2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2011
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006-2008
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
28 #include "rpc_client/init_lsa.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/util_pw.h"
31 #include "lib/winbind_util.h"
33 #include "../librpc/gen_ndr/ndr_auth.h"
34 #include "../auth/auth_sam_reply.h"
37 #define DBGC_CLASS DBGC_AUTH
39 /****************************************************************************
40 Create a UNIX user on demand.
41 ****************************************************************************/
43 static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
45 TALLOC_CTX *ctx = talloc_tos();
49 add_script = talloc_strdup(ctx, lp_adduser_script());
50 if (!add_script || !*add_script) {
53 add_script = talloc_all_string_sub(ctx,
61 add_script = talloc_all_string_sub(ctx,
70 add_script = talloc_all_string_sub(ctx,
78 ret = smbrun(add_script,NULL);
81 ("smb_create_user: Running the command `%s' gave %d\n",
86 /****************************************************************************
87 Create an auth_usersupplied_data structure after appropriate mapping.
88 ****************************************************************************/
90 NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info,
92 const char *client_domain,
93 const char *workstation_name,
94 const struct tsocket_address *remote_address,
97 const struct samr_Password *lm_interactive_pwd,
98 const struct samr_Password *nt_interactive_pwd,
99 const char *plaintext,
100 enum auth_password_state password_state)
105 char *internal_username = NULL;
107 was_mapped = map_username(talloc_tos(), smb_name, &internal_username);
108 if (!internal_username) {
109 return NT_STATUS_NO_MEMORY;
112 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
113 client_domain, smb_name, workstation_name));
115 domain = client_domain;
117 /* If you connect to a Windows domain member using a bogus domain name,
118 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
119 * the Windows box is a DC the name will become DOMAIN\user and be
120 * authenticated against AD, if the Windows box is a member server but
121 * not a DC the name will become WORKSTATION\user. A standalone
122 * non-domain member box will also map to WORKSTATION\user.
123 * This also deals with the client passing in a "" domain */
125 if (!is_trusted_domain(domain) &&
126 !strequal(domain, my_sam_name()))
128 if (lp_map_untrusted_to_domain())
129 domain = my_sam_name();
131 domain = get_global_sam_name();
132 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
133 "workstation [%s]\n",
134 client_domain, domain, smb_name, workstation_name));
137 /* We know that the given domain is trusted (and we are allowing them),
138 * it is our global SAM name, or for legacy behavior it is our
139 * primary domain name */
141 result = make_user_info(user_info, smb_name, internal_username,
142 client_domain, domain, workstation_name,
143 remote_address, lm_pwd, nt_pwd,
144 lm_interactive_pwd, nt_interactive_pwd,
145 plaintext, password_state);
146 if (NT_STATUS_IS_OK(result)) {
147 /* We have tried mapping */
148 (*user_info)->mapped_state = true;
149 /* did we actually map the user to a different name? */
150 (*user_info)->was_mapped = was_mapped;
155 /****************************************************************************
156 Create an auth_usersupplied_data, making the DATA_BLOBs here.
157 Decrypt and encrypt the passwords.
158 ****************************************************************************/
160 bool make_user_info_netlogon_network(struct auth_usersupplied_info **user_info,
161 const char *smb_name,
162 const char *client_domain,
163 const char *workstation_name,
164 const struct tsocket_address *remote_address,
165 uint32 logon_parameters,
166 const uchar *lm_network_pwd,
168 const uchar *nt_network_pwd,
173 DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
174 DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
176 status = make_user_info_map(user_info,
177 smb_name, client_domain,
180 lm_pwd_len ? &lm_blob : NULL,
181 nt_pwd_len ? &nt_blob : NULL,
183 AUTH_PASSWORD_RESPONSE);
185 if (NT_STATUS_IS_OK(status)) {
186 (*user_info)->logon_parameters = logon_parameters;
188 ret = NT_STATUS_IS_OK(status) ? true : false;
190 data_blob_free(&lm_blob);
191 data_blob_free(&nt_blob);
195 /****************************************************************************
196 Create an auth_usersupplied_data, making the DATA_BLOBs here.
197 Decrypt and encrypt the passwords.
198 ****************************************************************************/
200 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info,
201 const char *smb_name,
202 const char *client_domain,
203 const char *workstation_name,
204 const struct tsocket_address *remote_address,
205 uint32 logon_parameters,
207 const uchar lm_interactive_pwd[16],
208 const uchar nt_interactive_pwd[16],
209 const uchar *dc_sess_key)
211 struct samr_Password lm_pwd;
212 struct samr_Password nt_pwd;
213 unsigned char local_lm_response[24];
214 unsigned char local_nt_response[24];
215 unsigned char key[16];
217 memcpy(key, dc_sess_key, 16);
219 if (lm_interactive_pwd)
220 memcpy(lm_pwd.hash, lm_interactive_pwd, sizeof(lm_pwd.hash));
222 if (nt_interactive_pwd)
223 memcpy(nt_pwd.hash, nt_interactive_pwd, sizeof(nt_pwd.hash));
225 #ifdef DEBUG_PASSWORD
227 dump_data(100, key, sizeof(key));
229 DEBUG(100,("lm owf password:"));
230 dump_data(100, lm_pwd.hash, sizeof(lm_pwd.hash));
232 DEBUG(100,("nt owf password:"));
233 dump_data(100, nt_pwd.hash, sizeof(nt_pwd.hash));
236 if (lm_interactive_pwd)
237 arcfour_crypt(lm_pwd.hash, key, sizeof(lm_pwd.hash));
239 if (nt_interactive_pwd)
240 arcfour_crypt(nt_pwd.hash, key, sizeof(nt_pwd.hash));
242 #ifdef DEBUG_PASSWORD
243 DEBUG(100,("decrypt of lm owf password:"));
244 dump_data(100, lm_pwd.hash, sizeof(lm_pwd));
246 DEBUG(100,("decrypt of nt owf password:"));
247 dump_data(100, nt_pwd.hash, sizeof(nt_pwd));
250 if (lm_interactive_pwd)
251 SMBOWFencrypt(lm_pwd.hash, chal,
254 if (nt_interactive_pwd)
255 SMBOWFencrypt(nt_pwd.hash, chal,
258 /* Password info paranoia */
264 DATA_BLOB local_lm_blob;
265 DATA_BLOB local_nt_blob;
267 if (lm_interactive_pwd) {
268 local_lm_blob = data_blob(local_lm_response,
269 sizeof(local_lm_response));
272 if (nt_interactive_pwd) {
273 local_nt_blob = data_blob(local_nt_response,
274 sizeof(local_nt_response));
277 nt_status = make_user_info_map(
279 smb_name, client_domain, workstation_name,
281 lm_interactive_pwd ? &local_lm_blob : NULL,
282 nt_interactive_pwd ? &local_nt_blob : NULL,
283 lm_interactive_pwd ? &lm_pwd : NULL,
284 nt_interactive_pwd ? &nt_pwd : NULL,
285 NULL, AUTH_PASSWORD_HASH);
287 if (NT_STATUS_IS_OK(nt_status)) {
288 (*user_info)->logon_parameters = logon_parameters;
291 ret = NT_STATUS_IS_OK(nt_status) ? true : false;
292 data_blob_free(&local_lm_blob);
293 data_blob_free(&local_nt_blob);
299 /****************************************************************************
300 Create an auth_usersupplied_data structure
301 ****************************************************************************/
303 bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
304 const char *smb_name,
305 const char *client_domain,
306 const struct tsocket_address *remote_address,
308 DATA_BLOB plaintext_password)
311 DATA_BLOB local_lm_blob;
312 DATA_BLOB local_nt_blob;
313 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
314 char *plaintext_password_string;
316 * Not encrypted - do so.
319 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
321 if (plaintext_password.data && plaintext_password.length) {
322 unsigned char local_lm_response[24];
324 #ifdef DEBUG_PASSWORD
325 DEBUG(10,("Unencrypted password (len %d):\n",
326 (int)plaintext_password.length));
327 dump_data(100, plaintext_password.data,
328 plaintext_password.length);
331 SMBencrypt( (const char *)plaintext_password.data,
332 (const uchar*)chal, local_lm_response);
333 local_lm_blob = data_blob(local_lm_response, 24);
335 /* We can't do an NT hash here, as the password needs to be
337 local_nt_blob = data_blob_null;
339 local_lm_blob = data_blob_null;
340 local_nt_blob = data_blob_null;
343 plaintext_password_string = talloc_strndup(talloc_tos(),
344 (const char *)plaintext_password.data,
345 plaintext_password.length);
346 if (!plaintext_password_string) {
350 ret = make_user_info_map(
351 user_info, smb_name, client_domain,
352 get_remote_machine_name(),
354 local_lm_blob.data ? &local_lm_blob : NULL,
355 local_nt_blob.data ? &local_nt_blob : NULL,
357 plaintext_password_string,
358 AUTH_PASSWORD_PLAIN);
360 if (plaintext_password_string) {
361 memset(plaintext_password_string, '\0', strlen(plaintext_password_string));
362 talloc_free(plaintext_password_string);
365 data_blob_free(&local_lm_blob);
366 return NT_STATUS_IS_OK(ret) ? true : false;
369 /****************************************************************************
370 Create an auth_usersupplied_data structure
371 ****************************************************************************/
373 NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info,
374 const char *smb_name,
375 const char *client_domain,
376 const struct tsocket_address *remote_address,
377 DATA_BLOB lm_resp, DATA_BLOB nt_resp)
379 return make_user_info_map(user_info, smb_name,
381 get_remote_machine_name(),
383 lm_resp.data && (lm_resp.length > 0) ? &lm_resp : NULL,
384 nt_resp.data && (nt_resp.length > 0) ? &nt_resp : NULL,
386 AUTH_PASSWORD_RESPONSE);
389 /****************************************************************************
390 Create a guest user_info blob, for anonymous authentication.
391 ****************************************************************************/
393 bool make_user_info_guest(const struct tsocket_address *remote_address,
394 struct auth_usersupplied_info **user_info)
398 nt_status = make_user_info(user_info,
406 AUTH_PASSWORD_RESPONSE);
408 return NT_STATUS_IS_OK(nt_status) ? true : false;
411 static NTSTATUS log_nt_token(struct security_token *token)
413 TALLOC_CTX *frame = talloc_stackframe();
418 if ((lp_log_nt_token_command() == NULL) ||
419 (strlen(lp_log_nt_token_command()) == 0)) {
424 group_sidstr = talloc_strdup(frame, "");
425 for (i=1; i<token->num_sids; i++) {
426 group_sidstr = talloc_asprintf(
427 frame, "%s %s", group_sidstr,
428 sid_string_talloc(frame, &token->sids[i]));
431 command = talloc_string_sub(
432 frame, lp_log_nt_token_command(),
433 "%s", sid_string_talloc(frame, &token->sids[0]));
434 command = talloc_string_sub(frame, command, "%t", group_sidstr);
436 if (command == NULL) {
438 return NT_STATUS_NO_MEMORY;
441 DEBUG(8, ("running command: [%s]\n", command));
442 if (smbrun(command, NULL) != 0) {
443 DEBUG(0, ("Could not log NT token\n"));
445 return NT_STATUS_ACCESS_DENIED;
453 * Create the token to use from server_info->info3 and
454 * server_info->sids (the info3/sam groups). Find the unix gids.
457 NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
458 const struct auth_serversupplied_info *server_info,
459 DATA_BLOB *session_key,
460 struct auth_session_info **session_info_out)
462 struct security_token *t;
465 struct dom_sid tmp_sid;
466 struct auth_session_info *session_info;
467 struct wbcUnixId *ids;
469 /* Ensure we can't possible take a code path leading to a
472 return NT_STATUS_LOGON_FAILURE;
475 session_info = talloc_zero(mem_ctx, struct auth_session_info);
477 return NT_STATUS_NO_MEMORY;
480 session_info->unix_token = talloc_zero(session_info, struct security_unix_token);
481 if (!session_info->unix_token) {
482 TALLOC_FREE(session_info);
483 return NT_STATUS_NO_MEMORY;
486 session_info->unix_token->uid = server_info->utok.uid;
487 session_info->unix_token->gid = server_info->utok.gid;
489 session_info->unix_info = talloc_zero(session_info, struct auth_user_info_unix);
490 if (!session_info->unix_info) {
491 TALLOC_FREE(session_info);
492 return NT_STATUS_NO_MEMORY;
495 session_info->unix_info->unix_name = talloc_strdup(session_info, server_info->unix_name);
496 if (!session_info->unix_info->unix_name) {
497 TALLOC_FREE(session_info);
498 return NT_STATUS_NO_MEMORY;
501 session_info->unix_info->sanitized_username = talloc_strdup(session_info, server_info->sanitized_username);
502 if (!session_info->unix_info->sanitized_username) {
503 TALLOC_FREE(session_info);
504 return NT_STATUS_NO_MEMORY;
507 session_info->unix_info->system = server_info->system;
510 data_blob_free(&session_info->session_key);
511 session_info->session_key = data_blob_talloc(session_info,
513 session_key->length);
514 if (!session_info->session_key.data && session_key->length) {
515 return NT_STATUS_NO_MEMORY;
518 session_info->session_key = data_blob_talloc( session_info, server_info->session_key.data,
519 server_info->session_key.length);
522 if (session_info->security_token) {
523 /* Just copy the token, it has already been finalised
524 * (nasty hack to support a cached guest session_info,
525 * and a possible strategy for auth_samba4 to pass in
526 * a finalised session) */
528 session_info->security_token = dup_nt_token(session_info, server_info->security_token);
529 if (!session_info->security_token) {
530 TALLOC_FREE(session_info);
531 return NT_STATUS_NO_MEMORY;
534 session_info->unix_token->ngroups = server_info->utok.ngroups;
535 if (server_info->utok.ngroups != 0) {
536 session_info->unix_token->groups = (gid_t *)talloc_memdup(
537 session_info->unix_token, server_info->utok.groups,
538 sizeof(gid_t)*session_info->unix_token->ngroups);
540 session_info->unix_token->groups = NULL;
543 *session_info_out = session_info;
547 /* We need to populate session_info->info with the information found in server_info->info3 */
548 status = make_user_info_SamBaseInfo(session_info, "", &server_info->info3->base,
549 server_info->guest == false,
550 &session_info->info);
551 if (!NT_STATUS_IS_OK(status)) {
552 DEBUG(0, ("conversion of info3 into auth_user_info failed!\n"));
553 TALLOC_FREE(session_info);
558 * If winbind is not around, we can not make much use of the SIDs the
559 * domain controller provided us with. Likewise if the user name was
560 * mapped to some local unix user.
563 if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
564 (server_info->nss_token)) {
565 char *found_username = NULL;
566 status = create_token_from_username(session_info,
567 server_info->unix_name,
569 &session_info->unix_token->uid,
570 &session_info->unix_token->gid,
572 &session_info->security_token);
573 if (NT_STATUS_IS_OK(status)) {
574 session_info->unix_info->unix_name = found_username;
577 status = create_local_nt_token_from_info3(session_info,
581 &session_info->security_token);
584 if (!NT_STATUS_IS_OK(status)) {
588 /* Convert the SIDs to gids. */
590 session_info->unix_token->ngroups = 0;
591 session_info->unix_token->groups = NULL;
593 t = session_info->security_token;
595 ids = talloc_array(talloc_tos(), struct wbcUnixId,
598 return NT_STATUS_NO_MEMORY;
601 if (!sids_to_unix_ids(t->sids, t->num_sids, ids)) {
603 return NT_STATUS_NO_MEMORY;
606 /* Start at index 1, where the groups start. */
608 for (i=1; i<t->num_sids; i++) {
610 if (ids[i].type != WBC_ID_TYPE_GID) {
611 DEBUG(10, ("Could not convert SID %s to gid, "
613 sid_string_dbg(&t->sids[i])));
616 if (!add_gid_to_array_unique(session_info, ids[i].id.gid,
617 &session_info->unix_token->groups,
618 &session_info->unix_token->ngroups)) {
619 return NT_STATUS_NO_MEMORY;
624 * Add the "Unix Group" SID for each gid to catch mapped groups
625 * and their Unix equivalent. This is to solve the backwards
626 * compatibility problem of 'valid users = +ntadmin' where
627 * ntadmin has been paired with "Domain Admins" in the group
628 * mapping table. Otherwise smb.conf would need to be changed
629 * to 'valid user = "Domain Admins"'. --jerry
631 * For consistency we also add the "Unix User" SID,
632 * so that the complete unix token is represented within
636 uid_to_unix_users_sid(session_info->unix_token->uid, &tmp_sid);
638 add_sid_to_array_unique(session_info->security_token, &tmp_sid,
639 &session_info->security_token->sids,
640 &session_info->security_token->num_sids);
642 for ( i=0; i<session_info->unix_token->ngroups; i++ ) {
643 gid_to_unix_groups_sid(session_info->unix_token->groups[i], &tmp_sid);
644 add_sid_to_array_unique(session_info->security_token, &tmp_sid,
645 &session_info->security_token->sids,
646 &session_info->security_token->num_sids);
649 security_token_debug(DBGC_AUTH, 10, session_info->security_token);
650 debug_unix_user_token(DBGC_AUTH, 10,
651 session_info->unix_token->uid,
652 session_info->unix_token->gid,
653 session_info->unix_token->ngroups,
654 session_info->unix_token->groups);
656 status = log_nt_token(session_info->security_token);
657 if (!NT_STATUS_IS_OK(status)) {
661 *session_info_out = session_info;
665 /***************************************************************************
666 Make (and fill) a server_info struct from a 'struct passwd' by conversion
668 ***************************************************************************/
670 NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
675 struct samu *sampass = NULL;
676 char *qualified_name = NULL;
677 TALLOC_CTX *mem_ctx = NULL;
678 struct dom_sid u_sid;
679 enum lsa_SidType type;
680 struct auth_serversupplied_info *result;
683 * The SID returned in server_info->sam_account is based
684 * on our SAM sid even though for a pure UNIX account this should
685 * not be the case as it doesn't really exist in the SAM db.
686 * This causes lookups on "[in]valid users" to fail as they
687 * will lookup this name as a "Unix User" SID to check against
688 * the user token. Fix this by adding the "Unix User"\unix_username
689 * SID to the sid array. The correct fix should probably be
690 * changing the server_info->sam_account user SID to be a
691 * S-1-22 Unix SID, but this might break old configs where
692 * plaintext passwords were used with no SAM backend.
695 mem_ctx = talloc_init("make_server_info_pw_tmp");
697 return NT_STATUS_NO_MEMORY;
700 qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
701 unix_users_domain_name(),
703 if (!qualified_name) {
704 TALLOC_FREE(mem_ctx);
705 return NT_STATUS_NO_MEMORY;
708 if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
711 TALLOC_FREE(mem_ctx);
712 return NT_STATUS_NO_SUCH_USER;
715 TALLOC_FREE(mem_ctx);
717 if (type != SID_NAME_USER) {
718 return NT_STATUS_NO_SUCH_USER;
721 if ( !(sampass = samu_new( NULL )) ) {
722 return NT_STATUS_NO_MEMORY;
725 status = samu_set_unix( sampass, pwd );
726 if (!NT_STATUS_IS_OK(status)) {
730 /* In pathological cases the above call can set the account
731 * name to the DOMAIN\username form. Reset the account name
732 * using unix_username */
733 pdb_set_username(sampass, unix_username, PDB_SET);
735 /* set the user sid to be the calculated u_sid */
736 pdb_set_user_sid(sampass, &u_sid, PDB_SET);
738 result = make_server_info(NULL);
739 if (result == NULL) {
740 TALLOC_FREE(sampass);
741 return NT_STATUS_NO_MEMORY;
744 status = samu_to_SamInfo3(result, sampass, lp_netbios_name(),
745 &result->info3, &result->extra);
746 TALLOC_FREE(sampass);
747 if (!NT_STATUS_IS_OK(status)) {
748 DEBUG(10, ("Failed to convert samu to info3: %s\n",
754 result->unix_name = talloc_strdup(result, unix_username);
755 result->sanitized_username = sanitize_username(result, unix_username);
757 if ((result->unix_name == NULL)
758 || (result->sanitized_username == NULL)) {
760 return NT_STATUS_NO_MEMORY;
763 result->utok.uid = pwd->pw_uid;
764 result->utok.gid = pwd->pw_gid;
766 *server_info = result;
771 static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,
772 struct netr_SamInfo3 *info3)
774 const char *guest_account = lp_guestaccount();
775 struct dom_sid domain_sid;
779 pwd = Get_Pwnam_alloc(mem_ctx, guest_account);
781 DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
782 "account [%s]!\n", guest_account));
783 return NT_STATUS_NO_SUCH_USER;
786 /* Set account name */
787 tmp = talloc_strdup(mem_ctx, pwd->pw_name);
789 return NT_STATUS_NO_MEMORY;
791 init_lsa_String(&info3->base.account_name, tmp);
793 /* Set domain name */
794 tmp = talloc_strdup(mem_ctx, get_global_sam_name());
796 return NT_STATUS_NO_MEMORY;
798 init_lsa_StringLarge(&info3->base.domain, tmp);
801 sid_copy(&domain_sid, get_global_sam_sid());
803 info3->base.domain_sid = dom_sid_dup(mem_ctx, &domain_sid);
804 if (info3->base.domain_sid == NULL) {
805 return NT_STATUS_NO_MEMORY;
809 info3->base.rid = DOMAIN_RID_GUEST;
812 info3->base.primary_gid = BUILTIN_RID_GUESTS;
815 info3->base.user_flags = NETLOGON_GUEST;
821 /***************************************************************************
822 Make (and fill) a user_info struct for a guest login.
823 This *must* succeed for smbd to start. If there is no mapping entry for
824 the guest gid, then create one.
826 The resulting structure is a 'session_info' because
827 create_local_token() has already been called on it. This is quite
828 nasty, as the auth subsystem isn't expect this, but the behavior is
830 ***************************************************************************/
832 static NTSTATUS make_new_session_info_guest(struct auth_session_info **session_info, struct auth_serversupplied_info **server_info)
834 static const char zeros[16] = {0};
835 const char *guest_account = lp_guestaccount();
836 const char *domain = lp_netbios_name();
837 struct netr_SamInfo3 info3;
842 tmp_ctx = talloc_stackframe();
843 if (tmp_ctx == NULL) {
844 return NT_STATUS_NO_MEMORY;
849 status = get_guest_info3(tmp_ctx, &info3);
850 if (!NT_STATUS_IS_OK(status)) {
851 DEBUG(0, ("get_guest_info3 failed with %s\n",
856 status = make_server_info_info3(tmp_ctx,
861 if (!NT_STATUS_IS_OK(status)) {
862 DEBUG(0, ("make_server_info_info3 failed with %s\n",
867 (*server_info)->guest = true;
869 /* This should not be done here (we should produce a server
870 * info, and later construct a session info from it), but for
871 * now this does not change the previous behavior */
872 status = create_local_token(tmp_ctx, *server_info, NULL, session_info);
873 if (!NT_STATUS_IS_OK(status)) {
874 DEBUG(0, ("create_local_token failed: %s\n",
878 talloc_steal(NULL, *session_info);
879 talloc_steal(NULL, *server_info);
881 /* annoying, but the Guest really does have a session key, and it is
883 (*session_info)->session_key = data_blob(zeros, sizeof(zeros));
885 alpha_strcpy(tmp, (*server_info)->info3->base.account_name.string,
886 ". _-$", sizeof(tmp));
887 (*session_info)->unix_info->sanitized_username = talloc_strdup(*session_info, tmp);
889 status = NT_STATUS_OK;
891 TALLOC_FREE(tmp_ctx);
895 /***************************************************************************
896 Make (and fill) a auth_session_info struct for a system user login.
897 This *must* succeed for smbd to start.
898 ***************************************************************************/
900 static NTSTATUS make_new_session_info_system(TALLOC_CTX *mem_ctx,
901 struct auth_session_info **session_info)
906 pwd = getpwuid_alloc(mem_ctx, sec_initial_uid());
908 return NT_STATUS_NO_SUCH_USER;
911 status = make_session_info_from_username(mem_ctx,
916 if (!NT_STATUS_IS_OK(status)) {
920 (*session_info)->unix_info->system = true;
922 status = add_sid_to_array_unique((*session_info)->security_token->sids,
924 &(*session_info)->security_token->sids,
925 &(*session_info)->security_token->num_sids);
926 if (!NT_STATUS_IS_OK(status)) {
927 TALLOC_FREE((*session_info));
934 /****************************************************************************
935 Fake a auth_session_info just from a username (as a
936 session_info structure, with create_local_token() already called on
938 ****************************************************************************/
940 NTSTATUS make_session_info_from_username(TALLOC_CTX *mem_ctx,
941 const char *username,
943 struct auth_session_info **session_info)
945 struct auth_serversupplied_info *result;
949 pwd = Get_Pwnam_alloc(talloc_tos(), username);
951 return NT_STATUS_NO_SUCH_USER;
954 status = make_server_info_pw(&result, pwd->pw_name, pwd);
958 if (!NT_STATUS_IS_OK(status)) {
962 result->nss_token = true;
963 result->guest = is_guest;
965 /* Now turn the server_info into a session_info with the full token etc */
966 status = create_local_token(mem_ctx, result, NULL, session_info);
971 /* This function MUST only used to create the cached server_info for
974 * This is a lossy conversion. Variables known to be lost so far
977 * - nss_token (not needed because the only read doesn't happen
978 * for the GUEST user, as this routine populates ->security_token
980 * - extra (not needed because the guest account must have valid RIDs per the output of get_guest_info3())
982 * - The 'server_info' parameter allows the missing 'info3' to be copied across.
984 static struct auth_serversupplied_info *copy_session_info_serverinfo_guest(TALLOC_CTX *mem_ctx,
985 const struct auth_session_info *src,
986 struct auth_serversupplied_info *server_info)
988 struct auth_serversupplied_info *dst;
990 dst = make_server_info(mem_ctx);
995 /* This element must be provided to convert back to an auth_serversupplied_info */
996 SMB_ASSERT(src->unix_info);
1001 /* This element must be provided to convert back to an
1002 * auth_serversupplied_info. This needs to be from the
1003 * auth_session_info because the group values in particular
1004 * may change during create_local_token() processing */
1005 SMB_ASSERT(src->unix_token);
1006 dst->utok.uid = src->unix_token->uid;
1007 dst->utok.gid = src->unix_token->gid;
1008 dst->utok.ngroups = src->unix_token->ngroups;
1009 if (src->unix_token->ngroups != 0) {
1010 dst->utok.groups = (gid_t *)talloc_memdup(
1011 dst, src->unix_token->groups,
1012 sizeof(gid_t)*dst->utok.ngroups);
1014 dst->utok.groups = NULL;
1017 /* We must have a security_token as otherwise the lossy
1018 * conversion without nss_token would cause create_local_token
1019 * to take the wrong path */
1020 SMB_ASSERT(src->security_token);
1022 dst->security_token = dup_nt_token(dst, src->security_token);
1023 if (!dst->security_token) {
1028 dst->session_key = data_blob_talloc( dst, src->session_key.data,
1029 src->session_key.length);
1031 /* This is OK because this functions is only used for the
1032 * GUEST account, which has all-zero keys for both values */
1033 dst->lm_session_key = data_blob_talloc(dst, src->session_key.data,
1034 src->session_key.length);
1036 dst->info3 = copy_netr_SamInfo3(dst, server_info->info3);
1042 dst->unix_name = talloc_strdup(dst, src->unix_info->unix_name);
1043 if (!dst->unix_name) {
1048 dst->sanitized_username = talloc_strdup(dst, src->unix_info->sanitized_username);
1049 if (!dst->sanitized_username) {
1057 struct auth_session_info *copy_session_info(TALLOC_CTX *mem_ctx,
1058 const struct auth_session_info *src)
1060 struct auth_session_info *dst;
1062 enum ndr_err_code ndr_err;
1064 ndr_err = ndr_push_struct_blob(
1065 &blob, talloc_tos(), src,
1066 (ndr_push_flags_fn_t)ndr_push_auth_session_info);
1067 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1068 DEBUG(0, ("copy_session_info(): ndr_push_auth_session_info failed: "
1069 "%s\n", ndr_errstr(ndr_err)));
1073 dst = talloc(mem_ctx, struct auth_session_info);
1075 DEBUG(0, ("talloc failed\n"));
1076 TALLOC_FREE(blob.data);
1080 ndr_err = ndr_pull_struct_blob(
1082 (ndr_pull_flags_fn_t)ndr_pull_auth_session_info);
1083 TALLOC_FREE(blob.data);
1085 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1086 DEBUG(0, ("copy_session_info(): ndr_pull_auth_session_info failed: "
1087 "%s\n", ndr_errstr(ndr_err)));
1096 * Set a new session key. Used in the rpc server where we have to override the
1097 * SMB level session key with SystemLibraryDTC
1100 bool session_info_set_session_key(struct auth_session_info *info,
1101 DATA_BLOB session_key)
1103 TALLOC_FREE(info->session_key.data);
1105 info->session_key = data_blob_talloc(
1106 info, session_key.data, session_key.length);
1108 return (info->session_key.data != NULL);
1111 static struct auth_session_info *guest_info = NULL;
1113 static struct auth_serversupplied_info *guest_server_info = NULL;
1115 bool init_guest_info(void)
1117 if (guest_info != NULL)
1120 return NT_STATUS_IS_OK(make_new_session_info_guest(&guest_info, &guest_server_info));
1123 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
1124 struct auth_serversupplied_info **server_info)
1126 /* This is trickier than it would appear to need to be because
1127 * we are trying to avoid certain costly operations when the
1128 * structure is converted to a 'auth_session_info' again in
1129 * create_local_token() */
1130 *server_info = copy_session_info_serverinfo_guest(mem_ctx, guest_info, guest_server_info);
1131 return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1134 NTSTATUS make_session_info_guest(TALLOC_CTX *mem_ctx,
1135 struct auth_session_info **session_info)
1137 *session_info = copy_session_info(mem_ctx, guest_info);
1138 return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1141 static struct auth_session_info *system_info = NULL;
1143 NTSTATUS init_system_info(void)
1145 if (system_info != NULL)
1146 return NT_STATUS_OK;
1148 return make_new_session_info_system(NULL, &system_info);
1151 NTSTATUS make_session_info_system(TALLOC_CTX *mem_ctx,
1152 struct auth_session_info **session_info)
1154 if (system_info == NULL) return NT_STATUS_UNSUCCESSFUL;
1155 *session_info = copy_session_info(mem_ctx, system_info);
1156 return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1159 const struct auth_session_info *get_session_info_system(void)
1164 bool copy_current_user(struct current_user *dst, struct current_user *src)
1167 struct security_token *nt_token;
1169 groups = (gid_t *)memdup(src->ut.groups,
1170 sizeof(gid_t) * src->ut.ngroups);
1171 if ((src->ut.ngroups != 0) && (groups == NULL)) {
1175 nt_token = dup_nt_token(NULL, src->nt_user_token);
1176 if (nt_token == NULL) {
1181 dst->conn = src->conn;
1182 dst->vuid = src->vuid;
1183 dst->ut.uid = src->ut.uid;
1184 dst->ut.gid = src->ut.gid;
1185 dst->ut.ngroups = src->ut.ngroups;
1186 dst->ut.groups = groups;
1187 dst->nt_user_token = nt_token;
1191 /***************************************************************************
1192 Purely internal function for make_server_info_info3
1193 ***************************************************************************/
1195 static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
1196 const char *username, char **found_username,
1197 struct passwd **pwd,
1198 bool *username_was_mapped)
1200 char *orig_dom_user = NULL;
1201 char *dom_user = NULL;
1202 char *lower_username = NULL;
1203 char *real_username = NULL;
1204 struct passwd *passwd;
1206 lower_username = talloc_strdup(mem_ctx, username);
1207 if (!lower_username) {
1208 return NT_STATUS_NO_MEMORY;
1210 strlower_m( lower_username );
1212 orig_dom_user = talloc_asprintf(mem_ctx,
1215 *lp_winbind_separator(),
1217 if (!orig_dom_user) {
1218 return NT_STATUS_NO_MEMORY;
1221 /* Get the passwd struct. Try to create the account if necessary. */
1223 *username_was_mapped = map_username(mem_ctx, orig_dom_user, &dom_user);
1225 return NT_STATUS_NO_MEMORY;
1228 passwd = smb_getpwnam(mem_ctx, dom_user, &real_username, true );
1230 DEBUG(3, ("Failed to find authenticated user %s via "
1231 "getpwnam(), denying access.\n", dom_user));
1232 return NT_STATUS_NO_SUCH_USER;
1235 if (!real_username) {
1236 return NT_STATUS_NO_MEMORY;
1241 /* This is pointless -- there is no support for differing
1242 unix and windows names. Make sure to always store the
1243 one we actually looked up and succeeded. Have I mentioned
1244 why I hate the 'winbind use default domain' parameter?
1247 *found_username = talloc_strdup( mem_ctx, real_username );
1249 return NT_STATUS_OK;
1252 /****************************************************************************
1253 Wrapper to allow the getpwnam() call to strip the domain name and
1254 try again in case a local UNIX user is already there. Also run through
1255 the username if we fallback to the username only.
1256 ****************************************************************************/
1258 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, const char *domuser,
1259 char **p_save_username, bool create )
1261 struct passwd *pw = NULL;
1263 char *username = NULL;
1265 /* we only save a copy of the username it has been mangled
1266 by winbindd use default domain */
1267 *p_save_username = NULL;
1269 /* don't call map_username() here since it has to be done higher
1270 up the stack so we don't call it multiple times */
1272 username = talloc_strdup(mem_ctx, domuser);
1277 p = strchr_m( username, *lp_winbind_separator() );
1279 /* code for a DOMAIN\user string */
1282 pw = Get_Pwnam_alloc( mem_ctx, domuser );
1284 /* make sure we get the case of the username correct */
1285 /* work around 'winbind use default domain = yes' */
1287 if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
1290 /* split the domain and username into 2 strings */
1294 *p_save_username = talloc_asprintf(mem_ctx,
1297 *lp_winbind_separator(),
1299 if (!*p_save_username) {
1304 *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
1311 /* setup for lookup of just the username */
1312 /* remember that p and username are overlapping memory */
1315 username = talloc_strdup(mem_ctx, p);
1321 /* just lookup a plain username */
1323 pw = Get_Pwnam_alloc(mem_ctx, username);
1325 /* Create local user if requested but only if winbindd
1326 is not running. We need to protect against cases
1327 where winbindd is failing and then prematurely
1328 creating users in /etc/passwd */
1330 if ( !pw && create && !winbind_ping() ) {
1331 /* Don't add a machine account. */
1332 if (username[strlen(username)-1] == '$')
1335 _smb_create_user(NULL, username, NULL);
1336 pw = Get_Pwnam_alloc(mem_ctx, username);
1339 /* one last check for a valid passwd struct */
1342 *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
1347 /***************************************************************************
1348 Make a server_info struct from the info3 returned by a domain logon
1349 ***************************************************************************/
1351 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
1352 const char *sent_nt_username,
1354 struct auth_serversupplied_info **server_info,
1355 struct netr_SamInfo3 *info3)
1357 static const char zeros[16] = {0, };
1359 NTSTATUS nt_status = NT_STATUS_OK;
1360 char *found_username = NULL;
1361 const char *nt_domain;
1362 const char *nt_username;
1363 bool username_was_mapped;
1365 struct auth_serversupplied_info *result;
1366 struct dom_sid *group_sid;
1367 struct netr_SamInfo3 *i3;
1370 Here is where we should check the list of
1371 trusted domains, and verify that the SID
1375 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
1377 /* If the server didn't give us one, just use the one we sent
1379 nt_username = sent_nt_username;
1382 nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
1384 /* If the server didn't give us one, just use the one we sent
1389 /* If getpwnam() fails try the add user script (2.2.x behavior).
1391 We use the _unmapped_ username here in an attempt to provide
1392 consistent username mapping behavior between kerberos and NTLM[SSP]
1393 authentication in domain mode security. I.E. Username mapping
1394 should be applied to the fully qualified username
1395 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1396 called map_username() unnecessarily in make_user_info_map() but
1397 that is how the current code is designed. Making the change here
1398 is the least disruptive place. -- jerry */
1400 /* this call will try to create the user if necessary */
1402 nt_status = check_account(mem_ctx, nt_domain, sent_nt_username,
1403 &found_username, &pwd,
1404 &username_was_mapped);
1406 if (!NT_STATUS_IS_OK(nt_status)) {
1410 result = make_server_info(NULL);
1411 if (result == NULL) {
1412 DEBUG(4, ("make_server_info failed!\n"));
1413 return NT_STATUS_NO_MEMORY;
1416 result->unix_name = talloc_strdup(result, found_username);
1418 result->sanitized_username = sanitize_username(result,
1420 if (result->sanitized_username == NULL) {
1421 TALLOC_FREE(result);
1422 return NT_STATUS_NO_MEMORY;
1425 /* copy in the info3 */
1426 result->info3 = i3 = copy_netr_SamInfo3(result, info3);
1427 if (result->info3 == NULL) {
1428 TALLOC_FREE(result);
1429 return NT_STATUS_NO_MEMORY;
1432 /* Fill in the unix info we found on the way */
1433 result->utok.uid = pwd->pw_uid;
1434 result->utok.gid = pwd->pw_gid;
1436 /* We can't just trust that the primary group sid sent us is something
1437 * we can really use. Obtain the usable sid, and store the original
1438 * one as an additional group if it had to be replaced */
1439 nt_status = get_primary_group_sid(mem_ctx, found_username,
1441 if (!NT_STATUS_IS_OK(nt_status)) {
1442 TALLOC_FREE(result);
1446 /* store and check if it is the same we got originally */
1447 sid_peek_rid(group_sid, &i3->base.primary_gid);
1448 if (i3->base.primary_gid != info3->base.primary_gid) {
1449 uint32_t n = i3->base.groups.count;
1450 /* not the same, store the original as an additional group */
1451 i3->base.groups.rids =
1452 talloc_realloc(i3, i3->base.groups.rids,
1453 struct samr_RidWithAttribute, n + 1);
1454 if (i3->base.groups.rids == NULL) {
1455 TALLOC_FREE(result);
1456 return NT_STATUS_NO_MEMORY;
1458 i3->base.groups.rids[n].rid = info3->base.primary_gid;
1459 i3->base.groups.rids[n].attributes = SE_GROUP_ENABLED;
1460 i3->base.groups.count = n + 1;
1463 /* ensure we are never given NULL session keys */
1465 if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
1466 result->session_key = data_blob_null;
1468 result->session_key = data_blob_talloc(
1469 result, info3->base.key.key,
1470 sizeof(info3->base.key.key));
1473 if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
1474 result->lm_session_key = data_blob_null;
1476 result->lm_session_key = data_blob_talloc(
1477 result, info3->base.LMSessKey.key,
1478 sizeof(info3->base.LMSessKey.key));
1481 result->nss_token |= username_was_mapped;
1483 result->guest = (info3->base.user_flags & NETLOGON_GUEST);
1485 *server_info = result;
1487 return NT_STATUS_OK;
1490 /*****************************************************************************
1491 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1492 ******************************************************************************/
1494 NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
1495 const char *sent_nt_username,
1497 const struct wbcAuthUserInfo *info,
1498 struct auth_serversupplied_info **server_info)
1500 struct netr_SamInfo3 *info3;
1502 info3 = wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx, info);
1504 return NT_STATUS_NO_MEMORY;
1507 return make_server_info_info3(mem_ctx,
1508 sent_nt_username, domain,
1509 server_info, info3);
1513 * Verify whether or not given domain is trusted.
1515 * @param domain_name name of the domain to be verified
1516 * @return true if domain is one of the trusted ones or
1517 * false if otherwise
1520 bool is_trusted_domain(const char* dom_name)
1522 struct dom_sid trustdom_sid;
1525 /* no trusted domains for a standalone server */
1527 if ( lp_server_role() == ROLE_STANDALONE )
1530 if (dom_name == NULL || dom_name[0] == '\0') {
1534 if (strequal(dom_name, get_global_sam_name())) {
1538 /* if we are a DC, then check for a direct trust relationships */
1542 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1543 "[%s]\n", dom_name ));
1544 ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
1552 /* If winbind is around, ask it */
1554 result = wb_is_trusted_domain(dom_name);
1556 if (result == WBC_ERR_SUCCESS) {
1560 if (result == WBC_ERR_DOMAIN_NOT_FOUND) {
1561 /* winbind could not find the domain */
1565 /* The only other possible result is that winbind is not up
1566 and running. We need to update the trustdom_cache
1569 update_trustdom_cache();
1572 /* now the trustdom cache should be available a DC could still
1573 * have a transitive trust so fall back to the cache of trusted
1574 * domains (like a domain member would use */
1576 if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) {
1586 on a logon error possibly map the error to success if "map to guest"
1589 NTSTATUS do_map_to_guest_server_info(NTSTATUS status,
1590 struct auth_serversupplied_info **server_info,
1591 const char *user, const char *domain)
1593 user = user ? user : "";
1594 domain = domain ? domain : "";
1596 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1597 if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) ||
1598 (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD)) {
1599 DEBUG(3,("No such user %s [%s] - using guest account\n",
1601 status = make_server_info_guest(NULL, server_info);
1603 } else if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
1604 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD) {
1605 DEBUG(3,("Registered username %s for guest access\n",
1607 status = make_server_info_guest(NULL, server_info);