2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2004
5 Copyright (C) Gerald Carter 2003
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #define DBGC_CLASS DBGC_AUTH
27 /****************************************************************************
28 Do a specific test for an smb password being correct, given a smb_password and
29 the lanman and NT responses.
30 ****************************************************************************/
32 static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
36 const struct samr_Password *lm_pwd,
37 const struct samr_Password *nt_pwd,
38 const struct auth_usersupplied_info *user_info,
39 DATA_BLOB *user_sess_key,
40 DATA_BLOB *lm_sess_key)
44 if (acct_flags & ACB_PWNOTREQ) {
45 if (lp_null_passwords()) {
46 DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n",
50 DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n",
52 return NT_STATUS_LOGON_FAILURE;
56 status = ntlm_password_check(mem_ctx, &auth_context->challenge,
57 &user_info->lm_resp, &user_info->nt_resp,
58 &user_info->lm_interactive_password,
59 &user_info->nt_interactive_password,
61 user_info->smb_name.str,
62 user_info->client_domain.str,
63 lm_pwd->hash, nt_pwd->hash, user_sess_key, lm_sess_key);
65 if (NT_STATUS_IS_OK(status)) {
66 if (user_sess_key && user_sess_key->data) {
67 talloc_steal(auth_context, user_sess_key->data);
69 if (lm_sess_key && lm_sess_key->data) {
70 talloc_steal(auth_context, lm_sess_key->data);
78 /****************************************************************************
79 Do a specific test for a SAM_ACCOUNT being vaild for this connection
80 (ie not disabled, expired and the like).
81 ****************************************************************************/
83 static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
87 NTTIME *must_change_time,
88 NTTIME *last_set_time,
89 const char *workstation_list,
90 const struct auth_usersupplied_info *user_info)
92 DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n", username));
94 /* Quit if the account was disabled. */
95 if (acct_flags & ACB_DISABLED) {
96 DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", username));
97 return NT_STATUS_ACCOUNT_DISABLED;
100 /* Quit if the account was locked out. */
101 if (acct_flags & ACB_AUTOLOCK) {
102 DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", username));
103 return NT_STATUS_ACCOUNT_LOCKED_OUT;
106 /* Test account expire time */
107 if ((*acct_expiry) != -1 && time(NULL) > nt_time_to_unix(*acct_expiry)) {
108 DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", username));
109 DEBUG(3,("sam_account_ok: Account expired at '%s'.\n",
110 nt_time_string(mem_ctx, *acct_expiry)));
111 return NT_STATUS_ACCOUNT_EXPIRED;
114 if (!(acct_flags & ACB_PWNOEXP)) {
116 /* check for immediate expiry "must change at next logon" */
117 if (*must_change_time == 0 && *last_set_time != 0) {
118 DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n",
120 return NT_STATUS_PASSWORD_MUST_CHANGE;
123 /* check for expired password */
124 if ((*must_change_time) != 0 && nt_time_to_unix(*must_change_time) < time(NULL)) {
125 DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n",
127 DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n",
128 nt_time_string(mem_ctx, *must_change_time)));
129 return NT_STATUS_PASSWORD_EXPIRED;
133 /* Test workstation. Workstation list is comma separated. */
135 if (workstation_list && *workstation_list) {
136 BOOL invalid_ws = True;
137 const char *s = workstation_list;
141 while (next_token(&s, tok, ",", sizeof(tok))) {
142 DEBUG(10,("sam_account_ok: checking for workstation match %s and %s (len=%d)\n",
143 tok, user_info->wksta_name.str, user_info->wksta_name.len));
145 if(strequal(tok, user_info->wksta_name.str)) {
152 return NT_STATUS_INVALID_WORKSTATION;
155 if (acct_flags & ACB_DOMTRUST) {
156 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", username));
157 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
160 if (acct_flags & ACB_SVRTRUST) {
161 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", username));
162 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
165 if (acct_flags & ACB_WSTRUST) {
166 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", username));
167 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
173 /****************************************************************************
174 check if a username/password is OK assuming the password is a 24 byte
175 SMB hash supplied in the user_info structure
176 return an NT_STATUS constant.
177 ****************************************************************************/
179 static NTSTATUS check_sam_security(const struct auth_context *auth_context,
180 void *my_private_data,
182 const struct auth_usersupplied_info *user_info,
183 struct auth_serversupplied_info **server_info)
185 struct ldb_message **msgs;
186 struct ldb_message **msgs_domain;
188 char *username = user_info->internal_username.str;
190 const char *workstation_list;
192 NTTIME must_change_time;
193 NTTIME last_set_time;
198 const char *domain_dn;
199 const char *domain_sid;
202 DATA_BLOB user_sess_key = data_blob(NULL, 0);
203 DATA_BLOB lm_sess_key = data_blob(NULL, 0);
204 struct samr_Password *lm_pwd, *nt_pwd;
206 const char *attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash",
207 "userAccountControl",
213 /* required for server_info, not access control: */
229 const char *domain_attrs[] = {"name"};
231 if (!user_info || !auth_context) {
232 return NT_STATUS_UNSUCCESSFUL;
235 sam_ctx = samdb_connect(mem_ctx);
236 if (sam_ctx == NULL) {
237 return NT_STATUS_INVALID_SYSTEM_SERVICE;
239 /* pull the user attributes */
240 ret = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
241 "(&(sAMAccountName=%s)(objectclass=user))",
245 DEBUG(3,("check_sam_security: Couldn't find user [%s] in passdb file.\n",
247 return NT_STATUS_NO_SUCH_USER;
251 DEBUG(0,("Found %d records matching user [%s]\n", ret, username));
252 return NT_STATUS_INTERNAL_DB_CORRUPTION;
255 domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
257 return NT_STATUS_INTERNAL_DB_CORRUPTION;
260 /* find the domain's DN */
261 ret_domain = samdb_search(sam_ctx, mem_ctx, NULL, &msgs_domain, domain_attrs,
262 "(&(objectSid=%s)(objectclass=domain))",
265 if (ret_domain == 0) {
266 DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n",
268 return NT_STATUS_NO_SUCH_USER;
271 if (ret_domain > 1) {
272 DEBUG(0,("Found %d records matching domain [%s]\n",
273 ret_domain, domain_sid));
274 return NT_STATUS_INTERNAL_DB_CORRUPTION;
277 domain_dn = msgs_domain[0]->dn;
279 acct_flags = samdb_result_acct_flags(msgs[0], "sAMAcctFlags");
281 /* Quit if the account was locked out. */
282 if (acct_flags & ACB_AUTOLOCK) {
283 DEBUG(3,("check_sam_security: Account for user %s was locked out.\n",
285 return NT_STATUS_ACCOUNT_LOCKED_OUT;
288 if (!NT_STATUS_IS_OK(nt_status = samdb_result_passwords(mem_ctx, msgs[0],
289 &lm_pwd, &nt_pwd))) {
293 nt_status = sam_password_ok(auth_context, mem_ctx,
294 username, acct_flags,
296 user_info, &user_sess_key, &lm_sess_key);
298 if (!NT_STATUS_IS_OK(nt_status)) {
302 acct_expiry = samdb_result_nttime(msgs[0], "accountExpires", 0);
303 must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx,
306 last_set_time = samdb_result_nttime(msgs[0], "pwdLastSet", 0);
308 workstation_list = samdb_result_string(msgs[0], "userWorkstations", NULL);
310 nt_status = sam_account_ok(mem_ctx, username, acct_flags,
317 if (!NT_STATUS_IS_OK(nt_status)) {
321 if (!NT_STATUS_IS_OK(nt_status = make_server_info(auth_context, server_info, username))) {
322 DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
327 struct ldb_message **group_msgs;
328 char *dn = msgs[0]->dn;
330 const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL };
331 /* find list of sids */
332 struct dom_sid **groupSIDs = NULL;
333 struct dom_sid *user_sid;
334 struct dom_sid *primary_group_sid;
339 group_ret = samdb_search(sam_ctx,
340 mem_ctx, NULL, &group_msgs, group_attrs,
341 "(&(member=%s)(sAMAccountType=*))",
343 if (group_ret == -1) {
344 return NT_STATUS_INTERNAL_DB_CORRUPTION;
348 !(groupSIDs = talloc_array_p(*server_info, struct dom_sid *, group_ret))) {
349 talloc_free(*server_info);
350 return NT_STATUS_NO_MEMORY;
353 /* Need to unroll some nested groups, but not aliases */
354 for (i = 0; i < group_ret; i++) {
355 sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
356 groupSIDs[i] = dom_sid_parse_talloc(*server_info, sidstr);
359 sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
360 user_sid = dom_sid_parse_talloc(*server_info, sidstr);
361 primary_group_sid = dom_sid_parse_talloc(*server_info, sidstr);
362 rid = samdb_result_uint(msgs[0], "primaryGroupID", ~0);
365 primary_group_sid = groupSIDs[0];
367 primary_group_sid = NULL;
370 primary_group_sid->sub_auths[primary_group_sid->num_auths-1] = rid;
373 (*server_info)->user_sid = user_sid;
374 (*server_info)->primary_group_sid = primary_group_sid;
376 (*server_info)->n_domain_groups = group_ret;
377 (*server_info)->domain_groups = groupSIDs;
380 (*server_info)->account_name
381 = talloc_strdup(*server_info,
382 samdb_result_string(msgs[0], "sAMAccountName", ""));
384 (*server_info)->domain
385 = talloc_strdup(*server_info,
386 samdb_result_string(msgs_domain[0], "name", ""));
388 (*server_info)->full_name
389 = talloc_strdup(*server_info,
390 samdb_result_string(msgs[0], "displayName", ""));
392 (*server_info)->logon_script
393 = talloc_strdup(*server_info,
394 samdb_result_string(msgs[0], "scriptPath", ""));
395 (*server_info)->profile_path
396 = talloc_strdup(*server_info,
397 samdb_result_string(msgs[0], "profilePath", ""));
398 (*server_info)->home_directory
399 = talloc_strdup(*server_info,
400 samdb_result_string(msgs[0], "homeDirectory", ""));
402 (*server_info)->home_drive
403 = talloc_strdup(*server_info,
404 samdb_result_string(msgs[0], "homeDrive", ""));
406 (*server_info)->last_logon = samdb_result_nttime(msgs[0], "lastLogon", 0);
407 (*server_info)->last_logoff = samdb_result_nttime(msgs[0], "lastLogoff", 0);
408 (*server_info)->acct_expiry = samdb_result_nttime(msgs[0], "accountExpires", 0);
409 (*server_info)->last_password_change = samdb_result_nttime(msgs[0], "pwdLastSet", 0);
410 (*server_info)->allow_password_change
411 = samdb_result_allow_password_change(sam_ctx, mem_ctx,
412 domain_dn, msgs[0], "pwdLastSet");
413 (*server_info)->force_password_change
414 = samdb_result_force_password_change(sam_ctx, mem_ctx,
415 domain_dn, msgs[0], "pwdLastSet");
417 (*server_info)->logon_count = samdb_result_uint(msgs[0], "logonCount", 0);
418 (*server_info)->bad_password_count = samdb_result_uint(msgs[0], "badPwdCount", 0);
420 (*server_info)->acct_flags = samdb_result_acct_flags(msgs[0], "userAccountControl");
422 (*server_info)->guest = False;
424 (*server_info)->user_session_key = user_sess_key;
425 (*server_info)->lm_session_key = lm_sess_key;
427 if (!(*server_info)->account_name
428 || !(*server_info)->full_name
429 || !(*server_info)->logon_script
430 || !(*server_info)->profile_path
431 || !(*server_info)->home_directory
432 || !(*server_info)->home_drive) {
433 talloc_destroy(*server_info);
434 return NT_STATUS_NO_MEMORY;
440 /* module initialisation */
441 static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context,
443 struct auth_methods **auth_method)
445 if (!make_auth_methods(auth_context, auth_method)) {
446 return NT_STATUS_NO_MEMORY;
449 (*auth_method)->auth = check_sam_security;
450 (*auth_method)->name = "sam_ignoredomain";
455 /****************************************************************************
456 Check SAM security (above) but with a few extra checks.
457 ****************************************************************************/
459 static NTSTATUS check_samstrict_security(const struct auth_context *auth_context,
460 void *my_private_data,
462 const struct auth_usersupplied_info *user_info,
463 struct auth_serversupplied_info **server_info)
466 if (!user_info || !auth_context) {
467 return NT_STATUS_LOGON_FAILURE;
470 /* If we are a domain member, we must not
471 attempt to check the password locally,
472 unless it is one of our aliases. */
474 if (!is_myname(user_info->domain.str)) {
475 DEBUG(7,("The requested user domain is not the local server name. [%s]\\[%s]\n",
476 user_info->domain.str,user_info->internal_username.str));
477 return NT_STATUS_NO_SUCH_USER;
480 return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info);
483 /* module initialisation */
484 static NTSTATUS auth_init_sam(struct auth_context *auth_context,
486 struct auth_methods **auth_method)
488 if (!make_auth_methods(auth_context, auth_method)) {
489 return NT_STATUS_NO_MEMORY;
492 (*auth_method)->auth = check_samstrict_security;
493 (*auth_method)->name = "sam";
497 NTSTATUS auth_sam_init(void)
500 struct auth_operations ops;
503 ops.init = auth_init_sam;
504 ret = register_backend("auth", &ops);
505 if (!NT_STATUS_IS_OK(ret)) {
506 DEBUG(0,("Failed to register '%s' auth backend!\n",
511 ops.name = "sam_ignoredomain";
512 ops.init = auth_init_sam_ignoredomain;
513 ret = register_backend("auth", &ops);
514 if (!NT_STATUS_IS_OK(ret)) {
515 DEBUG(0,("Failed to register '%s' auth backend!\n",