember that p and username are overlapping memory */
1330 username = talloc_strdup(mem_ctx, p);
1336 /* just lookup a plain username */
1338 pw = Get_Pwnam_alloc(mem_ctx, username);
1340 /* Create local user if requested but only if winbindd
1341 is not running. We need to protect against cases
1342 where winbindd is failing and then prematurely
1343 creating users in /etc/passwd */
1345 if ( !pw && create && !winbind_ping() ) {
1346 /* Don't add a machine account. */
1347 if (username[strlen(username)-1] == '$')
1350 _smb_create_user(NULL, username, NULL);
1351 pw = Get_Pwnam_alloc(mem_ctx, username);
1354 /* one last check for a valid passwd struct */
1357 *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
1362 /***************************************************************************
1363 Make a server_info struct from the info3 returned by a domain logon
1364 ***************************************************************************/
1366 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
1367 const char *sent_nt_username,
1369 struct auth_serversupplied_info **server_info,
1370 struct netr_SamInfo3 *info3)
1372 static const char zeros[16] = {0, };
1374 NTSTATUS nt_status = NT_STATUS_OK;
1375 char *found_username = NULL;
1376 const char *nt_domain;
1377 const char *nt_username;
1378 bool username_was_mapped;
1380 struct auth_serversupplied_info *result;
1381 struct dom_sid *group_sid;
1382 struct netr_SamInfo3 *i3;
1385 Here is where we should check the list of
1386 trusted domains, and verify that the SID
1390 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
1392 /* If the server didn't give us one, just use the one we sent
1394 nt_username = sent_nt_username;
1397 nt_domain = talloc_strdup(mem_ctx, info3->base.logon_domain.string);
1399 /* If the server didn't give us one, just use the one we sent
1404 /* If getpwnam() fails try the add user script (2.2.x behavior).
1406 We use the _unmapped_ username here in an attempt to provide
1407 consistent username mapping behavior between kerberos and NTLM[SSP]
1408 authentication in domain mode security. I.E. Username mapping
1409 should be applied to the fully qualified username
1410 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1411 called map_username() unnecessarily in make_user_info_map() but
1412 that is how the current code is designed. Making the change here
1413 is the least disruptive place. -- jerry */
1415 /* this call will try to create the user if necessary */
1417 nt_status = check_account(mem_ctx, nt_domain, sent_nt_username,
1418 &found_username, &pwd,
1419 &username_was_mapped);
1421 if (!NT_STATUS_IS_OK(nt_status)) {
1425 result = make_server_info(NULL);
1426 if (result == NULL) {
1427 DEBUG(4, ("make_server_info failed!\n"));
1428 return NT_STATUS_NO_MEMORY;
1431 result->unix_name = talloc_strdup(result, found_username);
1433 /* copy in the info3 */
1434 result->info3 = i3 = copy_netr_SamInfo3(result, info3);
1435 if (result->info3 == NULL) {
1436 TALLOC_FREE(result);
1437 return NT_STATUS_NO_MEMORY;
1440 /* Fill in the unix info we found on the way */
1441 result->utok.uid = pwd->pw_uid;
1442 result->utok.gid = pwd->pw_gid;
1444 /* We can't just trust that the primary group sid sent us is something
1445 * we can really use. Obtain the usable sid, and store the original
1446 * one as an additional group if it had to be replaced */
1447 nt_status = get_primary_group_sid(mem_ctx, found_username,
1449 if (!NT_STATUS_IS_OK(nt_status)) {
1450 TALLOC_FREE(result);
1454 /* store and check if it is the same we got originally */
1455 sid_peek_rid(group_sid, &i3->base.primary_gid);
1456 if (i3->base.primary_gid != info3->base.primary_gid) {
1457 uint32_t n = i3->base.groups.count;
1458 /* not the same, store the original as an additional group */
1459 i3->base.groups.rids =
1460 talloc_realloc(i3, i3->base.groups.rids,
1461 struct samr_RidWithAttribute, n + 1);
1462 if (i3->base.groups.rids == NULL) {
1463 TALLOC_FREE(result);
1464 return NT_STATUS_NO_MEMORY;
1466 i3->base.groups.rids[n].rid = info3->base.primary_gid;
1467 i3->base.groups.rids[n].attributes = SE_GROUP_ENABLED;
1468 i3->base.groups.count = n + 1;
1471 /* ensure we are never given NULL session keys */
1473 if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
1474 result->session_key = data_blob_null;
1476 result->session_key = data_blob_talloc(
1477 result, info3->base.key.key,
1478 sizeof(info3->base.key.key));
1481 if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
1482 result->lm_session_key = data_blob_null;
1484 result->lm_session_key = data_blob_talloc(
1485 result, info3->base.LMSessKey.key,
1486 sizeof(info3->base.LMSessKey.key));
1489 result->nss_token |= username_was_mapped;
1491 result->guest = (info3->base.user_flags & NETLOGON_GUEST);
1493 *server_info = result;
1495 return NT_STATUS_OK;
1498 /*****************************************************************************
1499 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1500 ******************************************************************************/
1502 NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
1503 const char *sent_nt_username,
1505 const struct wbcAuthUserInfo *info,
1506 struct auth_serversupplied_info **server_info)
1508 struct netr_SamInfo3 *info3;
1510 info3 = wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx, info);
1512 return NT_STATUS_NO_MEMORY;
1515 return make_server_info_info3(mem_ctx,
1516 sent_nt_username, domain,
1517 server_info, info3);
1521 * Verify whether or not given domain is trusted.
1523 * @param domain_name name of the domain to be verified
1524 * @return true if domain is one of the trusted ones or
1525 * false if otherwise
1528 bool is_trusted_domain(const char* dom_name)
1530 struct dom_sid trustdom_sid;
1533 /* no trusted domains for a standalone server */
1535 if ( lp_server_role() == ROLE_STANDALONE )
1538 if (dom_name == NULL || dom_name[0] == '\0') {
1542 if (strequal(dom_name, get_global_sam_name())) {
1546 /* if we are a DC, then check for a direct trust relationships */
1550 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1551 "[%s]\n", dom_name ));
1552 ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
1560 /* If winbind is around, ask it */
1562 result = wb_is_trusted_domain(dom_name);
1564 if (result == WBC_ERR_SUCCESS) {
1568 if (result == WBC_ERR_DOMAIN_NOT_FOUND) {
1569 /* winbind could not find the domain */
1573 /* The only other possible result is that winbind is not up
1574 and running. We need to update the trustdom_cache
1577 update_trustdom_cache();
1580 /* now the trustdom cache should be available a DC could still
1581 * have a transitive trust so fall back to the cache of trusted
1582 * domains (like a domain member would use */
1584 if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) {
1594 on a logon error possibly map the error to success if "map to guest"
1597 NTSTATUS do_map_to_guest_server_info(NTSTATUS status,
1598 struct auth_serversupplied_info **server_info,
1599 const char *user, const char *domain)
1601 user = user ? user : "";
1602 domain = domain ? domain : "";
1604 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1605 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) ||
1606 (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD)) {
1607 DEBUG(3,("No such user %s [%s] - using guest account\n",
1609 return make_server_info_guest(NULL, server_info);
1611 } else if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1612 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD) {
1613 DEBUG(3,("Registered username %s for guest access\n",
1615 return make_server_info_guest(NULL, server_info);