source3/winbindd/winbindd_pam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - pam auth funcions
   5
   6    Copyright (C) Andrew Tridgell 2000
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett 2001-2002
   9    Copyright (C) Guenther Deschner 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_WINBIND
  29
  30 #define LOGON_KRB5_FAIL_CLOCK_SKEW      0x02000000
  31
  32 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
  33                                     struct winbindd_cli_state *state,
  34                                     struct netr_SamInfo3 *info3)
  35 {
  36         char *ex;
  37         size_t size;
  38         uint32_t i;
  39
  40         state->response.data.auth.info3.logon_time =
  41                 nt_time_to_unix(info3->base.last_logon);
  42         state->response.data.auth.info3.logoff_time =
  43                 nt_time_to_unix(info3->base.last_logoff);
  44         state->response.data.auth.info3.kickoff_time =
  45                 nt_time_to_unix(info3->base.acct_expiry);
  46         state->response.data.auth.info3.pass_last_set_time =
  47                 nt_time_to_unix(info3->base.last_password_change);
  48         state->response.data.auth.info3.pass_can_change_time =
  49                 nt_time_to_unix(info3->base.allow_password_change);
  50         state->response.data.auth.info3.pass_must_change_time =
  51                 nt_time_to_unix(info3->base.force_password_change);
  52
  53         state->response.data.auth.info3.logon_count = info3->base.logon_count;
  54         state->response.data.auth.info3.bad_pw_count = info3->base.bad_password_count;
  55
  56         state->response.data.auth.info3.user_rid = info3->base.rid;
  57         state->response.data.auth.info3.group_rid = info3->base.primary_gid;
  58         sid_to_fstring(state->response.data.auth.info3.dom_sid, info3->base.domain_sid);
  59
  60         state->response.data.auth.info3.num_groups = info3->base.groups.count;
  61         state->response.data.auth.info3.user_flgs = info3->base.user_flags;
  62
  63         state->response.data.auth.info3.acct_flags = info3->base.acct_flags;
  64         state->response.data.auth.info3.num_other_sids = info3->sidcount;
  65
  66         fstrcpy(state->response.data.auth.info3.user_name,
  67                 info3->base.account_name.string);
  68         fstrcpy(state->response.data.auth.info3.full_name,
  69                 info3->base.full_name.string);
  70         fstrcpy(state->response.data.auth.info3.logon_script,
  71                 info3->base.logon_script.string);
  72         fstrcpy(state->response.data.auth.info3.profile_path,
  73                 info3->base.profile_path.string);
  74         fstrcpy(state->response.data.auth.info3.home_dir,
  75                 info3->base.home_directory.string);
  76         fstrcpy(state->response.data.auth.info3.dir_drive,
  77                 info3->base.home_drive.string);
  78
  79         fstrcpy(state->response.data.auth.info3.logon_srv,
  80                 info3->base.logon_server.string);
  81         fstrcpy(state->response.data.auth.info3.logon_dom,
  82                 info3->base.domain.string);
  83
  84         ex = talloc_strdup(mem_ctx, "");
  85         NT_STATUS_HAVE_NO_MEMORY(ex);
  86
  87         for (i=0; i < info3->base.groups.count; i++) {
  88                 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
  89                                                    info3->base.groups.rids[i].rid,
  90                                                    info3->base.groups.rids[i].attributes);
  91                 NT_STATUS_HAVE_NO_MEMORY(ex);
  92         }
  93
  94         for (i=0; i < info3->sidcount; i++) {
  95                 char *sid;
  96
  97                 sid = dom_sid_string(mem_ctx, info3->sids[i].sid);
  98                 NT_STATUS_HAVE_NO_MEMORY(sid);
  99
 100                 ex = talloc_asprintf_append_buffer(ex, "%s:0x%08X\n",
 101                                                    sid,
 102                                                    info3->sids[i].attributes);
 103                 NT_STATUS_HAVE_NO_MEMORY(ex);
 104
 105                 talloc_free(sid);
 106         }
 107
 108         size = talloc_get_size(ex);
 109
 110         SAFE_FREE(state->response.extra_data.data);
 111         state->response.extra_data.data = SMB_MALLOC(size);
 112         if (!state->response.extra_data.data) {
 113                 return NT_STATUS_NO_MEMORY;
 114         }
 115         memcpy(state->response.extra_data.data, ex, size);
 116         talloc_free(ex);
 117
 118         state->response.length += size;
 119
 120         return NT_STATUS_OK;
 121 }
 122
 123 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
 124                                     struct winbindd_cli_state *state,
 125                                     struct netr_SamInfo3 *info3)
 126 {
 127         DATA_BLOB blob;
 128         enum ndr_err_code ndr_err;
 129
 130         ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
 131                                        (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
 132         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 133                 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
 134                 return ndr_map_error2ntstatus(ndr_err);
 135         }
 136
 137         SAFE_FREE(state->response.extra_data.data);
 138         state->response.extra_data.data = SMB_MALLOC(blob.length);
 139         if (!state->response.extra_data.data) {
 140                 data_blob_free(&blob);
 141                 return NT_STATUS_NO_MEMORY;
 142         }
 143
 144         memset(state->response.extra_data.data, '\0', blob.length);
 145         memcpy(state->response.extra_data.data, blob.data, blob.length);
 146         state->response.length += blob.length;
 147
 148         data_blob_free(&blob);
 149
 150         return NT_STATUS_OK;
 151 }
 152
 153 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
 154                                      struct winbindd_cli_state *state,
 155                                      const struct netr_SamInfo3 *info3,
 156                                      const char *name_domain,
 157                                      const char *name_user)
 158 {
 159         /* We've been asked to return the unix username, per
 160            'winbind use default domain' settings and the like */
 161
 162         const char *nt_username, *nt_domain;
 163
 164         nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
 165         if (!nt_domain) {
 166                 /* If the server didn't give us one, just use the one
 167                  * we sent them */
 168                 nt_domain = name_domain;
 169         }
 170
 171         nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
 172         if (!nt_username) {
 173                 /* If the server didn't give us one, just use the one
 174                  * we sent them */
 175                 nt_username = name_user;
 176         }
 177
 178         fill_domain_username(state->response.data.auth.unix_username,
 179                              nt_domain, nt_username, True);
 180
 181         DEBUG(5,("Setting unix username to [%s]\n",
 182                 state->response.data.auth.unix_username));
 183
 184         return NT_STATUS_OK;
 185 }
 186
 187 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 188                                  struct winbindd_cli_state *state,
 189                                  const struct netr_SamInfo3 *info3,
 190                                  const char *name_domain,
 191                                  const char *name_user)
 192 {
 193         char *afsname = NULL;
 194         char *cell;
 195
 196         afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
 197         if (afsname == NULL) {
 198                 return NT_STATUS_NO_MEMORY;
 199         }
 200
 201         afsname = talloc_string_sub(mem_ctx,
 202                                     lp_afs_username_map(),
 203                                     "%D", name_domain);
 204         afsname = talloc_string_sub(mem_ctx, afsname,
 205                                     "%u", name_user);
 206         afsname = talloc_string_sub(mem_ctx, afsname,
 207                                     "%U", name_user);
 208
 209         {
 210                 DOM_SID user_sid;
 211                 fstring sidstr;
 212
 213                 sid_copy(&user_sid, info3->base.domain_sid);
 214                 sid_append_rid(&user_sid, info3->base.rid);
 215                 sid_to_fstring(sidstr, &user_sid);
 216                 afsname = talloc_string_sub(mem_ctx, afsname,
 217                                             "%s", sidstr);
 218         }
 219
 220         if (afsname == NULL) {
 221                 return NT_STATUS_NO_MEMORY;
 222         }
 223
 224         strlower_m(afsname);
 225
 226         DEBUG(10, ("Generating token for user %s\n", afsname));
 227
 228         cell = strchr(afsname, '@');
 229
 230         if (cell == NULL) {
 231                 return NT_STATUS_NO_MEMORY;
 232         }
 233
 234         *cell = '\0';
 235         cell += 1;
 236
 237         /* Append an AFS token string */
 238         SAFE_FREE(state->response.extra_data.data);
 239         state->response.extra_data.data =
 240                 afs_createtoken_str(afsname, cell);
 241
 242         if (state->response.extra_data.data != NULL) {
 243                 state->response.length +=
 244                         strlen((const char *)state->response.extra_data.data)+1;
 245         }
 246
 247         return NT_STATUS_OK;
 248 }
 249
 250 static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 251                                      struct netr_SamInfo3 *info3,
 252                                      const char *group_sid)
 253 /**
 254  * Check whether a user belongs to a group or list of groups.
 255  *
 256  * @param mem_ctx talloc memory context.
 257  * @param info3 user information, including group membership info.
 258  * @param group_sid One or more groups , separated by commas.
 259  *
 260  * @return NT_STATUS_OK on success,
 261  *    NT_STATUS_LOGON_FAILURE if the user does not belong,
 262  *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
 263  */
 264 {
 265         DOM_SID *require_membership_of_sid;
 266         size_t num_require_membership_of_sid;
 267         char *req_sid;
 268         const char *p;
 269         DOM_SID sid;
 270         size_t i;
 271         struct nt_user_token *token;
 272         TALLOC_CTX *frame = NULL;
 273         NTSTATUS status;
 274
 275         /* Parse the 'required group' SID */
 276
 277         if (!group_sid || !group_sid[0]) {
 278                 /* NO sid supplied, all users may access */
 279                 return NT_STATUS_OK;
 280         }
 281
 282         if (!(token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
 283                 DEBUG(0, ("talloc failed\n"));
 284                 return NT_STATUS_NO_MEMORY;
 285         }
 286
 287         num_require_membership_of_sid = 0;
 288         require_membership_of_sid = NULL;
 289
 290         p = group_sid;
 291
 292         frame = talloc_stackframe();
 293         while (next_token_talloc(frame, &p, &req_sid, ",")) {
 294                 if (!string_to_sid(&sid, req_sid)) {
 295                         DEBUG(0, ("check_info3_in_group: could not parse %s "
 296                                   "as a SID!", req_sid));
 297                         TALLOC_FREE(frame);
 298                         return NT_STATUS_INVALID_PARAMETER;
 299                 }
 300
 301                 status = add_sid_to_array(mem_ctx, &sid,
 302                                           &require_membership_of_sid,
 303                                           &num_require_membership_of_sid);
 304                 if (!NT_STATUS_IS_OK(status)) {
 305                         DEBUG(0, ("add_sid_to_array failed\n"));
 306                         TALLOC_FREE(frame);
 307                         return status;
 308                 }
 309         }
 310
 311         TALLOC_FREE(frame);
 312
 313         status = sid_array_from_info3(mem_ctx, info3,
 314                                       &token->user_sids,
 315                                       &token->num_sids,
 316                                       True);
 317         if (!NT_STATUS_IS_OK(status)) {
 318                 return status;
 319         }
 320
 321         if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
 322                                                   token))
 323             || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
 324                                                      token))) {
 325                 DEBUG(3, ("could not add aliases: %s\n",
 326                           nt_errstr(status)));
 327                 return status;
 328         }
 329
 330         debug_nt_user_token(DBGC_CLASS, 10, token);
 331
 332         for (i=0; i<num_require_membership_of_sid; i++) {
 333                 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
 334                                    &require_membership_of_sid[i])));
 335                 if (nt_token_check_sid(&require_membership_of_sid[i],
 336                                        token)) {
 337                         DEBUG(10, ("Access ok\n"));
 338                         return NT_STATUS_OK;
 339                 }
 340         }
 341
 342         /* Do not distinguish this error from a wrong username/pw */
 343
 344         return NT_STATUS_LOGON_FAILURE;
 345 }
 346
 347 struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
 348                                         const char *domain_name)
 349 {
 350         struct winbindd_domain *domain;
 351
 352         if (IS_DC) {
 353                 domain = find_domain_from_name_noinit(domain_name);
 354                 if (domain == NULL) {
 355                         DEBUG(3, ("Authentication for domain [%s] refused "
 356                                   "as it is not a trusted domain\n",
 357                                   domain_name));
 358                 }
 359                 return domain;
 360         }
 361
 362         if (is_myname(domain_name)) {
 363                 DEBUG(3, ("Authentication for domain %s (local domain "
 364                           "to this server) not supported at this "
 365                           "stage\n", domain_name));
 366                 return NULL;
 367         }
 368
 369         /* we can auth against trusted domains */
 370         if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
 371                 domain = find_domain_from_name_noinit(domain_name);
 372                 if (domain == NULL) {
 373                         DEBUG(3, ("Authentication for domain [%s] skipped "
 374                                   "as it is not a trusted domain\n",
 375                                   domain_name));
 376                 } else {
 377                         return domain;
 378                 }
 379         }
 380
 381         return find_our_domain();
 382 }
 383
 384 static void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
 385 {
 386         resp->data.auth.nt_status = NT_STATUS_V(result);
 387         fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result));
 388
 389         /* we might have given a more useful error above */
 390         if (*resp->data.auth.error_string == '\0')
 391                 fstrcpy(resp->data.auth.error_string,
 392                         get_friendly_nt_error_msg(result));
 393         resp->data.auth.pam_error = nt_status_to_pam(result);
 394 }
 395
 396 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
 397                                        struct winbindd_cli_state *state)
 398 {
 399         struct winbindd_methods *methods;
 400         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 401         struct samr_DomInfo1 password_policy;
 402
 403         if ( !winbindd_can_contact_domain( domain ) ) {
 404                 DEBUG(5,("fillup_password_policy: No inbound trust to "
 405                          "contact domain %s\n", domain->name));
 406                 return NT_STATUS_NOT_SUPPORTED;
 407         }
 408
 409         methods = domain->methods;
 410
 411         status = methods->password_policy(domain, state->mem_ctx, &password_policy);
 412         if (NT_STATUS_IS_ERR(status)) {
 413                 return status;
 414         }
 415
 416         state->response.data.auth.policy.min_length_password =
 417                 password_policy.min_password_length;
 418         state->response.data.auth.policy.password_history =
 419                 password_policy.password_history_length;
 420         state->response.data.auth.policy.password_properties =
 421                 password_policy.password_properties;
 422         state->response.data.auth.policy.expire =
 423                 nt_time_to_unix_abs((NTTIME *)&(password_policy.max_password_age));
 424         state->response.data.auth.policy.min_passwordage =
 425                 nt_time_to_unix_abs((NTTIME *)&(password_policy.min_password_age));
 426
 427         return NT_STATUS_OK;
 428 }
 429
 430 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
 431                                                          TALLOC_CTX *mem_ctx,
 432                                                          uint16 *lockout_threshold)
 433 {
 434         struct winbindd_methods *methods;
 435         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 436         struct samr_DomInfo12 lockout_policy;
 437
 438         *lockout_threshold = 0;
 439
 440         methods = domain->methods;
 441
 442         status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
 443         if (NT_STATUS_IS_ERR(status)) {
 444                 return status;
 445         }
 446
 447         *lockout_threshold = lockout_policy.lockout_threshold;
 448
 449         return NT_STATUS_OK;
 450 }
 451
 452 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
 453                                    TALLOC_CTX *mem_ctx,
 454                                    uint32 *password_properties)
 455 {
 456         struct winbindd_methods *methods;
 457         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 458         struct samr_DomInfo1 password_policy;
 459
 460         *password_properties = 0;
 461
 462         methods = domain->methods;
 463
 464         status = methods->password_policy(domain, mem_ctx, &password_policy);
 465         if (NT_STATUS_IS_ERR(status)) {
 466                 return status;
 467         }
 468
 469         *password_properties = password_policy.password_properties;
 470
 471         return NT_STATUS_OK;
 472 }
 473
 474 #ifdef HAVE_KRB5
 475
 476 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 477                                         const char *type,
 478                                         uid_t uid,
 479                                         bool *internal_ccache)
 480 {
 481         /* accept FILE and WRFILE as krb5_cc_type from the client and then
 482          * build the full ccname string based on the user's uid here -
 483          * Guenther*/
 484
 485         const char *gen_cc = NULL;
 486
 487         *internal_ccache = True;
 488
 489         if (uid == -1) {
 490                 goto memory_ccache;
 491         }
 492
 493         if (!type || type[0] == '\0') {
 494                 goto memory_ccache;
 495         }
 496
 497         if (strequal(type, "FILE")) {
 498                 gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
 499         } else if (strequal(type, "WRFILE")) {
 500                 gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
 501         } else {
 502                 DEBUG(10,("we don't allow to set a %s type ccache\n", type));
 503                 goto memory_ccache;
 504         }
 505
 506         *internal_ccache = False;
 507         goto done;
 508
 509   memory_ccache:
 510         gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
 511
 512   done:
 513         if (gen_cc == NULL) {
 514                 DEBUG(0,("out of memory\n"));
 515                 return NULL;
 516         }
 517
 518         DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
 519
 520         return gen_cc;
 521 }
 522
 523 static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
 524 {
 525         const char *type = state->request.data.auth.krb5_cc_type;
 526
 527         state->response.data.auth.krb5ccname[0] = '\0';
 528
 529         if (type[0] == '\0') {
 530                 return;
 531         }
 532
 533         if (!strequal(type, "FILE") &&
 534             !strequal(type, "WRFILE")) {
 535                 DEBUG(10,("won't return krbccname for a %s type ccache\n",
 536                         type));
 537                 return;
 538         }
 539
 540         fstrcpy(state->response.data.auth.krb5ccname, cc);
 541 }
 542
 543 #endif
 544
 545 static uid_t get_uid_from_state(struct winbindd_cli_state *state)
 546 {
 547         uid_t uid = -1;
 548
 549         uid = state->request.data.auth.uid;
 550
 551         if (uid < 0) {
 552                 DEBUG(1,("invalid uid: '%d'\n", uid));
 553                 return -1;
 554         }
 555         return uid;
 556 }
 557
 558 /**********************************************************************
 559  Authenticate a user with a clear text password using Kerberos and fill up
 560  ccache if required
 561  **********************************************************************/
 562
 563 static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 564                                             struct winbindd_cli_state *state,
 565                                             struct netr_SamInfo3 **info3)
 566 {
 567 #ifdef HAVE_KRB5
 568         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 569         krb5_error_code krb5_ret;
 570         const char *cc = NULL;
 571         const char *principal_s = NULL;
 572         const char *service = NULL;
 573         char *realm = NULL;
 574         fstring name_domain, name_user;
 575         time_t ticket_lifetime = 0;
 576         time_t renewal_until = 0;
 577         uid_t uid = -1;
 578         ADS_STRUCT *ads;
 579         time_t time_offset = 0;
 580         bool internal_ccache = True;
 581
 582         ZERO_STRUCTP(info3);
 583
 584         *info3 = NULL;
 585
 586         /* 1st step:
 587          * prepare a krb5_cc_cache string for the user */
 588
 589         uid = get_uid_from_state(state);
 590         if (uid == -1) {
 591                 DEBUG(0,("no valid uid\n"));
 592         }
 593
 594         cc = generate_krb5_ccache(state->mem_ctx,
 595                                   state->request.data.auth.krb5_cc_type,
 596                                   state->request.data.auth.uid,
 597                                   &internal_ccache);
 598         if (cc == NULL) {
 599                 return NT_STATUS_NO_MEMORY;
 600         }
 601
 602
 603         /* 2nd step:
 604          * get kerberos properties */
 605
 606         if (domain->private_data) {
 607                 ads = (ADS_STRUCT *)domain->private_data;
 608                 time_offset = ads->auth.time_offset;
 609         }
 610
 611
 612         /* 3rd step:
 613          * do kerberos auth and setup ccache as the user */
 614
 615         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
 616
 617         realm = domain->alt_name;
 618         strupper_m(realm);
 619
 620         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
 621         if (principal_s == NULL) {
 622                 return NT_STATUS_NO_MEMORY;
 623         }
 624
 625         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
 626         if (service == NULL) {
 627                 return NT_STATUS_NO_MEMORY;
 628         }
 629
 630         /* if this is a user ccache, we need to act as the user to let the krb5
 631          * library handle the chown, etc. */
 632
 633         /************************ ENTERING NON-ROOT **********************/
 634
 635         if (!internal_ccache) {
 636                 set_effective_uid(uid);
 637                 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
 638         }
 639
 640         result = kerberos_return_info3_from_pac(state->mem_ctx,
 641                                                 principal_s,
 642                                                 state->request.data.auth.pass,
 643                                                 time_offset,
 644                                                 &ticket_lifetime,
 645                                                 &renewal_until,
 646                                                 cc,
 647                                                 True,
 648                                                 True,
 649                                                 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 650                                                 info3);
 651         if (!internal_ccache) {
 652                 gain_root_privilege();
 653         }
 654
 655         /************************ RETURNED TO ROOT **********************/
 656
 657         if (!NT_STATUS_IS_OK(result)) {
 658                 goto failed;
 659         }
 660
 661         DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
 662                 principal_s));
 663
 664         /* if we had a user's ccache then return that string for the pam
 665          * environment */
 666
 667         if (!internal_ccache) {
 668
 669                 setup_return_cc_name(state, cc);
 670
 671                 result = add_ccache_to_list(principal_s,
 672                                             cc,
 673                                             service,
 674                                             state->request.data.auth.user,
 675                                             realm,
 676                                             uid,
 677                                             time(NULL),
 678                                             ticket_lifetime,
 679                                             renewal_until,
 680                                             False);
 681
 682                 if (!NT_STATUS_IS_OK(result)) {
 683                         DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
 684                                 nt_errstr(result)));
 685                 }
 686         } else {
 687
 688                 /* need to delete the memory cred cache, it is not used anymore */
 689
 690                 krb5_ret = ads_kdestroy(cc);
 691                 if (krb5_ret) {
 692                         DEBUG(3,("winbindd_raw_kerberos_login: "
 693                                  "could not destroy krb5 credential cache: "
 694                                  "%s\n", error_message(krb5_ret)));
 695                 }
 696
 697         }
 698
 699         return NT_STATUS_OK;
 700
 701 failed:
 702
 703         /* we could have created a new credential cache with a valid tgt in it
 704          * but we werent able to get or verify the service ticket for this
 705          * local host and therefor didn't get the PAC, we need to remove that
 706          * cache entirely now */
 707
 708         krb5_ret = ads_kdestroy(cc);
 709         if (krb5_ret) {
 710                 DEBUG(3,("winbindd_raw_kerberos_login: "
 711                          "could not destroy krb5 credential cache: "
 712                          "%s\n", error_message(krb5_ret)));
 713         }
 714
 715         if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
 716                 DEBUG(3,("winbindd_raw_kerberos_login: "
 717                           "could not remove ccache for user %s\n",
 718                         state->request.data.auth.user));
 719         }
 720
 721         return result;
 722 #else
 723         return NT_STATUS_NOT_SUPPORTED;
 724 #endif /* HAVE_KRB5 */
 725 }
 726
 727 /****************************************************************
 728 ****************************************************************/
 729
 730 static bool check_request_flags(uint32_t flags)
 731 {
 732         uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
 733                                WBFLAG_PAM_INFO3_TEXT |
 734                                WBFLAG_PAM_INFO3_NDR;
 735
 736         if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
 737              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
 738              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
 739               !(flags & flags_edata) ) {
 740                 return True;
 741         }
 742
 743         DEBUG(1,("check_request_flags: invalid request flags[0x%08X]\n",flags));
 744
 745         return False;
 746 }
 747
 748 /****************************************************************
 749 ****************************************************************/
 750
 751 static NTSTATUS append_data(struct winbindd_cli_state *state,
 752                             struct netr_SamInfo3 *info3,
 753                             const char *name_domain,
 754                             const char *name_user)
 755 {
 756         NTSTATUS result;
 757         uint32_t flags = state->request.flags;
 758
 759         if (flags & WBFLAG_PAM_USER_SESSION_KEY) {
 760                 memcpy(state->response.data.auth.user_session_key,
 761                        info3->base.key.key,
 762                        sizeof(state->response.data.auth.user_session_key)
 763                        /* 16 */);
 764         }
 765
 766         if (flags & WBFLAG_PAM_LMKEY) {
 767                 memcpy(state->response.data.auth.first_8_lm_hash,
 768                        info3->base.LMSessKey.key,
 769                        sizeof(state->response.data.auth.first_8_lm_hash)
 770                        /* 8 */);
 771         }
 772
 773         if (flags & WBFLAG_PAM_INFO3_TEXT) {
 774                 result = append_info3_as_txt(state->mem_ctx, state, info3);
 775                 if (!NT_STATUS_IS_OK(result)) {
 776                         DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
 777                                 nt_errstr(result)));
 778                         return result;
 779                 }
 780         }
 781
 782         /* currently, anything from here on potentially overwrites extra_data. */
 783
 784         if (flags & WBFLAG_PAM_INFO3_NDR) {
 785                 result = append_info3_as_ndr(state->mem_ctx, state, info3);
 786                 if (!NT_STATUS_IS_OK(result)) {
 787                         DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
 788                                 nt_errstr(result)));
 789                         return result;
 790                 }
 791         }
 792
 793         if (flags & WBFLAG_PAM_UNIX_NAME) {
 794                 result = append_unix_username(state->mem_ctx, state, info3,
 795                                               name_domain, name_user);
 796                 if (!NT_STATUS_IS_OK(result)) {
 797                         DEBUG(10,("Failed to append Unix Username: %s\n",
 798                                 nt_errstr(result)));
 799                         return result;
 800                 }
 801         }
 802
 803         if (flags & WBFLAG_PAM_AFS_TOKEN) {
 804                 result = append_afs_token(state->mem_ctx, state, info3,
 805                                           name_domain, name_user);
 806                 if (!NT_STATUS_IS_OK(result)) {
 807                         DEBUG(10,("Failed to append AFS token: %s\n",
 808                                 nt_errstr(result)));
 809                         return result;
 810                 }
 811         }
 812
 813         return NT_STATUS_OK;
 814 }
 815
 816 void winbindd_pam_auth(struct winbindd_cli_state *state)
 817 {
 818         struct winbindd_domain *domain;
 819         fstring name_domain, name_user;
 820         NTSTATUS result;
 821
 822         /* Ensure null termination */
 823         state->request.data.auth.user
 824                 [sizeof(state->request.data.auth.user)-1]='\0';
 825
 826         /* Ensure null termination */
 827         state->request.data.auth.pass
 828                 [sizeof(state->request.data.auth.pass)-1]='\0';
 829
 830         DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
 831                   state->request.data.auth.user));
 832
 833         if (!check_request_flags(state->request.flags)) {
 834                 result = NT_STATUS_INVALID_PARAMETER_MIX;
 835                 goto done;
 836         }
 837
 838         /* Parse domain and username */
 839
 840         ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
 841
 842         if (!canonicalize_username(state->request.data.auth.user,
 843                                name_domain, name_user)) {
 844                 result = NT_STATUS_NO_SUCH_USER;
 845                 goto done;
 846         }
 847
 848         domain = find_auth_domain(state, name_domain);
 849
 850         if (domain == NULL) {
 851                 result = NT_STATUS_NO_SUCH_USER;
 852                 goto done;
 853         }
 854
 855         sendto_domain(state, domain);
 856         return;
 857  done:
 858         set_auth_errors(&state->response, result);
 859         DEBUG(5, ("Plain text authentication for %s returned %s "
 860                   "(PAM: %d)\n",
 861                   state->request.data.auth.user,
 862                   state->response.data.auth.nt_status_string,
 863                   state->response.data.auth.pam_error));
 864         request_error(state);
 865 }
 866
 867 NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 868                                        struct winbindd_cli_state *state,
 869                                        struct netr_SamInfo3 **info3)
 870 {
 871         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
 872         uint16 max_allowed_bad_attempts;
 873         fstring name_domain, name_user;
 874         DOM_SID sid;
 875         enum lsa_SidType type;
 876         uchar new_nt_pass[NT_HASH_LEN];
 877         const uint8 *cached_nt_pass;
 878         const uint8 *cached_salt;
 879         struct netr_SamInfo3 *my_info3;
 880         time_t kickoff_time, must_change_time;
 881         bool password_good = False;
 882 #ifdef HAVE_KRB5
 883         struct winbindd_tdc_domain *tdc_domain = NULL;
 884 #endif
 885
 886         *info3 = NULL;
 887
 888         ZERO_STRUCTP(info3);
 889
 890         DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
 891
 892         /* Parse domain and username */
 893
 894         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
 895
 896
 897         if (!lookup_cached_name(state->mem_ctx,
 898                                 name_domain,
 899                                 name_user,
 900                                 &sid,
 901                                 &type)) {
 902                 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
 903                 return NT_STATUS_NO_SUCH_USER;
 904         }
 905
 906         if (type != SID_NAME_USER) {
 907                 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
 908                 return NT_STATUS_LOGON_FAILURE;
 909         }
 910
 911         result = winbindd_get_creds(domain,
 912                                     state->mem_ctx,
 913                                     &sid,
 914                                     &my_info3,
 915                                     &cached_nt_pass,
 916                                     &cached_salt);
 917         if (!NT_STATUS_IS_OK(result)) {
 918                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
 919                 return result;
 920         }
 921
 922         *info3 = my_info3;
 923
 924         E_md4hash(state->request.data.auth.pass, new_nt_pass);
 925
 926         dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
 927         dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
 928         if (cached_salt) {
 929                 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
 930         }
 931
 932         if (cached_salt) {
 933                 /* In this case we didn't store the nt_hash itself,
 934                    but the MD5 combination of salt + nt_hash. */
 935                 uchar salted_hash[NT_HASH_LEN];
 936                 E_md5hash(cached_salt, new_nt_pass, salted_hash);
 937
 938                 password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
 939                         True : False;
 940         } else {
 941                 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
 942                 password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
 943                         True : False;
 944         }
 945
 946         if (password_good) {
 947
 948                 /* User *DOES* know the password, update logon_time and reset
 949                  * bad_pw_count */
 950
 951                 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
 952
 953                 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
 954                         return NT_STATUS_ACCOUNT_LOCKED_OUT;
 955                 }
 956
 957                 if (my_info3->base.acct_flags & ACB_DISABLED) {
 958                         return NT_STATUS_ACCOUNT_DISABLED;
 959                 }
 960
 961                 if (my_info3->base.acct_flags & ACB_WSTRUST) {
 962                         return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 963                 }
 964
 965                 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
 966                         return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 967                 }
 968
 969                 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
 970                         return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 971                 }
 972
 973                 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
 974                         DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
 975                                 my_info3->base.acct_flags));
 976                         return NT_STATUS_LOGON_FAILURE;
 977                 }
 978
 979                 kickoff_time = nt_time_to_unix(my_info3->base.acct_expiry);
 980                 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
 981                         return NT_STATUS_ACCOUNT_EXPIRED;
 982                 }
 983
 984                 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
 985                 if (must_change_time != 0 && must_change_time < time(NULL)) {
 986                         /* we allow grace logons when the password has expired */
 987                         my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
 988                         /* return NT_STATUS_PASSWORD_EXPIRED; */
 989                         goto success;
 990                 }
 991
 992 #ifdef HAVE_KRB5
 993                 if ((state->request.flags & WBFLAG_PAM_KRB5) &&
 994                     ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
 995                     (tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL)) {
 996
 997                         uid_t uid = -1;
 998                         const char *cc = NULL;
 999                         char *realm = NULL;
1000                         const char *principal_s = NULL;
1001                         const char *service = NULL;
1002                         bool internal_ccache = False;
1003
1004                         uid = get_uid_from_state(state);
1005                         if (uid == -1) {
1006                                 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
1007                                 return NT_STATUS_INVALID_PARAMETER;
1008                         }
1009
1010                         cc = generate_krb5_ccache(state->mem_ctx,
1011                                                 state->request.data.auth.krb5_cc_type,
1012                                                 state->request.data.auth.uid,
1013                                                 &internal_ccache);
1014                         if (cc == NULL) {
1015                                 return NT_STATUS_NO_MEMORY;
1016                         }
1017
1018                         realm = domain->alt_name;
1019                         strupper_m(realm);
1020
1021                         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
1022                         if (principal_s == NULL) {
1023                                 return NT_STATUS_NO_MEMORY;
1024                         }
1025
1026                         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
1027                         if (service == NULL) {
1028                                 return NT_STATUS_NO_MEMORY;
1029                         }
1030
1031                         if (!internal_ccache) {
1032
1033                                 setup_return_cc_name(state, cc);
1034
1035                                 result = add_ccache_to_list(principal_s,
1036                                                             cc,
1037                                                             service,
1038                                                             state->request.data.auth.user,
1039                                                             domain->alt_name,
1040                                                             uid,
1041                                                             time(NULL),
1042                                                             time(NULL) + lp_winbind_cache_time(),
1043                                                             time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
1044                                                             True);
1045
1046                                 if (!NT_STATUS_IS_OK(result)) {
1047                                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
1048                                                 "to add ccache to list: %s\n",
1049                                                 nt_errstr(result)));
1050                                 }
1051                         }
1052                 }
1053 #endif /* HAVE_KRB5 */
1054  success:
1055                 /* FIXME: we possibly should handle logon hours as well (does xp when
1056                  * offline?) see auth/auth_sam.c:sam_account_ok for details */
1057
1058                 unix_to_nt_time(&my_info3->base.last_logon, time(NULL));
1059                 my_info3->base.bad_password_count = 0;
1060
1061                 result = winbindd_update_creds_by_info3(domain,
1062                                                         state->mem_ctx,
1063                                                         state->request.data.auth.user,
1064                                                         state->request.data.auth.pass,
1065                                                         my_info3);
1066                 if (!NT_STATUS_IS_OK(result)) {
1067                         DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1068                                 nt_errstr(result)));
1069                         return result;
1070                 }
1071
1072                 return NT_STATUS_OK;
1073
1074         }
1075
1076         /* User does *NOT* know the correct password, modify info3 accordingly */
1077
1078         /* failure of this is not critical */
1079         result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1080         if (!NT_STATUS_IS_OK(result)) {
1081                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1082                           "Won't be able to honour account lockout policies\n"));
1083         }
1084
1085         /* increase counter */
1086         my_info3->base.bad_password_count++;
1087
1088         if (max_allowed_bad_attempts == 0) {
1089                 goto failed;
1090         }
1091
1092         /* lockout user */
1093         if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1094
1095                 uint32 password_properties;
1096
1097                 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1098                 if (!NT_STATUS_IS_OK(result)) {
1099                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1100                 }
1101
1102                 if ((my_info3->base.rid != DOMAIN_USER_RID_ADMIN) ||
1103                     (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1104                         my_info3->base.acct_flags |= ACB_AUTOLOCK;
1105                 }
1106         }
1107
1108 failed:
1109         result = winbindd_update_creds_by_info3(domain,
1110                                                 state->mem_ctx,
1111                                                 state->request.data.auth.user,
1112                                                 NULL,
1113                                                 my_info3);
1114
1115         if (!NT_STATUS_IS_OK(result)) {
1116                 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1117                         nt_errstr(result)));
1118         }
1119
1120         return NT_STATUS_LOGON_FAILURE;
1121 }
1122
1123 NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1124                                          struct winbindd_cli_state *state,
1125                                          struct netr_SamInfo3 **info3)
1126 {
1127         struct winbindd_domain *contact_domain;
1128         fstring name_domain, name_user;
1129         NTSTATUS result;
1130
1131         DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1132
1133         /* Parse domain and username */
1134
1135         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1136
1137         /* what domain should we contact? */
1138
1139         if ( IS_DC ) {
1140                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1141                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1142                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1143                         result = NT_STATUS_NO_SUCH_USER;
1144                         goto done;
1145                 }
1146
1147         } else {
1148                 if (is_myname(name_domain)) {
1149                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1150                         result =  NT_STATUS_NO_SUCH_USER;
1151                         goto done;
1152                 }
1153
1154                 contact_domain = find_domain_from_name(name_domain);
1155                 if (contact_domain == NULL) {
1156                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1157                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1158
1159                         contact_domain = find_our_domain();
1160                 }
1161         }
1162
1163         if (contact_domain->initialized &&
1164             contact_domain->active_directory) {
1165                 goto try_login;
1166         }
1167
1168         if (!contact_domain->initialized) {
1169                 init_dc_connection(contact_domain);
1170         }
1171
1172         if (!contact_domain->active_directory) {
1173                 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1174                 return NT_STATUS_INVALID_LOGON_TYPE;
1175         }
1176 try_login:
1177         result = winbindd_raw_kerberos_login(contact_domain, state, info3);
1178 done:
1179         return result;
1180 }
1181
1182 NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
1183                                          struct winbindd_cli_state *state,
1184                                          struct netr_SamInfo3 **info3)
1185 {
1186
1187         struct rpc_pipe_client *netlogon_pipe;
1188         uchar chal[8];
1189         DATA_BLOB lm_resp;
1190         DATA_BLOB nt_resp;
1191         int attempts = 0;
1192         unsigned char local_lm_response[24];
1193         unsigned char local_nt_response[24];
1194         struct winbindd_domain *contact_domain;
1195         fstring name_domain, name_user;
1196         bool retry;
1197         NTSTATUS result;
1198         struct netr_SamInfo3 *my_info3 = NULL;
1199
1200         *info3 = NULL;
1201
1202         DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1203
1204         /* Parse domain and username */
1205
1206         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1207
1208         /* do password magic */
1209
1210
1211         generate_random_buffer(chal, 8);
1212         if (lp_client_ntlmv2_auth()) {
1213                 DATA_BLOB server_chal;
1214                 DATA_BLOB names_blob;
1215                 DATA_BLOB nt_response;
1216                 DATA_BLOB lm_response;
1217                 server_chal = data_blob_talloc(state->mem_ctx, chal, 8);
1218
1219                 /* note that the 'workgroup' here is a best guess - we don't know
1220                    the server's domain at this point.  The 'server name' is also
1221                    dodgy...
1222                 */
1223                 names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1224
1225                 if (!SMBNTLMv2encrypt(name_user, name_domain,
1226                                       state->request.data.auth.pass,
1227                                       &server_chal,
1228                                       &names_blob,
1229                                       &lm_response, &nt_response, NULL)) {
1230                         data_blob_free(&names_blob);
1231                         data_blob_free(&server_chal);
1232                         DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1233                         result = NT_STATUS_NO_MEMORY;
1234                         goto done;
1235                 }
1236                 data_blob_free(&names_blob);
1237                 data_blob_free(&server_chal);
1238                 lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data,
1239                                            lm_response.length);
1240                 nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data,
1241                                            nt_response.length);
1242                 data_blob_free(&lm_response);
1243                 data_blob_free(&nt_response);
1244
1245         } else {
1246                 if (lp_client_lanman_auth()
1247                     && SMBencrypt(state->request.data.auth.pass,
1248                                   chal,
1249                                   local_lm_response)) {
1250                         lm_resp = data_blob_talloc(state->mem_ctx,
1251                                                    local_lm_response,
1252                                                    sizeof(local_lm_response));
1253                 } else {
1254                         lm_resp = data_blob_null;
1255                 }
1256                 SMBNTencrypt(state->request.data.auth.pass,
1257                              chal,
1258                              local_nt_response);
1259
1260                 nt_resp = data_blob_talloc(state->mem_ctx,
1261                                            local_nt_response,
1262                                            sizeof(local_nt_response));
1263         }
1264
1265         /* what domain should we contact? */
1266
1267         if ( IS_DC ) {
1268                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1269                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1270                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1271                         result = NT_STATUS_NO_SUCH_USER;
1272                         goto done;
1273                 }
1274
1275         } else {
1276                 if (is_myname(name_domain)) {
1277                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1278                         result =  NT_STATUS_NO_SUCH_USER;
1279                         goto done;
1280                 }
1281
1282                 contact_domain = find_our_domain();
1283         }
1284
1285         /* check authentication loop */
1286
1287         do {
1288                 NTSTATUS (*logon_fn)(struct rpc_pipe_client *cli,
1289                                      TALLOC_CTX *mem_ctx,
1290                                      uint32 logon_parameters,
1291                                      const char *server,
1292                                      const char *username,
1293                                      const char *domain,
1294                                      const char *workstation,
1295                                      const uint8 chal[8],
1296                                      DATA_BLOB lm_response,
1297                                      DATA_BLOB nt_response,
1298                                      struct netr_SamInfo3 **info3);
1299
1300                 ZERO_STRUCTP(my_info3);
1301                 retry = False;
1302
1303                 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1304
1305                 if (!NT_STATUS_IS_OK(result)) {
1306                         DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1307                         goto done;
1308                 }
1309
1310                 logon_fn = contact_domain->can_do_samlogon_ex
1311                         ? rpccli_netlogon_sam_network_logon_ex
1312                         : rpccli_netlogon_sam_network_logon;
1313
1314                 result = logon_fn(netlogon_pipe,
1315                                   state->mem_ctx,
1316                                   0,
1317                                   contact_domain->dcname, /* server name */
1318                                   name_user,              /* user name */
1319                                   name_domain,            /* target domain */
1320                                   global_myname(),        /* workstation */
1321                                   chal,
1322                                   lm_resp,
1323                                   nt_resp,
1324                                   &my_info3);
1325                 attempts += 1;
1326
1327                 if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
1328                     && contact_domain->can_do_samlogon_ex) {
1329                         DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1330                                   "retrying with NetSamLogon\n"));
1331                         contact_domain->can_do_samlogon_ex = False;
1332                         retry = True;
1333                         continue;
1334                 }
1335
1336                 /* We have to try a second time as cm_connect_netlogon
1337                    might not yet have noticed that the DC has killed
1338                    our connection. */
1339
1340                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1341                         retry = True;
1342                         continue;
1343                 }
1344
1345                 /* if we get access denied, a possible cause was that we had
1346                    and open connection to the DC, but someone changed our
1347                    machine account password out from underneath us using 'net
1348                    rpc changetrustpw' */
1349
1350                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1351                         DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1352                                  "ACCESS_DENIED.  Maybe the trust account "
1353                                 "password was changed and we didn't know it. "
1354                                  "Killing connections to domain %s\n",
1355                                 name_domain));
1356                         invalidate_cm_connection(&contact_domain->conn);
1357                         retry = True;
1358                 }
1359
1360         } while ( (attempts < 2) && retry );
1361
1362         /* handle the case where a NT4 DC does not fill in the acct_flags in
1363          * the samlogon reply info3. When accurate info3 is required by the
1364          * caller, we look up the account flags ourselve - gd */
1365
1366         if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
1367             NT_STATUS_IS_OK(result) && (my_info3->base.acct_flags == 0)) {
1368
1369                 struct rpc_pipe_client *samr_pipe;
1370                 POLICY_HND samr_domain_handle, user_pol;
1371                 union samr_UserInfo *info = NULL;
1372                 NTSTATUS status_tmp;
1373                 uint32 acct_flags;
1374
1375                 status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
1376                                             &samr_pipe, &samr_domain_handle);
1377
1378                 if (!NT_STATUS_IS_OK(status_tmp)) {
1379                         DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1380                                 nt_errstr(status_tmp)));
1381                         goto done;
1382                 }
1383
1384                 status_tmp = rpccli_samr_OpenUser(samr_pipe, state->mem_ctx,
1385                                                   &samr_domain_handle,
1386                                                   MAXIMUM_ALLOWED_ACCESS,
1387                                                   my_info3->base.rid,
1388                                                   &user_pol);
1389
1390                 if (!NT_STATUS_IS_OK(status_tmp)) {
1391                         DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1392                                 nt_errstr(status_tmp)));
1393                         goto done;
1394                 }
1395
1396                 status_tmp = rpccli_samr_QueryUserInfo(samr_pipe, state->mem_ctx,
1397                                                        &user_pol,
1398                                                        16,
1399                                                        &info);
1400
1401                 if (!NT_STATUS_IS_OK(status_tmp)) {
1402                         DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1403                                 nt_errstr(status_tmp)));
1404                         rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1405                         goto done;
1406                 }
1407
1408                 acct_flags = info->info16.acct_flags;
1409
1410                 if (acct_flags == 0) {
1411                         rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1412                         goto done;
1413                 }
1414
1415                 my_info3->base.acct_flags = acct_flags;
1416
1417                 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1418
1419                 rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1420         }
1421
1422         *info3 = my_info3;
1423 done:
1424         return result;
1425 }
1426
1427 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1428                                             struct winbindd_cli_state *state)
1429 {
1430         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1431         NTSTATUS krb5_result = NT_STATUS_OK;
1432         fstring name_domain, name_user;
1433         struct netr_SamInfo3 *info3 = NULL;
1434
1435         /* Ensure null termination */
1436         state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
1437
1438         /* Ensure null termination */
1439         state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
1440
1441         DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1442                   state->request.data.auth.user));
1443
1444         if (!check_request_flags(state->request.flags)) {
1445                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1446                 goto done;
1447         }
1448
1449         /* Parse domain and username */
1450
1451         ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1452
1453         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1454
1455         if (domain->online == False) {
1456                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1457                 if (domain->startup) {
1458                         /* Logons are very important to users. If we're offline and
1459                            we get a request within the first 30 seconds of startup,
1460                            try very hard to find a DC and go online. */
1461
1462                         DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1463                                 "request in startup mode.\n", domain->name ));
1464
1465                         winbindd_flush_negative_conn_cache(domain);
1466                         result = init_dc_connection(domain);
1467                 }
1468         }
1469
1470         DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1471
1472         /* Check for Kerberos authentication */
1473         if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
1474
1475                 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1476                 /* save for later */
1477                 krb5_result = result;
1478
1479
1480                 if (NT_STATUS_IS_OK(result)) {
1481                         DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1482                         goto process_result;
1483                 } else {
1484                         DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1485                 }
1486
1487                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1488                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1489                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1490                         DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1491                         set_domain_offline( domain );
1492                         goto cached_logon;
1493                 }
1494
1495                 /* there are quite some NT_STATUS errors where there is no
1496                  * point in retrying with a samlogon, we explictly have to take
1497                  * care not to increase the bad logon counter on the DC */
1498
1499                 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1500                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1501                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1502                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1503                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1504                     NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1505                     NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1506                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1507                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1508                     NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1509                         goto process_result;
1510                 }
1511
1512                 if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1513                         DEBUG(3,("falling back to samlogon\n"));
1514                         goto sam_logon;
1515                 } else {
1516                         goto cached_logon;
1517                 }
1518         }
1519
1520 sam_logon:
1521         /* Check for Samlogon authentication */
1522         if (domain->online) {
1523                 result = winbindd_dual_pam_auth_samlogon(domain, state, &info3);
1524
1525                 if (NT_STATUS_IS_OK(result)) {
1526                         DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1527                         /* add the Krb5 err if we have one */
1528                         if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1529                                 info3->base.user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1530                         }
1531                         goto process_result;
1532                 }
1533
1534                 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1535                           nt_errstr(result)));
1536
1537                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1538                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1539                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1540                 {
1541                         DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1542                         set_domain_offline( domain );
1543                         goto cached_logon;
1544                 }
1545
1546                         if (domain->online) {
1547                                 /* We're still online - fail. */
1548                                 goto done;
1549                         }
1550         }
1551
1552 cached_logon:
1553         /* Check for Cached logons */
1554         if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
1555             lp_winbind_offline_logon()) {
1556
1557                 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1558
1559                 if (NT_STATUS_IS_OK(result)) {
1560                         DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1561                         goto process_result;
1562                 } else {
1563                         DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1564                         goto done;
1565                 }
1566         }
1567
1568 process_result:
1569
1570         if (NT_STATUS_IS_OK(result)) {
1571
1572                 DOM_SID user_sid;
1573
1574                 /* In all codepaths where result == NT_STATUS_OK info3 must have
1575                    been initialized. */
1576                 if (!info3) {
1577                         result = NT_STATUS_INTERNAL_ERROR;
1578                         goto done;
1579                 }
1580
1581                 netsamlogon_cache_store(name_user, info3);
1582                 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1583
1584                 /* save name_to_sid info as early as possible (only if
1585                    this is our primary domain so we don't invalidate
1586                    the cache entry by storing the seq_num for the wrong
1587                    domain). */
1588                 if ( domain->primary ) {
1589                         sid_compose(&user_sid, info3->base.domain_sid,
1590                                     info3->base.rid);
1591                         cache_name2sid(domain, name_domain, name_user,
1592                                        SID_NAME_USER, &user_sid);
1593                 }
1594
1595                 /* Check if the user is in the right group */
1596
1597                 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1598                                         state->request.data.auth.require_membership_of_sid))) {
1599                         DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1600                                   state->request.data.auth.user,
1601                                   state->request.data.auth.require_membership_of_sid));
1602                         goto done;
1603                 }
1604
1605                 result = append_data(state, info3, name_domain, name_user);
1606                 if (!NT_STATUS_IS_OK(result)) {
1607                         goto done;
1608                 }
1609
1610                 if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
1611
1612                         /* Store in-memory creds for single-signon using ntlm_auth. */
1613                         result = winbindd_add_memory_creds(state->request.data.auth.user,
1614                                                         get_uid_from_state(state),
1615                                                         state->request.data.auth.pass);
1616
1617                         if (!NT_STATUS_IS_OK(result)) {
1618                                 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
1619                                 goto done;
1620                         }
1621
1622                         if (lp_winbind_offline_logon()) {
1623                                 result = winbindd_store_creds(domain,
1624                                                       state->mem_ctx,
1625                                                       state->request.data.auth.user,
1626                                                       state->request.data.auth.pass,
1627                                                       info3, NULL);
1628                                 if (!NT_STATUS_IS_OK(result)) {
1629
1630                                         /* Release refcount. */
1631                                         winbindd_delete_memory_creds(state->request.data.auth.user);
1632
1633                                         DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
1634                                         goto done;
1635                                 }
1636                         }
1637                 }
1638
1639
1640                 if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
1641                         result = fillup_password_policy(domain, state);
1642
1643                         if (!NT_STATUS_IS_OK(result)
1644                             && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1645                         {
1646                                 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
1647                                 goto done;
1648                         }
1649                 }
1650
1651                 result = NT_STATUS_OK;
1652         }
1653
1654 done:
1655         /* give us a more useful (more correct?) error code */
1656         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1657             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1658                 result = NT_STATUS_NO_LOGON_SERVERS;
1659         }
1660
1661         state->response.data.auth.nt_status = NT_STATUS_V(result);
1662         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1663
1664         /* we might have given a more useful error above */
1665         if (!*state->response.data.auth.error_string)
1666                 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1667         state->response.data.auth.pam_error = nt_status_to_pam(result);
1668
1669         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1670               state->request.data.auth.user,
1671               state->response.data.auth.nt_status_string,
1672               state->response.data.auth.pam_error));
1673
1674         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1675 }
1676
1677
1678 /**********************************************************************
1679  Challenge Response Authentication Protocol
1680 **********************************************************************/
1681
1682 void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
1683 {
1684         struct winbindd_domain *domain = NULL;
1685         const char *domain_name = NULL;
1686         NTSTATUS result;
1687
1688         if (!check_request_flags(state->request.flags)) {
1689                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1690                 goto done;
1691         }
1692
1693         if (!state->privileged) {
1694                 char *error_string = NULL;
1695                 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1696                           "denied.  !\n"));
1697                 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1698                              "on %s are set correctly.\n",
1699                              get_winbind_priv_pipe_dir()));
1700                 /* send a better message than ACCESS_DENIED */
1701                 error_string = talloc_asprintf(state->mem_ctx,
1702                                                "winbind client not authorized "
1703                                                "to use winbindd_pam_auth_crap."
1704                                                " Ensure permissions on %s "
1705                                                "are set correctly.",
1706                                                get_winbind_priv_pipe_dir());
1707                 fstrcpy(state->response.data.auth.error_string, error_string);
1708                 result = NT_STATUS_ACCESS_DENIED;
1709                 goto done;
1710         }
1711
1712         /* Ensure null termination */
1713         state->request.data.auth_crap.user
1714                 [sizeof(state->request.data.auth_crap.user)-1]=0;
1715         state->request.data.auth_crap.domain
1716                 [sizeof(state->request.data.auth_crap.domain)-1]=0;
1717
1718         DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1719                   (unsigned long)state->pid,
1720                   state->request.data.auth_crap.domain,
1721                   state->request.data.auth_crap.user));
1722
1723         if (*state->request.data.auth_crap.domain != '\0') {
1724                 domain_name = state->request.data.auth_crap.domain;
1725         } else if (lp_winbind_use_default_domain()) {
1726                 domain_name = lp_workgroup();
1727         }
1728
1729         if (domain_name != NULL)
1730                 domain = find_auth_domain(state, domain_name);
1731
1732         if (domain != NULL) {
1733                 sendto_domain(state, domain);
1734                 return;
1735         }
1736
1737         result = NT_STATUS_NO_SUCH_USER;
1738
1739  done:
1740         set_auth_errors(&state->response, result);
1741         DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1742                   state->request.data.auth_crap.domain,
1743                   state->request.data.auth_crap.user,
1744                   state->response.data.auth.nt_status_string,
1745                   state->response.data.auth.pam_error));
1746         request_error(state);
1747         return;
1748 }
1749
1750
1751 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1752                                                  struct winbindd_cli_state *state)
1753 {
1754         NTSTATUS result;
1755         struct netr_SamInfo3 *info3 = NULL;
1756         struct rpc_pipe_client *netlogon_pipe;
1757         const char *name_user = NULL;
1758         const char *name_domain = NULL;
1759         const char *workstation;
1760         struct winbindd_domain *contact_domain;
1761         int attempts = 0;
1762         bool retry;
1763
1764         DATA_BLOB lm_resp, nt_resp;
1765
1766         /* This is child-only, so no check for privileged access is needed
1767            anymore */
1768
1769         /* Ensure null termination */
1770         state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
1771         state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
1772
1773         if (!check_request_flags(state->request.flags)) {
1774                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1775                 goto done;
1776         }
1777
1778         name_user = state->request.data.auth_crap.user;
1779
1780         if (*state->request.data.auth_crap.domain) {
1781                 name_domain = state->request.data.auth_crap.domain;
1782         } else if (lp_winbind_use_default_domain()) {
1783                 name_domain = lp_workgroup();
1784         } else {
1785                 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1786                          name_user));
1787                 result = NT_STATUS_NO_SUCH_USER;
1788                 goto done;
1789         }
1790
1791         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1792                   name_domain, name_user));
1793
1794         if (*state->request.data.auth_crap.workstation) {
1795                 workstation = state->request.data.auth_crap.workstation;
1796         } else {
1797                 workstation = global_myname();
1798         }
1799
1800         if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
1801                 || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
1802                 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1803                           state->request.data.auth_crap.lm_resp_len,
1804                           state->request.data.auth_crap.nt_resp_len));
1805                 result = NT_STATUS_INVALID_PARAMETER;
1806                 goto done;
1807         }
1808
1809         lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
1810                                         state->request.data.auth_crap.lm_resp_len);
1811         nt_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.nt_resp,
1812                                         state->request.data.auth_crap.nt_resp_len);
1813
1814         /* what domain should we contact? */
1815
1816         if ( IS_DC ) {
1817                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1818                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1819                                   state->request.data.auth_crap.user, name_domain, name_user, name_domain));
1820                         result = NT_STATUS_NO_SUCH_USER;
1821                         goto done;
1822                 }
1823         } else {
1824                 if (is_myname(name_domain)) {
1825                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1826                         result =  NT_STATUS_NO_SUCH_USER;
1827                         goto done;
1828                 }
1829                 contact_domain = find_our_domain();
1830         }
1831
1832         do {
1833                 NTSTATUS (*logon_fn)(struct rpc_pipe_client *cli,
1834                                      TALLOC_CTX *mem_ctx,
1835                                      uint32 logon_parameters,
1836                                      const char *server,
1837                                      const char *username,
1838                                      const char *domain,
1839                                      const char *workstation,
1840                                      const uint8 chal[8],
1841                                      DATA_BLOB lm_response,
1842                                      DATA_BLOB nt_response,
1843                                      struct netr_SamInfo3 **info3);
1844
1845                 retry = False;
1846
1847                 netlogon_pipe = NULL;
1848                 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1849
1850                 if (!NT_STATUS_IS_OK(result)) {
1851                         DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1852                                   nt_errstr(result)));
1853                         goto done;
1854                 }
1855
1856                 logon_fn = contact_domain->can_do_samlogon_ex
1857                         ? rpccli_netlogon_sam_network_logon_ex
1858                         : rpccli_netlogon_sam_network_logon;
1859
1860                 result = logon_fn(netlogon_pipe,
1861                                   state->mem_ctx,
1862                                   state->request.data.auth_crap.logon_parameters,
1863                                   contact_domain->dcname,
1864                                   name_user,
1865                                   name_domain,
1866                                   /* Bug #3248 - found by Stefan Burkei. */
1867                                   workstation, /* We carefully set this above so use it... */
1868                                   state->request.data.auth_crap.chal,
1869                                   lm_resp,
1870                                   nt_resp,
1871                                   &info3);
1872
1873                 if ((NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR)
1874                     && contact_domain->can_do_samlogon_ex) {
1875                         DEBUG(3, ("Got a DC that can not do NetSamLogonEx, "
1876                                   "retrying with NetSamLogon\n"));
1877                         contact_domain->can_do_samlogon_ex = False;
1878                         retry = True;
1879                         continue;
1880                 }
1881
1882                 attempts += 1;
1883
1884                 /* We have to try a second time as cm_connect_netlogon
1885                    might not yet have noticed that the DC has killed
1886                    our connection. */
1887
1888                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1889                         retry = True;
1890                         continue;
1891                 }
1892
1893                 /* if we get access denied, a possible cause was that we had and open
1894                    connection to the DC, but someone changed our machine account password
1895                    out from underneath us using 'net rpc changetrustpw' */
1896
1897                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1898                         DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1899                                  "ACCESS_DENIED.  Maybe the trust account "
1900                                 "password was changed and we didn't know it. "
1901                                  "Killing connections to domain %s\n",
1902                                 name_domain));
1903                         invalidate_cm_connection(&contact_domain->conn);
1904                         retry = True;
1905                 }
1906
1907         } while ( (attempts < 2) && retry );
1908
1909         if (NT_STATUS_IS_OK(result)) {
1910
1911                 netsamlogon_cache_store(name_user, info3);
1912                 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1913
1914                 /* Check if the user is in the right group */
1915
1916                 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1917                                                         state->request.data.auth_crap.require_membership_of_sid))) {
1918                         DEBUG(3, ("User %s is not in the required group (%s), so "
1919                                   "crap authentication is rejected\n",
1920                                   state->request.data.auth_crap.user,
1921                                   state->request.data.auth_crap.require_membership_of_sid));
1922                         goto done;
1923                 }
1924
1925                 result = append_data(state, info3, name_domain, name_user);
1926                 if (!NT_STATUS_IS_OK(result)) {
1927                         goto done;
1928                 }
1929         }
1930
1931 done:
1932
1933         /* give us a more useful (more correct?) error code */
1934         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1935             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1936                 result = NT_STATUS_NO_LOGON_SERVERS;
1937         }
1938
1939         if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1940                 result = nt_status_squash(result);
1941         }
1942
1943         state->response.data.auth.nt_status = NT_STATUS_V(result);
1944         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1945
1946         /* we might have given a more useful error above */
1947         if (!*state->response.data.auth.error_string) {
1948                 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1949         }
1950         state->response.data.auth.pam_error = nt_status_to_pam(result);
1951
1952         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1953               ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1954                name_domain,
1955                name_user,
1956                state->response.data.auth.nt_status_string,
1957                state->response.data.auth.pam_error));
1958
1959         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1960 }
1961
1962 /* Change a user password */
1963
1964 void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
1965 {
1966         fstring domain, user;
1967         struct winbindd_domain *contact_domain;
1968
1969         DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
1970                 state->request.data.chauthtok.user));
1971
1972         /* Setup crap */
1973
1974         ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1975
1976         if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
1977                 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1978                 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
1979                           "(PAM: %d)\n",
1980                           state->request.data.auth.user,
1981                           state->response.data.auth.nt_status_string,
1982                           state->response.data.auth.pam_error));
1983                 request_error(state);
1984                 return;
1985         }
1986
1987         contact_domain = find_domain_from_name(domain);
1988         if (!contact_domain) {
1989                 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1990                 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
1991                           state->request.data.chauthtok.user, domain, user, domain));
1992                 request_error(state);
1993                 return;
1994         }
1995
1996         sendto_domain(state, contact_domain);
1997 }
1998
1999 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
2000                                                  struct winbindd_cli_state *state)
2001 {
2002         char *oldpass;
2003         char *newpass = NULL;
2004         POLICY_HND dom_pol;
2005         struct rpc_pipe_client *cli;
2006         bool got_info = False;
2007         struct samr_DomInfo1 *info = NULL;
2008         struct samr_ChangeReject *reject = NULL;
2009         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2010         fstring domain, user;
2011
2012         DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
2013                   state->request.data.auth.user));
2014
2015         if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
2016                 goto done;
2017         }
2018
2019         /* Change password */
2020
2021         oldpass = state->request.data.chauthtok.oldpass;
2022         newpass = state->request.data.chauthtok.newpass;
2023
2024         /* Initialize reject reason */
2025         state->response.data.auth.reject_reason = Undefined;
2026
2027         /* Get sam handle */
2028
2029         result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
2030                                 &dom_pol);
2031         if (!NT_STATUS_IS_OK(result)) {
2032                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2033                 goto done;
2034         }
2035
2036         result = rpccli_samr_chgpasswd3(cli, state->mem_ctx,
2037                                         user,
2038                                         newpass,
2039                                         oldpass,
2040                                         &info,
2041                                         &reject);
2042
2043         /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2044
2045         if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2046                 state->response.data.auth.policy.min_length_password =
2047                         info->min_password_length;
2048                 state->response.data.auth.policy.password_history =
2049                         info->password_history_length;
2050                 state->response.data.auth.policy.password_properties =
2051                         info->password_properties;
2052                 state->response.data.auth.policy.expire =
2053                         nt_time_to_unix_abs((NTTIME *)&info->max_password_age);
2054                 state->response.data.auth.policy.min_passwordage =
2055                         nt_time_to_unix_abs((NTTIME *)&info->min_password_age);
2056
2057                 state->response.data.auth.reject_reason =
2058                         reject->reason;
2059
2060                 got_info = True;
2061         }
2062
2063         /* only fallback when the chgpasswd3 call is not supported */
2064         if ((NT_STATUS_EQUAL(result, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR))) ||
2065                    (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) ||
2066                    (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED))) {
2067
2068                 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
2069                         nt_errstr(result)));
2070
2071                 result = rpccli_samr_chgpasswd_user(cli, state->mem_ctx, user, newpass, oldpass);
2072
2073                 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2074                    Map to the same status code as Windows 2003. */
2075
2076                 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2077                         result = NT_STATUS_PASSWORD_RESTRICTION;
2078                 }
2079         }
2080
2081 done:
2082
2083         if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
2084
2085                 /* Update the single sign-on memory creds. */
2086                 result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
2087                                                         newpass);
2088
2089                 if (!NT_STATUS_IS_OK(result)) {
2090                         DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
2091                         goto process_result;
2092                 }
2093
2094                 if (lp_winbind_offline_logon()) {
2095                         result = winbindd_update_creds_by_name(contact_domain,
2096                                                          state->mem_ctx, user,
2097                                                          newpass);
2098                         if (!NT_STATUS_IS_OK(result)) {
2099                                 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
2100                                 goto process_result;
2101                         }
2102                 }
2103         }
2104
2105         if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2106
2107                 NTSTATUS policy_ret;
2108
2109                 policy_ret = fillup_password_policy(contact_domain, state);
2110
2111                 /* failure of this is non critical, it will just provide no
2112                  * additional information to the client why the change has
2113                  * failed - Guenther */
2114
2115                 if (!NT_STATUS_IS_OK(policy_ret)) {
2116                         DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2117                         goto process_result;
2118                 }
2119         }
2120
2121 process_result:
2122
2123         state->response.data.auth.nt_status = NT_STATUS_V(result);
2124         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2125         fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2126         state->response.data.auth.pam_error = nt_status_to_pam(result);
2127
2128         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2129               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2130                domain,
2131                user,
2132                state->response.data.auth.nt_status_string,
2133                state->response.data.auth.pam_error));
2134
2135         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2136 }
2137
2138 void winbindd_pam_logoff(struct winbindd_cli_state *state)
2139 {
2140         struct winbindd_domain *domain;
2141         fstring name_domain, user;
2142         uid_t caller_uid = (uid_t)-1;
2143         uid_t request_uid = state->request.data.logoff.uid;
2144
2145         DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
2146                 state->request.data.logoff.user));
2147
2148         /* Ensure null termination */
2149         state->request.data.logoff.user
2150                 [sizeof(state->request.data.logoff.user)-1]='\0';
2151
2152         state->request.data.logoff.krb5ccname
2153                 [sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
2154
2155         if (request_uid == (gid_t)-1) {
2156                 goto failed;
2157         }
2158
2159         if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
2160                 goto failed;
2161         }
2162
2163         if ((domain = find_auth_domain(state, name_domain)) == NULL) {
2164                 goto failed;
2165         }
2166
2167         if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
2168                 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2169                         strerror(errno)));
2170                 goto failed;
2171         }
2172
2173         switch (caller_uid) {
2174                 case -1:
2175                         goto failed;
2176                 case 0:
2177                         /* root must be able to logoff any user - gd */
2178                         state->request.data.logoff.uid = request_uid;
2179                         break;
2180                 default:
2181                         if (caller_uid != request_uid) {
2182                                 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2183                                 goto failed;
2184                         }
2185                         state->request.data.logoff.uid = caller_uid;
2186                         break;
2187         }
2188
2189         sendto_domain(state, domain);
2190         return;
2191
2192  failed:
2193         set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2194         DEBUG(5, ("Pam Logoff for %s returned %s "
2195                   "(PAM: %d)\n",
2196                   state->request.data.logoff.user,
2197                   state->response.data.auth.nt_status_string,
2198                   state->response.data.auth.pam_error));
2199         request_error(state);
2200         return;
2201 }
2202
2203 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2204                                               struct winbindd_cli_state *state)
2205 {
2206         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2207
2208         DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2209                 state->request.data.logoff.user));
2210
2211         if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
2212                 result = NT_STATUS_OK;
2213                 goto process_result;
2214         }
2215
2216         if (state->request.data.logoff.krb5ccname[0] == '\0') {
2217                 result = NT_STATUS_OK;
2218                 goto process_result;
2219         }
2220
2221 #ifdef HAVE_KRB5
2222
2223         if (state->request.data.logoff.uid < 0) {
2224                 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2225                 goto process_result;
2226         }
2227
2228         /* what we need here is to find the corresponding krb5 ccache name *we*
2229          * created for a given username and destroy it */
2230
2231         if (!ccache_entry_exists(state->request.data.logoff.user)) {
2232                 result = NT_STATUS_OK;
2233                 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2234                 goto process_result;
2235         }
2236
2237         if (!ccache_entry_identical(state->request.data.logoff.user,
2238                                         state->request.data.logoff.uid,
2239                                         state->request.data.logoff.krb5ccname)) {
2240                 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2241                 goto process_result;
2242         }
2243
2244         result = remove_ccache(state->request.data.logoff.user);
2245         if (!NT_STATUS_IS_OK(result)) {
2246                 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2247                         nt_errstr(result)));
2248                 goto process_result;
2249         }
2250
2251 #else
2252         result = NT_STATUS_NOT_SUPPORTED;
2253 #endif
2254
2255 process_result:
2256
2257         winbindd_delete_memory_creds(state->request.data.logoff.user);
2258
2259         state->response.data.auth.nt_status = NT_STATUS_V(result);
2260         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2261         fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2262         state->response.data.auth.pam_error = nt_status_to_pam(result);
2263
2264         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2265 }
2266
2267 /* Change user password with auth crap*/
2268
2269 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
2270 {
2271         struct winbindd_domain *domain = NULL;
2272         const char *domain_name = NULL;
2273
2274         /* Ensure null termination */
2275         state->request.data.chng_pswd_auth_crap.user[
2276                 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2277         state->request.data.chng_pswd_auth_crap.domain[
2278                 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2279
2280         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2281                   (unsigned long)state->pid,
2282                   state->request.data.chng_pswd_auth_crap.domain,
2283                   state->request.data.chng_pswd_auth_crap.user));
2284
2285         if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
2286                 domain_name = state->request.data.chng_pswd_auth_crap.domain;
2287         } else if (lp_winbind_use_default_domain()) {
2288                 domain_name = lp_workgroup();
2289         }
2290
2291         if (domain_name != NULL)
2292                 domain = find_domain_from_name(domain_name);
2293
2294         if (domain != NULL) {
2295                 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2296                           "%s\n", (unsigned long)state->pid,domain->name));
2297                 sendto_domain(state, domain);
2298                 return;
2299         }
2300
2301         set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2302         DEBUG(5, ("CRAP change password  for %s\\%s returned %s (PAM: %d)\n",
2303                   state->request.data.chng_pswd_auth_crap.domain,
2304                   state->request.data.chng_pswd_auth_crap.user,
2305                   state->response.data.auth.nt_status_string,
2306                   state->response.data.auth.pam_error));
2307         request_error(state);
2308         return;
2309 }
2310
2311 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2312 {
2313         NTSTATUS result;
2314         DATA_BLOB new_nt_password;
2315         DATA_BLOB old_nt_hash_enc;
2316         DATA_BLOB new_lm_password;
2317         DATA_BLOB old_lm_hash_enc;
2318         fstring  domain,user;
2319         POLICY_HND dom_pol;
2320         struct winbindd_domain *contact_domain = domainSt;
2321         struct rpc_pipe_client *cli;
2322
2323         /* Ensure null termination */
2324         state->request.data.chng_pswd_auth_crap.user[
2325                 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2326         state->request.data.chng_pswd_auth_crap.domain[
2327                 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2328         *domain = 0;
2329         *user = 0;
2330
2331         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2332                   (unsigned long)state->pid,
2333                   state->request.data.chng_pswd_auth_crap.domain,
2334                   state->request.data.chng_pswd_auth_crap.user));
2335
2336         if (lp_winbind_offline_logon()) {
2337                 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2338                 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2339                 result = NT_STATUS_ACCESS_DENIED;
2340                 goto done;
2341         }
2342
2343         if (*state->request.data.chng_pswd_auth_crap.domain) {
2344                 fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
2345         } else {
2346                 parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
2347                                   domain, user);
2348
2349                 if(!*domain) {
2350                         DEBUG(3,("no domain specified with username (%s) - "
2351                                  "failing auth\n",
2352                                  state->request.data.chng_pswd_auth_crap.user));
2353                         result = NT_STATUS_NO_SUCH_USER;
2354                         goto done;
2355                 }
2356         }
2357
2358         if (!*domain && lp_winbind_use_default_domain()) {
2359                 fstrcpy(domain,(char *)lp_workgroup());
2360         }
2361
2362         if(!*user) {
2363                 fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
2364         }
2365
2366         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2367                   (unsigned long)state->pid, domain, user));
2368
2369         /* Change password */
2370         new_nt_password = data_blob_talloc(
2371                 state->mem_ctx,
2372                 state->request.data.chng_pswd_auth_crap.new_nt_pswd,
2373                 state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
2374
2375         old_nt_hash_enc = data_blob_talloc(
2376                 state->mem_ctx,
2377                 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
2378                 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2379
2380         if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2381                 new_lm_password = data_blob_talloc(
2382                         state->mem_ctx,
2383                         state->request.data.chng_pswd_auth_crap.new_lm_pswd,
2384                         state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
2385
2386                 old_lm_hash_enc = data_blob_talloc(
2387                         state->mem_ctx,
2388                         state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
2389                         state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2390         } else {
2391                 new_lm_password.length = 0;
2392                 old_lm_hash_enc.length = 0;
2393         }
2394
2395         /* Get sam handle */
2396
2397         result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2398         if (!NT_STATUS_IS_OK(result)) {
2399                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2400                 goto done;
2401         }
2402
2403         result = rpccli_samr_chng_pswd_auth_crap(
2404                 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2405                 new_lm_password, old_lm_hash_enc);
2406
2407  done:
2408         state->response.data.auth.nt_status = NT_STATUS_V(result);
2409         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2410         fstrcpy(state->response.data.auth.error_string,
2411                 get_friendly_nt_error_msg(result));
2412         state->response.data.auth.pam_error = nt_status_to_pam(result);
2413
2414         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2415               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2416                domain, user,
2417                state->response.data.auth.nt_status_string,
2418                state->response.data.auth.pam_error));
2419
2420         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2421 }