b36b5bbe889b0266a65696153b6a94929ebe6cc3
[ira/wip.git] / source3 / nsswitch / libwbclient / wbclient.h
1 /*
2    Unix SMB/CIFS implementation.
3
4    Winbind client API
5
6    Copyright (C) Gerald (Jerry) Carter 2007
7
8    This library is free software; you can redistribute it and/or
9    modify it under the terms of the GNU Lesser General Public
10    License as published by the Free Software Foundation; either
11    version 3 of the License, or (at your option) any later version.
12
13    This library is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
16    Library General Public License for more details.
17
18    You should have received a copy of the GNU Lesser General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #ifndef _WBCLIENT_H
23 #define _WBCLIENT_H
24
25 #include <pwd.h>
26 #include <grp.h>
27
28 /* Define error types */
29
30 /**
31  *  @brief Status codes returned from wbc functions
32  **/
33
34 enum _wbcErrType {
35         WBC_ERR_SUCCESS = 0,    /**< Successful completion **/
36         WBC_ERR_NOT_IMPLEMENTED,/**< Function not implemented **/
37         WBC_ERR_UNKNOWN_FAILURE,/**< General failure **/
38         WBC_ERR_NO_MEMORY,      /**< Memory allocation error **/
39         WBC_ERR_INVALID_SID,    /**< Invalid SID format **/
40         WBC_ERR_INVALID_PARAM,  /**< An Invalid parameter was supplied **/
41         WBC_ERR_WINBIND_NOT_AVAILABLE,   /**< Winbind daemon is not available **/
42         WBC_ERR_DOMAIN_NOT_FOUND,        /**< Domain is not trusted or cannot be found **/
43         WBC_INVALID_RESPONSE,        /**< Winbind returned an invalid response **/
44         WBC_ERR_NSS_ERROR,            /**< NSS_STATUS error **/
45         WBC_ERR_AUTH_ERROR        /**< Authentication failed **/
46 };
47
48 typedef enum _wbcErrType wbcErr;
49
50 #define WBC_ERROR_IS_OK(x) ((x) == WBC_ERR_SUCCESS)
51
52 const char *wbcErrorString(wbcErr error);
53
54 /**
55  *  @brief Some useful details about the running winbindd
56  *
57  **/
58 struct wbcInterfaceDetails {
59         uint32_t interface_version;
60         const char *winbind_version;
61         char winbind_separator;
62         const char *netbios_name;
63         const char *netbios_domain;
64         const char *dns_domain;
65 };
66
67 /*
68  * Data types used by the Winbind Client API
69  */
70
71 #ifndef MAXSUBAUTHS
72 #define MAXSUBAUTHS 15 /* max sub authorities in a SID */
73 #endif
74
75 /**
76  *  @brief Windows Security Identifier
77  *
78  **/
79
80 struct wbcDomainSid {
81         uint8_t   sid_rev_num;
82         uint8_t   num_auths;
83         uint8_t   id_auth[6];
84         uint32_t  sub_auths[MAXSUBAUTHS];
85 };
86
87 /**
88  * @brief Security Identifier type
89  **/
90
91 enum wbcSidType {
92         WBC_SID_NAME_USE_NONE=0,
93         WBC_SID_NAME_USER=1,
94         WBC_SID_NAME_DOM_GRP=2,
95         WBC_SID_NAME_DOMAIN=3,
96         WBC_SID_NAME_ALIAS=4,
97         WBC_SID_NAME_WKN_GRP=5,
98         WBC_SID_NAME_DELETED=6,
99         WBC_SID_NAME_INVALID=7,
100         WBC_SID_NAME_UNKNOWN=8,
101         WBC_SID_NAME_COMPUTER=9
102 };
103
104 /**
105  * @brief Security Identifier with attributes
106  **/
107
108 struct wbcSidWithAttr {
109         struct wbcDomainSid sid;
110         uint32_t attributes;
111 };
112
113 /* wbcSidWithAttr->attributes */
114
115 #define WBC_SID_ATTR_GROUP_MANDATORY            0x00000001
116 #define WBC_SID_ATTR_GROUP_ENABLED_BY_DEFAULT   0x00000002
117 #define WBC_SID_ATTR_GROUP_ENABLED              0x00000004
118 #define WBC_SID_ATTR_GROUP_OWNER                0x00000008
119 #define WBC_SID_ATTR_GROUP_USEFOR_DENY_ONLY     0x00000010
120 #define WBC_SID_ATTR_GROUP_RESOURCE             0x20000000
121 #define WBC_SID_ATTR_GROUP_LOGON_ID             0xC0000000
122
123 /**
124  * @brief Domain Information
125  **/
126
127 struct wbcDomainInfo {
128         char *short_name;
129         char *dns_name;
130         struct wbcDomainSid sid;
131         uint32_t flags;
132 };
133
134 /* wbcDomainInfo->flags */
135
136 #define WBC_DOMINFO_NATIVE            0x00000001
137 #define WBC_DOMINFO_AD                0x00000002
138 #define WBC_DOMINFO_PRIMARY           0x00000004
139
140 /**
141  * @brief Auth User Parameters
142  **/
143
144 struct wbcAuthUserParams {
145         const char *account_name;
146         const char *domain_name;
147         const char *workstation_name;
148
149         uint32_t flags;
150
151         uint32_t parameter_control;
152
153         enum wbcAuthUserLevel {
154                 WBC_AUTH_USER_LEVEL_PLAIN = 1,
155                 WBC_AUTH_USER_LEVEL_HASH = 2,
156                 WBC_AUTH_USER_LEVEL_RESPONSE = 3
157         } level;
158         union {
159                 const char *plaintext;
160                 struct {
161                         uint8_t nt_hash[16];
162                         uint8_t lm_hash[16];
163                 } hash;
164                 struct {
165                         uint8_t challenge[8];
166                         uint32_t nt_length;
167                         uint8_t *nt_data;
168                         uint32_t lm_length;
169                         uint8_t *lm_data;
170                 } response;
171         } password;
172 };
173
174 /* wbcAuthUserParams->parameter_control */
175
176 #define WBC_MSV1_0_CLEARTEXT_PASSWORD_ALLOWED           0x00000002
177 #define WBC_MSV1_0_UPDATE_LOGON_STATISTICS              0x00000004
178 #define WBC_MSV1_0_RETURN_USER_PARAMETERS               0x00000008
179 #define WBC_MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT           0x00000020
180 #define WBC_MSV1_0_RETURN_PROFILE_PATH                  0x00000200
181 #define WBC_MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT      0x00000800
182
183 /* wbcAuthUserParams->flags */
184
185 #define WBC_AUTH_PARAM_FLAGS_INTERACTIVE_LOGON          0x00000001
186
187 /**
188  * @brief Auth User Information
189  *
190  * Some of the strings are maybe NULL
191  **/
192
193 struct wbcAuthUserInfo {
194         uint32_t user_flags;
195
196         char *account_name;
197         char *user_principal;
198         char *full_name;
199         char *domain_name;
200         char *dns_domain_name;
201
202         uint32_t acct_flags;
203         uint8_t user_session_key[16];
204         uint8_t lm_session_key[8];
205
206         uint16_t logon_count;
207         uint16_t bad_password_count;
208
209         uint64_t logon_time;
210         uint64_t logoff_time;
211         uint64_t kickoff_time;
212         uint64_t pass_last_set_time;
213         uint64_t pass_can_change_time;
214         uint64_t pass_must_change_time;
215
216         char *logon_server;
217         char *logon_script;
218         char *profile_path;
219         char *home_directory;
220         char *home_drive;
221
222         /*
223          * the 1st one is the account sid
224          * the 2nd one is the primary_group sid
225          * followed by the rest of the groups
226          */
227         uint32_t num_sids;
228         struct wbcSidWithAttr *sids;
229 };
230
231 /* wbcAuthUserInfo->user_flags */
232
233 #define WBC_AUTH_USER_INFO_GUEST                        0x00000001
234 #define WBC_AUTH_USER_INFO_NOENCRYPTION                 0x00000002
235 #define WBC_AUTH_USER_INFO_CACHED_ACCOUNT               0x00000004
236 #define WBC_AUTH_USER_INFO_USED_LM_PASSWORD             0x00000008
237 #define WBC_AUTH_USER_INFO_EXTRA_SIDS                   0x00000020
238 #define WBC_AUTH_USER_INFO_SUBAUTH_SESSION_KEY          0x00000040
239 #define WBC_AUTH_USER_INFO_SERVER_TRUST_ACCOUNT         0x00000080
240 #define WBC_AUTH_USER_INFO_NTLMV2_ENABLED               0x00000100
241 #define WBC_AUTH_USER_INFO_RESOURCE_GROUPS              0x00000200
242 #define WBC_AUTH_USER_INFO_PROFILE_PATH_RETURNED        0x00000400
243 #define WBC_AUTH_USER_INFO_GRACE_LOGON                  0x01000000
244
245 /* wbcAuthUserInfo->acct_flags */
246
247 #define WBC_ACB_DISABLED                        0x00000001 /* 1 User account disabled */
248 #define WBC_ACB_HOMDIRREQ                       0x00000002 /* 1 Home directory required */
249 #define WBC_ACB_PWNOTREQ                        0x00000004 /* 1 User password not required */
250 #define WBC_ACB_TEMPDUP                         0x00000008 /* 1 Temporary duplicate account */
251 #define WBC_ACB_NORMAL                          0x00000010 /* 1 Normal user account */
252 #define WBC_ACB_MNS                             0x00000020 /* 1 MNS logon user account */
253 #define WBC_ACB_DOMTRUST                        0x00000040 /* 1 Interdomain trust account */
254 #define WBC_ACB_WSTRUST                         0x00000080 /* 1 Workstation trust account */
255 #define WBC_ACB_SVRTRUST                        0x00000100 /* 1 Server trust account */
256 #define WBC_ACB_PWNOEXP                         0x00000200 /* 1 User password does not expire */
257 #define WBC_ACB_AUTOLOCK                        0x00000400 /* 1 Account auto locked */
258 #define WBC_ACB_ENC_TXT_PWD_ALLOWED             0x00000800 /* 1 Encryped text password is allowed */
259 #define WBC_ACB_SMARTCARD_REQUIRED              0x00001000 /* 1 Smart Card required */
260 #define WBC_ACB_TRUSTED_FOR_DELEGATION          0x00002000 /* 1 Trusted for Delegation */
261 #define WBC_ACB_NOT_DELEGATED                   0x00004000 /* 1 Not delegated */
262 #define WBC_ACB_USE_DES_KEY_ONLY                0x00008000 /* 1 Use DES key only */
263 #define WBC_ACB_DONT_REQUIRE_PREAUTH            0x00010000 /* 1 Preauth not required */
264 #define WBC_ACB_PW_EXPIRED                      0x00020000 /* 1 Password Expired */
265 #define WBC_ACB_NO_AUTH_DATA_REQD               0x00080000   /* 1 = No authorization data required */
266
267 struct wbcAuthErrorInfo {
268         uint32_t nt_status;
269         char *nt_string;
270         int32_t pam_error;
271         char *display_string;
272 };
273
274 /*
275  * Memory Management
276  */
277
278 void wbcFreeMemory(void*);
279
280
281 /*
282  * Utility functions for dealing with SIDs
283  */
284
285 wbcErr wbcSidToString(const struct wbcDomainSid *sid,
286                       char **sid_string);
287
288 wbcErr wbcStringToSid(const char *sid_string,
289                       struct wbcDomainSid *sid);
290
291 wbcErr wbcPing(void);
292
293 wbcErr wbcInterfaceDetails(struct wbcInterfaceDetails **details);
294
295 /*
296  * Name/SID conversion
297  */
298
299 wbcErr wbcLookupName(const char *dom_name,
300                      const char *name,
301                      struct wbcDomainSid *sid,
302                      enum wbcSidType *name_type);
303
304 wbcErr wbcLookupSid(const struct wbcDomainSid *sid,
305                     char **domain,
306                     char **name,
307                     enum wbcSidType *name_type);
308
309 wbcErr wbcLookupRids(struct wbcDomainSid *dom_sid,
310                      int num_rids,
311                      uint32_t *rids,
312                      const char **domain_name,
313                      const char ***names,
314                      enum wbcSidType **types);
315
316 wbcErr wbcLookupUserSids(const struct wbcDomainSid *user_sid,
317                          bool domain_groups_only,
318                          uint32_t *num_sids,
319                          struct wbcDomainSid **sids);
320
321 wbcErr wbcListUsers(const char *domain_name,
322                     uint32_t *num_users,
323                     const char ***users);
324
325 wbcErr wbcListGroups(const char *domain_name,
326                      uint32_t *num_groups,
327                      const char ***groups);
328
329 /*
330  * SID/uid/gid Mappings
331  */
332
333 wbcErr wbcSidToUid(const struct wbcDomainSid *sid,
334                    uid_t *puid);
335
336 wbcErr wbcUidToSid(uid_t uid,
337                    struct wbcDomainSid *sid);
338
339 wbcErr wbcSidToGid(const struct wbcDomainSid *sid,
340                    gid_t *pgid);
341
342 wbcErr wbcGidToSid(gid_t gid,
343                    struct wbcDomainSid *sid);
344
345 wbcErr wbcAllocateUid(uid_t *puid);
346
347 wbcErr wbcAllocateGid(gid_t *pgid);
348
349 wbcErr wbcSetUidMapping(uid_t uid, const struct wbcDomainSid *sid);
350
351 wbcErr wbcSetGidMapping(gid_t gid, const struct wbcDomainSid *sid);
352
353 wbcErr wbcSetUidHwm(uid_t uid_hwm);
354
355 wbcErr wbcSetGidHwm(gid_t gid_hwm);
356
357 /*
358  * NSS Lookup User/Group details
359  */
360
361 wbcErr wbcGetpwnam(const char *name, struct passwd **pwd);
362
363 wbcErr wbcGetpwuid(uid_t uid, struct passwd **pwd);
364
365 wbcErr wbcGetgrnam(const char *name, struct group **grp);
366
367 wbcErr wbcGetgrgid(gid_t gid, struct group **grp);
368
369 wbcErr wbcSetpwent(void);
370
371 wbcErr wbcEndpwent(void);
372
373 wbcErr wbcGetpwent(struct passwd **pwd);
374
375 wbcErr wbcSetgrent(void);
376
377 wbcErr wbcEndgrent(void);
378
379 wbcErr wbcGetgrent(struct group **grp);
380
381 wbcErr wbcGetGroups(const char *account,
382                     uint32_t *num_groups,
383                     gid_t **_groups);
384
385
386 /*
387  * Lookup Domain information
388  */
389
390 wbcErr wbcDomainInfo(const char *domain,
391                      struct wbcDomainInfo **info);
392
393 /*
394  * Athenticate functions
395  */
396
397 wbcErr wbcAuthenticateUser(const char *username,
398                            const char *password);
399
400 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
401                              struct wbcAuthUserInfo **info,
402                              struct wbcAuthErrorInfo **error);
403
404 /*
405  * Resolve functions
406  */
407 wbcErr wbcResolveWinsByName(const char *name, const char **ip);
408 wbcErr wbcResolveWinsByIP(const char *ip, const char **name);
409
410 /*
411  * Trusted domain functions
412  */
413 wbcErr wbcCheckTrustCredentials(const char *domain,
414                                 struct wbcAuthErrorInfo **error);
415
416 #endif      /* _WBCLIENT_H */