2 Unix SMB/CIFS implementation.
4 Winbind daemon - krb5 credential cache functions
5 and in-memory cache functions.
7 Copyright (C) Guenther Deschner 2005-2006
8 Copyright (C) Jeremy Allison 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../libcli/auth/libcli_auth.h"
28 #include "libads/kerberos_proto.h"
31 #define DBGC_CLASS DBGC_WINBIND
33 /* uncomment this to do fast debugging on the krb5 ticket renewal event */
34 #ifdef DEBUG_KRB5_TKT_RENEWAL
35 #undef DEBUG_KRB5_TKT_RENEWAL
38 #define MAX_CCACHES 100
40 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
41 static void krb5_ticket_gain_handler(struct event_context *,
45 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *,
48 /* The Krb5 ticket refresh handler should be scheduled
49 at one-half of the period from now till the tkt
52 static time_t krb5_event_refresh_time(time_t end_time)
54 time_t rest = end_time - time(NULL);
55 return end_time - rest/2;
58 /****************************************************************
59 Find an entry by name.
60 ****************************************************************/
62 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
64 struct WINBINDD_CCACHE_ENTRY *entry;
66 for (entry = ccache_list; entry; entry = entry->next) {
67 if (strequal(entry->username, username)) {
74 /****************************************************************
76 ****************************************************************/
78 static int ccache_entry_count(void)
80 struct WINBINDD_CCACHE_ENTRY *entry;
83 for (entry = ccache_list; entry; entry = entry->next) {
89 void ccache_remove_all_after_fork(void)
91 struct WINBINDD_CCACHE_ENTRY *cur, *next;
93 for (cur = ccache_list; cur; cur = next) {
95 DLIST_REMOVE(ccache_list, cur);
96 TALLOC_FREE(cur->event);
103 /****************************************************************
104 Do the work of refreshing the ticket.
105 ****************************************************************/
107 static void krb5_ticket_refresh_handler(struct event_context *event_ctx,
108 struct timed_event *te,
112 struct WINBINDD_CCACHE_ENTRY *entry =
113 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
117 time_t expire_time = 0;
118 struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
121 DEBUG(10,("krb5_ticket_refresh_handler called\n"));
122 DEBUGADD(10,("event called for: %s, %s\n",
123 entry->ccname, entry->username));
125 TALLOC_FREE(entry->event);
129 /* Kinit again if we have the user password and we can't renew the old
132 * This happens when machine are put to sleep for a very long time. */
134 if (entry->renew_until < time(NULL)) {
136 if (cred_ptr && cred_ptr->pass) {
138 set_effective_uid(entry->uid);
140 ret = kerberos_kinit_password_ext(entry->principal_name,
142 0, /* hm, can we do time correction here ? */
143 &entry->refresh_time,
146 False, /* no PAC required anymore */
148 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
150 gain_root_privilege();
153 DEBUG(3,("krb5_ticket_refresh_handler: "
154 "could not re-kinit: %s\n",
155 error_message(ret)));
156 /* destroy the ticket because we cannot rekinit
157 * it, ignore error here */
158 ads_kdestroy(entry->ccname);
160 /* Don't break the ticket refresh chain: retry
161 * refreshing ticket sometime later when KDC is
162 * unreachable -- BoYang. More error code handling
166 if ((ret == KRB5_KDC_UNREACH)
167 || (ret == KRB5_REALM_CANT_RESOLVE)) {
168 #if defined(DEBUG_KRB5_TKT_RENEWAL)
169 new_start = time(NULL) + 30;
171 new_start = time(NULL) +
172 MAX(30, lp_winbind_cache_time());
174 add_krb5_ticket_gain_handler_event(entry,
175 timeval_set(new_start, 0));
178 TALLOC_FREE(entry->event);
182 DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
183 "for: %s in ccache: %s\n",
184 entry->principal_name, entry->ccname));
186 #if defined(DEBUG_KRB5_TKT_RENEWAL)
187 new_start = time(NULL) + 30;
189 /* The tkt should be refreshed at one-half the period
190 from now to the expiration time */
191 expire_time = entry->refresh_time;
192 new_start = krb5_event_refresh_time(entry->refresh_time);
197 * No cached credentials
198 * destroy ticket and refresh chain
200 ads_kdestroy(entry->ccname);
201 TALLOC_FREE(entry->event);
206 set_effective_uid(entry->uid);
208 ret = smb_krb5_renew_ticket(entry->ccname,
209 entry->principal_name,
212 #if defined(DEBUG_KRB5_TKT_RENEWAL)
213 new_start = time(NULL) + 30;
215 expire_time = new_start;
216 new_start = krb5_event_refresh_time(new_start);
219 gain_root_privilege();
222 DEBUG(3,("krb5_ticket_refresh_handler: "
223 "could not renew tickets: %s\n",
224 error_message(ret)));
225 /* maybe we are beyond the renewing window */
227 /* evil rises here, we refresh ticket failed,
228 * but the ticket might be expired. Therefore,
229 * When we refresh ticket failed, destory the
232 ads_kdestroy(entry->ccname);
234 /* avoid breaking the renewal chain: retry in
235 * lp_winbind_cache_time() seconds when the KDC was not
236 * available right now.
237 * the return code can be KRB5_REALM_CANT_RESOLVE.
238 * More error code handling here? */
240 if ((ret == KRB5_KDC_UNREACH)
241 || (ret == KRB5_REALM_CANT_RESOLVE)) {
242 #if defined(DEBUG_KRB5_TKT_RENEWAL)
243 new_start = time(NULL) + 30;
245 new_start = time(NULL) +
246 MAX(30, lp_winbind_cache_time());
248 /* ticket is destroyed here, we have to regain it
249 * if it is possible */
250 add_krb5_ticket_gain_handler_event(entry,
251 timeval_set(new_start, 0));
255 /* This is evil, if the ticket was already expired.
256 * renew ticket function returns KRB5KRB_AP_ERR_TKT_EXPIRED.
257 * But there is still a chance that we can rekinit it.
259 * This happens when user login in online mode, and then network
260 * down or something cause winbind goes offline for a very long time,
261 * and then goes online again. ticket expired, renew failed.
262 * This happens when machine are put to sleep for a long time,
263 * but shorter than entry->renew_util.
265 * Looks like the KDC is reachable, we want to rekinit as soon as
266 * possible instead of waiting some time later. */
267 if ((ret == KRB5KRB_AP_ERR_TKT_EXPIRED)
268 || (ret == KRB5_FCC_NOFILE)) goto rekinit;
274 /* in cases that ticket will be unrenewable soon, we don't try to renew ticket
275 * but try to regain ticket if it is possible */
276 if (entry->renew_until && expire_time
277 && (entry->renew_until <= expire_time)) {
278 /* try to regain ticket 10 seconds before expiration */
280 add_krb5_ticket_gain_handler_event(entry,
281 timeval_set(expire_time, 0));
285 if (entry->refresh_time == 0) {
286 entry->refresh_time = new_start;
288 entry->event = event_add_timed(winbind_event_context(), entry,
289 timeval_set(new_start, 0),
290 krb5_ticket_refresh_handler,
296 /****************************************************************
297 Do the work of regaining a ticket when coming from offline auth.
298 ****************************************************************/
300 static void krb5_ticket_gain_handler(struct event_context *event_ctx,
301 struct timed_event *te,
305 struct WINBINDD_CCACHE_ENTRY *entry =
306 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
310 struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
311 struct winbindd_domain *domain = NULL;
314 DEBUG(10,("krb5_ticket_gain_handler called\n"));
315 DEBUGADD(10,("event called for: %s, %s\n",
316 entry->ccname, entry->username));
318 TALLOC_FREE(entry->event);
322 if (!cred_ptr || !cred_ptr->pass) {
323 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
327 if ((domain = find_domain_from_name(entry->realm)) == NULL) {
328 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
332 if (!domain->online) {
336 set_effective_uid(entry->uid);
338 ret = kerberos_kinit_password_ext(entry->principal_name,
340 0, /* hm, can we do time correction here ? */
341 &entry->refresh_time,
344 False, /* no PAC required anymore */
346 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
348 gain_root_privilege();
351 DEBUG(3,("krb5_ticket_gain_handler: "
352 "could not kinit: %s\n",
353 error_message(ret)));
354 /* evil. If we cannot do it, destroy any the __maybe__
355 * __existing__ ticket */
356 ads_kdestroy(entry->ccname);
360 DEBUG(10,("krb5_ticket_gain_handler: "
361 "successful kinit for: %s in ccache: %s\n",
362 entry->principal_name, entry->ccname));
368 #if defined(DEBUG_KRB5_TKT_RENEWAL)
369 t = timeval_set(time(NULL) + 30, 0);
371 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
374 add_krb5_ticket_gain_handler_event(entry, t);
379 #if defined(DEBUG_KRB5_TKT_RENEWAL)
380 t = timeval_set(time(NULL) + 30, 0);
382 t = timeval_set(krb5_event_refresh_time(entry->refresh_time), 0);
385 if (entry->refresh_time == 0) {
386 entry->refresh_time = t.tv_sec;
388 entry->event = event_add_timed(winbind_event_context(),
391 krb5_ticket_refresh_handler,
398 /**************************************************************
399 The gain initial ticket case is recognised as entry->refresh_time
401 **************************************************************/
403 static void add_krb5_ticket_gain_handler_event(struct WINBINDD_CCACHE_ENTRY *entry,
406 entry->refresh_time = 0;
407 entry->event = event_add_timed(winbind_event_context(),
410 krb5_ticket_gain_handler,
414 void ccache_regain_all_now(void)
416 struct WINBINDD_CCACHE_ENTRY *cur;
417 struct timeval t = timeval_current();
419 for (cur = ccache_list; cur; cur = cur->next) {
420 struct timed_event *new_event;
423 * if refresh_time is 0, we know that the
424 * the event has the krb5_ticket_gain_handler
426 if (cur->refresh_time == 0) {
427 new_event = event_add_timed(winbind_event_context(),
430 krb5_ticket_gain_handler,
433 new_event = event_add_timed(winbind_event_context(),
436 krb5_ticket_refresh_handler,
444 TALLOC_FREE(cur->event);
445 cur->event = new_event;
451 /****************************************************************
452 Check if an ccache entry exists.
453 ****************************************************************/
455 bool ccache_entry_exists(const char *username)
457 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
458 return (entry != NULL);
461 /****************************************************************
462 Ensure we're changing the correct entry.
463 ****************************************************************/
465 bool ccache_entry_identical(const char *username,
469 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
475 if (entry->uid != uid) {
476 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
477 (unsigned int)entry->uid, (unsigned int)uid));
480 if (!strcsequal(entry->ccname, ccname)) {
481 DEBUG(0,("cache_entry_identical: "
482 "ccnames differ: (cache) %s != (client) %s\n",
483 entry->ccname, ccname));
489 NTSTATUS add_ccache_to_list(const char *princ_name,
492 const char *username,
498 bool postponed_request)
500 struct WINBINDD_CCACHE_ENTRY *entry = NULL;
507 if ((username == NULL && princ_name == NULL) ||
508 ccname == NULL || uid < 0) {
509 return NT_STATUS_INVALID_PARAMETER;
512 if (ccache_entry_count() + 1 > MAX_CCACHES) {
513 DEBUG(10,("add_ccache_to_list: "
514 "max number of ccaches reached\n"));
515 return NT_STATUS_NO_MORE_ENTRIES;
518 /* If it is cached login, destroy krb5 ticket
519 * to avoid surprise. */
521 if (postponed_request) {
522 /* ignore KRB5_FCC_NOFILE error here */
523 ret = ads_kdestroy(ccname);
524 if (ret == KRB5_FCC_NOFILE) {
528 DEBUG(0, ("add_ccache_to_list: failed to destroy "
529 "user krb5 ccache %s with %s\n", ccname,
530 error_message(ret)));
531 return krb5_to_nt_status(ret);
533 DEBUG(10, ("add_ccache_to_list: successfully destroyed "
534 "krb5 ccache %s for user %s\n", ccname,
539 /* Reference count old entries */
540 entry = get_ccache_by_username(username);
542 /* Check cached entries are identical. */
543 if (!ccache_entry_identical(username, uid, ccname)) {
544 return NT_STATUS_INVALID_PARAMETER;
547 DEBUG(10,("add_ccache_to_list: "
548 "ref count on entry %s is now %d\n",
549 username, entry->ref_count));
550 /* FIXME: in this case we still might want to have a krb5 cred
551 * event handler created - gd
552 * Add ticket refresh handler here */
554 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
559 if (postponed_request) {
560 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
561 add_krb5_ticket_gain_handler_event(entry, t);
563 /* Renew at 1/2 the ticket expiration time */
564 #if defined(DEBUG_KRB5_TKT_RENEWAL)
565 t = timeval_set(time(NULL)+30, 0);
567 t = timeval_set(krb5_event_refresh_time(ticket_end),
570 if (!entry->refresh_time) {
571 entry->refresh_time = t.tv_sec;
573 entry->event = event_add_timed(winbind_event_context(),
576 krb5_ticket_refresh_handler,
581 ntret = remove_ccache(username);
582 if (!NT_STATUS_IS_OK(ntret)) {
583 DEBUG(0, ("add_ccache_to_list: Failed to remove krb5 "
584 "ccache %s for user %s\n", entry->ccname,
586 DEBUG(0, ("add_ccache_to_list: error is %s\n",
590 return NT_STATUS_NO_MEMORY;
593 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
599 entry = TALLOC_P(NULL, struct WINBINDD_CCACHE_ENTRY);
601 return NT_STATUS_NO_MEMORY;
607 entry->username = talloc_strdup(entry, username);
608 if (!entry->username) {
613 entry->principal_name = talloc_strdup(entry, princ_name);
614 if (!entry->principal_name) {
619 entry->service = talloc_strdup(entry, service);
620 if (!entry->service) {
625 entry->ccname = talloc_strdup(entry, ccname);
626 if (!entry->ccname) {
630 entry->realm = talloc_strdup(entry, realm);
635 entry->create_time = create_time;
636 entry->renew_until = renew_until;
638 entry->ref_count = 1;
640 if (!lp_winbind_refresh_tickets() || renew_until <= 0) {
644 if (postponed_request) {
645 t = timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0);
646 add_krb5_ticket_gain_handler_event(entry, t);
648 /* Renew at 1/2 the ticket expiration time */
649 #if defined(DEBUG_KRB5_TKT_RENEWAL)
650 t = timeval_set(time(NULL)+30, 0);
652 t = timeval_set(krb5_event_refresh_time(ticket_end), 0);
654 if (entry->refresh_time == 0) {
655 entry->refresh_time = t.tv_sec;
657 entry->event = event_add_timed(winbind_event_context(),
660 krb5_ticket_refresh_handler,
668 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
672 DLIST_ADD(ccache_list, entry);
674 DEBUG(10,("add_ccache_to_list: "
675 "added ccache [%s] for user [%s] to the list\n",
683 return NT_STATUS_NO_MEMORY;
686 /*******************************************************************
687 Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer
689 *******************************************************************/
691 NTSTATUS remove_ccache(const char *username)
693 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
694 NTSTATUS status = NT_STATUS_OK;
700 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
703 if (entry->ref_count <= 0) {
704 DEBUG(0,("remove_ccache: logic error. "
705 "ref count for user %s = %d\n",
706 username, entry->ref_count));
707 return NT_STATUS_INTERNAL_DB_CORRUPTION;
712 if (entry->ref_count > 0) {
713 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
714 username, entry->ref_count));
718 /* no references any more */
720 DLIST_REMOVE(ccache_list, entry);
721 TALLOC_FREE(entry->event); /* unregisters events */
724 ret = ads_kdestroy(entry->ccname);
726 /* we ignore the error when there has been no credential cache */
727 if (ret == KRB5_FCC_NOFILE) {
730 DEBUG(0,("remove_ccache: "
731 "failed to destroy user krb5 ccache %s with: %s\n",
732 entry->ccname, error_message(ret)));
734 DEBUG(10,("remove_ccache: "
735 "successfully destroyed krb5 ccache %s for user %s\n",
736 entry->ccname, username));
738 status = krb5_to_nt_status(ret);
742 DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
747 /*******************************************************************
748 In memory credentials cache code.
749 *******************************************************************/
751 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
753 /***********************************************************
754 Find an entry on the list by name.
755 ***********************************************************/
757 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
759 struct WINBINDD_MEMORY_CREDS *p;
761 for (p = memory_creds_list; p; p = p->next) {
762 if (strequal(p->username, username)) {
769 /***********************************************************
770 Store the required creds and mlock them.
771 ***********************************************************/
773 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp,
776 #if !defined(HAVE_MLOCK)
779 /* new_entry->nt_hash is the base pointer for the block
780 of memory pointed into by new_entry->lm_hash and
781 new_entry->pass (if we're storing plaintext). */
783 memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
785 memcredp->len += strlen(pass)+1;
790 /* aligning the memory on on x86_64 and compiling
791 with gcc 4.1 using -O2 causes a segv in the
792 next memset() --jerry */
793 memcredp->nt_hash = SMB_MALLOC_ARRAY(unsigned char, memcredp->len);
795 /* On non-linux platforms, mlock()'d memory must be aligned */
796 memcredp->nt_hash = SMB_MEMALIGN_ARRAY(unsigned char,
797 getpagesize(), memcredp->len);
799 if (!memcredp->nt_hash) {
800 return NT_STATUS_NO_MEMORY;
802 memset(memcredp->nt_hash, 0x0, memcredp->len);
804 memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
806 #ifdef DEBUG_PASSWORD
807 DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
809 if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
810 DEBUG(0,("failed to mlock memory: %s (%d)\n",
811 strerror(errno), errno));
812 SAFE_FREE(memcredp->nt_hash);
813 return map_nt_error_from_unix(errno);
816 #ifdef DEBUG_PASSWORD
817 DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
820 /* Create and store the password hashes. */
821 E_md4hash(pass, memcredp->nt_hash);
822 E_deshash(pass, memcredp->lm_hash);
825 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
826 memcpy(memcredp->pass, pass,
827 memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
834 /***********************************************************
835 Destroy existing creds.
836 ***********************************************************/
838 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
840 #if !defined(HAVE_MUNLOCK)
843 if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
844 DEBUG(0,("failed to munlock memory: %s (%d)\n",
845 strerror(errno), errno));
846 return map_nt_error_from_unix(errno);
848 memset(memcredp->nt_hash, '\0', memcredp->len);
849 SAFE_FREE(memcredp->nt_hash);
850 memcredp->nt_hash = NULL;
851 memcredp->lm_hash = NULL;
852 memcredp->pass = NULL;
858 /***********************************************************
859 Replace the required creds with new ones (password change).
860 ***********************************************************/
862 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
865 NTSTATUS status = delete_memory_creds(memcredp);
866 if (!NT_STATUS_IS_OK(status)) {
869 return store_memory_creds(memcredp, pass);
872 /*************************************************************
873 Store credentials in memory in a list.
874 *************************************************************/
876 static NTSTATUS winbindd_add_memory_creds_internal(const char *username,
880 /* Shortcut to ensure we don't store if no mlock. */
881 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
885 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
887 memcredp = find_memory_creds_by_name(username);
888 if (uid == (uid_t)-1) {
889 DEBUG(0,("winbindd_add_memory_creds_internal: "
890 "invalid uid for user %s.\n", username));
891 return NT_STATUS_INVALID_PARAMETER;
895 /* Already exists. Increment the reference count and replace stored creds. */
896 if (uid != memcredp->uid) {
897 DEBUG(0,("winbindd_add_memory_creds_internal: "
898 "uid %u for user %s doesn't "
899 "match stored uid %u. Replacing.\n",
900 (unsigned int)uid, username,
901 (unsigned int)memcredp->uid));
904 memcredp->ref_count++;
905 DEBUG(10,("winbindd_add_memory_creds_internal: "
906 "ref count for user %s is now %d\n",
907 username, memcredp->ref_count));
908 return winbindd_replace_memory_creds_internal(memcredp, pass);
911 memcredp = TALLOC_ZERO_P(NULL, struct WINBINDD_MEMORY_CREDS);
913 return NT_STATUS_NO_MEMORY;
915 memcredp->username = talloc_strdup(memcredp, username);
916 if (!memcredp->username) {
917 talloc_destroy(memcredp);
918 return NT_STATUS_NO_MEMORY;
921 status = store_memory_creds(memcredp, pass);
922 if (!NT_STATUS_IS_OK(status)) {
923 talloc_destroy(memcredp);
928 memcredp->ref_count = 1;
929 DLIST_ADD(memory_creds_list, memcredp);
931 DEBUG(10,("winbindd_add_memory_creds_internal: "
932 "added entry for user %s\n", username));
938 /*************************************************************
939 Store users credentials in memory. If we also have a
940 struct WINBINDD_CCACHE_ENTRY for this username with a
941 refresh timer, then store the plaintext of the password
942 and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
943 *************************************************************/
945 NTSTATUS winbindd_add_memory_creds(const char *username,
949 struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
952 status = winbindd_add_memory_creds_internal(username, uid, pass);
953 if (!NT_STATUS_IS_OK(status)) {
958 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
959 memcredp = find_memory_creds_by_name(username);
961 entry->cred_ptr = memcredp;
968 /*************************************************************
969 Decrement the in-memory ref count - delete if zero.
970 *************************************************************/
972 NTSTATUS winbindd_delete_memory_creds(const char *username)
974 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
975 struct WINBINDD_CCACHE_ENTRY *entry = NULL;
976 NTSTATUS status = NT_STATUS_OK;
978 memcredp = find_memory_creds_by_name(username);
979 entry = get_ccache_by_username(username);
982 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
984 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
987 if (memcredp->ref_count <= 0) {
988 DEBUG(0,("winbindd_delete_memory_creds: logic error. "
989 "ref count for user %s = %d\n",
990 username, memcredp->ref_count));
991 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
994 memcredp->ref_count--;
995 if (memcredp->ref_count <= 0) {
996 delete_memory_creds(memcredp);
997 DLIST_REMOVE(memory_creds_list, memcredp);
998 talloc_destroy(memcredp);
999 DEBUG(10,("winbindd_delete_memory_creds: "
1000 "deleted entry for user %s\n",
1003 DEBUG(10,("winbindd_delete_memory_creds: "
1004 "entry for user %s ref_count now %d\n",
1005 username, memcredp->ref_count));
1009 /* Ensure we have no dangling references to this. */
1010 entry->cred_ptr = NULL;
1016 /***********************************************************
1017 Replace the required creds with new ones (password change).
1018 ***********************************************************/
1020 NTSTATUS winbindd_replace_memory_creds(const char *username,
1023 struct WINBINDD_MEMORY_CREDS *memcredp = NULL;
1025 memcredp = find_memory_creds_by_name(username);
1027 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
1029 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1032 DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
1035 return winbindd_replace_memory_creds_internal(memcredp, pass);