2 Unix SMB/CIFS implementation.
4 PAC Glue between Samba and the KDC
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2009
7 Copyright (C) Simo Sorce <idra@samba.org> 2010
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../libds/common/flags.h"
27 #include "auth/auth.h"
28 #include "auth/auth_sam_reply.h"
29 #include "kdc/kdc-glue.h"
30 #include "kdc/pac-glue.h"
31 #include "param/param.h"
32 #include "librpc/gen_ndr/ndr_krb5pac.h"
33 #include "libcli/security/security.h"
34 #include "dsdb/samdb/samdb.h"
35 #include "auth/kerberos/pac_utils.h"
38 NTSTATUS samba_get_logon_info_pac_blob(TALLOC_CTX *mem_ctx,
39 struct auth_user_info_dc *info,
42 struct netr_SamInfo3 *info3;
43 union PAC_INFO pac_info;
44 enum ndr_err_code ndr_err;
47 ZERO_STRUCT(pac_info);
49 nt_status = auth_convert_user_info_dc_saminfo3(mem_ctx, info, &info3);
50 if (!NT_STATUS_IS_OK(nt_status)) {
51 DEBUG(1, ("Getting Samba info failed: %s\n",
52 nt_errstr(nt_status)));
56 pac_info.logon_info.info = talloc_zero(mem_ctx, struct PAC_LOGON_INFO);
57 if (!pac_info.logon_info.info) {
58 return NT_STATUS_NO_MEMORY;
61 pac_info.logon_info.info->info3 = *info3;
63 ndr_err = ndr_push_union_blob(pac_data, mem_ctx, &pac_info,
65 (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
66 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
67 nt_status = ndr_map_error2ntstatus(ndr_err);
68 DEBUG(1, ("PAC (presig) push failed: %s\n",
69 nt_errstr(nt_status)));
76 krb5_error_code samba_make_krb5_pac(krb5_context context,
78 DATA_BLOB *deleg_blob,
85 /* The user account may be set not to want the PAC */
90 ret = krb5_data_copy(&pac_data, pac_blob->data, pac_blob->length);
95 ZERO_STRUCT(deleg_data);
97 ret = krb5_data_copy(&deleg_data,
101 krb5_data_free(&pac_data);
106 ret = krb5_pac_init(context, pac);
108 krb5_data_free(&pac_data);
109 krb5_data_free(&deleg_data);
113 ret = krb5_pac_add_buffer(context, *pac, PAC_TYPE_LOGON_INFO, &pac_data);
114 krb5_data_free(&pac_data);
116 krb5_data_free(&deleg_data);
121 ret = krb5_pac_add_buffer(context, *pac,
122 PAC_TYPE_CONSTRAINED_DELEGATION,
124 krb5_data_free(&deleg_data);
133 bool samba_princ_needs_pac(struct hdb_entry_ex *princ)
136 struct samba_kdc_entry *p = talloc_get_type(princ->ctx, struct samba_kdc_entry);
137 uint32_t userAccountControl;
140 /* The service account may be set not to want the PAC */
141 userAccountControl = ldb_msg_find_attr_as_uint(p->msg, "userAccountControl", 0);
142 if (userAccountControl & UF_NO_AUTH_DATA_REQUIRED) {
149 /* Was the krbtgt in this DB (ie, should we check the incoming signature) and was it an RODC */
150 int samba_krbtgt_is_in_db(struct hdb_entry_ex *princ, bool *is_in_db, bool *is_untrusted)
153 struct samba_kdc_entry *p = talloc_get_type(princ->ctx, struct samba_kdc_entry);
154 int rodc_krbtgt_number, trust_direction;
157 TALLOC_CTX *mem_ctx = talloc_new(NULL);
162 trust_direction = ldb_msg_find_attr_as_int(p->msg, "trustDirection", 0);
164 if (trust_direction != 0) {
165 /* Domain trust - we cannot check the sig, but we trust it for a correct PAC
167 This is exactly where we should flag for SID
168 validation when we do inter-foreest trusts
170 talloc_free(mem_ctx);
171 *is_untrusted = false;
176 /* The lack of password controls etc applies to krbtgt by
177 * virtue of being that particular RID */
178 status = dom_sid_split_rid(NULL, samdb_result_dom_sid(mem_ctx, p->msg, "objectSid"), NULL, &rid);
180 if (!NT_STATUS_IS_OK(status)) {
181 talloc_free(mem_ctx);
185 rodc_krbtgt_number = ldb_msg_find_attr_as_int(p->msg, "msDS-SecondaryKrbTgtNumber", -1);
187 if (p->kdc_db_ctx->my_krbtgt_number == 0) {
188 if (rid == DOMAIN_RID_KRBTGT) {
189 *is_untrusted = false;
191 talloc_free(mem_ctx);
193 } else if (rodc_krbtgt_number != -1) {
195 *is_untrusted = true;
196 talloc_free(mem_ctx);
199 } else if ((rid != DOMAIN_RID_KRBTGT) && (rodc_krbtgt_number == p->kdc_db_ctx->my_krbtgt_number)) {
200 talloc_free(mem_ctx);
201 *is_untrusted = false;
204 } else if (rid == DOMAIN_RID_KRBTGT) {
205 /* krbtgt viewed from an RODC */
206 talloc_free(mem_ctx);
207 *is_untrusted = false;
213 talloc_free(mem_ctx);
214 *is_untrusted = true;
219 NTSTATUS samba_kdc_get_pac_blob(TALLOC_CTX *mem_ctx,
220 struct hdb_entry_ex *client,
221 DATA_BLOB **_pac_blob)
223 struct samba_kdc_entry *p = talloc_get_type(client->ctx, struct samba_kdc_entry);
224 struct auth_user_info_dc *user_info_dc;
228 /* The user account may be set not to want the PAC */
229 if ( ! samba_princ_needs_pac(client)) {
234 pac_blob = talloc_zero(mem_ctx, DATA_BLOB);
236 return NT_STATUS_NO_MEMORY;
239 nt_status = authsam_make_user_info_dc(mem_ctx, p->kdc_db_ctx->samdb,
240 lpcfg_netbios_name(p->kdc_db_ctx->lp_ctx),
241 lpcfg_sam_name(p->kdc_db_ctx->lp_ctx),
247 if (!NT_STATUS_IS_OK(nt_status)) {
248 DEBUG(0, ("Getting user info for PAC failed: %s\n",
249 nt_errstr(nt_status)));
253 nt_status = samba_get_logon_info_pac_blob(mem_ctx, user_info_dc, pac_blob);
254 if (!NT_STATUS_IS_OK(nt_status)) {
255 DEBUG(0, ("Building PAC failed: %s\n",
256 nt_errstr(nt_status)));
260 *_pac_blob = pac_blob;
264 NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx,
265 krb5_context context,
266 const krb5_pac pac, DATA_BLOB *pac_blob,
267 struct PAC_SIGNATURE_DATA *pac_srv_sig,
268 struct PAC_SIGNATURE_DATA *pac_kdc_sig)
270 struct auth_user_info_dc *user_info_dc;
274 ret = kerberos_pac_to_user_info_dc(mem_ctx, pac,
275 context, &user_info_dc, pac_srv_sig, pac_kdc_sig);
277 return NT_STATUS_UNSUCCESSFUL;
280 nt_status = samba_get_logon_info_pac_blob(mem_ctx,
281 user_info_dc, pac_blob);
286 NTSTATUS samba_kdc_update_delegation_info_blob(TALLOC_CTX *mem_ctx,
287 krb5_context context,
289 const krb5_principal server_principal,
290 const krb5_principal proxy_principal,
297 enum ndr_err_code ndr_err;
299 struct PAC_CONSTRAINED_DELEGATION _d;
300 struct PAC_CONSTRAINED_DELEGATION *d = NULL;
304 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
306 if (tmp_ctx == NULL) {
307 return NT_STATUS_NO_MEMORY;
310 ret = krb5_pac_get_buffer(context, pac, PAC_TYPE_CONSTRAINED_DELEGATION, &old_data);
312 ZERO_STRUCT(old_data);
314 talloc_free(tmp_ctx);
315 return NT_STATUS_UNSUCCESSFUL;
318 old_blob.length = old_data.length;
319 old_blob.data = (uint8_t *)old_data.data;
322 if (old_blob.length > 0) {
323 ndr_err = ndr_pull_union_blob(&old_blob, mem_ctx,
324 &info, PAC_TYPE_CONSTRAINED_DELEGATION,
325 (ndr_pull_flags_fn_t)ndr_pull_PAC_INFO);
326 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
327 krb5_data_free(&old_data);
328 nt_status = ndr_map_error2ntstatus(ndr_err);
329 DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status)));
330 talloc_free(tmp_ctx);
335 info.constrained_delegation.info = &_d;
337 krb5_data_free(&old_data);
339 ret = krb5_unparse_name(context, server_principal, &server);
341 talloc_free(tmp_ctx);
342 return NT_STATUS_INTERNAL_ERROR;
345 ret = krb5_unparse_name_flags(context, proxy_principal,
346 KRB5_PRINCIPAL_UNPARSE_NO_REALM, &proxy);
349 talloc_free(tmp_ctx);
350 return NT_STATUS_INTERNAL_ERROR;
353 d = info.constrained_delegation.info;
354 i = d->num_transited_services;
355 d->proxy_target.string = server;
356 d->transited_services = talloc_realloc(mem_ctx, d->transited_services,
357 struct lsa_String, i + 1);
358 d->transited_services[i].string = proxy;
359 d->num_transited_services = i + 1;
361 ndr_err = ndr_push_union_blob(new_blob, mem_ctx,
362 &info, PAC_TYPE_CONSTRAINED_DELEGATION,
363 (ndr_push_flags_fn_t)ndr_push_PAC_INFO);
366 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
367 krb5_data_free(&old_data);
368 nt_status = ndr_map_error2ntstatus(ndr_err);
369 DEBUG(0,("can't parse the PAC LOGON_INFO: %s\n", nt_errstr(nt_status)));
370 talloc_free(tmp_ctx);
374 talloc_free(tmp_ctx);
378 /* this function allocates 'data' using malloc.
379 * The caller is responsible for freeing it */
380 void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
385 krb5_error_code ret = 0;
390 pa.padata_type = KRB5_PADATA_PW_SALT;
391 pa.padata_value.length = 12;
392 pa.padata_value.data = malloc(pa.padata_value.length);
393 if (!pa.padata_value.data) {
399 SIVAL(pa.padata_value.data, 0, NT_STATUS_V(nt_status));
400 SIVAL(pa.padata_value.data, 4, 0);
401 SIVAL(pa.padata_value.data, 8, 1);
403 ASN1_MALLOC_ENCODE(PA_DATA, buf, len, &pa, &len, ret);
404 free(pa.padata_value.data);
407 e_data->length = len;
412 /* function to map policy errors */
413 krb5_error_code samba_kdc_map_policy_err(NTSTATUS nt_status)
417 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_MUST_CHANGE))
418 ret = KRB5KDC_ERR_KEY_EXPIRED;
419 else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_PASSWORD_EXPIRED))
420 ret = KRB5KDC_ERR_KEY_EXPIRED;
421 else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_EXPIRED))
422 ret = KRB5KDC_ERR_CLIENT_REVOKED;
423 else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_DISABLED))
424 ret = KRB5KDC_ERR_CLIENT_REVOKED;
425 else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_LOGON_HOURS))
426 ret = KRB5KDC_ERR_CLIENT_REVOKED;
427 else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCOUNT_LOCKED_OUT))
428 ret = KRB5KDC_ERR_CLIENT_REVOKED;
429 else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_WORKSTATION))
430 ret = KRB5KDC_ERR_POLICY;
432 ret = KRB5KDC_ERR_POLICY;
437 /* Given a kdc entry, consult the account_ok routine in auth/auth_sam.c
439 NTSTATUS samba_kdc_check_client_access(struct samba_kdc_entry *kdc_entry,
440 const char *client_name,
441 const char *workstation,
442 bool password_change)
447 tmp_ctx = talloc_named(NULL, 0, "samba_kdc_check_client_access");
449 return NT_STATUS_NO_MEMORY;
452 /* we allow all kinds of trusts here */
453 nt_status = authsam_account_ok(tmp_ctx,
454 kdc_entry->kdc_db_ctx->samdb,
455 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
456 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
457 kdc_entry->realm_dn, kdc_entry->msg,
458 workstation, client_name,
459 true, password_change);
461 talloc_free(tmp_ctx);
465 int kdc_check_pac(krb5_context context,
467 struct PAC_SIGNATURE_DATA *kdc_sig,
472 krb5_keyblock keyblock;
474 if (kdc_sig->type == CKSUMTYPE_HMAC_MD5) {
475 etype = ETYPE_ARCFOUR_HMAC_MD5;
477 ret = krb5_cksumtype_to_enctype(context,
485 #if HDB_ENCTYPE2KEY_TAKES_KEYSET
486 ret = hdb_enctype2key(context, &ent->entry, NULL, etype, &key);
488 ret = hdb_enctype2key(context, &ent->entry, etype, &key);
497 return check_pac_checksum(srv_sig, kdc_sig,