4 Copyright (c) 2010, Simo Sorce <idra@samba.org>
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #define TEVENT_DEPRECATED 1
23 #include "param/param.h"
24 #include "dsdb/samdb/samdb.h"
25 #include "system/kerberos.h"
28 #include "kdc/sdb_kdb.h"
29 #include "auth/kerberos/kerberos.h"
30 #include "kdc/samba_kdc.h"
31 #include "kdc/pac-glue.h"
32 #include "kdc/db-glue.h"
34 #include "mit_samba.h"
36 void mit_samba_context_free(struct mit_samba_context *ctx)
38 /* free heimdal's krb5_context */
40 krb5_free_context(ctx->context);
43 /* then free everything else */
47 int mit_samba_context_init(struct mit_samba_context **_ctx)
50 struct mit_samba_context *ctx;
51 const char *s4_conf_file;
53 struct samba_kdc_base_context base_ctx;
55 ctx = talloc(NULL, struct mit_samba_context);
61 base_ctx.ev_ctx = tevent_context_init(ctx);
62 if (!base_ctx.ev_ctx) {
66 tevent_loop_allow_nesting(base_ctx.ev_ctx);
67 base_ctx.lp_ctx = loadparm_init_global(false);
68 if (!base_ctx.lp_ctx) {
72 /* init s4 configuration */
73 s4_conf_file = lpcfg_configfile(base_ctx.lp_ctx);
75 lpcfg_load(base_ctx.lp_ctx, s4_conf_file);
77 lpcfg_load_default(base_ctx.lp_ctx);
80 status = samba_kdc_setup_db_ctx(ctx, &base_ctx, &ctx->db_ctx);
81 if (!NT_STATUS_IS_OK(status)) {
86 /* init heimdal's krb_context and log facilities */
87 ret = smb_krb5_init_context_basic(ctx,
98 mit_samba_context_free(ctx);
106 int mit_samba_get_principal(struct mit_samba_context *ctx,
107 krb5_const_principal principal,
109 krb5_db_entry **_kentry)
111 struct sdb_entry_ex sentry;
112 krb5_db_entry *kentry;
116 kentry = malloc(sizeof(krb5_db_entry));
117 if (kentry == NULL) {
121 if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
122 sflags |= SDB_F_CANON;
124 if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |
125 KRB5_KDB_FLAG_INCLUDE_PAC)) {
126 sflags |= SDB_F_GET_CLIENT;
127 } else if (ks_is_tgs_principal(ctx, principal)) {
128 sflags |= SDB_F_GET_KRBTGT;
130 sflags |= SDB_F_GET_ANY;
133 /* always set this or the created_by data will not be populated by samba's
134 * backend and we will fail to parse the entry later */
135 sflags |= SDB_F_ADMIN_DATA;
137 ret = samba_kdc_fetch(ctx->context, ctx->db_ctx,
138 principal, sflags, 0, &sentry);
142 case SDB_ERR_NOENTRY:
143 ret = KRB5_KDB_NOENTRY;
145 case SDB_ERR_WRONG_REALM:
146 ret = KRB5KDC_ERR_WRONG_REALM;
148 case SDB_ERR_NOT_FOUND_HERE:
149 /* FIXME: RODC support */
154 ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
156 sdb_free_entry(&sentry);
167 int mit_samba_get_firstkey(struct mit_samba_context *ctx,
168 krb5_db_entry **_kentry)
170 struct sdb_entry_ex sentry;
171 krb5_db_entry *kentry;
174 kentry = malloc(sizeof(krb5_db_entry));
175 if (kentry == NULL) {
179 ret = samba_kdc_firstkey(ctx->context, ctx->db_ctx, &sentry);
183 case SDB_ERR_NOENTRY:
185 return KRB5_KDB_NOENTRY;
186 case SDB_ERR_NOT_FOUND_HERE:
187 /* FIXME: RODC support */
193 ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
195 sdb_free_entry(&sentry);
205 int mit_samba_get_nextkey(struct mit_samba_context *ctx,
206 krb5_db_entry **_kentry)
208 struct sdb_entry_ex sentry;
209 krb5_db_entry *kentry;
212 kentry = malloc(sizeof(krb5_db_entry));
213 if (kentry == NULL) {
217 ret = samba_kdc_nextkey(ctx->context, ctx->db_ctx, &sentry);
221 case SDB_ERR_NOENTRY:
223 return KRB5_KDB_NOENTRY;
224 case SDB_ERR_NOT_FOUND_HERE:
225 /* FIXME: RODC support */
231 ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
233 sdb_free_entry(&sentry);
243 int mit_samba_get_pac_data(struct mit_samba_context *ctx,
244 krb5_db_entry *client,
250 struct samba_kdc_entry *skdc_entry;
252 skdc_entry = talloc_get_type_abort(client->e_data,
253 struct samba_kdc_entry);
255 tmp_ctx = talloc_named(ctx, 0, "mit_samba_get_pac_data context");
260 nt_status = samba_kdc_get_pac_blob(tmp_ctx, skdc_entry, &pac_blob);
261 if (!NT_STATUS_IS_OK(nt_status)) {
262 talloc_free(tmp_ctx);
266 data->data = (uint8_t *)malloc(pac_blob->length);
268 talloc_free(tmp_ctx);
271 memcpy(data->data, pac_blob->data, pac_blob->length);
272 data->length = pac_blob->length;
274 talloc_free(tmp_ctx);
278 int mit_samba_update_pac_data(struct mit_samba_context *ctx,
279 krb5_db_entry *client,
281 DATA_BLOB *logon_data)
284 DATA_BLOB *logon_blob;
285 krb5_error_code code;
289 struct samba_kdc_entry *skdc_entry = NULL;
292 skdc_entry = talloc_get_type_abort(client->e_data,
293 struct samba_kdc_entry);
296 /* The user account may be set not to want the PAC */
297 if (client && !samba_princ_needs_pac(skdc_entry)) {
301 tmp_ctx = talloc_named(ctx, 0, "mit_samba_update_pac_data context");
306 logon_blob = talloc_zero(tmp_ctx, DATA_BLOB);
312 code = krb5_pac_parse(ctx->context,
313 pac_data->data, pac_data->length, &pac);
319 /* TODO: An implementation-specific decision will need to be
320 * made as to when to check the KDC pac signature, and how to
321 * untrust untrusted RODCs */
322 nt_status = samba_kdc_update_pac_blob(tmp_ctx, ctx->context,
323 pac, logon_blob, NULL, NULL);
324 if (!NT_STATUS_IS_OK(nt_status)) {
325 DEBUG(0, ("Building PAC failed: %s\n",
326 nt_errstr(nt_status)));
331 logon_data->data = (uint8_t *)malloc(logon_blob->length);
332 if (!logon_data->data) {
336 memcpy(logon_data->data, logon_blob->data, logon_blob->length);
337 logon_data->length = logon_blob->length;
342 if (pac) krb5_pac_free(ctx->context, pac);
343 talloc_free(tmp_ctx);
347 /* provide header, function is exported but there are no public headers */
349 krb5_error_code encode_krb5_padata_sequence(krb5_pa_data *const *rep, krb5_data **code);
351 /* this function allocates 'data' using malloc.
352 * The caller is responsible for freeing it */
353 static void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
355 krb5_error_code ret = 0;
356 krb5_pa_data pa, *ppa = NULL;
365 pa.magic = KV5M_PA_DATA;
366 pa.pa_type = KRB5_PADATA_PW_SALT;
368 pa.contents = malloc(pa.length);
373 SIVAL(pa.contents, 0, NT_STATUS_V(nt_status));
374 SIVAL(pa.contents, 4, 0);
375 SIVAL(pa.contents, 8, 1);
379 ret = encode_krb5_padata_sequence(&ppa, &d);
385 e_data->data = (uint8_t *)d->data;
386 e_data->length = d->length;
388 /* free d, not d->data - gd */
394 int mit_samba_check_client_access(struct mit_samba_context *ctx,
395 krb5_db_entry *client,
396 const char *client_name,
397 krb5_db_entry *server,
398 const char *server_name,
399 const char *netbios_name,
400 bool password_change,
403 struct samba_kdc_entry *skdc_entry;
406 skdc_entry = talloc_get_type(client->e_data, struct samba_kdc_entry);
408 nt_status = samba_kdc_check_client_access(skdc_entry,
413 if (!NT_STATUS_IS_OK(nt_status)) {
414 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
418 samba_kdc_build_edata_reply(nt_status, e_data);
420 return samba_kdc_map_policy_err(nt_status);
426 int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
427 krb5_db_entry *kentry,
428 const char *target_name,
429 bool is_nt_enterprise_name)
433 * This is disabled because mit_samba_update_pac_data() does not handle
434 * S4U_DELEGATION_INFO
437 return KRB5KDC_ERR_BADOPTION;
439 krb5_principal target_principal;
443 if (is_nt_enterprise_name) {
444 flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE;
447 ret = krb5_parse_name_flags(ctx->context, target_name,
448 flags, &target_principal);
453 ret = samba_kdc_check_s4u2proxy(ctx->context,
458 krb5_free_principal(ctx->context, target_principal);