- Good is not compliant with our default authentication mechanism. Disable it for...

We probably need to return an Access denied error instead. TBD later.

- Add support for fAnonymousLogin in NspiBind

diff --git a/mapiproxy/dcesrv_mapiproxy.c b/mapiproxy/dcesrv_mapiproxy.c
index 7be295329845ae9ed6b68831f68701b9a4b535ae..b5aa7d43cc05e7edebb7988893bb1f1153a0f889 100644 (file)
--- a/mapiproxy/dcesrv_mapiproxy.c
+++ b/mapiproxy/dcesrv_mapiproxy.c
@@ -305,11 +305,12 @@ static NTSTATUS mapiproxy_op_ndr_pull(struct dcesrv_call_state *dce_call, TALLOC
 
        dce_call->fault_code = 0;
 
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(0, ("User is not authenticated, cannot process\n"));
-               dce_call->fault_code = DCERPC_FAULT_OP_RNG_ERROR;
-               return NT_STATUS_NET_WRITE_FAULT;
-       }
+/*     HACK: Disable authentication */ 
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(0, ("User is not authenticated, cannot process\n"));
+//             dce_call->fault_code = DCERPC_FAULT_OP_RNG_ERROR;
+//             return NT_STATUS_NET_WRITE_FAULT;
+//     }
 
        /* If remote connection bind/auth has been delayed */
        if (private->connected == false && private->server_mode == false) {

diff --git a/mapiproxy/servers/default/emsmdb/dcesrv_exchange_emsmdb.c b/mapiproxy/servers/default/emsmdb/dcesrv_exchange_emsmdb.c
index 6be3f943bc12c107c3535c6fab7c7562b4bfcdb0..56a696aa7b3b55bbf72452b6b90dd8168870961a 100644 (file)
--- a/mapiproxy/servers/default/emsmdb/dcesrv_exchange_emsmdb.c
+++ b/mapiproxy/servers/default/emsmdb/dcesrv_exchange_emsmdb.c
@@ -90,8 +90,9 @@ static enum MAPISTATUS dcesrv_EcDoConnect(struct dcesrv_call_state *dce_call,
 
        DEBUG(3, ("exchange_emsmdb: EcDoConnect (0x0)\n"));
 
+       /* HACK: Disable authentication */ 
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
+       if (!dcesrv_call_authenticated(dce_call) && 1 == 0) {
                DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
        failure:
                wire_handle.handle_type = EXCHANGE_HANDLE_EMSMDB;
@@ -252,11 +253,12 @@ static enum MAPISTATUS dcesrv_EcDoDisconnect(struct dcesrv_call_state *dce_call,
 
        DEBUG(3, ("exchange_emsmdb: EcDoDisconnect (0x1)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-               return MAPI_E_LOGON_FAILED;
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//             return MAPI_E_LOGON_FAILED;
+//     }
 
        /* Step 1. Retrieve handle and free if emsmdbp context and session are available */
        h = dcesrv_handle_fetch(dce_call->context, r->in.handle, DCESRV_HANDLE_ANY);
@@ -1208,11 +1210,12 @@ static enum MAPISTATUS dcesrv_EcDoRpc(struct dcesrv_call_state *dce_call,
 
        DEBUG(3, ("exchange_emsmdb: EcDoRpc (0x2)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-               return MAPI_E_LOGON_FAILED;
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//             return MAPI_E_LOGON_FAILED;
+//     }
 
        /* Retrieve the emsmdbp_context from the session management system */
         session = dcesrv_find_emsmdb_session(&r->in.handle->uuid);

diff --git a/mapiproxy/servers/default/nspi/dcesrv_exchange_nsp.c b/mapiproxy/servers/default/nspi/dcesrv_exchange_nsp.c
index 4a7d388d09a9b915052ee1e4f74a1cb3e062a1ef..306242d4e259beed3c6e4354141d56978f148a74 100644 (file)
--- a/mapiproxy/servers/default/nspi/dcesrv_exchange_nsp.c
+++ b/mapiproxy/servers/default/nspi/dcesrv_exchange_nsp.c
@@ -85,7 +85,7 @@ static void dcesrv_NspiBind(struct dcesrv_call_state *dce_call,
        DEBUG(5, ("exchange_nsp: NspiBind (0x0)\n"));
 
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
+       if (!dcesrv_call_authenticated(dce_call) && (r->in.dwFlags & fAnonymousLogin)) {
                DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
 
                wire_handle.handle_type = EXCHANGE_HANDLE_NSP;
@@ -104,7 +104,7 @@ static void dcesrv_NspiBind(struct dcesrv_call_state *dce_call,
        }
 
        /* Step 2. Check if incoming user belongs to the Exchange organization */
-       if (emsabp_verify_user(dce_call, emsabp_ctx) == false) {
+       if ((emsabp_verify_user(dce_call, emsabp_ctx) == false) && (r->in.dwFlags & fAnonymousLogin)) {
                talloc_free(emsabp_ctx);
 
                wire_handle.handle_type = EXCHANGE_HANDLE_NSP;
@@ -193,11 +193,12 @@ static void dcesrv_NspiUnbind(struct dcesrv_call_state *dce_call,
 
        DEBUG(5, ("exchange_nsp: NspiUnbind (0x1)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-               DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//             DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
+//     }
 
        /* Step 1. Retrieve handle and free if emsabp context and session are available */
        h = dcesrv_handle_fetch(dce_call->context, r->in.handle, DCESRV_HANDLE_ANY);
@@ -263,11 +264,12 @@ static void dcesrv_NspiQueryRows(struct dcesrv_call_state *dce_call,
 
        DEBUG(3, ("exchange_nsp: NspiQueryRows (0x3)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-               DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//             DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
+//     }
 
        emsabp_ctx = dcesrv_find_emsabp_context(&r->in.handle->uuid);
        if (!emsabp_ctx) {
@@ -386,11 +388,12 @@ static void dcesrv_NspiGetMatches(struct dcesrv_call_state *dce_call,
 
        DEBUG(3, ("exchange_nsp: NspiGetMatches (0x5)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-               DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//             DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
+//     }
 
        emsabp_ctx = dcesrv_find_emsabp_context(&r->in.handle->uuid);
        if (!emsabp_ctx) {
@@ -478,11 +481,12 @@ static void dcesrv_NspiDNToMId(struct dcesrv_call_state *dce_call,
 
        DEBUG(3, ("exchange_nsp: NspiDNToMId (0x7)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-               DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//             DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
+//     }
 
        emsabp_ctx = dcesrv_find_emsabp_context(&r->in.handle->uuid);
        if (!emsabp_ctx) {
@@ -554,11 +558,12 @@ static void dcesrv_NspiGetProps(struct dcesrv_call_state *dce_call,
 
        DEBUG(3, ("exchange_nsp: NspiGetProps (0x9)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-               DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//             DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
+//     }
 
        emsabp_ctx = dcesrv_find_emsabp_context(&r->in.handle->uuid);
        if (!emsabp_ctx) {
@@ -693,11 +698,12 @@ static void dcesrv_NspiGetSpecialTable(struct dcesrv_call_state *dce_call,
 
        DEBUG(3, ("exchange_nsp: NspiGetSpecialTable (0xC)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-               DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//             DCESRV_NSP_RETURN(r, MAPI_E_LOGON_FAILED, NULL);
+//     }
 
        emsabp_ctx = dcesrv_find_emsabp_context(&r->in.handle->uuid);
        if (!emsabp_ctx) {

diff --git a/mapiproxy/servers/default/rfr/dcesrv_exchange_ds_rfr.c b/mapiproxy/servers/default/rfr/dcesrv_exchange_ds_rfr.c
index 21f3ff524a28cf8809a91308db26c12b285bb1b6..287f18ab3cd57698adefe92cb3a29f8760b549c8 100644 (file)
--- a/mapiproxy/servers/default/rfr/dcesrv_exchange_ds_rfr.c
+++ b/mapiproxy/servers/default/rfr/dcesrv_exchange_ds_rfr.c
@@ -50,15 +50,16 @@ static enum MAPISTATUS dcesrv_RfrGetNewDSA(struct dcesrv_call_state *dce_call,
 
        DEBUG(5, ("exchange_ds_rfr: RfrGetNewDSA (0x0)\n"));
 
+       /* HACK: Disable authentication */
        /* Step 0. Ensure incoming user is authenticated */
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-
-               r->out.ppszUnused = NULL;
-               r->out.ppszServer = NULL;
-               r->out.result = MAPI_E_LOGON_FAILED;
-               return MAPI_E_LOGON_FAILED;
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+//
+//             r->out.ppszUnused = NULL;
+//             r->out.ppszServer = NULL;
+//             r->out.result = MAPI_E_LOGON_FAILED;
+//             return MAPI_E_LOGON_FAILED;
+//     }
 
        /* Step 1. We don't have load-balancing support yet, just return Samba FQDN name */
        netbiosname = lpcfg_netbios_name(dce_call->conn->dce_ctx->lp_ctx);
@@ -100,21 +101,21 @@ static enum MAPISTATUS dcesrv_RfrGetFQDNFromLegacyDN(struct dcesrv_call_state *d
 
        DEBUG(3, ("exchange_ds_rfr: RfrGetFQDNFromLegacyDN (0x1)\n"));
 
-       if (!dcesrv_call_authenticated(dce_call)) {
-               DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
-
-       failure:
-               r->out.ppszServerFQDN = talloc_array(mem_ctx, const char *, 2);
-               r->out.ppszServerFQDN[0] = NULL;
-               r->out.result = MAPI_E_LOGON_FAILED;
-               return MAPI_E_LOGON_FAILED;
-       }
-
-       netbiosname = lpcfg_netbios_name(dce_call->conn->dce_ctx->lp_ctx);
-       realm = lpcfg_realm(dce_call->conn->dce_ctx->lp_ctx);
-       if (!netbiosname || !realm) {
-               goto failure;
-       }
+//     if (!dcesrv_call_authenticated(dce_call)) {
+//             DEBUG(1, ("No challenge requested by client, cannot authenticate\n"));
+
+//     failure:
+//             r->out.ppszServerFQDN = talloc_array(mem_ctx, const char *, 2);
+//             r->out.ppszServerFQDN[0] = NULL;
+//             r->out.result = MAPI_E_LOGON_FAILED;
+//             return MAPI_E_LOGON_FAILED;
+//     }
+
+//     netbiosname = lpcfg_netbios_name(dce_call->conn->dce_ctx->lp_ctx);
+//     realm = lpcfg_realm(dce_call->conn->dce_ctx->lp_ctx);
+//     if (!netbiosname || !realm) {
+//             goto failure;
+//     }
 
        fqdn = talloc_asprintf(mem_ctx, "%s.%s", netbiosname, realm);
        r->out.ppszServerFQDN = talloc_array(mem_ctx, const char *, 2);