2 Unix SMB/CIFS implementation.
4 Winbind authentication mechnism
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Andrew Bartlett 2001 - 2002
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "librpc/gen_ndr/ndr_netlogon.h"
27 #include "auth/auth.h"
28 #include "nsswitch/winbind_client.h"
30 static NTSTATUS get_info3_from_ndr(TALLOC_CTX *mem_ctx, struct winbindd_response *response, struct netr_SamInfo3 *info3)
32 size_t len = response->length - sizeof(struct winbindd_response);
36 blob.length = len - 4;
37 blob.data = (uint8_t *)(((char *)response->extra_data) + 4);
39 status = ndr_pull_struct_blob(&blob, mem_ctx, info3,
40 (ndr_pull_flags_fn_t)ndr_pull_netr_SamInfo3);
44 DEBUG(2, ("get_info3_from_ndr: No info3 struct found!\n"));
45 return NT_STATUS_UNSUCCESSFUL;
49 /* Authenticate a user with a challenge/response */
50 static NTSTATUS winbind_check_password(struct auth_method_context *ctx,
52 const struct auth_usersupplied_info *user_info,
53 struct auth_serversupplied_info **server_info)
55 struct winbindd_request request;
56 struct winbindd_response response;
59 struct netr_SamInfo3 info3;
61 /* Send off request */
62 const struct auth_usersupplied_info *user_info_temp;
63 nt_status = encrypt_user_info(mem_ctx, ctx->auth_ctx,
64 AUTH_PASSWORD_RESPONSE,
65 user_info, &user_info_temp);
66 if (!NT_STATUS_IS_OK(nt_status)) {
69 user_info = user_info_temp;
72 ZERO_STRUCT(response);
73 request.flags = WBFLAG_PAM_INFO3_NDR;
74 fstrcpy(request.data.auth_crap.user,
75 user_info->client.account_name);
76 fstrcpy(request.data.auth_crap.domain,
77 user_info->client.domain_name);
78 fstrcpy(request.data.auth_crap.workstation,
79 user_info->workstation_name);
81 memcpy(request.data.auth_crap.chal, ctx->auth_ctx->challenge.data.data, sizeof(request.data.auth_crap.chal));
83 request.data.auth_crap.lm_resp_len = MIN(user_info->password.response.lanman.length,
84 sizeof(request.data.auth_crap.lm_resp));
85 request.data.auth_crap.nt_resp_len = MIN(user_info->password.response.nt.length,
86 sizeof(request.data.auth_crap.nt_resp));
88 memcpy(request.data.auth_crap.lm_resp, user_info->password.response.lanman.data,
89 request.data.auth_crap.lm_resp_len);
90 memcpy(request.data.auth_crap.nt_resp, user_info->password.response.nt.data,
91 request.data.auth_crap.nt_resp_len);
93 result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response);
95 nt_status = NT_STATUS(response.data.auth.nt_status);
96 NT_STATUS_NOT_OK_RETURN(nt_status);
98 if (result == NSS_STATUS_SUCCESS && response.extra_data) {
99 union netr_Validation validation;
101 nt_status = get_info3_from_ndr(mem_ctx, &response, &info3);
102 SAFE_FREE(response.extra_data);
103 NT_STATUS_NOT_OK_RETURN(nt_status);
105 validation.sam3 = &info3;
106 nt_status = make_server_info_netlogon_validation(mem_ctx,
107 user_info->client.account_name,
111 } else if (result == NSS_STATUS_SUCCESS && !response.extra_data) {
112 DEBUG(0, ("Winbindd authenticated the user [%s]\\[%s], "
113 "but did not include the required info3 reply!\n",
114 user_info->client.domain_name, user_info->client.account_name));
115 return NT_STATUS_INSUFFICIENT_LOGON_INFO;
116 } else if (NT_STATUS_IS_OK(nt_status)) {
117 DEBUG(1, ("Winbindd authentication for [%s]\\[%s] failed, "
118 "but no error code is available!\n",
119 user_info->client.domain_name, user_info->client.account_name));
120 return NT_STATUS_NO_LOGON_SERVERS;
126 static const struct auth_operations winbind_ops = {
128 .get_challenge = auth_get_challenge_not_implemented,
129 .check_password = winbind_check_password
132 NTSTATUS auth_winbind_init(void)
136 ret = auth_register(&winbind_ops);
137 if (!NT_STATUS_IS_OK(ret)) {
138 DEBUG(0,("Failed to register 'winbind' auth backend!\n"));