source3/nsswitch/libwbclient/wbc_pam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind client API
   5
   6    Copyright (C) Gerald (Jerry) Carter 2007
   7
   8    This library is free software; you can redistribute it and/or
   9    modify it under the terms of the GNU Lesser General Public
  10    License as published by the Free Software Foundation; either
  11    version 3 of the License, or (at your option) any later version.
  12
  13    This library is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16    Library General Public License for more details.
  17
  18    You should have received a copy of the GNU Lesser General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /* Required Headers */
  23
  24 #include "libwbclient.h"
  25
  26 /** @brief Authenticate a username/password pair
  27  *
  28  * @param username     Name of user to authenticate
  29  * @param password     Clear text password os user
  30  *
  31  * @return #wbcErr
  32  **/
  33
  34 wbcErr wbcAuthenticateUser(const char *username,
  35                            const char *password)
  36 {
  37         wbcErr wbc_status = WBC_ERR_SUCCESS;
  38         struct wbcAuthUserParams params;
  39
  40         ZERO_STRUCT(params);
  41
  42         params.account_name             = username;
  43         params.level                    = WBC_AUTH_USER_LEVEL_PLAIN;
  44         params.password.plaintext       = password;
  45
  46         wbc_status = wbcAuthenticateUserEx(&params, NULL, NULL);
  47         BAIL_ON_WBC_ERROR(wbc_status);
  48
  49 done:
  50         return wbc_status;
  51 }
  52
  53 static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
  54                                    const struct winbindd_response *resp,
  55                                    struct wbcAuthUserInfo **_i)
  56 {
  57         wbcErr wbc_status = WBC_ERR_SUCCESS;
  58         struct wbcAuthUserInfo *i;
  59         struct wbcDomainSid domain_sid;
  60         char *p;
  61         uint32_t sn = 0;
  62         uint32_t j;
  63
  64         i = talloc(mem_ctx, struct wbcAuthUserInfo);
  65         BAIL_ON_PTR_ERROR(i, wbc_status);
  66
  67         i->user_flags   = resp->data.auth.info3.user_flgs;
  68
  69         i->account_name = talloc_strdup(i, resp->data.auth.info3.user_name);
  70         BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
  71         i->user_principal= NULL;
  72         i->full_name    = talloc_strdup(i, resp->data.auth.info3.full_name);
  73         BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
  74         i->domain_name  = talloc_strdup(i, resp->data.auth.info3.logon_dom);
  75         BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
  76         i->dns_domain_name= NULL;
  77
  78         i->acct_flags   = resp->data.auth.info3.acct_flags;
  79         memcpy(i->user_session_key,
  80                resp->data.auth.user_session_key,
  81                sizeof(i->user_session_key));
  82         memcpy(i->lm_session_key,
  83                resp->data.auth.first_8_lm_hash,
  84                sizeof(i->lm_session_key));
  85
  86         i->logon_count          = resp->data.auth.info3.logon_count;
  87         i->bad_password_count   = resp->data.auth.info3.bad_pw_count;
  88
  89         i->logon_time           = resp->data.auth.info3.logon_time;
  90         i->logoff_time          = resp->data.auth.info3.logoff_time;
  91         i->kickoff_time         = resp->data.auth.info3.kickoff_time;
  92         i->pass_last_set_time   = resp->data.auth.info3.pass_last_set_time;
  93         i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
  94         i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
  95
  96         i->logon_server = talloc_strdup(i, resp->data.auth.info3.logon_srv);
  97         BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
  98         i->logon_script = talloc_strdup(i, resp->data.auth.info3.logon_script);
  99         BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
 100         i->profile_path = talloc_strdup(i, resp->data.auth.info3.profile_path);
 101         BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
 102         i->home_directory= talloc_strdup(i, resp->data.auth.info3.home_dir);
 103         BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
 104         i->home_drive   = talloc_strdup(i, resp->data.auth.info3.dir_drive);
 105         BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
 106
 107         i->num_sids     = 2;
 108         i->num_sids     += resp->data.auth.info3.num_groups;
 109         i->num_sids     += resp->data.auth.info3.num_other_sids;
 110
 111         i->sids = talloc_array(i, struct wbcSidWithAttr, i->num_sids);
 112         BAIL_ON_PTR_ERROR(i->sids, wbc_status);
 113
 114         wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
 115                                     &domain_sid);
 116         BAIL_ON_WBC_ERROR(wbc_status);
 117
 118 #define _SID_COMPOSE(s, d, r, a) { \
 119         (s).sid = d; \
 120         if ((s).sid.num_auths < WBC_MAXSUBAUTHS) { \
 121                 (s).sid.sub_auths[(s).sid.num_auths++] = r; \
 122         } else { \
 123                 wbc_status = WBC_ERR_INVALID_SID; \
 124                 BAIL_ON_WBC_ERROR(wbc_status); \
 125         } \
 126         (s).attributes = a; \
 127 } while (0)
 128
 129         sn = 0;
 130         _SID_COMPOSE(i->sids[sn], domain_sid,
 131                      resp->data.auth.info3.user_rid,
 132                      0);
 133         sn++;
 134         _SID_COMPOSE(i->sids[sn], domain_sid,
 135                      resp->data.auth.info3.group_rid,
 136                      0);
 137         sn++;
 138
 139         p = (char *)resp->extra_data.data;
 140         if (!p) {
 141                 wbc_status = WBC_ERR_INVALID_RESPONSE;
 142                 BAIL_ON_WBC_ERROR(wbc_status);
 143         }
 144
 145         for (j=0; j < resp->data.auth.info3.num_groups; j++) {
 146                 uint32_t rid;
 147                 uint32_t attrs;
 148                 int ret;
 149                 char *s = p;
 150                 char *e = strchr(p, '\n');
 151                 if (!e) {
 152                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 153                         BAIL_ON_WBC_ERROR(wbc_status);
 154                 }
 155                 e[0] = '\0';
 156                 p = &e[1];
 157
 158                 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
 159                 if (ret != 2) {
 160                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 161                         BAIL_ON_WBC_ERROR(wbc_status);
 162                 }
 163
 164                 _SID_COMPOSE(i->sids[sn], domain_sid,
 165                              rid, attrs);
 166                 sn++;
 167         }
 168
 169         for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
 170                 uint32_t attrs;
 171                 int ret;
 172                 char *s = p;
 173                 char *a;
 174                 char *e = strchr(p, '\n');
 175                 if (!e) {
 176                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 177                         BAIL_ON_WBC_ERROR(wbc_status);
 178                 }
 179                 e[0] = '\0';
 180                 p = &e[1];
 181
 182                 e = strchr(s, ':');
 183                 if (!e) {
 184                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 185                         BAIL_ON_WBC_ERROR(wbc_status);
 186                 }
 187                 e[0] = '\0';
 188                 a = &e[1];
 189
 190                 ret = sscanf(a, "0x%08X",
 191                              &attrs);
 192                 if (ret != 1) {
 193                         wbc_status = WBC_ERR_INVALID_RESPONSE;
 194                         BAIL_ON_WBC_ERROR(wbc_status);
 195                 }
 196
 197                 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
 198                 BAIL_ON_WBC_ERROR(wbc_status);
 199
 200                 i->sids[sn].attributes = attrs;
 201                 sn++;
 202         }
 203
 204         i->num_sids = sn;
 205
 206         *_i = i;
 207         i = NULL;
 208 done:
 209         talloc_free(i);
 210         return wbc_status;
 211 }
 212
 213 static wbcErr wbc_create_error_info(TALLOC_CTX *mem_ctx,
 214                                   const struct winbindd_response *resp,
 215                                   struct wbcAuthErrorInfo **_e)
 216 {
 217         wbcErr wbc_status = WBC_ERR_SUCCESS;
 218         struct wbcAuthErrorInfo *e;
 219
 220         e = talloc(mem_ctx, struct wbcAuthErrorInfo);
 221         BAIL_ON_PTR_ERROR(e, wbc_status);
 222
 223         e->nt_status = resp->data.auth.nt_status;
 224         e->pam_error = resp->data.auth.pam_error;
 225         e->nt_string = talloc_strdup(e, resp->data.auth.nt_status_string);
 226         BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
 227
 228         e->display_string = talloc_strdup(e, resp->data.auth.error_string);
 229         BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
 230
 231         *_e = e;
 232         e = NULL;
 233
 234 done:
 235         talloc_free(e);
 236         return wbc_status;
 237 }
 238
 239 static wbcErr wbc_create_password_policy_info(TALLOC_CTX *mem_ctx,
 240                                               const struct winbindd_response *resp,
 241                                               struct wbcUserPasswordPolicyInfo **_i)
 242 {
 243         wbcErr wbc_status = WBC_ERR_SUCCESS;
 244         struct wbcUserPasswordPolicyInfo *i;
 245
 246         i = talloc(mem_ctx, struct wbcUserPasswordPolicyInfo);
 247         BAIL_ON_PTR_ERROR(i, wbc_status);
 248
 249         i->min_passwordage      = resp->data.auth.policy.min_passwordage;
 250         i->min_length_password  = resp->data.auth.policy.min_length_password;
 251         i->password_history     = resp->data.auth.policy.password_history;
 252         i->password_properties  = resp->data.auth.policy.password_properties;
 253         i->expire               = resp->data.auth.policy.expire;
 254
 255         *_i = i;
 256         i = NULL;
 257
 258 done:
 259         talloc_free(i);
 260         return wbc_status;
 261 }
 262
 263 /** @brief Authenticate with more detailed information
 264  *
 265  * @param params       Input parameters, WBC_AUTH_USER_LEVEL_HASH
 266  *                     is not supported yet
 267  * @param info         Output details on WBC_ERR_SUCCESS
 268  * @param error        Output details on WBC_ERR_AUTH_ERROR
 269  *
 270  * @return #wbcErr
 271  **/
 272
 273 wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
 274                              struct wbcAuthUserInfo **info,
 275                              struct wbcAuthErrorInfo **error)
 276 {
 277         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 278         int cmd = 0;
 279         struct winbindd_request request;
 280         struct winbindd_response response;
 281
 282         ZERO_STRUCT(request);
 283         ZERO_STRUCT(response);
 284
 285         if (error) {
 286                 *error = NULL;
 287         }
 288
 289         if (!params) {
 290                 wbc_status = WBC_ERR_INVALID_PARAM;
 291                 BAIL_ON_WBC_ERROR(wbc_status);
 292         }
 293
 294         if (!params->account_name) {
 295                 wbc_status = WBC_ERR_INVALID_PARAM;
 296                 BAIL_ON_WBC_ERROR(wbc_status);
 297         }
 298
 299         /* Initialize request */
 300
 301         switch (params->level) {
 302         case WBC_AUTH_USER_LEVEL_PLAIN:
 303                 cmd = WINBINDD_PAM_AUTH;
 304                 request.flags = WBFLAG_PAM_INFO3_TEXT |
 305                                 WBFLAG_PAM_USER_SESSION_KEY |
 306                                 WBFLAG_PAM_LMKEY;
 307
 308                 if (!params->password.plaintext) {
 309                         wbc_status = WBC_ERR_INVALID_PARAM;
 310                         BAIL_ON_WBC_ERROR(wbc_status);
 311                 }
 312
 313                 if (params->domain_name && params->domain_name[0]) {
 314                         /* We need to get the winbind separator :-( */
 315                         struct winbindd_response sep_response;
 316
 317                         ZERO_STRUCT(sep_response);
 318
 319                         wbc_status = wbcRequestResponse(WINBINDD_INFO,
 320                                                         NULL, &sep_response);
 321                         BAIL_ON_WBC_ERROR(wbc_status);
 322
 323                         snprintf(request.data.auth.user,
 324                                  sizeof(request.data.auth.user)-1,
 325                                  "%s%c%s",
 326                                  params->domain_name,
 327                                  sep_response.data.info.winbind_separator,
 328                                  params->account_name);
 329                 } else {
 330                         strncpy(request.data.auth.user,
 331                                 params->account_name,
 332                                 sizeof(request.data.auth.user)-1);
 333                 }
 334                 strncpy(request.data.auth.pass,
 335                         params->password.plaintext,
 336                         sizeof(request.data.auth.pass)-1);
 337                 break;
 338
 339         case WBC_AUTH_USER_LEVEL_HASH:
 340                 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
 341                 BAIL_ON_WBC_ERROR(wbc_status);
 342                 break;
 343
 344         case WBC_AUTH_USER_LEVEL_RESPONSE:
 345                 cmd = WINBINDD_PAM_AUTH_CRAP;
 346                 request.flags = WBFLAG_PAM_INFO3_TEXT |
 347                                 WBFLAG_PAM_USER_SESSION_KEY |
 348                                 WBFLAG_PAM_LMKEY;
 349
 350                 if (params->password.response.lm_length &&
 351                     !params->password.response.lm_data) {
 352                         wbc_status = WBC_ERR_INVALID_PARAM;
 353                         BAIL_ON_WBC_ERROR(wbc_status);
 354                 }
 355                 if (params->password.response.lm_length == 0 &&
 356                     params->password.response.lm_data) {
 357                         wbc_status = WBC_ERR_INVALID_PARAM;
 358                         BAIL_ON_WBC_ERROR(wbc_status);
 359                 }
 360
 361                 if (params->password.response.nt_length &&
 362                     !params->password.response.nt_data) {
 363                         wbc_status = WBC_ERR_INVALID_PARAM;
 364                         BAIL_ON_WBC_ERROR(wbc_status);
 365                 }
 366                 if (params->password.response.nt_length == 0&&
 367                     params->password.response.nt_data) {
 368                         wbc_status = WBC_ERR_INVALID_PARAM;
 369                         BAIL_ON_WBC_ERROR(wbc_status);
 370                 }
 371
 372                 strncpy(request.data.auth_crap.user,
 373                         params->account_name,
 374                         sizeof(request.data.auth_crap.user)-1);
 375                 if (params->domain_name) {
 376                         strncpy(request.data.auth_crap.domain,
 377                                 params->domain_name,
 378                                 sizeof(request.data.auth_crap.domain)-1);
 379                 }
 380                 if (params->workstation_name) {
 381                         strncpy(request.data.auth_crap.workstation,
 382                                 params->workstation_name,
 383                                 sizeof(request.data.auth_crap.workstation)-1);
 384                 }
 385
 386                 request.data.auth_crap.logon_parameters =
 387                                 params->parameter_control;
 388
 389                 memcpy(request.data.auth_crap.chal,
 390                        params->password.response.challenge,
 391                        sizeof(request.data.auth_crap.chal));
 392
 393                 request.data.auth_crap.lm_resp_len =
 394                                 MIN(params->password.response.lm_length,
 395                                     sizeof(request.data.auth_crap.lm_resp));
 396                 request.data.auth_crap.nt_resp_len =
 397                                 MIN(params->password.response.nt_length,
 398                                     sizeof(request.data.auth_crap.nt_resp));
 399                 if (params->password.response.lm_data) {
 400                         memcpy(request.data.auth_crap.lm_resp,
 401                                params->password.response.lm_data,
 402                                request.data.auth_crap.lm_resp_len);
 403                 }
 404                 if (params->password.response.nt_data) {
 405                         memcpy(request.data.auth_crap.nt_resp,
 406                                params->password.response.nt_data,
 407                                request.data.auth_crap.nt_resp_len);
 408                 }
 409                 break;
 410         default:
 411                 break;
 412         }
 413
 414         if (cmd == 0) {
 415                 wbc_status = WBC_ERR_INVALID_PARAM;
 416                 BAIL_ON_WBC_ERROR(wbc_status);
 417         }
 418
 419         wbc_status = wbcRequestResponse(cmd,
 420                                         &request,
 421                                         &response);
 422         if (response.data.auth.nt_status != 0) {
 423                 if (error) {
 424                         wbc_status = wbc_create_error_info(NULL,
 425                                                            &response,
 426                                                            error);
 427                         BAIL_ON_WBC_ERROR(wbc_status);
 428                 }
 429
 430                 wbc_status = WBC_ERR_AUTH_ERROR;
 431                 BAIL_ON_WBC_ERROR(wbc_status);
 432         }
 433         BAIL_ON_WBC_ERROR(wbc_status);
 434
 435         if (info) {
 436                 wbc_status = wbc_create_auth_info(NULL,
 437                                                   &response,
 438                                                   info);
 439                 BAIL_ON_WBC_ERROR(wbc_status);
 440         }
 441
 442 done:
 443         if (response.extra_data.data)
 444                 free(response.extra_data.data);
 445
 446         return wbc_status;
 447 }
 448
 449 /** @brief Trigger a verification of the trust credentials of a specific domain
 450  *
 451  * @param *domain      The name of the domain, only NULL for the default domain is
 452  *                     supported yet. Other values than NULL will result in
 453  *                     WBC_ERR_NOT_IMPLEMENTED.
 454  * @param error        Output details on WBC_ERR_AUTH_ERROR
 455  *
 456  * @return #wbcErr
 457  *
 458  **/
 459 wbcErr wbcCheckTrustCredentials(const char *domain,
 460                                 struct wbcAuthErrorInfo **error)
 461 {
 462         struct winbindd_request request;
 463         struct winbindd_response response;
 464         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 465
 466         if (domain) {
 467                 /*
 468                  * the current protocol doesn't support
 469                  * specifying a domain
 470                  */
 471                 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
 472                 BAIL_ON_WBC_ERROR(wbc_status);
 473         }
 474
 475         ZERO_STRUCT(request);
 476         ZERO_STRUCT(response);
 477
 478         /* Send request */
 479
 480         wbc_status = wbcRequestResponse(WINBINDD_CHECK_MACHACC,
 481                                         &request,
 482                                         &response);
 483         if (response.data.auth.nt_status != 0) {
 484                 if (error) {
 485                         wbc_status = wbc_create_error_info(NULL,
 486                                                            &response,
 487                                                            error);
 488                         BAIL_ON_WBC_ERROR(wbc_status);
 489                 }
 490
 491                 wbc_status = WBC_ERR_AUTH_ERROR;
 492                 BAIL_ON_WBC_ERROR(wbc_status);
 493         }
 494         BAIL_ON_WBC_ERROR(wbc_status);
 495
 496  done:
 497         return wbc_status;
 498 }
 499
 500 /** @brief Trigger a logoff notification to Winbind for a specific user
 501  *
 502  * @param username    Name of user to remove from Winbind's list of
 503  *                    logged on users.
 504  * @param uid         Uid assigned to the username
 505  * @param ccfilename  Absolute path to the Krb5 credentials cache to
 506  *                    be removed
 507  *
 508  * @return #wbcErr
 509  *
 510  **/
 511
 512 wbcErr wbcLogoffUser(const char *username,
 513                      uid_t uid,
 514                      const char *ccfilename)
 515 {
 516         struct winbindd_request request;
 517         struct winbindd_response response;
 518         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 519
 520         /* validate input */
 521
 522         if (!username) {
 523                 wbc_status = WBC_ERR_INVALID_PARAM;
 524                 BAIL_ON_WBC_ERROR(wbc_status);
 525         }
 526
 527         ZERO_STRUCT(request);
 528         ZERO_STRUCT(response);
 529
 530         strncpy(request.data.logoff.user, username,
 531                 sizeof(request.data.logoff.user)-1);
 532         request.data.logoff.uid = uid;
 533
 534         if (ccfilename) {
 535                 strncpy(request.data.logoff.krb5ccname, ccfilename,
 536                         sizeof(request.data.logoff.krb5ccname)-1);
 537         }
 538
 539         /* Send request */
 540
 541         wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
 542                                         &request,
 543                                         &response);
 544
 545         /* Take the response above and return it to the caller */
 546
 547  done:
 548         return wbc_status;
 549 }
 550
 551 /** @brief Change a password for a user with more detailed information upon
 552  *         failure
 553  * @param params                Input parameters
 554  * @param error                 User output details on WBC_ERR_PWD_CHANGE_FAILED
 555  * @param reject_reason         New password reject reason on WBC_ERR_PWD_CHANGE_FAILED
 556  * @param policy                Password policy output details on WBC_ERR_PWD_CHANGE_FAILED
 557  *
 558  * @return #wbcErr
 559  **/
 560
 561 wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
 562                                struct wbcAuthErrorInfo **error,
 563                                enum wbcPasswordChangeRejectReason *reject_reason,
 564                                struct wbcUserPasswordPolicyInfo **policy)
 565 {
 566         struct winbindd_request request;
 567         struct winbindd_response response;
 568         wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
 569         int cmd = 0;
 570
 571         /* validate input */
 572
 573         if (!params->account_name) {
 574                 wbc_status = WBC_ERR_INVALID_PARAM;
 575                 BAIL_ON_WBC_ERROR(wbc_status);
 576         }
 577
 578         if (error) {
 579                 *error = NULL;
 580         }
 581
 582         if (policy) {
 583                 *policy = NULL;
 584         }
 585
 586         if (reject_reason) {
 587                 *reject_reason = -1;
 588         }
 589
 590         ZERO_STRUCT(request);
 591         ZERO_STRUCT(response);
 592
 593         switch (params->level) {
 594         case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
 595                 cmd = WINBINDD_PAM_CHAUTHTOK;
 596
 597                 if (!params->account_name) {
 598                         wbc_status = WBC_ERR_INVALID_PARAM;
 599                         BAIL_ON_WBC_ERROR(wbc_status);
 600                 }
 601
 602                 strncpy(request.data.chauthtok.user, params->account_name,
 603                         sizeof(request.data.chauthtok.user) - 1);
 604
 605                 if (params->old_password.plaintext) {
 606                         strncpy(request.data.chauthtok.oldpass,
 607                                 params->old_password.plaintext,
 608                                 sizeof(request.data.chauthtok.oldpass) - 1);
 609                 }
 610
 611                 if (params->new_password.plaintext) {
 612                         strncpy(request.data.chauthtok.newpass,
 613                                 params->new_password.plaintext,
 614                                 sizeof(request.data.chauthtok.newpass) - 1);
 615                 }
 616                 break;
 617
 618         case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
 619                 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
 620
 621                 if (!params->account_name || !params->domain_name) {
 622                         wbc_status = WBC_ERR_INVALID_PARAM;
 623                         BAIL_ON_WBC_ERROR(wbc_status);
 624                 }
 625
 626                 if (params->old_password.response.old_lm_hash_enc_length &&
 627                     !params->old_password.response.old_lm_hash_enc_data) {
 628                         wbc_status = WBC_ERR_INVALID_PARAM;
 629                         BAIL_ON_WBC_ERROR(wbc_status);
 630                 }
 631
 632                 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
 633                     params->old_password.response.old_lm_hash_enc_data) {
 634                         wbc_status = WBC_ERR_INVALID_PARAM;
 635                         BAIL_ON_WBC_ERROR(wbc_status);
 636                 }
 637
 638                 if (params->old_password.response.old_nt_hash_enc_length &&
 639                     !params->old_password.response.old_nt_hash_enc_data) {
 640                         wbc_status = WBC_ERR_INVALID_PARAM;
 641                         BAIL_ON_WBC_ERROR(wbc_status);
 642                 }
 643
 644                 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
 645                     params->old_password.response.old_nt_hash_enc_data) {
 646                         wbc_status = WBC_ERR_INVALID_PARAM;
 647                         BAIL_ON_WBC_ERROR(wbc_status);
 648                 }
 649
 650                 if (params->new_password.response.lm_length &&
 651                     !params->new_password.response.lm_data) {
 652                         wbc_status = WBC_ERR_INVALID_PARAM;
 653                         BAIL_ON_WBC_ERROR(wbc_status);
 654                 }
 655
 656                 if (params->new_password.response.lm_length == 0 &&
 657                     params->new_password.response.lm_data) {
 658                         wbc_status = WBC_ERR_INVALID_PARAM;
 659                         BAIL_ON_WBC_ERROR(wbc_status);
 660                 }
 661
 662                 if (params->new_password.response.nt_length &&
 663                     !params->new_password.response.nt_data) {
 664                         wbc_status = WBC_ERR_INVALID_PARAM;
 665                         BAIL_ON_WBC_ERROR(wbc_status);
 666                 }
 667
 668                 if (params->new_password.response.nt_length == 0 &&
 669                     params->new_password.response.nt_data) {
 670                         wbc_status = WBC_ERR_INVALID_PARAM;
 671                         BAIL_ON_WBC_ERROR(wbc_status);
 672                 }
 673
 674                 strncpy(request.data.chng_pswd_auth_crap.user,
 675                         params->account_name,
 676                         sizeof(request.data.chng_pswd_auth_crap.user) - 1);
 677
 678                 strncpy(request.data.chng_pswd_auth_crap.domain,
 679                         params->domain_name,
 680                         sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
 681
 682                 if (params->new_password.response.nt_data) {
 683                         memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
 684                                params->new_password.response.nt_data,
 685                                request.data.chng_pswd_auth_crap.new_nt_pswd_len);
 686                         request.data.chng_pswd_auth_crap.new_nt_pswd_len =
 687                                 params->new_password.response.nt_length;
 688                 }
 689
 690                 if (params->new_password.response.lm_data) {
 691                         memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
 692                                params->new_password.response.lm_data,
 693                                request.data.chng_pswd_auth_crap.new_lm_pswd_len);
 694                         request.data.chng_pswd_auth_crap.new_lm_pswd_len =
 695                                 params->new_password.response.lm_length;
 696                 }
 697
 698                 if (params->old_password.response.old_nt_hash_enc_data) {
 699                         memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
 700                                params->old_password.response.old_nt_hash_enc_data,
 701                                request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
 702                         request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
 703                                 params->old_password.response.old_nt_hash_enc_length;
 704                 }
 705
 706                 if (params->old_password.response.old_lm_hash_enc_data) {
 707                         memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
 708                                params->old_password.response.old_lm_hash_enc_data,
 709                                request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
 710                         request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
 711                                 params->old_password.response.old_lm_hash_enc_length;
 712                 }
 713
 714                 break;
 715         default:
 716                 wbc_status = WBC_ERR_INVALID_PARAM;
 717                 BAIL_ON_WBC_ERROR(wbc_status);
 718                 break;
 719         }
 720
 721         if (cmd == 0) {
 722                 wbc_status = WBC_ERR_INVALID_PARAM;
 723                 BAIL_ON_WBC_ERROR(wbc_status);
 724         }
 725
 726         /* Send request */
 727
 728         wbc_status = wbcRequestResponse(cmd,
 729                                         &request,
 730                                         &response);
 731         if (WBC_ERROR_IS_OK(wbc_status)) {
 732                 goto done;
 733         }
 734
 735         /* Take the response above and return it to the caller */
 736
 737         if (response.data.auth.nt_status != 0) {
 738                 if (error) {
 739                         wbc_status = wbc_create_error_info(NULL,
 740                                                            &response,
 741                                                            error);
 742                         BAIL_ON_WBC_ERROR(wbc_status);
 743                 }
 744
 745         }
 746
 747         if (policy) {
 748                 wbc_status = wbc_create_password_policy_info(NULL,
 749                                                              &response,
 750                                                              policy);
 751                 BAIL_ON_WBC_ERROR(wbc_status);
 752         }
 753
 754         if (reject_reason) {
 755                 *reject_reason = response.data.auth.reject_reason;
 756         }
 757
 758         wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
 759         BAIL_ON_WBC_ERROR(wbc_status);
 760
 761  done:
 762         return wbc_status;
 763 }
 764
 765 /** @brief Change a password for a user
 766  *
 767  * @param username              Name of user to authenticate
 768  * @param old_password          Old clear text password of user
 769  * @param new_password          New clear text password of user
 770  *
 771  * @return #wbcErr
 772  **/
 773
 774 wbcErr wbcChangeUserPassword(const char *username,
 775                              const char *old_password,
 776                              const char *new_password)
 777 {
 778         wbcErr wbc_status = WBC_ERR_SUCCESS;
 779         struct wbcChangePasswordParams params;
 780
 781         ZERO_STRUCT(params);
 782
 783         params.account_name             = username;
 784         params.level                    = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
 785         params.old_password.plaintext   = old_password;
 786         params.new_password.plaintext   = new_password;
 787
 788         wbc_status = wbcChangeUserPasswordEx(&params,
 789                                              NULL,
 790                                              NULL,
 791                                              NULL);
 792         BAIL_ON_WBC_ERROR(wbc_status);
 793
 794 done:
 795         return wbc_status;
 796 }