source4/kdc/mit_samba.c

   1 /*
   2    MIT-Samba4 library
   3
   4    Copyright (c) 2010, Simo Sorce <idra@samba.org>
   5    Copyright (c) 2014-2015 Guenther Deschner <gd@samba.org>
   6    Copyright (c) 2014-2016 Andreas Schneider <asn@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #define TEVENT_DEPRECATED 1
  23
  24 #include "includes.h"
  25 #include "param/param.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "system/kerberos.h"
  28 #include <kdb.h>
  29 #include <kadm5/kadm_err.h>
  30 #include "kdc/sdb.h"
  31 #include "kdc/sdb_kdb.h"
  32 #include "auth/kerberos/kerberos.h"
  33 #include "kdc/samba_kdc.h"
  34 #include "kdc/pac-glue.h"
  35 #include "kdc/db-glue.h"
  36 #include "auth/auth.h"
  37 #include "kdc/kpasswd_glue.h"
  38 #include "auth/auth_sam.h"
  39
  40 #include "mit_samba.h"
  41
  42 void mit_samba_context_free(struct mit_samba_context *ctx)
  43 {
  44         /* free heimdal's krb5_context */
  45         if (ctx->context) {
  46                 krb5_free_context(ctx->context);
  47         }
  48
  49         /* then free everything else */
  50         talloc_free(ctx);
  51 }
  52
  53 int mit_samba_context_init(struct mit_samba_context **_ctx)
  54 {
  55         NTSTATUS status;
  56         struct mit_samba_context *ctx;
  57         const char *s4_conf_file;
  58         int ret;
  59         struct samba_kdc_base_context base_ctx;
  60
  61         ctx = talloc_zero(NULL, struct mit_samba_context);
  62         if (!ctx) {
  63                 ret = ENOMEM;
  64                 goto done;
  65         }
  66
  67         base_ctx.ev_ctx = tevent_context_init(ctx);
  68         if (!base_ctx.ev_ctx) {
  69                 ret = ENOMEM;
  70                 goto done;
  71         }
  72         tevent_loop_allow_nesting(base_ctx.ev_ctx);
  73         base_ctx.lp_ctx = loadparm_init_global(false);
  74         if (!base_ctx.lp_ctx) {
  75                 ret = ENOMEM;
  76                 goto done;
  77         }
  78
  79         setup_logging("mitkdc", DEBUG_DEFAULT_STDOUT);
  80
  81         /* init s4 configuration */
  82         s4_conf_file = lpcfg_configfile(base_ctx.lp_ctx);
  83         if (s4_conf_file) {
  84                 lpcfg_load(base_ctx.lp_ctx, s4_conf_file);
  85         } else {
  86                 lpcfg_load_default(base_ctx.lp_ctx);
  87         }
  88
  89         status = samba_kdc_setup_db_ctx(ctx, &base_ctx, &ctx->db_ctx);
  90         if (!NT_STATUS_IS_OK(status)) {
  91                 ret = EINVAL;
  92                 goto done;
  93         }
  94
  95         /* init heimdal's krb_context and log facilities */
  96         ret = smb_krb5_init_context_basic(ctx,
  97                                           ctx->db_ctx->lp_ctx,
  98                                           &ctx->context);
  99         if (ret) {
 100                 goto done;
 101         }
 102
 103         ret = 0;
 104
 105 done:
 106         if (ret) {
 107                 mit_samba_context_free(ctx);
 108         } else {
 109                 *_ctx = ctx;
 110         }
 111         return ret;
 112 }
 113
 114 static krb5_error_code ks_is_tgs_principal(struct mit_samba_context *ctx,
 115                                            krb5_const_principal principal)
 116 {
 117         char *p;
 118         int eq = -1;
 119
 120         p = smb_krb5_principal_get_comp_string(ctx, ctx->context, principal, 0);
 121
 122         eq = krb5_princ_size(ctx->context, principal) == 2 &&
 123              (strcmp(p, KRB5_TGS_NAME) == 0);
 124
 125         talloc_free(p);
 126
 127         return eq;
 128 }
 129
 130 int mit_samba_generate_salt(krb5_data *salt)
 131 {
 132         if (salt == NULL) {
 133                 return EINVAL;
 134         }
 135
 136         salt->length = 16;
 137         salt->data = malloc(salt->length);
 138         if (salt->data == NULL) {
 139                 return ENOMEM;
 140         }
 141
 142         generate_random_buffer((uint8_t *)salt->data, salt->length);
 143
 144         return 0;
 145 }
 146
 147 int mit_samba_generate_random_password(krb5_data *pwd)
 148 {
 149         TALLOC_CTX *tmp_ctx;
 150         char *password;
 151
 152         if (pwd == NULL) {
 153                 return EINVAL;
 154         }
 155         pwd->length = 24;
 156
 157         tmp_ctx = talloc_named(NULL,
 158                                0,
 159                                "mit_samba_create_principal_password context");
 160         if (tmp_ctx == NULL) {
 161                 return ENOMEM;
 162         }
 163
 164         password = generate_random_password(tmp_ctx, pwd->length, pwd->length);
 165         if (password == NULL) {
 166                 talloc_free(tmp_ctx);
 167                 return ENOMEM;
 168         }
 169
 170         pwd->data = strdup(password);
 171         talloc_free(tmp_ctx);
 172         if (pwd->data == NULL) {
 173                 return ENOMEM;
 174         }
 175
 176         return 0;
 177 }
 178
 179 int mit_samba_get_principal(struct mit_samba_context *ctx,
 180                             krb5_const_principal principal,
 181                             unsigned int kflags,
 182                             krb5_db_entry **_kentry)
 183 {
 184         struct sdb_entry_ex sentry = {
 185                 .free_entry = NULL,
 186         };
 187         krb5_db_entry *kentry;
 188         int ret;
 189         int sflags = 0;
 190
 191         kentry = calloc(1, sizeof(krb5_db_entry));
 192         if (kentry == NULL) {
 193                 return ENOMEM;
 194         }
 195
 196         if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {
 197                 sflags |= SDB_F_CANON;
 198         }
 199         if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |
 200                       KRB5_KDB_FLAG_INCLUDE_PAC)) {
 201                 /*
 202                  * KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is equal to
 203                  * SDB_F_FOR_AS_REQ
 204                  *
 205                  * We use ANY to also allow AS_REQ for service principal names
 206                  * This is supported by Windows.
 207                  */
 208                 sflags |= SDB_F_GET_ANY|SDB_F_FOR_AS_REQ;
 209         } else if (ks_is_tgs_principal(ctx, principal)) {
 210                 sflags |= SDB_F_GET_KRBTGT;
 211         } else {
 212                 sflags |= SDB_F_GET_SERVER|SDB_F_FOR_TGS_REQ;
 213         }
 214
 215         /* always set this or the created_by data will not be populated by samba's
 216          * backend and we will fail to parse the entry later */
 217         sflags |= SDB_F_ADMIN_DATA;
 218
 219         ret = samba_kdc_fetch(ctx->context, ctx->db_ctx,
 220                               principal, sflags, 0, &sentry);
 221         switch (ret) {
 222         case 0:
 223                 break;
 224         case SDB_ERR_NOENTRY:
 225                 ret = KRB5_KDB_NOENTRY;
 226                 goto done;
 227         case SDB_ERR_WRONG_REALM:
 228                 /*
 229                  * If we have a wrong realm e.g. if we try get a cross forest
 230                  * ticket, we return a ticket with the correct realm. The KDC
 231                  * will detect this an return the appropriate return code.
 232                  */
 233                 ret = 0;
 234                 break;
 235         case SDB_ERR_NOT_FOUND_HERE:
 236                 /* FIXME: RODC support */
 237         default:
 238                 goto done;
 239         }
 240
 241         ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
 242
 243         sdb_free_entry(&sentry);
 244
 245 done:
 246         if (ret) {
 247                 free(kentry);
 248         } else {
 249                 *_kentry = kentry;
 250         }
 251         return ret;
 252 }
 253
 254 int mit_samba_get_firstkey(struct mit_samba_context *ctx,
 255                            krb5_db_entry **_kentry)
 256 {
 257         struct sdb_entry_ex sentry = {
 258                 .free_entry = NULL,
 259         };
 260         krb5_db_entry *kentry;
 261         int ret;
 262
 263         kentry = malloc(sizeof(krb5_db_entry));
 264         if (kentry == NULL) {
 265                 return ENOMEM;
 266         }
 267
 268         ret = samba_kdc_firstkey(ctx->context, ctx->db_ctx, &sentry);
 269         switch (ret) {
 270         case 0:
 271                 break;
 272         case SDB_ERR_NOENTRY:
 273                 free(kentry);
 274                 return KRB5_KDB_NOENTRY;
 275         case SDB_ERR_NOT_FOUND_HERE:
 276                 /* FIXME: RODC support */
 277         default:
 278                 free(kentry);
 279                 return ret;
 280         }
 281
 282         ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
 283
 284         sdb_free_entry(&sentry);
 285
 286         if (ret) {
 287                 free(kentry);
 288         } else {
 289                 *_kentry = kentry;
 290         }
 291         return ret;
 292 }
 293
 294 int mit_samba_get_nextkey(struct mit_samba_context *ctx,
 295                           krb5_db_entry **_kentry)
 296 {
 297         struct sdb_entry_ex sentry = {
 298                 .free_entry = NULL,
 299         };
 300         krb5_db_entry *kentry;
 301         int ret;
 302
 303         kentry = malloc(sizeof(krb5_db_entry));
 304         if (kentry == NULL) {
 305                 return ENOMEM;
 306         }
 307
 308         ret = samba_kdc_nextkey(ctx->context, ctx->db_ctx, &sentry);
 309         switch (ret) {
 310         case 0:
 311                 break;
 312         case SDB_ERR_NOENTRY:
 313                 free(kentry);
 314                 return KRB5_KDB_NOENTRY;
 315         case SDB_ERR_NOT_FOUND_HERE:
 316                 /* FIXME: RODC support */
 317         default:
 318                 free(kentry);
 319                 return ret;
 320         }
 321
 322         ret = sdb_entry_ex_to_kdb_entry_ex(ctx->context, &sentry, kentry);
 323
 324         sdb_free_entry(&sentry);
 325
 326         if (ret) {
 327                 free(kentry);
 328         } else {
 329                 *_kentry = kentry;
 330         }
 331         return ret;
 332 }
 333
 334 int mit_samba_get_pac(struct mit_samba_context *smb_ctx,
 335                       krb5_context context,
 336                       krb5_db_entry *client,
 337                       krb5_keyblock *client_key,
 338                       krb5_pac *pac)
 339 {
 340         TALLOC_CTX *tmp_ctx;
 341         DATA_BLOB *logon_info_blob = NULL;
 342         DATA_BLOB *upn_dns_info_blob = NULL;
 343         DATA_BLOB *cred_ndr = NULL;
 344         DATA_BLOB **cred_ndr_ptr = NULL;
 345         DATA_BLOB cred_blob = data_blob_null;
 346         DATA_BLOB *pcred_blob = NULL;
 347         NTSTATUS nt_status;
 348         krb5_error_code code;
 349         struct samba_kdc_entry *skdc_entry;
 350
 351         skdc_entry = talloc_get_type_abort(client->e_data,
 352                                            struct samba_kdc_entry);
 353
 354         tmp_ctx = talloc_named(smb_ctx,
 355                                0,
 356                                "mit_samba_get_pac_data_blobs context");
 357         if (tmp_ctx == NULL) {
 358                 return ENOMEM;
 359         }
 360
 361 #if 0 /* TODO Find out if this is a pkinit_reply key */
 362         /* Check if we have a PREAUTH key */
 363         if (client_key != NULL) {
 364                 cred_ndr_ptr = &cred_ndr;
 365         }
 366 #endif
 367
 368         nt_status = samba_kdc_get_pac_blobs(tmp_ctx,
 369                                             skdc_entry,
 370                                             &logon_info_blob,
 371                                             cred_ndr_ptr,
 372                                             &upn_dns_info_blob);
 373         if (!NT_STATUS_IS_OK(nt_status)) {
 374                 talloc_free(tmp_ctx);
 375                 return EINVAL;
 376         }
 377
 378         if (cred_ndr != NULL) {
 379                 code = samba_kdc_encrypt_pac_credentials(context,
 380                                                          client_key,
 381                                                          cred_ndr,
 382                                                          tmp_ctx,
 383                                                          &cred_blob);
 384                 if (code != 0) {
 385                         talloc_free(tmp_ctx);
 386                         return code;
 387                 }
 388                 pcred_blob = &cred_blob;
 389         }
 390
 391         code = samba_make_krb5_pac(context,
 392                                    logon_info_blob,
 393                                    pcred_blob,
 394                                    upn_dns_info_blob,
 395                                    NULL,
 396                                    pac);
 397
 398         talloc_free(tmp_ctx);
 399         return code;
 400 }
 401
 402 int mit_samba_update_pac_data(struct mit_samba_context *ctx,
 403                               krb5_db_entry *client,
 404                               DATA_BLOB *pac_data,
 405                               DATA_BLOB *logon_data)
 406 {
 407         TALLOC_CTX *tmp_ctx;
 408         DATA_BLOB *logon_blob;
 409         krb5_error_code code;
 410         NTSTATUS nt_status;
 411         krb5_pac pac = NULL;
 412         int ret;
 413         struct samba_kdc_entry *skdc_entry = NULL;
 414
 415         if (client) {
 416                 skdc_entry = talloc_get_type_abort(client->e_data,
 417                                                    struct samba_kdc_entry);
 418         }
 419
 420         /* The user account may be set not to want the PAC */
 421         if (client && !samba_princ_needs_pac(skdc_entry)) {
 422                 return EINVAL;
 423         }
 424
 425         tmp_ctx = talloc_named(ctx, 0, "mit_samba_update_pac_data context");
 426         if (!tmp_ctx) {
 427                 return ENOMEM;
 428         }
 429
 430         logon_blob = talloc_zero(tmp_ctx, DATA_BLOB);
 431         if (!logon_blob) {
 432                 ret = ENOMEM;
 433                 goto done;
 434         }
 435
 436         code = krb5_pac_parse(ctx->context,
 437                               pac_data->data, pac_data->length, &pac);
 438         if (code) {
 439                 ret = EINVAL;
 440                 goto done;
 441         }
 442
 443         /* TODO: An implementation-specific decision will need to be
 444          * made as to when to check the KDC pac signature, and how to
 445          * untrust untrusted RODCs */
 446         nt_status = samba_kdc_update_pac_blob(tmp_ctx, ctx->context,
 447                                               pac, logon_blob, NULL, NULL);
 448         if (!NT_STATUS_IS_OK(nt_status)) {
 449                 DEBUG(0, ("Building PAC failed: %s\n",
 450                           nt_errstr(nt_status)));
 451                 ret = EINVAL;
 452                 goto done;
 453         }
 454
 455         logon_data->data = (uint8_t *)malloc(logon_blob->length);
 456         if (!logon_data->data) {
 457                 ret = ENOMEM;
 458                 goto done;
 459         }
 460         memcpy(logon_data->data, logon_blob->data, logon_blob->length);
 461         logon_data->length = logon_blob->length;
 462
 463         ret = 0;
 464
 465 done:
 466         if (pac) krb5_pac_free(ctx->context, pac);
 467         talloc_free(tmp_ctx);
 468         return ret;
 469 }
 470
 471 /* provide header, function is exported but there are no public headers */
 472
 473 krb5_error_code encode_krb5_padata_sequence(krb5_pa_data *const *rep, krb5_data **code);
 474
 475 /* this function allocates 'data' using malloc.
 476  * The caller is responsible for freeing it */
 477 static void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
 478 {
 479         krb5_error_code ret = 0;
 480         krb5_pa_data pa, *ppa = NULL;
 481         krb5_data *d = NULL;
 482
 483         if (!e_data)
 484                 return;
 485
 486         e_data->data   = NULL;
 487         e_data->length = 0;
 488
 489         pa.magic                = KV5M_PA_DATA;
 490         pa.pa_type              = KRB5_PADATA_PW_SALT;
 491         pa.length               = 12;
 492         pa.contents             = malloc(pa.length);
 493         if (!pa.contents) {
 494                 return;
 495         }
 496
 497         SIVAL(pa.contents, 0, NT_STATUS_V(nt_status));
 498         SIVAL(pa.contents, 4, 0);
 499         SIVAL(pa.contents, 8, 1);
 500
 501         ppa = &pa;
 502
 503         ret = encode_krb5_padata_sequence(&ppa, &d);
 504         free(pa.contents);
 505         if (ret) {
 506                 return;
 507         }
 508
 509         e_data->data   = (uint8_t *)d->data;
 510         e_data->length = d->length;
 511
 512         /* free d, not d->data - gd */
 513         free(d);
 514
 515         return;
 516 }
 517
 518 int mit_samba_check_client_access(struct mit_samba_context *ctx,
 519                                   krb5_db_entry *client,
 520                                   const char *client_name,
 521                                   krb5_db_entry *server,
 522                                   const char *server_name,
 523                                   const char *netbios_name,
 524                                   bool password_change,
 525                                   DATA_BLOB *e_data)
 526 {
 527         struct samba_kdc_entry *skdc_entry;
 528         NTSTATUS nt_status;
 529
 530         skdc_entry = talloc_get_type(client->e_data, struct samba_kdc_entry);
 531
 532         nt_status = samba_kdc_check_client_access(skdc_entry,
 533                                                   client_name,
 534                                                   netbios_name,
 535                                                   password_change);
 536
 537         if (!NT_STATUS_IS_OK(nt_status)) {
 538                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) {
 539                         return ENOMEM;
 540                 }
 541
 542                 samba_kdc_build_edata_reply(nt_status, e_data);
 543
 544                 return samba_kdc_map_policy_err(nt_status);
 545         }
 546
 547         return 0;
 548 }
 549
 550 int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,
 551                               krb5_db_entry *kentry,
 552                               const char *target_name,
 553                               bool is_nt_enterprise_name)
 554 {
 555 #if 1
 556         /*
 557          * This is disabled because mit_samba_update_pac_data() does not handle
 558          * S4U_DELEGATION_INFO
 559          */
 560
 561         return KRB5KDC_ERR_BADOPTION;
 562 #else
 563         krb5_principal target_principal;
 564         int flags = 0;
 565         int ret;
 566
 567         if (is_nt_enterprise_name) {
 568                 flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE;
 569         }
 570
 571         ret = krb5_parse_name_flags(ctx->context, target_name,
 572                                     flags, &target_principal);
 573         if (ret) {
 574                 return ret;
 575         }
 576
 577         ret = samba_kdc_check_s4u2proxy(ctx->context,
 578                                         ctx->db_ctx,
 579                                         skdc_entry,
 580                                         target_principal);
 581
 582         krb5_free_principal(ctx->context, target_principal);
 583
 584         return ret;
 585 #endif
 586 }
 587
 588 static krb5_error_code mit_samba_change_pwd_error(krb5_context context,
 589                                                   NTSTATUS result,
 590                                                   enum samPwdChangeReason reject_reason,
 591                                                   struct samr_DomInfo1 *dominfo)
 592 {
 593         krb5_error_code code = KADM5_PASS_Q_GENERIC;
 594
 595         if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
 596                 code = KADM5_BAD_PRINCIPAL;
 597                 krb5_set_error_message(context,
 598                                        code,
 599                                        "No such user when changing password");
 600         }
 601         if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
 602                 code = KADM5_PASS_Q_GENERIC;
 603                 krb5_set_error_message(context,
 604                                        code,
 605                                        "Not permitted to change password");
 606         }
 607         if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) &&
 608             dominfo != NULL) {
 609                 switch (reject_reason) {
 610                 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT:
 611                         code = KADM5_PASS_Q_TOOSHORT;
 612                         krb5_set_error_message(context,
 613                                                code,
 614                                                "Password too short, password "
 615                                                "must be at least %d characters "
 616                                                "long.",
 617                                                dominfo->min_password_length);
 618                         break;
 619                 case SAM_PWD_CHANGE_NOT_COMPLEX:
 620                         code = KADM5_PASS_Q_DICT;
 621                         krb5_set_error_message(context,
 622                                                code,
 623                                                "Password does not meet "
 624                                                "complexity requirements");
 625                         break;
 626                 case SAM_PWD_CHANGE_PWD_IN_HISTORY:
 627                         code = KADM5_PASS_TOOSOON;
 628                         krb5_set_error_message(context,
 629                                                code,
 630                                                "Password is already in password "
 631                                                "history. New password must not "
 632                                                "match any of your %d previous "
 633                                                "passwords.",
 634                                                dominfo->password_history_length);
 635                         break;
 636                 default:
 637                         code = KADM5_PASS_Q_GENERIC;
 638                         krb5_set_error_message(context,
 639                                                code,
 640                                                "Password change rejected, "
 641                                                "password changes may not be "
 642                                                "permitted on this account, or "
 643                                                "the minimum password age may "
 644                                                "not have elapsed.");
 645                         break;
 646                 }
 647         }
 648
 649         return code;
 650 }
 651
 652 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,
 653                                       char *pwd,
 654                                       krb5_db_entry *db_entry)
 655 {
 656         NTSTATUS status;
 657         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 658         TALLOC_CTX *tmp_ctx;
 659         DATA_BLOB password;
 660         enum samPwdChangeReason reject_reason;
 661         struct samr_DomInfo1 *dominfo;
 662         const char *error_string = NULL;
 663         struct auth_user_info_dc *user_info_dc;
 664         struct samba_kdc_entry *p;
 665         krb5_error_code code = 0;
 666
 667 #ifdef DEBUG_PASSWORD
 668         DEBUG(1,("mit_samba_kpasswd_change_password called with: %s\n", pwd));
 669 #endif
 670
 671         tmp_ctx = talloc_named(ctx, 0, "mit_samba_kpasswd_change_password");
 672         if (tmp_ctx == NULL) {
 673                 return ENOMEM;
 674         }
 675
 676         p = (struct samba_kdc_entry *)db_entry->e_data;
 677
 678         status = authsam_make_user_info_dc(tmp_ctx,
 679                                            ctx->db_ctx->samdb,
 680                                            lpcfg_netbios_name(ctx->db_ctx->lp_ctx),
 681                                            lpcfg_sam_name(ctx->db_ctx->lp_ctx),
 682                                            lpcfg_sam_dnsname(ctx->db_ctx->lp_ctx),
 683                                            p->realm_dn,
 684                                            p->msg,
 685                                            data_blob(NULL, 0),
 686                                            data_blob(NULL, 0),
 687                                            &user_info_dc);
 688         if (!NT_STATUS_IS_OK(status)) {
 689                 DEBUG(1,("authsam_make_user_info_dc failed: %s\n",
 690                         nt_errstr(status)));
 691                 talloc_free(tmp_ctx);
 692                 return EINVAL;
 693         }
 694
 695         status = auth_generate_session_info(tmp_ctx,
 696                                             ctx->db_ctx->lp_ctx,
 697                                             ctx->db_ctx->samdb,
 698                                             user_info_dc,
 699                                             0, /* session_info_flags */
 700                                             &ctx->session_info);
 701
 702         if (!NT_STATUS_IS_OK(status)) {
 703                 DEBUG(1,("auth_generate_session_info failed: %s\n",
 704                         nt_errstr(status)));
 705                 talloc_free(tmp_ctx);
 706                 return EINVAL;
 707         }
 708
 709         /* password is expected as UTF16 */
 710
 711         if (!convert_string_talloc(tmp_ctx, CH_UTF8, CH_UTF16,
 712                                    pwd, strlen(pwd),
 713                                    &password.data, &password.length)) {
 714                 DEBUG(1,("convert_string_talloc failed\n"));
 715                 talloc_free(tmp_ctx);
 716                 return EINVAL;
 717         }
 718
 719         status = samdb_kpasswd_change_password(tmp_ctx,
 720                                                ctx->db_ctx->lp_ctx,
 721                                                ctx->db_ctx->ev_ctx,
 722                                                ctx->db_ctx->samdb,
 723                                                ctx->session_info,
 724                                                &password,
 725                                                &reject_reason,
 726                                                &dominfo,
 727                                                &error_string,
 728                                                &result);
 729         if (!NT_STATUS_IS_OK(status)) {
 730                 DEBUG(1,("samdb_kpasswd_change_password failed: %s\n",
 731                         nt_errstr(status)));
 732                 code = KADM5_PASS_Q_GENERIC;
 733                 krb5_set_error_message(ctx->context, code, "%s", error_string);
 734                 goto out;
 735         }
 736
 737         if (!NT_STATUS_IS_OK(result)) {
 738                 code = mit_samba_change_pwd_error(ctx->context,
 739                                                   result,
 740                                                   reject_reason,
 741                                                   dominfo);
 742         }
 743
 744 out:
 745         talloc_free(tmp_ctx);
 746
 747         return code;
 748 }
 749
 750 void mit_samba_zero_bad_password_count(krb5_db_entry *db_entry)
 751 {
 752         struct samba_kdc_entry *p;
 753         struct ldb_dn *domain_dn;
 754
 755         p = (struct samba_kdc_entry *)db_entry->e_data;
 756
 757         domain_dn = ldb_get_default_basedn(p->kdc_db_ctx->samdb);
 758
 759         authsam_logon_success_accounting(p->kdc_db_ctx->samdb,
 760                                          p->msg,
 761                                          domain_dn,
 762                                          true);
 763 }
 764
 765
 766 void mit_samba_update_bad_password_count(krb5_db_entry *db_entry)
 767 {
 768         struct samba_kdc_entry *p;
 769
 770         p = (struct samba_kdc_entry *)db_entry->e_data;
 771
 772         authsam_update_bad_pwd_count(p->kdc_db_ctx->samdb,
 773                                      p->msg,
 774                                      ldb_get_default_basedn(p->kdc_db_ctx->samdb));
 775 }