Password and authentication handling
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2004
Copyright (C) Gerald Carter 2003
+ Copyright (C) Stefan Metzmacher 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_AUTH
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "system/time.h"
+#include "db_wrap.h"
+#include "lib/ldb/include/ldb.h"
+#include "auth/auth.h"
+#include "auth/auth_sam.h"
+#include "dsdb/samdb/samdb.h"
+#include "libcli/security/security.h"
+#include "libcli/ldap/ldap.h"
+#include "param/param.h"
+
+extern const char *user_attrs[];
+extern const char *domain_ref_attrs[];
/****************************************************************************
- Do a specific test for an smb password being correct, given a smb_password and
- the lanman and NT responses.
+ Look for the specified user in the sam, return ldb result structures
****************************************************************************/
-static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
- TALLOC_CTX *mem_ctx,
- const char *username,
- uint16 acct_flags,
- const uint8 lm_pw[16], const uint8 nt_pw[16],
- const auth_usersupplied_info *user_info,
- DATA_BLOB *user_sess_key,
- DATA_BLOB *lm_sess_key)
+static NTSTATUS authsam_search_account(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
+ const char *account_name,
+ const char *domain_name,
+ struct ldb_message ***ret_msgs,
+ struct ldb_message ***ret_msgs_domain_ref)
{
- if (acct_flags & ACB_PWNOTREQ) {
- if (lp_null_passwords()) {
- DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", username));
- return NT_STATUS_OK;
- } else {
- DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", username));
- return NT_STATUS_LOGON_FAILURE;
- }
- }
-
- return ntlm_password_check(mem_ctx, &auth_context->challenge,
- &user_info->lm_resp, &user_info->nt_resp,
- &user_info->lm_interactive_pwd, &user_info->nt_interactive_pwd,
- username,
- user_info->smb_name.str,
- user_info->client_domain.str,
- lm_pw, nt_pw, user_sess_key, lm_sess_key);
-}
+ struct ldb_message **msgs_tmp;
+ struct ldb_message **msgs;
+ struct ldb_message **msgs_domain_ref;
+ struct ldb_dn *partitions_basedn = samdb_partitions_dn(sam_ctx, mem_ctx);
+ int ret;
+ int ret_domain;
-/****************************************************************************
- Do a specific test for a SAM_ACCOUNT being vaild for this connection
- (ie not disabled, expired and the like).
-****************************************************************************/
+ struct ldb_dn *domain_dn = NULL;
-static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
- const char *username,
- uint16 acct_flags,
- struct ldb_message **msgs,
- const auth_usersupplied_info *user_info)
-{
- char *workstation_list;
- time_t kickoff_time;
-
- DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n", username));
+ if (domain_name) {
+ domain_dn = samdb_domain_to_dn(sam_ctx, mem_ctx, domain_name);
+ if (!domain_dn) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+ }
- /* Quit if the account was disabled. */
- if (acct_flags & ACB_DISABLED) {
- DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", username));
- return NT_STATUS_ACCOUNT_DISABLED;
+ /* pull the user attributes */
+ ret = gendb_search(sam_ctx, mem_ctx, domain_dn, &msgs, user_attrs,
+ "(&(sAMAccountName=%s)(objectclass=user))",
+ ldb_binary_encode_string(mem_ctx, account_name));
+ if (ret == -1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
- /* Quit if the account was locked out. */
- if (acct_flags & ACB_AUTOLOCK) {
- DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", username));
- return NT_STATUS_ACCOUNT_LOCKED_OUT;
+ if (ret == 0) {
+ DEBUG(3,("sam_search_user: Couldn't find user [%s\\%s] in samdb, under %s\n",
+ domain_name, account_name, ldb_dn_get_linearized(domain_dn)));
+ return NT_STATUS_NO_SUCH_USER;
}
-#if 0
- /* Test account expire time */
-
- kickoff_time = pdb_get_kickoff_time(sampass);
- if (kickoff_time != 0 && time(NULL) > kickoff_time) {
- DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", username));
- DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time));
- return NT_STATUS_ACCOUNT_EXPIRED;
+ if (ret > 1) {
+ DEBUG(0,("Found %d records matching user [%s]\n", ret, account_name));
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
- if (!(acct_flags & ACB_PWNOEXP)) {
- time_t must_change_time = pdb_get_pass_must_change_time(sampass);
- time_t last_set_time = pdb_get_pass_last_set_time(sampass);
+ if (!domain_dn) {
+ struct dom_sid *domain_sid;
- /* check for immediate expiry "must change at next logon" */
- if (must_change_time == 0 && last_set_time != 0) {
- DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", username));
- return NT_STATUS_PASSWORD_MUST_CHANGE;
+ domain_sid = samdb_result_sid_prefix(mem_ctx, msgs[0], "objectSid");
+ if (!domain_sid) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
- /* check for expired password */
- if (must_change_time < time(NULL) && must_change_time != 0) {
- DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", username));
- DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", timestring(mem_ctx, must_change_time), (long)must_change_time));
- return NT_STATUS_PASSWORD_EXPIRED;
+ /* find the domain's DN */
+ ret = gendb_search(sam_ctx, mem_ctx, NULL, &msgs_tmp, NULL,
+ "(&(objectSid=%s)(objectClass=domain))",
+ ldap_encode_ndr_dom_sid(mem_ctx, domain_sid));
+ if (ret == -1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
- }
-
- /* Test workstation. Workstation list is comma separated. */
-
- workstation_list = talloc_strdup(mem_ctx, pdb_get_workstations(sampass));
- if (!workstation_list)
- return NT_STATUS_NO_MEMORY;
-
- if (*workstation_list) {
- BOOL invalid_ws = True;
- const char *s = workstation_list;
-
- fstring tok;
-
- while (next_token(&s, tok, ",", sizeof(tok))) {
- DEBUG(10,("sam_account_ok: checking for workstation match %s and %s (len=%d)\n",
- tok, user_info->wksta_name.str, user_info->wksta_name.len));
- if(strequal(tok, user_info->wksta_name.str)) {
- invalid_ws = False;
- break;
- }
+
+ if (ret == 0) {
+ DEBUG(3,("check_sam_security: Couldn't find domain_sid [%s] in passdb file.\n",
+ dom_sid_string(mem_ctx, domain_sid)));
+ return NT_STATUS_NO_SUCH_USER;
}
- if (invalid_ws)
- return NT_STATUS_INVALID_WORKSTATION;
+ if (ret > 1) {
+ DEBUG(0,("Found %d records matching domain_sid [%s]\n",
+ ret, dom_sid_string(mem_ctx, domain_sid)));
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ domain_dn = msgs_tmp[0]->dn;
}
-#endif
- if (acct_flags & ACB_DOMTRUST) {
- DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", username));
- return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
+
+ ret_domain = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &msgs_domain_ref, domain_ref_attrs,
+ "(nCName=%s)", ldb_dn_get_linearized(domain_dn));
+ if (ret_domain == -1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
-
- if (acct_flags & ACB_SVRTRUST) {
- DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", username));
- return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
+
+ if (ret_domain == 0) {
+ DEBUG(3,("check_sam_security: Couldn't find domain [%s] in passdb file.\n",
+ ldb_dn_get_linearized(msgs_tmp[0]->dn)));
+ return NT_STATUS_NO_SUCH_USER;
}
-
- if (acct_flags & ACB_WSTRUST) {
- DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", username));
- return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
+
+ if (ret_domain > 1) {
+ DEBUG(0,("Found %d records matching domain [%s]\n",
+ ret_domain, ldb_dn_get_linearized(msgs_tmp[0]->dn)));
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
+
+ *ret_msgs = msgs;
+ *ret_msgs_domain_ref = msgs_domain_ref;
return NT_STATUS_OK;
}
/****************************************************************************
-check if a username/password is OK assuming the password is a 24 byte
-SMB hash supplied in the user_info structure
-return an NT_STATUS constant.
+ Do a specific test for an smb password being correct, given a smb_password and
+ the lanman and NT responses.
****************************************************************************/
-
-static NTSTATUS check_sam_security(const struct auth_context *auth_context,
- void *my_private_data,
- TALLOC_CTX *mem_ctx,
- const auth_usersupplied_info *user_info,
- auth_serversupplied_info **server_info)
+static NTSTATUS authsam_password_ok(struct auth_context *auth_context,
+ TALLOC_CTX *mem_ctx,
+ uint16_t acct_flags,
+ const struct samr_Password *lm_pwd,
+ const struct samr_Password *nt_pwd,
+ const struct auth_usersupplied_info *user_info,
+ DATA_BLOB *user_sess_key,
+ DATA_BLOB *lm_sess_key)
{
- struct ldb_message **msgs;
- void *sam_ctx;
- uint16 acct_flags;
- char *username = user_info->internal_username.str;
- BOOL ret;
- NTSTATUS nt_status;
- DATA_BLOB user_sess_key = data_blob(NULL, 0);
- DATA_BLOB lm_sess_key = data_blob(NULL, 0);
- const uint8 *lm_pwd, *nt_pwd;
- const char *unicodePwd;
- struct samr_Hash lmPwdHash_u, ntPwdHash_u;
- struct samr_Hash *lmPwdHash, *ntPwdHash;
- uint_t num_lm, num_nt;
-
- if (!user_info || !auth_context) {
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- sam_ctx = samdb_connect();
- if (sam_ctx == NULL) {
- return NT_STATUS_INVALID_SYSTEM_SERVICE;
+ NTSTATUS status;
+
+ if (acct_flags & ACB_PWNOTREQ) {
+ if (lp_null_passwords(global_loadparm)) {
+ DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n",
+ user_info->mapped.account_name));
+ return NT_STATUS_OK;
+ } else {
+ DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n",
+ user_info->mapped.account_name));
+ return NT_STATUS_LOGON_FAILURE;
+ }
}
- /* pull all the user attributes */
- ret = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, NULL,
- "(&(sAMAccountName=%s)(objectclass=user))",
- username);
- if (ret == 0) {
- DEBUG(3,("check_sam_security: Couldn't find user [%s] in passdb file.\n",
- username));
- return NT_STATUS_NO_SUCH_USER;
+ switch (user_info->password_state) {
+ case AUTH_PASSWORD_PLAIN:
+ {
+ const struct auth_usersupplied_info *user_info_temp;
+ status = encrypt_user_info(mem_ctx, auth_context,
+ AUTH_PASSWORD_HASH,
+ user_info, &user_info_temp);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Failed to convert plaintext password to password HASH: %s\n", nt_errstr(status)));
+ return status;
+ }
+ user_info = user_info_temp;
+
+ /*fall through*/
+ }
+ case AUTH_PASSWORD_HASH:
+ *lm_sess_key = data_blob(NULL, 0);
+ *user_sess_key = data_blob(NULL, 0);
+ status = hash_password_check(mem_ctx,
+ user_info->password.hash.lanman,
+ user_info->password.hash.nt,
+ user_info->mapped.account_name,
+ lm_pwd, nt_pwd);
+ NT_STATUS_NOT_OK_RETURN(status);
+ break;
+
+ case AUTH_PASSWORD_RESPONSE:
+ status = ntlm_password_check(mem_ctx, user_info->logon_parameters,
+ &auth_context->challenge.data,
+ &user_info->password.response.lanman,
+ &user_info->password.response.nt,
+ user_info->mapped.account_name,
+ user_info->client.account_name,
+ user_info->client.domain_name,
+ lm_pwd, nt_pwd,
+ user_sess_key, lm_sess_key);
+ NT_STATUS_NOT_OK_RETURN(status);
+ break;
}
- if (ret > 1) {
- DEBUG(1,("Found %d records matching user [%s]\n", ret, username));
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ if (user_sess_key && user_sess_key->data) {
+ talloc_steal(auth_context, user_sess_key->data);
}
-
- acct_flags = samdb_result_acct_flags(msgs[0], "sAMAcctFlags");
+ if (lm_sess_key && lm_sess_key->data) {
+ talloc_steal(auth_context, lm_sess_key->data);
+ }
+
+ return NT_STATUS_OK;
+}
+
+
+
+static NTSTATUS authsam_authenticate(struct auth_context *auth_context,
+ TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
+ struct ldb_message **msgs,
+ struct ldb_message **msgs_domain_ref,
+ const struct auth_usersupplied_info *user_info,
+ DATA_BLOB *user_sess_key, DATA_BLOB *lm_sess_key)
+{
+ struct samr_Password *lm_pwd, *nt_pwd;
+ NTSTATUS nt_status;
+ uint16_t acct_flags = samdb_result_acct_flags(msgs[0], "userAccountControl");
/* Quit if the account was locked out. */
if (acct_flags & ACB_AUTOLOCK) {
DEBUG(3,("check_sam_security: Account for user %s was locked out.\n",
- username));
+ user_info->mapped.account_name));
return NT_STATUS_ACCOUNT_LOCKED_OUT;
}
- unicodePwd = samdb_result_string(msgs[0], "unicodePwd", NULL);
-
- if (unicodePwd) {
- BOOL lm_hash_ok;
- /* compute the new nt and lm hashes */
- lm_hash_ok = E_deshash(unicodePwd, lmPwdHash_u.hash);
- E_md4hash(unicodePwd, ntPwdHash_u.hash);
-
- if (lm_hash_ok) {
- lm_pwd = lmPwdHash_u.hash;
- } else {
- lm_pwd = NULL;
+ /* You can only do an interactive login to normal accounts */
+ if (user_info->flags & USER_INFO_INTERACTIVE_LOGON) {
+ if (!(acct_flags & ACB_NORMAL)) {
+ return NT_STATUS_NO_SUCH_USER;
}
+ }
- nt_pwd = ntPwdHash_u.hash;
-
- } else {
- num_lm = samdb_result_hashes(mem_ctx, msgs[0], "lmPwdHash", &lmPwdHash);
- if (num_lm == 0) {
- lm_pwd = NULL;
- } else if (num_lm > 1) {
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- } else {
- lm_pwd = lmPwdHash[0].hash;
- }
-
- num_nt = samdb_result_hashes(mem_ctx, msgs[0], "ntPwdHash", &ntPwdHash);
- if (num_nt == 0) {
- nt_pwd = NULL;
- } else if (num_nt > 1) {
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- } else {
- nt_pwd = ntPwdHash[0].hash;
- }
+ nt_status = samdb_result_passwords(mem_ctx, msgs[0], &lm_pwd, &nt_pwd);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ nt_status = authsam_password_ok(auth_context, mem_ctx,
+ acct_flags, lm_pwd, nt_pwd,
+ user_info, user_sess_key, lm_sess_key);
+ NT_STATUS_NOT_OK_RETURN(nt_status);
+
+ nt_status = authsam_account_ok(mem_ctx, sam_ctx,
+ user_info->logon_parameters,
+ msgs[0],
+ msgs_domain_ref[0],
+ user_info->workstation_name,
+ user_info->mapped.account_name);
+
+ return nt_status;
+}
+
+
+
+static NTSTATUS authsam_check_password_internals(struct auth_method_context *ctx,
+ TALLOC_CTX *mem_ctx,
+ const char *domain,
+ const struct auth_usersupplied_info *user_info,
+ struct auth_serversupplied_info **server_info)
+{
+ NTSTATUS nt_status;
+ const char *account_name = user_info->mapped.account_name;
+ struct ldb_message **msgs;
+ struct ldb_message **domain_ref_msgs;
+ struct ldb_context *sam_ctx;
+ DATA_BLOB user_sess_key, lm_sess_key;
+ TALLOC_CTX *tmp_ctx;
+
+ if (!account_name || !*account_name) {
+ /* 'not for me' */
+ return NT_STATUS_NOT_IMPLEMENTED;
}
- nt_status = sam_password_ok(auth_context, mem_ctx,
- username, acct_flags,
- lm_pwd, nt_pwd,
- user_info, &user_sess_key, &lm_sess_key);
-
- if (!NT_STATUS_IS_OK(nt_status)) {
- return nt_status;
+ tmp_ctx = talloc_new(mem_ctx);
+ if (!tmp_ctx) {
+ return NT_STATUS_NO_MEMORY;
}
- nt_status = sam_account_ok(mem_ctx, username, acct_flags, msgs, user_info);
+ sam_ctx = samdb_connect(tmp_ctx, system_session(mem_ctx));
+ if (sam_ctx == NULL) {
+ talloc_free(tmp_ctx);
+ return NT_STATUS_INVALID_SYSTEM_SERVICE;
+ }
+ nt_status = authsam_search_account(tmp_ctx, sam_ctx, account_name, domain, &msgs, &domain_ref_msgs);
if (!NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(tmp_ctx);
return nt_status;
}
- if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, username))) {
- DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
+ nt_status = authsam_authenticate(ctx->auth_ctx, tmp_ctx, sam_ctx, msgs, domain_ref_msgs, user_info,
+ &user_sess_key, &lm_sess_key);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(tmp_ctx);
return nt_status;
}
- {
- struct ldb_message **group_msgs;
- char *dn = msgs[0]->dn;
- int group_ret;
- const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL };
- /* find list of sids */
- struct dom_sid **groupSIDs = NULL;
- struct dom_sid *user_sid;
- struct dom_sid *group_sid;
- const char *sidstr;
- int i;
-
- group_ret = samdb_search(sam_ctx,
- mem_ctx, NULL, &group_msgs, group_attrs,
- "(&(member=%s)(sAMAccountType=*))",
- dn);
-
- if (!(groupSIDs = talloc_realloc_p((*server_info)->mem_ctx, groupSIDs,
- struct dom_sid *, group_ret))) {
- talloc_destroy((*server_info)->mem_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- /* Need to unroll some nested groups, but not aliases */
- for (i = 0; i < group_ret; i++) {
- sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
- groupSIDs[i] = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
- }
-
- sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
- user_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
- group_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
- group_sid->sub_auths[group_sid->num_auths-1]
- = samdb_result_uint(msgs[0], "primaryGroupID", 0);
-
- if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx,
- user_sid, group_sid,
- group_ret, groupSIDs,
- False, &(*server_info)->ptok))) {
- DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
- free_server_info(server_info);
- return nt_status;
- }
+ nt_status = authsam_make_server_info(tmp_ctx, sam_ctx, msgs[0], domain_ref_msgs[0],
+ user_sess_key, lm_sess_key,
+ server_info);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(tmp_ctx);
+ return nt_status;
}
- (*server_info)->guest = False;
+ talloc_steal(mem_ctx, *server_info);
+ talloc_free(tmp_ctx);
- (*server_info)->user_session_key = user_sess_key;
- (*server_info)->lm_session_key = lm_sess_key;
-
- return nt_status;
+ return NT_STATUS_OK;
}
-/* module initialisation */
-static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
+static NTSTATUS authsam_ignoredomain_want_check(struct auth_method_context *ctx,
+ TALLOC_CTX *mem_ctx,
+ const struct auth_usersupplied_info *user_info)
{
- if (!make_auth_methods(auth_context, auth_method)) {
- return NT_STATUS_NO_MEMORY;
+ if (!user_info->mapped.account_name || !*user_info->mapped.account_name) {
+ return NT_STATUS_NOT_IMPLEMENTED;
}
- (*auth_method)->auth = check_sam_security;
- (*auth_method)->name = "sam_ignoredomain";
return NT_STATUS_OK;
}
+static NTSTATUS authsam_ignoredomain_check_password(struct auth_method_context *ctx,
+ TALLOC_CTX *mem_ctx,
+ const struct auth_usersupplied_info *user_info,
+ struct auth_serversupplied_info **server_info)
+{
+ return authsam_check_password_internals(ctx, mem_ctx, NULL, user_info, server_info);
+}
/****************************************************************************
Check SAM security (above) but with a few extra checks.
****************************************************************************/
-
-static NTSTATUS check_samstrict_security(const struct auth_context *auth_context,
- void *my_private_data,
- TALLOC_CTX *mem_ctx,
- const auth_usersupplied_info *user_info,
- auth_serversupplied_info **server_info)
+static NTSTATUS authsam_want_check(struct auth_method_context *ctx,
+ TALLOC_CTX *mem_ctx,
+ const struct auth_usersupplied_info *user_info)
{
+ bool is_local_name, is_my_domain;
- if (!user_info || !auth_context) {
- return NT_STATUS_LOGON_FAILURE;
+ if (!user_info->mapped.account_name || !*user_info->mapped.account_name) {
+ return NT_STATUS_NOT_IMPLEMENTED;
}
- /* If we are a domain member, we must not
- attempt to check the password locally,
- unless it is one of our aliases. */
-
- if (!is_myname(user_info->domain.str)) {
- DEBUG(7,("The requested user domain is not the local server name. [%s]\\[%s]\n",
- user_info->domain.str,user_info->internal_username.str));
- return NT_STATUS_NO_SUCH_USER;
+ is_local_name = lp_is_myname(global_loadparm,
+ user_info->mapped.domain_name);
+ is_my_domain = lp_is_mydomain(global_loadparm,
+ user_info->mapped.domain_name);
+
+ /* check whether or not we service this domain/workgroup name */
+ switch (lp_server_role(global_loadparm)) {
+ case ROLE_STANDALONE:
+ return NT_STATUS_OK;
+
+ case ROLE_DOMAIN_MEMBER:
+ if (!is_local_name) {
+ DEBUG(6,("authsam_check_password: %s is not one of my local names (DOMAIN_MEMBER)\n",
+ user_info->mapped.domain_name));
+ return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ return NT_STATUS_OK;
+
+ case ROLE_DOMAIN_CONTROLLER:
+ if (!is_local_name && !is_my_domain) {
+ DEBUG(6,("authsam_check_password: %s is not one of my local names or domain name (DC)\n",
+ user_info->mapped.domain_name));
+ return NT_STATUS_NOT_IMPLEMENTED;
+ }
+ return NT_STATUS_OK;
}
-
- return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info);
+
+ DEBUG(6,("authsam_check_password: lp_server_role() has an undefined value\n"));
+ return NT_STATUS_NOT_IMPLEMENTED;
}
-/* module initialisation */
-static NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
+/****************************************************************************
+Check SAM security (above) but with a few extra checks.
+****************************************************************************/
+static NTSTATUS authsam_check_password(struct auth_method_context *ctx,
+ TALLOC_CTX *mem_ctx,
+ const struct auth_usersupplied_info *user_info,
+ struct auth_serversupplied_info **server_info)
{
- if (!make_auth_methods(auth_context, auth_method)) {
- return NT_STATUS_NO_MEMORY;
+ const char *domain;
+
+ /* check whether or not we service this domain/workgroup name */
+ switch (lp_server_role(global_loadparm)) {
+ case ROLE_STANDALONE:
+ case ROLE_DOMAIN_MEMBER:
+ domain = lp_netbios_name(global_loadparm);
+ break;
+
+ case ROLE_DOMAIN_CONTROLLER:
+ domain = lp_workgroup(global_loadparm);
+ break;
+
+ default:
+ return NT_STATUS_NO_SUCH_USER;
}
- (*auth_method)->auth = check_samstrict_security;
- (*auth_method)->name = "sam";
- return NT_STATUS_OK;
+ return authsam_check_password_internals(ctx, mem_ctx, domain, user_info, server_info);
}
+static const struct auth_operations sam_ignoredomain_ops = {
+ .name = "sam_ignoredomain",
+ .get_challenge = auth_get_challenge_not_implemented,
+ .want_check = authsam_ignoredomain_want_check,
+ .check_password = authsam_ignoredomain_check_password
+};
+
+static const struct auth_operations sam_ops = {
+ .name = "sam",
+ .get_challenge = auth_get_challenge_not_implemented,
+ .want_check = authsam_want_check,
+ .check_password = authsam_check_password
+};
+
NTSTATUS auth_sam_init(void)
{
NTSTATUS ret;
- struct auth_operations ops;
- ops.name = "sam";
- ops.init = auth_init_sam;
- ret = register_backend("auth", &ops);
+ ret = auth_register(&sam_ops);
if (!NT_STATUS_IS_OK(ret)) {
- DEBUG(0,("Failed to register '%s' auth backend!\n",
- ops.name));
+ DEBUG(0,("Failed to register 'sam' auth backend!\n"));
return ret;
}
- ops.name = "sam_ignoredomain";
- ops.init = auth_init_sam_ignoredomain;
- ret = register_backend("auth", &ops);
+ ret = auth_register(&sam_ignoredomain_ops);
if (!NT_STATUS_IS_OK(ret)) {
- DEBUG(0,("Failed to register '%s' auth backend!\n",
- ops.name));
+ DEBUG(0,("Failed to register 'sam_ignoredomain' auth backend!\n"));
return ret;
}
git.samba.org / jelmer / samba4-debian.git / blobdiff