2 Unix SMB/CIFS implementation.
3 struct samu access routines
4 Copyright (C) Jeremy Allison 1996-2001
5 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6 Copyright (C) Gerald (Jerry) Carter 2000-2006
7 Copyright (C) Andrew Bartlett 2001-2002
8 Copyright (C) Stefan (metze) Metzmacher 2002
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "../libcli/auth/libcli_auth.h"
28 #define DBGC_CLASS DBGC_PASSDB
31 * @todo Redefine this to NULL, but this changes the API because
32 * much of samba assumes that the pdb_get...() funtions
33 * return strings. (ie not null-pointers).
34 * See also pdb_fill_default_sam().
37 #define PDB_NOT_QUITE_NULL ""
39 /*********************************************************************
40 Collection of get...() functions for struct samu.
41 ********************************************************************/
43 uint32_t pdb_get_acct_ctrl(const struct samu *sampass)
45 return sampass->acct_ctrl;
48 time_t pdb_get_logon_time(const struct samu *sampass)
50 return sampass->logon_time;
53 time_t pdb_get_logoff_time(const struct samu *sampass)
55 return sampass->logoff_time;
58 time_t pdb_get_kickoff_time(const struct samu *sampass)
60 return sampass->kickoff_time;
63 time_t pdb_get_bad_password_time(const struct samu *sampass)
65 return sampass->bad_password_time;
68 time_t pdb_get_pass_last_set_time(const struct samu *sampass)
70 return sampass->pass_last_set_time;
73 time_t pdb_get_pass_can_change_time(const struct samu *sampass)
77 /* if the last set time is zero, it means the user cannot
78 change their password, and this time must be zero. jmcd
80 if (sampass->pass_last_set_time == 0)
83 /* if the time is max, and the field has been changed,
84 we're trying to update this real value from the sampass
85 to indicate that the user cannot change their password. jmcd
87 if (sampass->pass_can_change_time == get_time_t_max() &&
88 IS_SAM_CHANGED(sampass, PDB_CANCHANGETIME))
89 return sampass->pass_can_change_time;
91 if (!pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &allow))
94 /* in normal cases, just calculate it from policy */
95 return sampass->pass_last_set_time + allow;
98 /* we need this for loading from the backend, so that we don't overwrite
99 non-changed max times, otherwise the pass_can_change checking won't work */
100 time_t pdb_get_pass_can_change_time_noncalc(const struct samu *sampass)
102 return sampass->pass_can_change_time;
105 time_t pdb_get_pass_must_change_time(const struct samu *sampass)
109 if (sampass->pass_last_set_time == 0)
112 if (sampass->acct_ctrl & ACB_PWNOEXP)
113 return get_time_t_max();
115 if (!pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &expire)
116 || expire == (uint32_t)-1 || expire == 0)
117 return get_time_t_max();
119 return sampass->pass_last_set_time + expire;
122 bool pdb_get_pass_can_change(const struct samu *sampass)
124 if (sampass->pass_can_change_time == get_time_t_max() &&
125 sampass->pass_last_set_time != 0)
130 uint16_t pdb_get_logon_divs(const struct samu *sampass)
132 return sampass->logon_divs;
135 uint32_t pdb_get_hours_len(const struct samu *sampass)
137 return sampass->hours_len;
140 const uint8 *pdb_get_hours(const struct samu *sampass)
142 return (sampass->hours);
145 const uint8 *pdb_get_nt_passwd(const struct samu *sampass)
147 SMB_ASSERT((!sampass->nt_pw.data)
148 || sampass->nt_pw.length == NT_HASH_LEN);
149 return (uint8 *)sampass->nt_pw.data;
152 const uint8 *pdb_get_lanman_passwd(const struct samu *sampass)
154 SMB_ASSERT((!sampass->lm_pw.data)
155 || sampass->lm_pw.length == LM_HASH_LEN);
156 return (uint8 *)sampass->lm_pw.data;
159 const uint8 *pdb_get_pw_history(const struct samu *sampass, uint32_t *current_hist_len)
161 SMB_ASSERT((!sampass->nt_pw_his.data)
162 || ((sampass->nt_pw_his.length % PW_HISTORY_ENTRY_LEN) == 0));
163 *current_hist_len = sampass->nt_pw_his.length / PW_HISTORY_ENTRY_LEN;
164 return (uint8 *)sampass->nt_pw_his.data;
167 /* Return the plaintext password if known. Most of the time
168 it isn't, so don't assume anything magic about this function.
170 Used to pass the plaintext to passdb backends that might
171 want to store more than just the NTLM hashes.
173 const char *pdb_get_plaintext_passwd(const struct samu *sampass)
175 return sampass->plaintext_pw;
178 const DOM_SID *pdb_get_user_sid(const struct samu *sampass)
180 return &sampass->user_sid;
183 const DOM_SID *pdb_get_group_sid(struct samu *sampass)
187 bool need_lookup_sid = false;
189 /* Return the cached group SID if we have that */
190 if ( sampass->group_sid ) {
191 return sampass->group_sid;
194 /* generate the group SID from the user's primary Unix group */
196 if ( !(gsid = TALLOC_ZERO_P( sampass, DOM_SID )) ) {
200 /* No algorithmic mapping, meaning that we have to figure out the
201 primary group SID according to group mapping and the user SID must
202 be a newly allocated one. We rely on the user's Unix primary gid.
203 We have no choice but to fail if we can't find it. */
205 if ( sampass->unix_pw ) {
206 pwd = sampass->unix_pw;
208 pwd = Get_Pwnam_alloc( sampass, pdb_get_username(sampass) );
212 DEBUG(0,("pdb_get_group_sid: Failed to find Unix account for %s\n", pdb_get_username(sampass) ));
216 gid_to_sid(gsid, pwd->pw_gid);
217 if (!is_null_sid(gsid)) {
221 sid_copy(&dgsid, gsid);
222 sid_split_rid(&dgsid, &rid);
223 if (sid_equal(&dgsid, get_global_sam_sid())) {
225 * As shortcut for the expensive lookup_sid call
226 * compare the domain sid part
229 case DOMAIN_RID_ADMINS:
230 case DOMAIN_RID_USERS:
231 sampass->group_sid = gsid;
232 return sampass->group_sid;
234 need_lookup_sid = true;
239 if (pdb_gid_to_sid(pwd->pw_gid, gsid)) {
240 need_lookup_sid = true;
245 if (need_lookup_sid) {
246 enum lsa_SidType type = SID_NAME_UNKNOWN;
249 const DOM_SID *usid = pdb_get_user_sid(sampass);
251 mem_ctx = talloc_init("pdb_get_group_sid");
256 DEBUG(10,("do lookup_sid(%s) for group of user %s\n",
257 sid_string_dbg(gsid), sid_string_dbg(usid)));
259 /* Now check that it's actually a domain group and not something else */
261 lookup_ret = lookup_sid(mem_ctx, gsid, NULL, NULL, &type);
263 TALLOC_FREE( mem_ctx );
265 if ( lookup_ret && (type == SID_NAME_DOM_GRP) ) {
266 sampass->group_sid = gsid;
267 return sampass->group_sid;
270 DEBUG(3, ("Primary group %s for user %s is a %s and not a domain group\n",
271 sid_string_dbg(gsid), pwd->pw_name, sid_type_lookup(type)));
274 /* Just set it to the 'Domain Users' RID of 513 which will
275 always resolve to a name */
277 sid_compose(gsid, get_global_sam_sid(), DOMAIN_RID_USERS);
279 sampass->group_sid = gsid;
281 return sampass->group_sid;
285 * Get flags showing what is initalised in the struct samu
286 * @param sampass the struct samu in question
287 * @return the flags indicating the members initialised in the struct.
290 enum pdb_value_state pdb_get_init_flags(const struct samu *sampass, enum pdb_elements element)
292 enum pdb_value_state ret = PDB_DEFAULT;
294 if (!sampass->change_flags || !sampass->set_flags)
297 if (bitmap_query(sampass->set_flags, element)) {
298 DEBUG(11, ("element %d: SET\n", element));
302 if (bitmap_query(sampass->change_flags, element)) {
303 DEBUG(11, ("element %d: CHANGED\n", element));
307 if (ret == PDB_DEFAULT) {
308 DEBUG(11, ("element %d: DEFAULT\n", element));
314 const char *pdb_get_username(const struct samu *sampass)
316 return sampass->username;
319 const char *pdb_get_domain(const struct samu *sampass)
321 return sampass->domain;
324 const char *pdb_get_nt_username(const struct samu *sampass)
326 return sampass->nt_username;
329 const char *pdb_get_fullname(const struct samu *sampass)
331 return sampass->full_name;
334 const char *pdb_get_homedir(const struct samu *sampass)
336 return sampass->home_dir;
339 const char *pdb_get_dir_drive(const struct samu *sampass)
341 return sampass->dir_drive;
344 const char *pdb_get_logon_script(const struct samu *sampass)
346 return sampass->logon_script;
349 const char *pdb_get_profile_path(const struct samu *sampass)
351 return sampass->profile_path;
354 const char *pdb_get_acct_desc(const struct samu *sampass)
356 return sampass->acct_desc;
359 const char *pdb_get_workstations(const struct samu *sampass)
361 return sampass->workstations;
364 const char *pdb_get_comment(const struct samu *sampass)
366 return sampass->comment;
369 const char *pdb_get_munged_dial(const struct samu *sampass)
371 return sampass->munged_dial;
374 uint16_t pdb_get_bad_password_count(const struct samu *sampass)
376 return sampass->bad_password_count;
379 uint16_t pdb_get_logon_count(const struct samu *sampass)
381 return sampass->logon_count;
384 uint32_t pdb_get_unknown_6(const struct samu *sampass)
386 return sampass->unknown_6;
389 void *pdb_get_backend_private_data(const struct samu *sampass, const struct pdb_methods *my_methods)
391 if (my_methods == sampass->backend_private_methods) {
392 return sampass->backend_private_data;
398 /*********************************************************************
399 Collection of set...() functions for struct samu.
400 ********************************************************************/
402 bool pdb_set_acct_ctrl(struct samu *sampass, uint32_t acct_ctrl, enum pdb_value_state flag)
404 sampass->acct_ctrl = acct_ctrl;
405 return pdb_set_init_flags(sampass, PDB_ACCTCTRL, flag);
408 bool pdb_set_logon_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
410 sampass->logon_time = mytime;
411 return pdb_set_init_flags(sampass, PDB_LOGONTIME, flag);
414 bool pdb_set_logoff_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
416 sampass->logoff_time = mytime;
417 return pdb_set_init_flags(sampass, PDB_LOGOFFTIME, flag);
420 bool pdb_set_kickoff_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
422 sampass->kickoff_time = mytime;
423 return pdb_set_init_flags(sampass, PDB_KICKOFFTIME, flag);
426 bool pdb_set_bad_password_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
428 sampass->bad_password_time = mytime;
429 return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_TIME, flag);
432 bool pdb_set_pass_can_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
434 sampass->pass_can_change_time = mytime;
435 return pdb_set_init_flags(sampass, PDB_CANCHANGETIME, flag);
438 bool pdb_set_pass_must_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
440 sampass->pass_must_change_time = mytime;
441 return pdb_set_init_flags(sampass, PDB_MUSTCHANGETIME, flag);
444 bool pdb_set_pass_last_set_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
446 sampass->pass_last_set_time = mytime;
447 return pdb_set_init_flags(sampass, PDB_PASSLASTSET, flag);
450 bool pdb_set_hours_len(struct samu *sampass, uint32_t len, enum pdb_value_state flag)
452 sampass->hours_len = len;
453 return pdb_set_init_flags(sampass, PDB_HOURSLEN, flag);
456 bool pdb_set_logon_divs(struct samu *sampass, uint16_t hours, enum pdb_value_state flag)
458 sampass->logon_divs = hours;
459 return pdb_set_init_flags(sampass, PDB_LOGONDIVS, flag);
463 * Set flags showing what is initalised in the struct samu
464 * @param sampass the struct samu in question
465 * @param flag The *new* flag to be set. Old flags preserved
466 * this flag is only added.
469 bool pdb_set_init_flags(struct samu *sampass, enum pdb_elements element, enum pdb_value_state value_flag)
471 if (!sampass->set_flags) {
472 if ((sampass->set_flags =
473 bitmap_talloc(sampass,
475 DEBUG(0,("bitmap_talloc failed\n"));
479 if (!sampass->change_flags) {
480 if ((sampass->change_flags =
481 bitmap_talloc(sampass,
483 DEBUG(0,("bitmap_talloc failed\n"));
490 if (!bitmap_set(sampass->change_flags, element)) {
491 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
494 if (!bitmap_set(sampass->set_flags, element)) {
495 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
498 DEBUG(11, ("element %d -> now CHANGED\n", element));
501 if (!bitmap_clear(sampass->change_flags, element)) {
502 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
505 if (!bitmap_set(sampass->set_flags, element)) {
506 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
509 DEBUG(11, ("element %d -> now SET\n", element));
513 if (!bitmap_clear(sampass->change_flags, element)) {
514 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
517 if (!bitmap_clear(sampass->set_flags, element)) {
518 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
521 DEBUG(11, ("element %d -> now DEFAULT\n", element));
528 bool pdb_set_user_sid(struct samu *sampass, const DOM_SID *u_sid, enum pdb_value_state flag)
533 sid_copy(&sampass->user_sid, u_sid);
535 DEBUG(10, ("pdb_set_user_sid: setting user sid %s\n",
536 sid_string_dbg(&sampass->user_sid)));
538 return pdb_set_init_flags(sampass, PDB_USERSID, flag);
541 bool pdb_set_user_sid_from_string(struct samu *sampass, fstring u_sid, enum pdb_value_state flag)
548 DEBUG(10, ("pdb_set_user_sid_from_string: setting user sid %s\n",
551 if (!string_to_sid(&new_sid, u_sid)) {
552 DEBUG(1, ("pdb_set_user_sid_from_string: %s isn't a valid SID!\n", u_sid));
556 if (!pdb_set_user_sid(sampass, &new_sid, flag)) {
557 DEBUG(1, ("pdb_set_user_sid_from_string: could not set sid %s on struct samu!\n", u_sid));
564 /********************************************************************
565 We never fill this in from a passdb backend but rather set is
566 based on the user's primary group membership. However, the
567 struct samu* is overloaded and reused in domain memship code
568 as well and built from the netr_SamInfo3 or PAC so we
569 have to allow the explicitly setting of a group SID here.
570 ********************************************************************/
572 bool pdb_set_group_sid(struct samu *sampass, const DOM_SID *g_sid, enum pdb_value_state flag)
580 if ( !(sampass->group_sid = TALLOC_P( sampass, DOM_SID )) ) {
584 /* if we cannot resolve the SID to gid, then just ignore it and
585 store DOMAIN_USERS as the primary groupSID */
587 sid_compose(&dug_sid, get_global_sam_sid(), DOMAIN_RID_USERS);
589 if (sid_equal(&dug_sid, g_sid)) {
590 sid_copy(sampass->group_sid, &dug_sid);
591 } else if (sid_to_gid( g_sid, &gid ) ) {
592 sid_copy(sampass->group_sid, g_sid);
594 sid_copy(sampass->group_sid, &dug_sid);
597 DEBUG(10, ("pdb_set_group_sid: setting group sid %s\n",
598 sid_string_dbg(sampass->group_sid)));
600 return pdb_set_init_flags(sampass, PDB_GROUPSID, flag);
603 /*********************************************************************
604 Set the user's UNIX name.
605 ********************************************************************/
607 bool pdb_set_username(struct samu *sampass, const char *username, enum pdb_value_state flag)
610 DEBUG(10, ("pdb_set_username: setting username %s, was %s\n", username,
611 (sampass->username)?(sampass->username):"NULL"));
613 sampass->username = talloc_strdup(sampass, username);
615 if (!sampass->username) {
616 DEBUG(0, ("pdb_set_username: talloc_strdup() failed!\n"));
620 sampass->username = PDB_NOT_QUITE_NULL;
623 return pdb_set_init_flags(sampass, PDB_USERNAME, flag);
626 /*********************************************************************
628 ********************************************************************/
630 bool pdb_set_domain(struct samu *sampass, const char *domain, enum pdb_value_state flag)
633 DEBUG(10, ("pdb_set_domain: setting domain %s, was %s\n", domain,
634 (sampass->domain)?(sampass->domain):"NULL"));
636 sampass->domain = talloc_strdup(sampass, domain);
638 if (!sampass->domain) {
639 DEBUG(0, ("pdb_set_domain: talloc_strdup() failed!\n"));
643 sampass->domain = PDB_NOT_QUITE_NULL;
646 return pdb_set_init_flags(sampass, PDB_DOMAIN, flag);
649 /*********************************************************************
650 Set the user's NT name.
651 ********************************************************************/
653 bool pdb_set_nt_username(struct samu *sampass, const char *nt_username, enum pdb_value_state flag)
656 DEBUG(10, ("pdb_set_nt_username: setting nt username %s, was %s\n", nt_username,
657 (sampass->nt_username)?(sampass->nt_username):"NULL"));
659 sampass->nt_username = talloc_strdup(sampass, nt_username);
661 if (!sampass->nt_username) {
662 DEBUG(0, ("pdb_set_nt_username: talloc_strdup() failed!\n"));
666 sampass->nt_username = PDB_NOT_QUITE_NULL;
669 return pdb_set_init_flags(sampass, PDB_NTUSERNAME, flag);
672 /*********************************************************************
673 Set the user's full name.
674 ********************************************************************/
676 bool pdb_set_fullname(struct samu *sampass, const char *full_name, enum pdb_value_state flag)
679 DEBUG(10, ("pdb_set_full_name: setting full name %s, was %s\n", full_name,
680 (sampass->full_name)?(sampass->full_name):"NULL"));
682 sampass->full_name = talloc_strdup(sampass, full_name);
684 if (!sampass->full_name) {
685 DEBUG(0, ("pdb_set_fullname: talloc_strdup() failed!\n"));
689 sampass->full_name = PDB_NOT_QUITE_NULL;
692 return pdb_set_init_flags(sampass, PDB_FULLNAME, flag);
695 /*********************************************************************
696 Set the user's logon script.
697 ********************************************************************/
699 bool pdb_set_logon_script(struct samu *sampass, const char *logon_script, enum pdb_value_state flag)
702 DEBUG(10, ("pdb_set_logon_script: setting logon script %s, was %s\n", logon_script,
703 (sampass->logon_script)?(sampass->logon_script):"NULL"));
705 sampass->logon_script = talloc_strdup(sampass, logon_script);
707 if (!sampass->logon_script) {
708 DEBUG(0, ("pdb_set_logon_script: talloc_strdup() failed!\n"));
712 sampass->logon_script = PDB_NOT_QUITE_NULL;
715 return pdb_set_init_flags(sampass, PDB_LOGONSCRIPT, flag);
718 /*********************************************************************
719 Set the user's profile path.
720 ********************************************************************/
722 bool pdb_set_profile_path(struct samu *sampass, const char *profile_path, enum pdb_value_state flag)
725 DEBUG(10, ("pdb_set_profile_path: setting profile path %s, was %s\n", profile_path,
726 (sampass->profile_path)?(sampass->profile_path):"NULL"));
728 sampass->profile_path = talloc_strdup(sampass, profile_path);
730 if (!sampass->profile_path) {
731 DEBUG(0, ("pdb_set_profile_path: talloc_strdup() failed!\n"));
735 sampass->profile_path = PDB_NOT_QUITE_NULL;
738 return pdb_set_init_flags(sampass, PDB_PROFILE, flag);
741 /*********************************************************************
742 Set the user's directory drive.
743 ********************************************************************/
745 bool pdb_set_dir_drive(struct samu *sampass, const char *dir_drive, enum pdb_value_state flag)
748 DEBUG(10, ("pdb_set_dir_drive: setting dir drive %s, was %s\n", dir_drive,
749 (sampass->dir_drive)?(sampass->dir_drive):"NULL"));
751 sampass->dir_drive = talloc_strdup(sampass, dir_drive);
753 if (!sampass->dir_drive) {
754 DEBUG(0, ("pdb_set_dir_drive: talloc_strdup() failed!\n"));
759 sampass->dir_drive = PDB_NOT_QUITE_NULL;
762 return pdb_set_init_flags(sampass, PDB_DRIVE, flag);
765 /*********************************************************************
766 Set the user's home directory.
767 ********************************************************************/
769 bool pdb_set_homedir(struct samu *sampass, const char *home_dir, enum pdb_value_state flag)
772 DEBUG(10, ("pdb_set_homedir: setting home dir %s, was %s\n", home_dir,
773 (sampass->home_dir)?(sampass->home_dir):"NULL"));
775 sampass->home_dir = talloc_strdup(sampass, home_dir);
777 if (!sampass->home_dir) {
778 DEBUG(0, ("pdb_set_home_dir: talloc_strdup() failed!\n"));
782 sampass->home_dir = PDB_NOT_QUITE_NULL;
785 return pdb_set_init_flags(sampass, PDB_SMBHOME, flag);
788 /*********************************************************************
789 Set the user's account description.
790 ********************************************************************/
792 bool pdb_set_acct_desc(struct samu *sampass, const char *acct_desc, enum pdb_value_state flag)
795 sampass->acct_desc = talloc_strdup(sampass, acct_desc);
797 if (!sampass->acct_desc) {
798 DEBUG(0, ("pdb_set_acct_desc: talloc_strdup() failed!\n"));
802 sampass->acct_desc = PDB_NOT_QUITE_NULL;
805 return pdb_set_init_flags(sampass, PDB_ACCTDESC, flag);
808 /*********************************************************************
809 Set the user's workstation allowed list.
810 ********************************************************************/
812 bool pdb_set_workstations(struct samu *sampass, const char *workstations, enum pdb_value_state flag)
815 DEBUG(10, ("pdb_set_workstations: setting workstations %s, was %s\n", workstations,
816 (sampass->workstations)?(sampass->workstations):"NULL"));
818 sampass->workstations = talloc_strdup(sampass, workstations);
820 if (!sampass->workstations) {
821 DEBUG(0, ("pdb_set_workstations: talloc_strdup() failed!\n"));
825 sampass->workstations = PDB_NOT_QUITE_NULL;
828 return pdb_set_init_flags(sampass, PDB_WORKSTATIONS, flag);
831 /*********************************************************************
832 ********************************************************************/
834 bool pdb_set_comment(struct samu *sampass, const char *comment, enum pdb_value_state flag)
837 sampass->comment = talloc_strdup(sampass, comment);
839 if (!sampass->comment) {
840 DEBUG(0, ("pdb_set_comment: talloc_strdup() failed!\n"));
844 sampass->comment = PDB_NOT_QUITE_NULL;
847 return pdb_set_init_flags(sampass, PDB_COMMENT, flag);
850 /*********************************************************************
851 Set the user's dial string.
852 ********************************************************************/
854 bool pdb_set_munged_dial(struct samu *sampass, const char *munged_dial, enum pdb_value_state flag)
857 sampass->munged_dial = talloc_strdup(sampass, munged_dial);
859 if (!sampass->munged_dial) {
860 DEBUG(0, ("pdb_set_munged_dial: talloc_strdup() failed!\n"));
864 sampass->munged_dial = PDB_NOT_QUITE_NULL;
867 return pdb_set_init_flags(sampass, PDB_MUNGEDDIAL, flag);
870 /*********************************************************************
871 Set the user's NT hash.
872 ********************************************************************/
874 bool pdb_set_nt_passwd(struct samu *sampass, const uint8 pwd[NT_HASH_LEN], enum pdb_value_state flag)
876 data_blob_clear_free(&sampass->nt_pw);
880 data_blob_talloc(sampass, pwd, NT_HASH_LEN);
882 sampass->nt_pw = data_blob_null;
885 return pdb_set_init_flags(sampass, PDB_NTPASSWD, flag);
888 /*********************************************************************
889 Set the user's LM hash.
890 ********************************************************************/
892 bool pdb_set_lanman_passwd(struct samu *sampass, const uint8 pwd[LM_HASH_LEN], enum pdb_value_state flag)
894 data_blob_clear_free(&sampass->lm_pw);
896 /* on keep the password if we are allowing LANMAN authentication */
898 if (pwd && lp_lanman_auth() ) {
899 sampass->lm_pw = data_blob_talloc(sampass, pwd, LM_HASH_LEN);
901 sampass->lm_pw = data_blob_null;
904 return pdb_set_init_flags(sampass, PDB_LMPASSWD, flag);
907 /*********************************************************************
908 Set the user's password history hash. historyLen is the number of
909 PW_HISTORY_SALT_LEN+SALTED_MD5_HASH_LEN length
910 entries to store in the history - this must match the size of the uint8 array
912 ********************************************************************/
914 bool pdb_set_pw_history(struct samu *sampass, const uint8 *pwd, uint32_t historyLen, enum pdb_value_state flag)
916 if (historyLen && pwd){
917 data_blob_free(&(sampass->nt_pw_his));
918 sampass->nt_pw_his = data_blob_talloc(sampass,
919 pwd, historyLen*PW_HISTORY_ENTRY_LEN);
920 if (!sampass->nt_pw_his.length) {
921 DEBUG(0, ("pdb_set_pw_history: data_blob_talloc() failed!\n"));
925 sampass->nt_pw_his = data_blob_talloc(sampass, NULL, 0);
928 return pdb_set_init_flags(sampass, PDB_PWHISTORY, flag);
931 /*********************************************************************
932 Set the user's plaintext password only (base procedure, see helper
934 ********************************************************************/
936 bool pdb_set_plaintext_pw_only(struct samu *sampass, const char *password, enum pdb_value_state flag)
939 if (sampass->plaintext_pw!=NULL)
940 memset(sampass->plaintext_pw,'\0',strlen(sampass->plaintext_pw)+1);
942 sampass->plaintext_pw = talloc_strdup(sampass, password);
944 if (!sampass->plaintext_pw) {
945 DEBUG(0, ("pdb_set_unknown_str: talloc_strdup() failed!\n"));
949 sampass->plaintext_pw = NULL;
952 return pdb_set_init_flags(sampass, PDB_PLAINTEXT_PW, flag);
955 bool pdb_set_bad_password_count(struct samu *sampass, uint16_t bad_password_count, enum pdb_value_state flag)
957 sampass->bad_password_count = bad_password_count;
958 return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_COUNT, flag);
961 bool pdb_set_logon_count(struct samu *sampass, uint16_t logon_count, enum pdb_value_state flag)
963 sampass->logon_count = logon_count;
964 return pdb_set_init_flags(sampass, PDB_LOGON_COUNT, flag);
967 bool pdb_set_unknown_6(struct samu *sampass, uint32_t unkn, enum pdb_value_state flag)
969 sampass->unknown_6 = unkn;
970 return pdb_set_init_flags(sampass, PDB_UNKNOWN6, flag);
973 bool pdb_set_hours(struct samu *sampass, const uint8 *hours, enum pdb_value_state flag)
976 memset ((char *)sampass->hours, 0, MAX_HOURS_LEN);
978 memcpy (sampass->hours, hours, MAX_HOURS_LEN);
981 return pdb_set_init_flags(sampass, PDB_HOURS, flag);
984 bool pdb_set_backend_private_data(struct samu *sampass, void *private_data,
985 void (*free_fn)(void **),
986 const struct pdb_methods *my_methods,
987 enum pdb_value_state flag)
989 if (sampass->backend_private_data &&
990 sampass->backend_private_data_free_fn) {
991 sampass->backend_private_data_free_fn(
992 &sampass->backend_private_data);
995 sampass->backend_private_data = private_data;
996 sampass->backend_private_data_free_fn = free_fn;
997 sampass->backend_private_methods = my_methods;
999 return pdb_set_init_flags(sampass, PDB_BACKEND_PRIVATE_DATA, flag);
1003 /* Helpful interfaces to the above */
1005 bool pdb_set_pass_can_change(struct samu *sampass, bool canchange)
1007 return pdb_set_pass_can_change_time(sampass,
1008 canchange ? 0 : get_time_t_max(),
1013 /*********************************************************************
1014 Set the user's PLAINTEXT password. Used as an interface to the above.
1015 Also sets the last change time to NOW.
1016 ********************************************************************/
1018 bool pdb_set_plaintext_passwd(struct samu *sampass, const char *plaintext)
1020 uchar new_lanman_p16[LM_HASH_LEN];
1021 uchar new_nt_p16[NT_HASH_LEN];
1024 uint32_t current_history_len;
1029 /* Calculate the MD4 hash (NT compatible) of the password */
1030 E_md4hash(plaintext, new_nt_p16);
1032 if (!pdb_set_nt_passwd (sampass, new_nt_p16, PDB_CHANGED))
1035 if (!E_deshash(plaintext, new_lanman_p16)) {
1036 /* E_deshash returns false for 'long' passwords (> 14
1037 DOS chars). This allows us to match Win2k, which
1038 does not store a LM hash for these passwords (which
1039 would reduce the effective password length to 14 */
1041 if (!pdb_set_lanman_passwd (sampass, NULL, PDB_CHANGED))
1044 if (!pdb_set_lanman_passwd (sampass, new_lanman_p16, PDB_CHANGED))
1048 if (!pdb_set_plaintext_pw_only (sampass, plaintext, PDB_CHANGED))
1051 if (!pdb_set_pass_last_set_time (sampass, time(NULL), PDB_CHANGED))
1054 if ((pdb_get_acct_ctrl(sampass) & ACB_NORMAL) == 0) {
1056 * No password history for non-user accounts
1061 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
1063 if (pwHistLen == 0) {
1064 /* Set the history length to zero. */
1065 pdb_set_pw_history(sampass, NULL, 0, PDB_CHANGED);
1070 * We need to make sure we don't have a race condition here -
1071 * the account policy history length can change between when
1072 * the pw_history was first loaded into the struct samu struct
1075 pwhistory = (uchar *)pdb_get_pw_history(sampass, ¤t_history_len);
1077 if ((current_history_len != 0) && (pwhistory == NULL)) {
1078 DEBUG(1, ("pdb_set_plaintext_passwd: pwhistory == NULL!\n"));
1082 if (current_history_len < pwHistLen) {
1084 * Ensure we have space for the needed history. This
1085 * also takes care of an account which did not have
1086 * any history at all so far, i.e. pwhistory==NULL
1088 uchar *new_history = talloc_zero_array(
1090 pwHistLen*PW_HISTORY_ENTRY_LEN);
1096 memcpy(new_history, pwhistory,
1097 current_history_len*PW_HISTORY_ENTRY_LEN);
1099 pwhistory = new_history;
1103 * Make room for the new password in the history list.
1105 if (pwHistLen > 1) {
1106 memmove(&pwhistory[PW_HISTORY_ENTRY_LEN], pwhistory,
1107 (pwHistLen-1)*PW_HISTORY_ENTRY_LEN );
1111 * Fill the salt area with 0-s: this indicates that
1112 * a plain nt hash is stored in the has area.
1113 * The old format was to store a 16 byte salt and
1114 * then an md5hash of the nt_hash concatenated with
1117 memset(pwhistory, 0, PW_HISTORY_SALT_LEN);
1120 * Store the plain nt hash in the second 16 bytes.
1121 * The old format was to store the md5 hash of
1124 memcpy(&pwhistory[PW_HISTORY_SALT_LEN], new_nt_p16, SALTED_MD5_HASH_LEN);
1126 pdb_set_pw_history(sampass, pwhistory, pwHistLen, PDB_CHANGED);
1131 /* check for any PDB_SET/CHANGED field and fill the appropriate mask bit */
1132 uint32_t pdb_build_fields_present(struct samu *sampass)
1134 /* value set to all for testing */