2 Unix SMB/CIFS implementation.
4 Winbind daemon - krb5 credential cache functions
5 and in-memory cache functions.
7 Copyright (C) Guenther Deschner 2005-2006
8 Copyright (C) Jeremy Allison 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
28 #define DBGC_CLASS DBGC_WINBIND
30 /* uncomment this to do fast debugging on the krb5 ticket renewal event */
31 #ifdef DEBUG_KRB5_TKT_RENEWAL
32 #undef DEBUG_KRB5_TKT_RENEWAL
35 #define MAX_CCACHES 100
37 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
38 static void krb5_ticket_gain_handler(struct event_context *,
42 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *,
45 /* The Krb5 ticket refresh handler should be scheduled
46 at one-half of the period from now till the tkt
48 #define KRB5_EVENT_REFRESH_TIME(x) ((x) - (((x) - time(NULL))/2))
50 /****************************************************************
51 Find an entry by name.
52 ****************************************************************/
54 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
56 struct WINBINDD_CCACHE_ENTRY *entry;
58 for (entry = ccache_list; entry; entry = entry->next) {
59 if (strequal(entry->username, username)) {
66 /****************************************************************
68 ****************************************************************/
70 static int ccache_entry_count(void)
72 struct WINBINDD_CCACHE_ENTRY *entry;
75 for (entry = ccache_list; entry; entry = entry->next) {
81 void ccache_remove_all_after_fork(void)
83 struct WINBINDD_CCACHE_ENTRY *cur, *next;
85 for (cur = ccache_list; cur; cur = next) {
87 DLIST_REMOVE(ccache_list, cur);
88 TALLOC_FREE(cur->event);
95 /****************************************************************
96 Do the work of refreshing the ticket.
97 ****************************************************************/
99 static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
100 struct timed_event *te,
104 struct WINBINDD_CCACHE_ENTRY *entry =
105 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
109 time_t expire_time = 0;
110 struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
113 DEBUG(10,("krb5_ticket_refresh_handler called\n"));
114 DEBUGADD(10,("event called for: %s, %s\n",
115 entry->ccname, entry->username));
117 TALLOC_FREE(entry->event);
121 /* Kinit again if we have the user password and we can't renew the old
124 * This happens when machine are put to sleep for a very long time. */
126 if (entry->renew_until < time(NULL)) {
128 if (cred_ptr && cred_ptr->pass) {
130 set_effective_uid(entry->uid);
132 ret = kerberos_kinit_password_ext(entry->principal_name,
134 0, /* hm, can we do time correction here ? */
135 &entry->refresh_time,
138 False, /* no PAC required anymore */
140 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
142 gain_root_privilege();
145 DEBUG(3,("krb5_ticket_refresh_handler: "
146 "could not re-kinit: %s\n",
147 error_message(ret)));
148 /* destroy the ticket because we cannot rekinit
149 * it, ignore error here */
150 ads_kdestroy(entry->ccname);
152 /* Don't break the ticket refresh chain: retry
153 * refreshing ticket sometime later when KDC is
154 * unreachable -- BoYang. More error code handling
158 if ((ret == KRB5_KDC_UNREACH)
159 || (ret == KRB5_REALM_CANT_RESOLVE)) {
160 #if defined(DEBUG_KRB5_TKT_RENEWAL)
161 new_start = time(NULL) + 30;
163 new_start = time(NULL) +
164 MAX(30, lp_winbind_cache_time());
166 add_krb5_ticket_gain_handler_event(entry,
167 timeval_set(new_start, 0));
170 TALLOC_FREE(entry->event);
174 DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
175 "for: %s in ccache: %s\n",
176 entry->principal_name, entry->ccname));
178 #if defined(DEBUG_KRB5_TKT_RENEWAL)
179 new_start = time(NULL) + 30;
181 /* The tkt should be refreshed at one-half the period
182 from now to the expiration time */
183 expire_time = entry->refresh_time;
184 new_start = KRB5_EVENT_REFRESH_TIME(entry->refresh_time);
189 * No cached credentials
190 * destroy ticket and refresh chain
192 ads_kdestroy(entry->ccname);
193 TALLOC_FREE(entry->event);
198 set_effective_uid(entry->uid);
200 ret = smb_krb5_renew_ticket(entry->ccname,
201 entry->principal_name,
204 #if defined(DEBUG_KRB5_TKT_RENEWAL)
205 new_start = time(NULL) + 30;
207 expire_time = new_start;
208 new_start = KRB5_EVENT_REFRESH_TIME(new_start);
211 gain_root_privilege();
214 DEBUG(3,("krb5_ticket_refresh_handler: "
215 "could not renew tickets: %s\n",
216 error_message(ret)));
217 /* maybe we are beyond the renewing window */
219 /* evil rises here, we refresh ticket failed,
220 * but the ticket might be expired. Therefore,
221 * When we refresh ticket failed, destory the
224 ads_kdestroy(entry->ccname);
226 /* avoid breaking the renewal chain: retry in
227 * lp_winbind_cache_time() seconds when the KDC was not
228 * available right now.
229 * the return code can be KRB5_REALM_CANT_RESOLVE.
230 * More error code handling here? */
232 if ((ret == KRB5_KDC_UNREACH)
233 || (ret == KRB5_REALM_CANT_RESOLVE)) {
234 #if defined(DEBUG_KRB5_TKT_RENEWAL)
235 new_start = time(NULL) + 30;
237 new_start = time(NULL) +
238 MAX(30, lp_winbind_cache_time());
240 /* ticket is destroyed here, we have to regain it
241 * if it is possible */
242 add_krb5_ticket_gain_handler_event(entry,
243 timeval_set(new_start, 0));
247 /* This is evil, if the ticket was already expired.
248 * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
249 * But there is still a chance that we can rekinit it.
251 * This happens when user login in online mode, and then network
252 * down or something cause winbind goes offline for a very long time,
253 * and then goes online again. ticket expired, renew failed.
254 * This happens when machine are put to sleep for a long time,
255 * but shorter than entry->renew_util.
257 * Looks like the KDC is reachable, we want to rekinit as soon as
258 * possible instead of waiting some time later. */
259 if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
260 || (ret == KRB5_FCC_NOFILE)) goto rekinit;
266 /* in cases that ticket will be unrenewable soon, we don't try to renew ticket
267 * but try to regain ticket if it is possible */
268 if (entry->renew_until && expire_time
269 && (entry->renew_until <= expire_time)) {
270 /* try to regain ticket 10 seconds beforre expiration */
272 add_krb5_ticket_gain_handler_event(entry,
273 timeval_set(expire_time, 0));
277 if (entry->refresh_time == 0) {
278 entry->refresh_time = new_start;
280 entry->event = event_add_timed(winbind_event_context(), entry,
281 timeval_set(new_start, 0),
282 krb5_ticket_refresh_handler,
288 /****************************************************************
289 Do the work of regaining a ticket when coming from offline auth.
290 ****************************************************************/
292 static void krb5_ticket_gain_handler(struct event_context *event_ctx,
293 struct timed_event *te,
297 struct WINBINDD_CCACHE_ENTRY *entry =
298 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
302 struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
303 struct winbindd_domain *domain = NULL;
306 DEBUG(10,("krb5_ticket_gain_handler called\n"));
307 DEBUGADD(10,("event called for: %s, %s\n",
308 entry->ccname, entry->username));
310 TALLOC_FREE(entry->event);
314 if (!cred_ptr || !cred_ptr->pass) {
315 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
319 if ((domain = find_domain_from_name(entry->realm)) == NULL) {
320 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
324 if (!domain->online) {
328 set_effective_uid(entry->uid);
330 ret = kerberos_kinit_password_ext(entry->principal_name,
332 0, /* hm, can we do time correction here ? */
333 &entry->refresh_time,
336 False, /* no PAC required anymore */
338 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
340 gain_root_privilege();
343 DEBUG(3,("krb5_ticket_gain_handler: "
344 "could not kinit: %s\n",
345 error_message(ret)));
346 /* evil. If we cannot do it, destroy any the __maybe__
347 * __existing__ ticket */
348 ads_kdestroy(entry->ccname);
352 DEBUG(10,("krb5_ticket_gain_handler: "
353 "successful kinit for: %s in ccache: %s\n",
354 entry->principal_name, entry->ccname));
360 #if defined(DEBUG_KRB5_TKT_REGAIN)
361 t = timeval_set(time(NULL) + 30, 0);
363 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
366 add_krb5_ticket_gain_handler_event(entry, t);
371 #if defined(DEBUG_KRB5_TKT_RENEWAL)
372 t = timeval_set(time(NULL) + 30, 0);
374 t = timeval_set(KRB5_EVENT_REFRESH_TIME(entry->refresh_time), 0);
377 if (entry->refresh_time == 0) {
378 entry->refresh_time = t.tv_sec;
380 entry->event = event_add_timed(winbind_event_context(),
383 krb5_ticket_refresh_handler,
390 /**************************************************************
391 The gain initial ticket case is recognised as entry->refresh_time
393 **************************************************************/
395 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
398 entry->refresh_time = 0;
399 entry->event = event_add_timed(winbind_event_context(),
402 krb5_ticket_gain_handler,
406 void ccache_regain_all_now(void)
408 struct WINBINDD_CCACHE_ENTRY *cur;
409 struct timeval t = timeval_current();
411 for (cur = ccache_list; cur; cur = cur->next) {
412 struct timed_event *new_event;
415 * if refresh_time is 0, we know that the
416 * the event has the krb5_ticket_gain_handler
418 if (cur->refresh_time == 0) {
419 new_event = event_add_timed(winbind_event_context(),
422 krb5_ticket_gain_handler,
425 new_event = event_add_timed(winbind_event_context(),
428 krb5_ticket_refresh_handler,
436 TALLOC_FREE(cur->event);
437 cur->event = new_event;
443 /****************************************************************
444 Check if an ccache entry exists.
445 ****************************************************************/
447 bool ccache_entry_exists(const char *username)
449 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
450 return (entry != NULL);
453 /****************************************************************
454 Ensure we're changing the correct entry.
455 ****************************************************************/
457 bool ccache_entry_identical(const char *username,
461 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
467 if (entry->uid != uid) {
468 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
469 (unsigned int)entry->uid, (unsigned int)uid));
472 if (!strcsequal(entry->ccname, ccname)) {
473 DEBUG(0,("cache_entry_identical: "
474 "ccnames differ: (cache) %s != (client) %s\n",
475 entry->ccname, ccname));
481 NTSTATUS add_ccache_to_list(const char *princ_name,
484 const char *username,
490 bool postponed_request)
492 struct WINBINDD_CCACHE_ENTRY *entry = NULL;
499 if ((username == NULL && princ_name == NULL) ||
500 ccname == NULL || uid < 0) {
501 return NT_STATUS_INVALID_PARAMETER;
504 if (ccache_entry_count() + 1 > MAX_CCACHES) {
505 DEBUG(10,("add_ccache_to_list: "
506 "max number of ccaches reached\n"));
507 return NT_STATUS_NO_MORE_ENTRIES;
510 /* If it is cached login, destroy krb5 ticket
511 * to avoid surprise. */
513 if (postponed_request) {
514 /* ignore KRB5_FCC_NOFILE error here */
515 ret = ads_kdestroy(ccname);
516 if (ret == KRB5_FCC_NOFILE) {
520 DEBUG(0, ("add_ccache_to_list: failed to destroy "
521 "user krb5 ccache %s with %s\n", ccname,
522 error_message(ret)));
523 return krb5_to_nt_status(ret);
525 DEBUG(10, ("add_ccache_to_list: successfully destroyed "
526 "krb5 ccache %s for user %s\n", ccname,
532 /* Reference count old entries */
533 entry = get_ccache_by_username(username);
535 /* Check cached entries are identical. */
536 if (!ccache_entry_identical(username, uid, ccname)) {
537 return NT_STATUS_INVALID_PARAMETER;
540 DEBUG(10,("add_ccache_to_list: "
541 "ref count on entry %s is now %d\n",
542 username, entry->ref_count));
543 /* FIXME: in this case we still might want to have a krb5 cred
544 * event handler created - gd
545 * Add ticket refresh handler here */
547 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
552 if (postponed_request) {
553 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
554 add_krb5_ticket_gain_handler_event(entry, t);
556 /* Renew at 1/2 the ticket expiration time */
557 #if defined(DEBUG_KRB5_TKT_RENEWAL)
558 t = timeval_set(time(NULL)+30, 0);
560 t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
562 if (!entry->refresh_time) {
563 entry->refresh_time = t.tv_sec;
565 entry->event = event_add_timed(winbind_event_context(),
568 krb5_ticket_refresh_handler,
573 ntret = remove_ccache(username);
574 if (!NT_STATUS_IS_OK(ntret)) {
575 DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
576 "ccache %s for user %s\n", entry->ccname,
578 DEBUG(0, ("add_ccache_to_list: error is %s\n",
582 return NT_STATUS_NO_MEMORY;
585 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
591 entry = TALLOC_P(NULL, struct WINBINDD_CCACHE_ENTRY);
593 return NT_STATUS_NO_MEMORY;
599 entry->username = talloc_strdup(entry, username);
600 if (!entry->username) {
605 entry->principal_name = talloc_strdup(entry, princ_name);
606 if (!entry->principal_name) {
611 entry->service = talloc_strdup(entry, service);
612 if (!entry->service) {
617 entry->ccname = talloc_strdup(entry, ccname);
618 if (!entry->ccname) {
622 entry->realm = talloc_strdup(entry, realm);
627 entry->create_time = create_time;
628 entry->renew_until = renew_until;
630 entry->ref_count = 1;
632 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
636 if (postponed_request) {
637 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
638 add_krb5_ticket_gain_handler_event(entry, t);
640 /* Renew at 1/2 the ticket expiration time */
641 #if defined(DEBUG_KRB5_TKT_RENEWAL)
642 t = timeval_set(time(NULL)+30, 0);
644 t = timeval_set(KRB5_EVENT_REFRESH_TIME(ticket_end), 0);
646 if (entry->refresh_time == 0) {
647 entry->refresh_time = t.tv_sec;
649 entry->event = event_add_timed(winbind_event_context(),
652 krb5_ticket_refresh_handler,
660 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
664 DLIST_ADD(ccache_list, entry);
666 DEBUG(10,("add_ccache_to_list: "
667 "added ccache [%s] for user [%s] to the list\n",
675 return NT_STATUS_NO_MEMORY;
678 /*******************************************************************
679 Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer
681 *******************************************************************/
683 NTSTATUS remove_ccache(const char *username)
685 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
686 NTSTATUS status = NT_STATUS_OK;
692 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
695 if (entry->ref_count <= 0) {
696 DEBUG(0,("remove_ccache: logic error. "
697 "ref count for user %s = %d\n",
698 username, entry->ref_count));
699 return NT_STATUS_INTERNAL_DB_CORRUPTION;
704 if (entry->ref_count > 0) {
705 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
706 username, entry->ref_count));
710 /* no references any more */
712 DLIST_REMOVE(ccache_list, entry);
713 TALLOC_FREE(entry->event); /* unregisters events */
716 ret = ads_kdestroy(entry->ccname);
718 /* we ignore the error when there has been no credential cache */
719 if (ret == KRB5_FCC_NOFILE) {
722 DEBUG(0,("remove_ccache: "
723 "failed to destroy user krb5 ccache %s with: %s\n",
724 entry->ccname, error_message(ret)));
726 DEBUG(10,("remove_ccache: "
727 "successfully destroyed krb5 ccache %s for user %s\n",
728 entry->ccname, username));
730 status = krb5_to_nt_status(ret);
734 DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
739 /*******************************************************************
740 In memory credentials cache code.
741 *******************************************************************/
743 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
745 /***********************************************************
746 Find an entry on the list by name.
747 ***********************************************************/
749 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
751 struct WINBINDD_MEMORY_CREDS *p;
753 for (p = memory_creds_list; p; p = p->next) {
754 if (strequal(p->username, username)) {
761 /***********************************************************
762 Store the required creds and mlock them.
763 ***********************************************************/
765 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp,
768 #if !defined(HAVE_MLOCK)
771 /* new_entry->nt_hash is the base pointer for the block
772 of memory pointed into by new_entry->lm_hash and
773 new_entry->pass (if we're storing plaintext). */
775 memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
777 memcredp->len += strlen(pass)+1;
782 /* aligning the memory on on x86_64 and compiling
783 with gcc 4.1 using -O2 causes a segv in the
784 next memset() --jerry */
785 memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
787 /* On non-linux platforms, mlock()'d memory must be aligned */
788 memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
789 getpagesize(), memcredp->len);
791 if (!memcredp->nt_hash) {
792 return NT_STATUS_NO_MEMORY;
794 memset(memcredp->nt_hash, 0x0, memcredp->len);
796 memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
798 #ifdef DEBUG_PASSWORD
799 DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
801 if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
802 DEBUG(0,("failed to mlock memory: %s (%d)\n",
803 strerror(errno), errno));
804 SAFE_FREE(memcredp->nt_hash);
805 return map_nt_error_from_unix(errno);
808 #ifdef DEBUG_PASSWORD
809 DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
812 /* Create and store the password hashes. */
813 E_md4hash(pass, memcredp->nt_hash);
814 E_deshash(pass, memcredp->lm_hash);
817 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
818 memcpy(memcredp->pass, pass,
819 memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
826 /***********************************************************
827 Destroy existing creds.
828 ***********************************************************/
830 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
832 #if !defined(HAVE_MUNLOCK)
835 if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
836 DEBUG(0,("failed to munlock memory: %s (%d)\n",
837 strerror(errno), errno));
838 return map_nt_error_from_unix(errno);
840 memset(memcredp->nt_hash, '\0', memcredp->len);
841 SAFE_FREE(memcredp->nt_hash);
842 memcredp->nt_hash = NULL;
843 memcredp->lm_hash = NULL;
844 memcredp->pass = NULL;
850 /***********************************************************
851 Replace the required creds with new ones (password change).
852 ***********************************************************/
854 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
857 NTSTATUS status = delete_memory_creds(memcredp);
858 if (!NT_STATUS_IS_OK(status)) {
861 return store_memory_creds(memcredp, pass);
864 /*************************************************************
865 Store credentials in memory in a list.
866 *************************************************************/
868 static NTSTATUS winbindd_add_memory_creds_internal(const char *username,
872 /* Shortcut to ensure we don't store if no mlock. */
873 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
877 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
879 memcredp = find_memory_creds_by_name(username);
880 if (uid == (uid_t)-1) {
881 DEBUG(0,("winbindd_add_memory_creds_internal: "
882 "invalid uid for user %s.\n", username));
883 return NT_STATUS_INVALID_PARAMETER;
887 /* Already exists. Increment the reference count and replace stored creds. */
888 if (uid != memcredp->uid) {
889 DEBUG(0,("winbindd_add_memory_creds_internal: "
890 "uid %u for user %s doesn't "
891 "match stored uid %u. Replacing.\n",
892 (unsigned int)uid, username,
893 (unsigned int)memcredp->uid));
896 memcredp->ref_count++;
897 DEBUG(10,("winbindd_add_memory_creds_internal: "
898 "ref count for user %s is now %d\n",
899 username, memcredp->ref_count));
900 return winbindd_replace_memory_creds_internal(memcredp, pass);
903 memcredp = TALLOC_ZERO_P(NULL, struct WINBINDD_MEMORY_CREDS);
905 return NT_STATUS_NO_MEMORY;
907 memcredp->username = talloc_strdup(memcredp, username);
908 if (!memcredp->username) {
909 talloc_destroy(memcredp);
910 return NT_STATUS_NO_MEMORY;
913 status = store_memory_creds(memcredp, pass);
914 if (!NT_STATUS_IS_OK(status)) {
915 talloc_destroy(memcredp);
920 memcredp->ref_count = 1;
921 DLIST_ADD(memory_creds_list, memcredp);
923 DEBUG(10,("winbindd_add_memory_creds_internal: "
924 "added entry for user %s\n", username));
930 /*************************************************************
931 Store users credentials in memory. If we also have a
932 struct WINBINDD_CCACHE_ENTRY for this username with a
933 refresh timer, then store the plaintext of the password
934 and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
935 *************************************************************/
937 NTSTATUS winbindd_add_memory_creds(const char *username,
941 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
944 status = winbindd_add_memory_creds_internal(username, uid, pass);
945 if (!NT_STATUS_IS_OK(status)) {
950 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
951 memcredp = find_memory_creds_by_name(username);
953 entry->cred_ptr = memcredp;
960 /*************************************************************
961 Decrement the in-memory ref count - delete if zero.
962 *************************************************************/
964 NTSTATUS winbindd_delete_memory_creds(const char *username)
966 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
967 struct WINBINDD_CCACHE_ENTRY *entry = NULL;
968 NTSTATUS status = NT_STATUS_OK;
970 memcredp = find_memory_creds_by_name(username);
971 entry = get_ccache_by_username(username);
974 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
976 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
979 if (memcredp->ref_count <= 0) {
980 DEBUG(0,("winbindd_delete_memory_creds: logic error. "
981 "ref count for user %s = %d\n",
982 username, memcredp->ref_count));
983 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
986 memcredp->ref_count--;
987 if (memcredp->ref_count <= 0) {
988 delete_memory_creds(memcredp);
989 DLIST_REMOVE(memory_creds_list, memcredp);
990 talloc_destroy(memcredp);
991 DEBUG(10,("winbindd_delete_memory_creds: "
992 "deleted entry for user %s\n",
995 DEBUG(10,("winbindd_delete_memory_creds: "
996 "entry for user %s ref_count now %d\n",
997 username, memcredp->ref_count));
1001 /* Ensure we have no dangling references to this. */
1002 entry->cred_ptr = NULL;
1008 /***********************************************************
1009 Replace the required creds with new ones (password change).
1010 ***********************************************************/
1012 NTSTATUS winbindd_replace_memory_creds(const char *username,
1015 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
1017 memcredp = find_memory_creds_by_name(username);
1019 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
1021 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1024 DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
1027 return winbindd_replace_memory_creds_internal(memcredp, pass);