source3/winbindd/winbindd_pam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - pam auth funcions
   5
   6    Copyright (C) Andrew Tridgell 2000
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett 2001-2002
   9    Copyright (C) Guenther Deschner 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_WINBIND
  29
  30 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
  31                                     struct winbindd_cli_state *state,
  32                                     NET_USER_INFO_3 *info3)
  33 {
  34         state->response.data.auth.info3.logon_time =
  35                 nt_time_to_unix(info3->logon_time);
  36         state->response.data.auth.info3.logoff_time =
  37                 nt_time_to_unix(info3->logoff_time);
  38         state->response.data.auth.info3.kickoff_time =
  39                 nt_time_to_unix(info3->kickoff_time);
  40         state->response.data.auth.info3.pass_last_set_time =
  41                 nt_time_to_unix(info3->pass_last_set_time);
  42         state->response.data.auth.info3.pass_can_change_time =
  43                 nt_time_to_unix(info3->pass_can_change_time);
  44         state->response.data.auth.info3.pass_must_change_time =
  45                 nt_time_to_unix(info3->pass_must_change_time);
  46
  47         state->response.data.auth.info3.logon_count = info3->logon_count;
  48         state->response.data.auth.info3.bad_pw_count = info3->bad_pw_count;
  49
  50         state->response.data.auth.info3.user_rid = info3->user_rid;
  51         state->response.data.auth.info3.group_rid = info3->group_rid;
  52         sid_to_fstring(state->response.data.auth.info3.dom_sid, &(info3->dom_sid.sid));
  53
  54         state->response.data.auth.info3.num_groups = info3->num_groups;
  55         state->response.data.auth.info3.user_flgs = info3->user_flgs;
  56
  57         state->response.data.auth.info3.acct_flags = info3->acct_flags;
  58         state->response.data.auth.info3.num_other_sids = info3->num_other_sids;
  59
  60         unistr2_to_ascii(state->response.data.auth.info3.user_name,
  61                 &info3->uni_user_name,
  62                 sizeof(state->response.data.auth.info3.user_name));
  63         unistr2_to_ascii(state->response.data.auth.info3.full_name,
  64                 &info3->uni_full_name,
  65                 sizeof(state->response.data.auth.info3.full_name));
  66         unistr2_to_ascii(state->response.data.auth.info3.logon_script,
  67                 &info3->uni_logon_script,
  68                 sizeof(state->response.data.auth.info3.logon_script));
  69         unistr2_to_ascii(state->response.data.auth.info3.profile_path,
  70                 &info3->uni_profile_path,
  71                 sizeof(state->response.data.auth.info3.profile_path));
  72         unistr2_to_ascii(state->response.data.auth.info3.home_dir,
  73                 &info3->uni_home_dir,
  74                 sizeof(state->response.data.auth.info3.home_dir));
  75         unistr2_to_ascii(state->response.data.auth.info3.dir_drive,
  76                 &info3->uni_dir_drive,
  77                 sizeof(state->response.data.auth.info3.dir_drive));
  78
  79         unistr2_to_ascii(state->response.data.auth.info3.logon_srv,
  80                 &info3->uni_logon_srv,
  81                 sizeof(state->response.data.auth.info3.logon_srv));
  82         unistr2_to_ascii(state->response.data.auth.info3.logon_dom,
  83                 &info3->uni_logon_dom,
  84                 sizeof(state->response.data.auth.info3.logon_dom));
  85
  86         return NT_STATUS_OK;
  87 }
  88
  89 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
  90                                     struct winbindd_cli_state *state,
  91                                     NET_USER_INFO_3 *info3)
  92 {
  93         prs_struct ps;
  94         uint32 size;
  95         if (!prs_init(&ps, 256 /* Random, non-zero number */, mem_ctx, MARSHALL)) {
  96                 return NT_STATUS_NO_MEMORY;
  97         }
  98         if (!net_io_user_info3("", info3, &ps, 1, 3, False)) {
  99                 prs_mem_free(&ps);
 100                 return NT_STATUS_UNSUCCESSFUL;
 101         }
 102
 103         size = prs_data_size(&ps);
 104         SAFE_FREE(state->response.extra_data.data);
 105         state->response.extra_data.data = SMB_MALLOC(size);
 106         if (!state->response.extra_data.data) {
 107                 prs_mem_free(&ps);
 108                 return NT_STATUS_NO_MEMORY;
 109         }
 110         memset( state->response.extra_data.data, '\0', size );
 111         prs_copy_all_data_out((char *)state->response.extra_data.data, &ps);
 112         state->response.length += size;
 113         prs_mem_free(&ps);
 114         return NT_STATUS_OK;
 115 }
 116
 117 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
 118                                      struct winbindd_cli_state *state,
 119                                      const NET_USER_INFO_3 *info3,
 120                                      const char *name_domain,
 121                                      const char *name_user)
 122 {
 123         /* We've been asked to return the unix username, per
 124            'winbind use default domain' settings and the like */
 125
 126         fstring username_out;
 127         const char *nt_username, *nt_domain;
 128
 129         if (!(nt_domain = unistr2_to_ascii_talloc(mem_ctx,
 130                                        &info3->uni_logon_dom))) {
 131                 /* If the server didn't give us one, just use the one
 132                  * we sent them */
 133                 nt_domain = name_domain;
 134         }
 135
 136         if (!(nt_username = unistr2_to_ascii_talloc(mem_ctx,
 137                                          &info3->uni_user_name))) {
 138                 /* If the server didn't give us one, just use the one
 139                  * we sent them */
 140                 nt_username = name_user;
 141         }
 142
 143         fill_domain_username(username_out, nt_domain, nt_username,
 144                              True);
 145
 146         DEBUG(5,("Setting unix username to [%s]\n", username_out));
 147
 148         SAFE_FREE(state->response.extra_data.data);
 149         state->response.extra_data.data = SMB_STRDUP(username_out);
 150         if (!state->response.extra_data.data) {
 151                 return NT_STATUS_NO_MEMORY;
 152         }
 153         state->response.length +=
 154                 strlen((const char *)state->response.extra_data.data)+1;
 155
 156         return NT_STATUS_OK;
 157 }
 158
 159 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
 160                                  struct winbindd_cli_state *state,
 161                                  const NET_USER_INFO_3 *info3,
 162                                  const char *name_domain,
 163                                  const char *name_user)
 164 {
 165         char *afsname = NULL;
 166         char *cell;
 167
 168         afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
 169         if (afsname == NULL) {
 170                 return NT_STATUS_NO_MEMORY;
 171         }
 172
 173         afsname = talloc_string_sub(mem_ctx,
 174                                     lp_afs_username_map(),
 175                                     "%D", name_domain);
 176         afsname = talloc_string_sub(mem_ctx, afsname,
 177                                     "%u", name_user);
 178         afsname = talloc_string_sub(mem_ctx, afsname,
 179                                     "%U", name_user);
 180
 181         {
 182                 DOM_SID user_sid;
 183                 fstring sidstr;
 184
 185                 sid_copy(&user_sid, &info3->dom_sid.sid);
 186                 sid_append_rid(&user_sid, info3->user_rid);
 187                 sid_to_fstring(sidstr, &user_sid);
 188                 afsname = talloc_string_sub(mem_ctx, afsname,
 189                                             "%s", sidstr);
 190         }
 191
 192         if (afsname == NULL) {
 193                 return NT_STATUS_NO_MEMORY;
 194         }
 195
 196         strlower_m(afsname);
 197
 198         DEBUG(10, ("Generating token for user %s\n", afsname));
 199
 200         cell = strchr(afsname, '@');
 201
 202         if (cell == NULL) {
 203                 return NT_STATUS_NO_MEMORY;
 204         }
 205
 206         *cell = '\0';
 207         cell += 1;
 208
 209         /* Append an AFS token string */
 210         SAFE_FREE(state->response.extra_data.data);
 211         state->response.extra_data.data =
 212                 afs_createtoken_str(afsname, cell);
 213
 214         if (state->response.extra_data.data != NULL) {
 215                 state->response.length +=
 216                         strlen((const char *)state->response.extra_data.data)+1;
 217         }
 218
 219         return NT_STATUS_OK;
 220 }
 221
 222 static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
 223                                      NET_USER_INFO_3 *info3,
 224                                      const char *group_sid)
 225 /**
 226  * Check whether a user belongs to a group or list of groups.
 227  *
 228  * @param mem_ctx talloc memory context.
 229  * @param info3 user information, including group membership info.
 230  * @param group_sid One or more groups , separated by commas.
 231  *
 232  * @return NT_STATUS_OK on success,
 233  *    NT_STATUS_LOGON_FAILURE if the user does not belong,
 234  *    or other NT_STATUS_IS_ERR(status) for other kinds of failure.
 235  */
 236 {
 237         DOM_SID *require_membership_of_sid;
 238         size_t num_require_membership_of_sid;
 239         char *req_sid;
 240         const char *p;
 241         DOM_SID sid;
 242         size_t i;
 243         struct nt_user_token *token;
 244         TALLOC_CTX *frame = NULL;
 245         NTSTATUS status;
 246
 247         /* Parse the 'required group' SID */
 248
 249         if (!group_sid || !group_sid[0]) {
 250                 /* NO sid supplied, all users may access */
 251                 return NT_STATUS_OK;
 252         }
 253
 254         if (!(token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
 255                 DEBUG(0, ("talloc failed\n"));
 256                 return NT_STATUS_NO_MEMORY;
 257         }
 258
 259         num_require_membership_of_sid = 0;
 260         require_membership_of_sid = NULL;
 261
 262         p = group_sid;
 263
 264         frame = talloc_stackframe();
 265         while (next_token_talloc(frame, &p, &req_sid, ",")) {
 266                 if (!string_to_sid(&sid, req_sid)) {
 267                         DEBUG(0, ("check_info3_in_group: could not parse %s "
 268                                   "as a SID!", req_sid));
 269                         TALLOC_FREE(frame);
 270                         return NT_STATUS_INVALID_PARAMETER;
 271                 }
 272
 273                 status = add_sid_to_array(mem_ctx, &sid,
 274                                           &require_membership_of_sid,
 275                                           &num_require_membership_of_sid);
 276                 if (!NT_STATUS_IS_OK(status)) {
 277                         DEBUG(0, ("add_sid_to_array failed\n"));
 278                         TALLOC_FREE(frame);
 279                         return status;
 280                 }
 281         }
 282
 283         TALLOC_FREE(frame);
 284
 285         status = sid_array_from_info3(mem_ctx, info3,
 286                                       &token->user_sids,
 287                                       &token->num_sids,
 288                                       True);
 289         if (!NT_STATUS_IS_OK(status)) {
 290                 return status;
 291         }
 292
 293         if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
 294                                                   token))
 295             || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
 296                                                      token))) {
 297                 DEBUG(3, ("could not add aliases: %s\n",
 298                           nt_errstr(status)));
 299                 return status;
 300         }
 301
 302         debug_nt_user_token(DBGC_CLASS, 10, token);
 303
 304         for (i=0; i<num_require_membership_of_sid; i++) {
 305                 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
 306                                    &require_membership_of_sid[i])));
 307                 if (nt_token_check_sid(&require_membership_of_sid[i],
 308                                        token)) {
 309                         DEBUG(10, ("Access ok\n"));
 310                         return NT_STATUS_OK;
 311                 }
 312         }
 313
 314         /* Do not distinguish this error from a wrong username/pw */
 315
 316         return NT_STATUS_LOGON_FAILURE;
 317 }
 318
 319 struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
 320                                         const char *domain_name)
 321 {
 322         struct winbindd_domain *domain;
 323
 324         if (IS_DC) {
 325                 domain = find_domain_from_name_noinit(domain_name);
 326                 if (domain == NULL) {
 327                         DEBUG(3, ("Authentication for domain [%s] refused"
 328                                   "as it is not a trusted domain\n",
 329                                   domain_name));
 330                 }
 331                 return domain;
 332         }
 333
 334         if (is_myname(domain_name)) {
 335                 DEBUG(3, ("Authentication for domain %s (local domain "
 336                           "to this server) not supported at this "
 337                           "stage\n", domain_name));
 338                 return NULL;
 339         }
 340
 341         /* we can auth against trusted domains */
 342         if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
 343                 domain = find_domain_from_name_noinit(domain_name);
 344                 if (domain == NULL) {
 345                         DEBUG(3, ("Authentication for domain [%s] skipped "
 346                                   "as it is not a trusted domain\n",
 347                                   domain_name));
 348                 } else {
 349                         return domain;
 350                 }
 351         }
 352
 353         return find_our_domain();
 354 }
 355
 356 static void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
 357 {
 358         resp->data.auth.nt_status = NT_STATUS_V(result);
 359         fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result));
 360
 361         /* we might have given a more useful error above */
 362         if (*resp->data.auth.error_string == '\0')
 363                 fstrcpy(resp->data.auth.error_string,
 364                         get_friendly_nt_error_msg(result));
 365         resp->data.auth.pam_error = nt_status_to_pam(result);
 366 }
 367
 368 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
 369                                        struct winbindd_cli_state *state)
 370 {
 371         struct winbindd_methods *methods;
 372         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 373         SAM_UNK_INFO_1 password_policy;
 374
 375         if ( !winbindd_can_contact_domain( domain ) ) {
 376                 DEBUG(5,("fillup_password_policy: No inbound trust to "
 377                          "contact domain %s\n", domain->name));
 378                 return NT_STATUS_NOT_SUPPORTED;
 379         }
 380
 381         methods = domain->methods;
 382
 383         status = methods->password_policy(domain, state->mem_ctx, &password_policy);
 384         if (NT_STATUS_IS_ERR(status)) {
 385                 return status;
 386         }
 387
 388         state->response.data.auth.policy.min_length_password =
 389                 password_policy.min_length_password;
 390         state->response.data.auth.policy.password_history =
 391                 password_policy.password_history;
 392         state->response.data.auth.policy.password_properties =
 393                 password_policy.password_properties;
 394         state->response.data.auth.policy.expire =
 395                 nt_time_to_unix_abs(&(password_policy.expire));
 396         state->response.data.auth.policy.min_passwordage =
 397                 nt_time_to_unix_abs(&(password_policy.min_passwordage));
 398
 399         return NT_STATUS_OK;
 400 }
 401
 402 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
 403                                                          TALLOC_CTX *mem_ctx,
 404                                                          uint16 *max_allowed_bad_attempts)
 405 {
 406         struct winbindd_methods *methods;
 407         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 408         SAM_UNK_INFO_12 lockout_policy;
 409
 410         *max_allowed_bad_attempts = 0;
 411
 412         methods = domain->methods;
 413
 414         status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
 415         if (NT_STATUS_IS_ERR(status)) {
 416                 return status;
 417         }
 418
 419         *max_allowed_bad_attempts = lockout_policy.bad_attempt_lockout;
 420
 421         return NT_STATUS_OK;
 422 }
 423
 424 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
 425                                    TALLOC_CTX *mem_ctx,
 426                                    uint32 *password_properties)
 427 {
 428         struct winbindd_methods *methods;
 429         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 430         SAM_UNK_INFO_1 password_policy;
 431
 432         *password_properties = 0;
 433
 434         methods = domain->methods;
 435
 436         status = methods->password_policy(domain, mem_ctx, &password_policy);
 437         if (NT_STATUS_IS_ERR(status)) {
 438                 return status;
 439         }
 440
 441         *password_properties = password_policy.password_properties;
 442
 443         return NT_STATUS_OK;
 444 }
 445
 446 #ifdef HAVE_KRB5
 447
 448 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
 449                                         const char *type,
 450                                         uid_t uid,
 451                                         bool *internal_ccache)
 452 {
 453         /* accept FILE and WRFILE as krb5_cc_type from the client and then
 454          * build the full ccname string based on the user's uid here -
 455          * Guenther*/
 456
 457         const char *gen_cc = NULL;
 458
 459         *internal_ccache = True;
 460
 461         if (uid == -1) {
 462                 goto memory_ccache;
 463         }
 464
 465         if (!type || type[0] == '\0') {
 466                 goto memory_ccache;
 467         }
 468
 469         if (strequal(type, "FILE")) {
 470                 gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
 471         } else if (strequal(type, "WRFILE")) {
 472                 gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
 473         } else {
 474                 DEBUG(10,("we don't allow to set a %s type ccache\n", type));
 475                 goto memory_ccache;
 476         }
 477
 478         *internal_ccache = False;
 479         goto done;
 480
 481   memory_ccache:
 482         gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
 483
 484   done:
 485         if (gen_cc == NULL) {
 486                 DEBUG(0,("out of memory\n"));
 487                 return NULL;
 488         }
 489
 490         DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
 491
 492         return gen_cc;
 493 }
 494
 495 static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
 496 {
 497         const char *type = state->request.data.auth.krb5_cc_type;
 498
 499         state->response.data.auth.krb5ccname[0] = '\0';
 500
 501         if (type[0] == '\0') {
 502                 return;
 503         }
 504
 505         if (!strequal(type, "FILE") &&
 506             !strequal(type, "WRFILE")) {
 507                 DEBUG(10,("won't return krbccname for a %s type ccache\n",
 508                         type));
 509                 return;
 510         }
 511
 512         fstrcpy(state->response.data.auth.krb5ccname, cc);
 513 }
 514
 515 #endif
 516
 517 static uid_t get_uid_from_state(struct winbindd_cli_state *state)
 518 {
 519         uid_t uid = -1;
 520
 521         uid = state->request.data.auth.uid;
 522
 523         if (uid < 0) {
 524                 DEBUG(1,("invalid uid: '%d'\n", uid));
 525                 return -1;
 526         }
 527         return uid;
 528 }
 529
 530 /**********************************************************************
 531  Authenticate a user with a clear text password using Kerberos and fill up
 532  ccache if required
 533  **********************************************************************/
 534
 535 static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
 536                                             struct winbindd_cli_state *state,
 537                                             NET_USER_INFO_3 **info3)
 538 {
 539 #ifdef HAVE_KRB5
 540         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 541         krb5_error_code krb5_ret;
 542         const char *cc = NULL;
 543         const char *principal_s = NULL;
 544         const char *service = NULL;
 545         char *realm = NULL;
 546         fstring name_domain, name_user;
 547         time_t ticket_lifetime = 0;
 548         time_t renewal_until = 0;
 549         uid_t uid = -1;
 550         ADS_STRUCT *ads;
 551         time_t time_offset = 0;
 552         bool internal_ccache = True;
 553
 554         ZERO_STRUCTP(info3);
 555
 556         *info3 = NULL;
 557
 558         /* 1st step:
 559          * prepare a krb5_cc_cache string for the user */
 560
 561         uid = get_uid_from_state(state);
 562         if (uid == -1) {
 563                 DEBUG(0,("no valid uid\n"));
 564         }
 565
 566         cc = generate_krb5_ccache(state->mem_ctx,
 567                                   state->request.data.auth.krb5_cc_type,
 568                                   state->request.data.auth.uid,
 569                                   &internal_ccache);
 570         if (cc == NULL) {
 571                 return NT_STATUS_NO_MEMORY;
 572         }
 573
 574
 575         /* 2nd step:
 576          * get kerberos properties */
 577
 578         if (domain->private_data) {
 579                 ads = (ADS_STRUCT *)domain->private_data;
 580                 time_offset = ads->auth.time_offset;
 581         }
 582
 583
 584         /* 3rd step:
 585          * do kerberos auth and setup ccache as the user */
 586
 587         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
 588
 589         realm = domain->alt_name;
 590         strupper_m(realm);
 591
 592         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
 593         if (principal_s == NULL) {
 594                 return NT_STATUS_NO_MEMORY;
 595         }
 596
 597         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
 598         if (service == NULL) {
 599                 return NT_STATUS_NO_MEMORY;
 600         }
 601
 602         /* if this is a user ccache, we need to act as the user to let the krb5
 603          * library handle the chown, etc. */
 604
 605         /************************ ENTERING NON-ROOT **********************/
 606
 607         if (!internal_ccache) {
 608                 set_effective_uid(uid);
 609                 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
 610         }
 611
 612         result = kerberos_return_info3_from_pac(state->mem_ctx,
 613                                                 principal_s,
 614                                                 state->request.data.auth.pass,
 615                                                 time_offset,
 616                                                 &ticket_lifetime,
 617                                                 &renewal_until,
 618                                                 cc,
 619                                                 True,
 620                                                 True,
 621                                                 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
 622                                                 info3);
 623         if (!internal_ccache) {
 624                 gain_root_privilege();
 625         }
 626
 627         /************************ RETURNED TO ROOT **********************/
 628
 629         if (!NT_STATUS_IS_OK(result)) {
 630                 goto failed;
 631         }
 632
 633         DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
 634                 principal_s));
 635
 636         /* if we had a user's ccache then return that string for the pam
 637          * environment */
 638
 639         if (!internal_ccache) {
 640
 641                 setup_return_cc_name(state, cc);
 642
 643                 result = add_ccache_to_list(principal_s,
 644                                             cc,
 645                                             service,
 646                                             state->request.data.auth.user,
 647                                             realm,
 648                                             uid,
 649                                             time(NULL),
 650                                             ticket_lifetime,
 651                                             renewal_until,
 652                                             False);
 653
 654                 if (!NT_STATUS_IS_OK(result)) {
 655                         DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
 656                                 nt_errstr(result)));
 657                 }
 658         } else {
 659
 660                 /* need to delete the memory cred cache, it is not used anymore */
 661
 662                 krb5_ret = ads_kdestroy(cc);
 663                 if (krb5_ret) {
 664                         DEBUG(3,("winbindd_raw_kerberos_login: "
 665                                  "could not destroy krb5 credential cache: "
 666                                  "%s\n", error_message(krb5_ret)));
 667                 }
 668
 669         }
 670
 671         return NT_STATUS_OK;
 672
 673 failed:
 674
 675         /* we could have created a new credential cache with a valid tgt in it
 676          * but we werent able to get or verify the service ticket for this
 677          * local host and therefor didn't get the PAC, we need to remove that
 678          * cache entirely now */
 679
 680         krb5_ret = ads_kdestroy(cc);
 681         if (krb5_ret) {
 682                 DEBUG(3,("winbindd_raw_kerberos_login: "
 683                          "could not destroy krb5 credential cache: "
 684                          "%s\n", error_message(krb5_ret)));
 685         }
 686
 687         if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
 688                 DEBUG(3,("winbindd_raw_kerberos_login: "
 689                           "could not remove ccache for user %s\n",
 690                         state->request.data.auth.user));
 691         }
 692
 693         return result;
 694 #else
 695         return NT_STATUS_NOT_SUPPORTED;
 696 #endif /* HAVE_KRB5 */
 697 }
 698
 699 /****************************************************************
 700 ****************************************************************/
 701
 702 static bool check_request_flags(uint32_t flags)
 703 {
 704         uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
 705                                WBFLAG_PAM_UNIX_NAME |
 706                                WBFLAG_PAM_INFO3_NDR;
 707
 708         if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
 709              ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
 710              ( (flags & flags_edata) == WBFLAG_PAM_UNIX_NAME) ||
 711               !(flags & flags_edata) ) {
 712                 return True;
 713         }
 714
 715         DEBUG(1,("check_request_flags: invalid request flags\n"));
 716
 717         return False;
 718 }
 719
 720 /****************************************************************
 721 ****************************************************************/
 722
 723 static NTSTATUS append_data(struct winbindd_cli_state *state,
 724                             NET_USER_INFO_3 *info3,
 725                             const char *name_domain,
 726                             const char *name_user)
 727 {
 728         NTSTATUS result;
 729         uint32_t flags = state->request.flags;
 730
 731         if (flags & WBFLAG_PAM_USER_SESSION_KEY) {
 732                 memcpy(state->response.data.auth.user_session_key,
 733                        info3->user_sess_key,
 734                        sizeof(state->response.data.auth.user_session_key)
 735                        /* 16 */);
 736         }
 737
 738         if (flags & WBFLAG_PAM_LMKEY) {
 739                 memcpy(state->response.data.auth.first_8_lm_hash,
 740                        info3->lm_sess_key,
 741                        sizeof(state->response.data.auth.first_8_lm_hash)
 742                        /* 8 */);
 743         }
 744
 745         if (flags & WBFLAG_PAM_INFO3_TEXT) {
 746                 result = append_info3_as_txt(state->mem_ctx, state, info3);
 747                 if (!NT_STATUS_IS_OK(result)) {
 748                         DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
 749                                 nt_errstr(result)));
 750                         return result;
 751                 }
 752         }
 753
 754         /* currently, anything from here on potentially overwrites extra_data. */
 755
 756         if (flags & WBFLAG_PAM_INFO3_NDR) {
 757                 result = append_info3_as_ndr(state->mem_ctx, state, info3);
 758                 if (!NT_STATUS_IS_OK(result)) {
 759                         DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
 760                                 nt_errstr(result)));
 761                         return result;
 762                 }
 763         }
 764
 765         if (flags & WBFLAG_PAM_UNIX_NAME) {
 766                 result = append_unix_username(state->mem_ctx, state, info3,
 767                                               name_domain, name_user);
 768                 if (!NT_STATUS_IS_OK(result)) {
 769                         DEBUG(10,("Failed to append Unix Username: %s\n",
 770                                 nt_errstr(result)));
 771                         return result;
 772                 }
 773         }
 774
 775         if (flags & WBFLAG_PAM_AFS_TOKEN) {
 776                 result = append_afs_token(state->mem_ctx, state, info3,
 777                                           name_domain, name_user);
 778                 if (!NT_STATUS_IS_OK(result)) {
 779                         DEBUG(10,("Failed to append AFS token: %s\n",
 780                                 nt_errstr(result)));
 781                         return result;
 782                 }
 783         }
 784
 785         return NT_STATUS_OK;
 786 }
 787
 788 void winbindd_pam_auth(struct winbindd_cli_state *state)
 789 {
 790         struct winbindd_domain *domain;
 791         fstring name_domain, name_user;
 792         NTSTATUS result;
 793
 794         /* Ensure null termination */
 795         state->request.data.auth.user
 796                 [sizeof(state->request.data.auth.user)-1]='\0';
 797
 798         /* Ensure null termination */
 799         state->request.data.auth.pass
 800                 [sizeof(state->request.data.auth.pass)-1]='\0';
 801
 802         DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
 803                   state->request.data.auth.user));
 804
 805         if (!check_request_flags(state->request.flags)) {
 806                 result = NT_STATUS_INVALID_PARAMETER_MIX;
 807                 goto done;
 808         }
 809
 810         /* Parse domain and username */
 811
 812         ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
 813
 814         if (!canonicalize_username(state->request.data.auth.user,
 815                                name_domain, name_user)) {
 816                 result = NT_STATUS_NO_SUCH_USER;
 817                 goto done;
 818         }
 819
 820         domain = find_auth_domain(state, name_domain);
 821
 822         if (domain == NULL) {
 823                 result = NT_STATUS_NO_SUCH_USER;
 824                 goto done;
 825         }
 826
 827         sendto_domain(state, domain);
 828         return;
 829  done:
 830         set_auth_errors(&state->response, result);
 831         DEBUG(5, ("Plain text authentication for %s returned %s "
 832                   "(PAM: %d)\n",
 833                   state->request.data.auth.user,
 834                   state->response.data.auth.nt_status_string,
 835                   state->response.data.auth.pam_error));
 836         request_error(state);
 837 }
 838
 839 NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
 840                                        struct winbindd_cli_state *state,
 841                                        NET_USER_INFO_3 **info3)
 842 {
 843         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
 844         uint16 max_allowed_bad_attempts;
 845         fstring name_domain, name_user;
 846         DOM_SID sid;
 847         enum lsa_SidType type;
 848         uchar new_nt_pass[NT_HASH_LEN];
 849         const uint8 *cached_nt_pass;
 850         const uint8 *cached_salt;
 851         NET_USER_INFO_3 *my_info3;
 852         time_t kickoff_time, must_change_time;
 853         bool password_good = False;
 854 #ifdef HAVE_KRB5
 855         struct winbindd_tdc_domain *tdc_domain = NULL;
 856 #endif
 857
 858         *info3 = NULL;
 859
 860         ZERO_STRUCTP(info3);
 861
 862         DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
 863
 864         /* Parse domain and username */
 865
 866         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
 867
 868
 869         if (!lookup_cached_name(state->mem_ctx,
 870                                 name_domain,
 871                                 name_user,
 872                                 &sid,
 873                                 &type)) {
 874                 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
 875                 return NT_STATUS_NO_SUCH_USER;
 876         }
 877
 878         if (type != SID_NAME_USER) {
 879                 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
 880                 return NT_STATUS_LOGON_FAILURE;
 881         }
 882
 883         result = winbindd_get_creds(domain,
 884                                     state->mem_ctx,
 885                                     &sid,
 886                                     &my_info3,
 887                                     &cached_nt_pass,
 888                                     &cached_salt);
 889         if (!NT_STATUS_IS_OK(result)) {
 890                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
 891                 return result;
 892         }
 893
 894         *info3 = my_info3;
 895
 896         E_md4hash(state->request.data.auth.pass, new_nt_pass);
 897
 898         dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
 899         dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
 900         if (cached_salt) {
 901                 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
 902         }
 903
 904         if (cached_salt) {
 905                 /* In this case we didn't store the nt_hash itself,
 906                    but the MD5 combination of salt + nt_hash. */
 907                 uchar salted_hash[NT_HASH_LEN];
 908                 E_md5hash(cached_salt, new_nt_pass, salted_hash);
 909
 910                 password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
 911                         True : False;
 912         } else {
 913                 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
 914                 password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
 915                         True : False;
 916         }
 917
 918         if (password_good) {
 919
 920                 /* User *DOES* know the password, update logon_time and reset
 921                  * bad_pw_count */
 922
 923                 my_info3->user_flgs |= NETLOGON_CACHED_ACCOUNT;
 924
 925                 if (my_info3->acct_flags & ACB_AUTOLOCK) {
 926                         return NT_STATUS_ACCOUNT_LOCKED_OUT;
 927                 }
 928
 929                 if (my_info3->acct_flags & ACB_DISABLED) {
 930                         return NT_STATUS_ACCOUNT_DISABLED;
 931                 }
 932
 933                 if (my_info3->acct_flags & ACB_WSTRUST) {
 934                         return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 935                 }
 936
 937                 if (my_info3->acct_flags & ACB_SVRTRUST) {
 938                         return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 939                 }
 940
 941                 if (my_info3->acct_flags & ACB_DOMTRUST) {
 942                         return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 943                 }
 944
 945                 if (!(my_info3->acct_flags & ACB_NORMAL)) {
 946                         DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
 947                                 my_info3->acct_flags));
 948                         return NT_STATUS_LOGON_FAILURE;
 949                 }
 950
 951                 kickoff_time = nt_time_to_unix(my_info3->kickoff_time);
 952                 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
 953                         return NT_STATUS_ACCOUNT_EXPIRED;
 954                 }
 955
 956                 must_change_time = nt_time_to_unix(my_info3->pass_must_change_time);
 957                 if (must_change_time != 0 && must_change_time < time(NULL)) {
 958                         /* we allow grace logons when the password has expired */
 959                         my_info3->user_flgs |= NETLOGON_GRACE_LOGON;
 960                         /* return NT_STATUS_PASSWORD_EXPIRED; */
 961                         goto success;
 962                 }
 963
 964 #ifdef HAVE_KRB5
 965                 if ((state->request.flags & WBFLAG_PAM_KRB5) &&
 966                     ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
 967                     (tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL)) {
 968
 969                         uid_t uid = -1;
 970                         const char *cc = NULL;
 971                         char *realm = NULL;
 972                         const char *principal_s = NULL;
 973                         const char *service = NULL;
 974                         bool internal_ccache = False;
 975
 976                         uid = get_uid_from_state(state);
 977                         if (uid == -1) {
 978                                 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
 979                                 return NT_STATUS_INVALID_PARAMETER;
 980                         }
 981
 982                         cc = generate_krb5_ccache(state->mem_ctx,
 983                                                 state->request.data.auth.krb5_cc_type,
 984                                                 state->request.data.auth.uid,
 985                                                 &internal_ccache);
 986                         if (cc == NULL) {
 987                                 return NT_STATUS_NO_MEMORY;
 988                         }
 989
 990                         realm = domain->alt_name;
 991                         strupper_m(realm);
 992
 993                         principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
 994                         if (principal_s == NULL) {
 995                                 return NT_STATUS_NO_MEMORY;
 996                         }
 997
 998                         service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
 999                         if (service == NULL) {
1000                                 return NT_STATUS_NO_MEMORY;
1001                         }
1002
1003                         if (!internal_ccache) {
1004
1005                                 setup_return_cc_name(state, cc);
1006
1007                                 result = add_ccache_to_list(principal_s,
1008                                                             cc,
1009                                                             service,
1010                                                             state->request.data.auth.user,
1011                                                             domain->alt_name,
1012                                                             uid,
1013                                                             time(NULL),
1014                                                             time(NULL) + lp_winbind_cache_time(),
1015                                                             time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
1016                                                             True);
1017
1018                                 if (!NT_STATUS_IS_OK(result)) {
1019                                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
1020                                                 "to add ccache to list: %s\n",
1021                                                 nt_errstr(result)));
1022                                 }
1023                         }
1024                 }
1025 #endif /* HAVE_KRB5 */
1026  success:
1027                 /* FIXME: we possibly should handle logon hours as well (does xp when
1028                  * offline?) see auth/auth_sam.c:sam_account_ok for details */
1029
1030                 unix_to_nt_time(&my_info3->logon_time, time(NULL));
1031                 my_info3->bad_pw_count = 0;
1032
1033                 result = winbindd_update_creds_by_info3(domain,
1034                                                         state->mem_ctx,
1035                                                         state->request.data.auth.user,
1036                                                         state->request.data.auth.pass,
1037                                                         my_info3);
1038                 if (!NT_STATUS_IS_OK(result)) {
1039                         DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1040                                 nt_errstr(result)));
1041                         return result;
1042                 }
1043
1044                 return NT_STATUS_OK;
1045
1046         }
1047
1048         /* User does *NOT* know the correct password, modify info3 accordingly */
1049
1050         /* failure of this is not critical */
1051         result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1052         if (!NT_STATUS_IS_OK(result)) {
1053                 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1054                           "Won't be able to honour account lockout policies\n"));
1055         }
1056
1057         /* increase counter */
1058         my_info3->bad_pw_count++;
1059
1060         if (max_allowed_bad_attempts == 0) {
1061                 goto failed;
1062         }
1063
1064         /* lockout user */
1065         if (my_info3->bad_pw_count >= max_allowed_bad_attempts) {
1066
1067                 uint32 password_properties;
1068
1069                 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1070                 if (!NT_STATUS_IS_OK(result)) {
1071                         DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1072                 }
1073
1074                 if ((my_info3->user_rid != DOMAIN_USER_RID_ADMIN) ||
1075                     (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1076                         my_info3->acct_flags |= ACB_AUTOLOCK;
1077                 }
1078         }
1079
1080 failed:
1081         result = winbindd_update_creds_by_info3(domain,
1082                                                 state->mem_ctx,
1083                                                 state->request.data.auth.user,
1084                                                 NULL,
1085                                                 my_info3);
1086
1087         if (!NT_STATUS_IS_OK(result)) {
1088                 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1089                         nt_errstr(result)));
1090         }
1091
1092         return NT_STATUS_LOGON_FAILURE;
1093 }
1094
1095 NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1096                                          struct winbindd_cli_state *state,
1097                                          NET_USER_INFO_3 **info3)
1098 {
1099         struct winbindd_domain *contact_domain;
1100         fstring name_domain, name_user;
1101         NTSTATUS result;
1102
1103         DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1104
1105         /* Parse domain and username */
1106
1107         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1108
1109         /* what domain should we contact? */
1110
1111         if ( IS_DC ) {
1112                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1113                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1114                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1115                         result = NT_STATUS_NO_SUCH_USER;
1116                         goto done;
1117                 }
1118
1119         } else {
1120                 if (is_myname(name_domain)) {
1121                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1122                         result =  NT_STATUS_NO_SUCH_USER;
1123                         goto done;
1124                 }
1125
1126                 contact_domain = find_domain_from_name(name_domain);
1127                 if (contact_domain == NULL) {
1128                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1129                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1130
1131                         contact_domain = find_our_domain();
1132                 }
1133         }
1134
1135         if (contact_domain->initialized &&
1136             contact_domain->active_directory) {
1137                 goto try_login;
1138         }
1139
1140         if (!contact_domain->initialized) {
1141                 init_dc_connection(contact_domain);
1142         }
1143
1144         if (!contact_domain->active_directory) {
1145                 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1146                 return NT_STATUS_INVALID_LOGON_TYPE;
1147         }
1148 try_login:
1149         result = winbindd_raw_kerberos_login(contact_domain, state, info3);
1150 done:
1151         return result;
1152 }
1153
1154 NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
1155                                          struct winbindd_cli_state *state,
1156                                          NET_USER_INFO_3 **info3)
1157 {
1158
1159         struct rpc_pipe_client *netlogon_pipe;
1160         uchar chal[8];
1161         DATA_BLOB lm_resp;
1162         DATA_BLOB nt_resp;
1163         int attempts = 0;
1164         unsigned char local_lm_response[24];
1165         unsigned char local_nt_response[24];
1166         struct winbindd_domain *contact_domain;
1167         fstring name_domain, name_user;
1168         bool retry;
1169         NTSTATUS result;
1170         NET_USER_INFO_3 *my_info3;
1171
1172         ZERO_STRUCTP(info3);
1173
1174         *info3 = NULL;
1175
1176         my_info3 = TALLOC_ZERO_P(state->mem_ctx, NET_USER_INFO_3);
1177         if (my_info3 == NULL) {
1178                 return NT_STATUS_NO_MEMORY;
1179         }
1180
1181
1182         DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1183
1184         /* Parse domain and username */
1185
1186         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1187
1188         /* do password magic */
1189
1190
1191         generate_random_buffer(chal, 8);
1192         if (lp_client_ntlmv2_auth()) {
1193                 DATA_BLOB server_chal;
1194                 DATA_BLOB names_blob;
1195                 DATA_BLOB nt_response;
1196                 DATA_BLOB lm_response;
1197                 server_chal = data_blob_talloc(state->mem_ctx, chal, 8);
1198
1199                 /* note that the 'workgroup' here is a best guess - we don't know
1200                    the server's domain at this point.  The 'server name' is also
1201                    dodgy...
1202                 */
1203                 names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1204
1205                 if (!SMBNTLMv2encrypt(name_user, name_domain,
1206                                       state->request.data.auth.pass,
1207                                       &server_chal,
1208                                       &names_blob,
1209                                       &lm_response, &nt_response, NULL)) {
1210                         data_blob_free(&names_blob);
1211                         data_blob_free(&server_chal);
1212                         DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1213                         result = NT_STATUS_NO_MEMORY;
1214                         goto done;
1215                 }
1216                 data_blob_free(&names_blob);
1217                 data_blob_free(&server_chal);
1218                 lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data,
1219                                            lm_response.length);
1220                 nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data,
1221                                            nt_response.length);
1222                 data_blob_free(&lm_response);
1223                 data_blob_free(&nt_response);
1224
1225         } else {
1226                 if (lp_client_lanman_auth()
1227                     && SMBencrypt(state->request.data.auth.pass,
1228                                   chal,
1229                                   local_lm_response)) {
1230                         lm_resp = data_blob_talloc(state->mem_ctx,
1231                                                    local_lm_response,
1232                                                    sizeof(local_lm_response));
1233                 } else {
1234                         lm_resp = data_blob_null;
1235                 }
1236                 SMBNTencrypt(state->request.data.auth.pass,
1237                              chal,
1238                              local_nt_response);
1239
1240                 nt_resp = data_blob_talloc(state->mem_ctx,
1241                                            local_nt_response,
1242                                            sizeof(local_nt_response));
1243         }
1244
1245         /* what domain should we contact? */
1246
1247         if ( IS_DC ) {
1248                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1249                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1250                                   state->request.data.auth.user, name_domain, name_user, name_domain));
1251                         result = NT_STATUS_NO_SUCH_USER;
1252                         goto done;
1253                 }
1254
1255         } else {
1256                 if (is_myname(name_domain)) {
1257                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1258                         result =  NT_STATUS_NO_SUCH_USER;
1259                         goto done;
1260                 }
1261
1262                 contact_domain = find_our_domain();
1263         }
1264
1265         /* check authentication loop */
1266
1267         do {
1268
1269                 ZERO_STRUCTP(my_info3);
1270                 retry = False;
1271
1272                 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1273
1274                 if (!NT_STATUS_IS_OK(result)) {
1275                         DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1276                         goto done;
1277                 }
1278
1279                 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1280                                                            state->mem_ctx,
1281                                                            0,
1282                                                            contact_domain->dcname, /* server name */
1283                                                            name_user,              /* user name */
1284                                                            name_domain,            /* target domain */
1285                                                            global_myname(),        /* workstation */
1286                                                            chal,
1287                                                            lm_resp,
1288                                                            nt_resp,
1289                                                            my_info3);
1290                 attempts += 1;
1291
1292                 /* We have to try a second time as cm_connect_netlogon
1293                    might not yet have noticed that the DC has killed
1294                    our connection. */
1295
1296                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1297                         retry = True;
1298                         continue;
1299                 }
1300
1301                 /* if we get access denied, a possible cause was that we had
1302                    and open connection to the DC, but someone changed our
1303                    machine account password out from underneath us using 'net
1304                    rpc changetrustpw' */
1305
1306                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1307                         DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1308                                  "ACCESS_DENIED.  Maybe the trust account "
1309                                 "password was changed and we didn't know it. "
1310                                  "Killing connections to domain %s\n",
1311                                 name_domain));
1312                         invalidate_cm_connection(&contact_domain->conn);
1313                         retry = True;
1314                 }
1315
1316         } while ( (attempts < 2) && retry );
1317
1318         /* handle the case where a NT4 DC does not fill in the acct_flags in
1319          * the samlogon reply info3. When accurate info3 is required by the
1320          * caller, we look up the account flags ourselve - gd */
1321
1322         if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
1323             (my_info3->acct_flags == 0) && NT_STATUS_IS_OK(result)) {
1324
1325                 struct rpc_pipe_client *samr_pipe;
1326                 POLICY_HND samr_domain_handle, user_pol;
1327                 SAM_USERINFO_CTR *user_ctr;
1328                 NTSTATUS status_tmp;
1329                 uint32 acct_flags;
1330
1331                 ZERO_STRUCT(user_ctr);
1332
1333                 status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
1334                                             &samr_pipe, &samr_domain_handle);
1335
1336                 if (!NT_STATUS_IS_OK(status_tmp)) {
1337                         DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1338                                 nt_errstr(status_tmp)));
1339                         goto done;
1340                 }
1341
1342                 status_tmp = rpccli_samr_OpenUser(samr_pipe, state->mem_ctx,
1343                                                   &samr_domain_handle,
1344                                                   MAXIMUM_ALLOWED_ACCESS,
1345                                                   my_info3->user_rid,
1346                                                   &user_pol);
1347
1348                 if (!NT_STATUS_IS_OK(status_tmp)) {
1349                         DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1350                                 nt_errstr(status_tmp)));
1351                         goto done;
1352                 }
1353
1354                 status_tmp = rpccli_samr_query_userinfo(samr_pipe, state->mem_ctx,
1355                                                         &user_pol, 16, &user_ctr);
1356
1357                 if (!NT_STATUS_IS_OK(status_tmp)) {
1358                         DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1359                                 nt_errstr(status_tmp)));
1360                         rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1361                         goto done;
1362                 }
1363
1364                 acct_flags = user_ctr->info.id16->acb_info;
1365
1366                 if (acct_flags == 0) {
1367                         rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1368                         goto done;
1369                 }
1370
1371                 my_info3->acct_flags = acct_flags;
1372
1373                 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1374
1375                 rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1376         }
1377
1378         *info3 = my_info3;
1379 done:
1380         return result;
1381 }
1382
1383 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1384                                             struct winbindd_cli_state *state)
1385 {
1386         NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1387         NTSTATUS krb5_result = NT_STATUS_OK;
1388         fstring name_domain, name_user;
1389         NET_USER_INFO_3 *info3 = NULL;
1390
1391         /* Ensure null termination */
1392         state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
1393
1394         /* Ensure null termination */
1395         state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
1396
1397         DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1398                   state->request.data.auth.user));
1399
1400         if (!check_request_flags(state->request.flags)) {
1401                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1402                 goto done;
1403         }
1404
1405         /* Parse domain and username */
1406
1407         ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1408
1409         parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1410
1411         if (domain->online == False) {
1412                 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1413                 if (domain->startup) {
1414                         /* Logons are very important to users. If we're offline and
1415                            we get a request within the first 30 seconds of startup,
1416                            try very hard to find a DC and go online. */
1417
1418                         DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1419                                 "request in startup mode.\n", domain->name ));
1420
1421                         winbindd_flush_negative_conn_cache(domain);
1422                         result = init_dc_connection(domain);
1423                 }
1424         }
1425
1426         DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1427
1428         /* Check for Kerberos authentication */
1429         if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
1430
1431                 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1432                 /* save for later */
1433                 krb5_result = result;
1434
1435
1436                 if (NT_STATUS_IS_OK(result)) {
1437                         DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1438                         goto process_result;
1439                 } else {
1440                         DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1441                 }
1442
1443                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1444                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1445                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1446                         DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1447                         set_domain_offline( domain );
1448                         goto cached_logon;
1449                 }
1450
1451                 /* there are quite some NT_STATUS errors where there is no
1452                  * point in retrying with a samlogon, we explictly have to take
1453                  * care not to increase the bad logon counter on the DC */
1454
1455                 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1456                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1457                     NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1458                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1459                     NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1460                     NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1461                     NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1462                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1463                     NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1464                     NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1465                         goto process_result;
1466                 }
1467
1468                 if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1469                         DEBUG(3,("falling back to samlogon\n"));
1470                         goto sam_logon;
1471                 } else {
1472                         goto cached_logon;
1473                 }
1474         }
1475
1476 sam_logon:
1477         /* Check for Samlogon authentication */
1478         if (domain->online) {
1479                 result = winbindd_dual_pam_auth_samlogon(domain, state, &info3);
1480
1481                 if (NT_STATUS_IS_OK(result)) {
1482                         DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1483                         /* add the Krb5 err if we have one */
1484                         if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1485                                 info3->user_flgs |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1486                         }
1487                         goto process_result;
1488                 }
1489
1490                 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1491                           nt_errstr(result)));
1492
1493                 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1494                     NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1495                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1496                 {
1497                         DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1498                         set_domain_offline( domain );
1499                         goto cached_logon;
1500                 }
1501
1502                         if (domain->online) {
1503                                 /* We're still online - fail. */
1504                                 goto done;
1505                         }
1506         }
1507
1508 cached_logon:
1509         /* Check for Cached logons */
1510         if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
1511             lp_winbind_offline_logon()) {
1512
1513                 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1514
1515                 if (NT_STATUS_IS_OK(result)) {
1516                         DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1517                         goto process_result;
1518                 } else {
1519                         DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1520                         goto done;
1521                 }
1522         }
1523
1524 process_result:
1525
1526         if (NT_STATUS_IS_OK(result)) {
1527
1528                 DOM_SID user_sid;
1529
1530                 /* In all codepaths where result == NT_STATUS_OK info3 must have
1531                    been initialized. */
1532                 if (!info3) {
1533                         result = NT_STATUS_INTERNAL_ERROR;
1534                         goto done;
1535                 }
1536
1537                 netsamlogon_cache_store(name_user, info3);
1538                 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1539
1540                 /* save name_to_sid info as early as possible (only if
1541                    this is our primary domain so we don't invalidate
1542                    the cache entry by storing the seq_num for the wrong
1543                    domain). */
1544                 if ( domain->primary ) {
1545                         sid_compose(&user_sid, &info3->dom_sid.sid,
1546                                     info3->user_rid);
1547                         cache_name2sid(domain, name_domain, name_user,
1548                                        SID_NAME_USER, &user_sid);
1549                 }
1550
1551                 /* Check if the user is in the right group */
1552
1553                 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1554                                         state->request.data.auth.require_membership_of_sid))) {
1555                         DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1556                                   state->request.data.auth.user,
1557                                   state->request.data.auth.require_membership_of_sid));
1558                         goto done;
1559                 }
1560
1561                 result = append_data(state, info3, name_domain, name_user);
1562                 if (!NT_STATUS_IS_OK(result)) {
1563                         goto done;
1564                 }
1565
1566                 if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
1567
1568                         /* Store in-memory creds for single-signon using ntlm_auth. */
1569                         result = winbindd_add_memory_creds(state->request.data.auth.user,
1570                                                         get_uid_from_state(state),
1571                                                         state->request.data.auth.pass);
1572
1573                         if (!NT_STATUS_IS_OK(result)) {
1574                                 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
1575                                 goto done;
1576                         }
1577
1578                         if (lp_winbind_offline_logon()) {
1579                                 result = winbindd_store_creds(domain,
1580                                                       state->mem_ctx,
1581                                                       state->request.data.auth.user,
1582                                                       state->request.data.auth.pass,
1583                                                       info3, NULL);
1584                                 if (!NT_STATUS_IS_OK(result)) {
1585
1586                                         /* Release refcount. */
1587                                         winbindd_delete_memory_creds(state->request.data.auth.user);
1588
1589                                         DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
1590                                         goto done;
1591                                 }
1592                         }
1593                 }
1594
1595
1596                 if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
1597                         result = fillup_password_policy(domain, state);
1598
1599                         if (!NT_STATUS_IS_OK(result)
1600                             && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1601                         {
1602                                 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
1603                                 goto done;
1604                         }
1605                 }
1606
1607                 result = NT_STATUS_OK;
1608         }
1609
1610 done:
1611         /* give us a more useful (more correct?) error code */
1612         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1613             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1614                 result = NT_STATUS_NO_LOGON_SERVERS;
1615         }
1616
1617         state->response.data.auth.nt_status = NT_STATUS_V(result);
1618         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1619
1620         /* we might have given a more useful error above */
1621         if (!*state->response.data.auth.error_string)
1622                 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1623         state->response.data.auth.pam_error = nt_status_to_pam(result);
1624
1625         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1626               state->request.data.auth.user,
1627               state->response.data.auth.nt_status_string,
1628               state->response.data.auth.pam_error));
1629
1630         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1631 }
1632
1633
1634 /**********************************************************************
1635  Challenge Response Authentication Protocol
1636 **********************************************************************/
1637
1638 void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
1639 {
1640         struct winbindd_domain *domain = NULL;
1641         const char *domain_name = NULL;
1642         NTSTATUS result;
1643
1644         if (!check_request_flags(state->request.flags)) {
1645                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1646                 goto done;
1647         }
1648
1649         if (!state->privileged) {
1650                 char *error_string = NULL;
1651                 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1652                           "denied.  !\n"));
1653                 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1654                              "on %s are set correctly.\n",
1655                              get_winbind_priv_pipe_dir()));
1656                 /* send a better message than ACCESS_DENIED */
1657                 error_string = talloc_asprintf(state->mem_ctx,
1658                                                "winbind client not authorized "
1659                                                "to use winbindd_pam_auth_crap."
1660                                                " Ensure permissions on %s "
1661                                                "are set correctly.",
1662                                                get_winbind_priv_pipe_dir());
1663                 fstrcpy(state->response.data.auth.error_string, error_string);
1664                 result = NT_STATUS_ACCESS_DENIED;
1665                 goto done;
1666         }
1667
1668         /* Ensure null termination */
1669         state->request.data.auth_crap.user
1670                 [sizeof(state->request.data.auth_crap.user)-1]=0;
1671         state->request.data.auth_crap.domain
1672                 [sizeof(state->request.data.auth_crap.domain)-1]=0;
1673
1674         DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1675                   (unsigned long)state->pid,
1676                   state->request.data.auth_crap.domain,
1677                   state->request.data.auth_crap.user));
1678
1679         if (*state->request.data.auth_crap.domain != '\0') {
1680                 domain_name = state->request.data.auth_crap.domain;
1681         } else if (lp_winbind_use_default_domain()) {
1682                 domain_name = lp_workgroup();
1683         }
1684
1685         if (domain_name != NULL)
1686                 domain = find_auth_domain(state, domain_name);
1687
1688         if (domain != NULL) {
1689                 sendto_domain(state, domain);
1690                 return;
1691         }
1692
1693         result = NT_STATUS_NO_SUCH_USER;
1694
1695  done:
1696         set_auth_errors(&state->response, result);
1697         DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1698                   state->request.data.auth_crap.domain,
1699                   state->request.data.auth_crap.user,
1700                   state->response.data.auth.nt_status_string,
1701                   state->response.data.auth.pam_error));
1702         request_error(state);
1703         return;
1704 }
1705
1706
1707 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1708                                                  struct winbindd_cli_state *state)
1709 {
1710         NTSTATUS result;
1711         NET_USER_INFO_3 info3;
1712         struct rpc_pipe_client *netlogon_pipe;
1713         const char *name_user = NULL;
1714         const char *name_domain = NULL;
1715         const char *workstation;
1716         struct winbindd_domain *contact_domain;
1717         int attempts = 0;
1718         bool retry;
1719
1720         DATA_BLOB lm_resp, nt_resp;
1721
1722         /* This is child-only, so no check for privileged access is needed
1723            anymore */
1724
1725         /* Ensure null termination */
1726         state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
1727         state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
1728
1729         if (!check_request_flags(state->request.flags)) {
1730                 result = NT_STATUS_INVALID_PARAMETER_MIX;
1731                 goto done;
1732         }
1733
1734         name_user = state->request.data.auth_crap.user;
1735
1736         if (*state->request.data.auth_crap.domain) {
1737                 name_domain = state->request.data.auth_crap.domain;
1738         } else if (lp_winbind_use_default_domain()) {
1739                 name_domain = lp_workgroup();
1740         } else {
1741                 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1742                          name_user));
1743                 result = NT_STATUS_NO_SUCH_USER;
1744                 goto done;
1745         }
1746
1747         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1748                   name_domain, name_user));
1749
1750         if (*state->request.data.auth_crap.workstation) {
1751                 workstation = state->request.data.auth_crap.workstation;
1752         } else {
1753                 workstation = global_myname();
1754         }
1755
1756         if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
1757                 || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
1758                 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1759                           state->request.data.auth_crap.lm_resp_len,
1760                           state->request.data.auth_crap.nt_resp_len));
1761                 result = NT_STATUS_INVALID_PARAMETER;
1762                 goto done;
1763         }
1764
1765         lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
1766                                         state->request.data.auth_crap.lm_resp_len);
1767         nt_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.nt_resp,
1768                                         state->request.data.auth_crap.nt_resp_len);
1769
1770         /* what domain should we contact? */
1771
1772         if ( IS_DC ) {
1773                 if (!(contact_domain = find_domain_from_name(name_domain))) {
1774                         DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1775                                   state->request.data.auth_crap.user, name_domain, name_user, name_domain));
1776                         result = NT_STATUS_NO_SUCH_USER;
1777                         goto done;
1778                 }
1779         } else {
1780                 if (is_myname(name_domain)) {
1781                         DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1782                         result =  NT_STATUS_NO_SUCH_USER;
1783                         goto done;
1784                 }
1785                 contact_domain = find_our_domain();
1786         }
1787
1788         do {
1789                 ZERO_STRUCT(info3);
1790                 retry = False;
1791
1792                 netlogon_pipe = NULL;
1793                 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1794
1795                 if (!NT_STATUS_IS_OK(result)) {
1796                         DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1797                                   nt_errstr(result)));
1798                         goto done;
1799                 }
1800
1801                 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1802                                                            state->mem_ctx,
1803                                                            state->request.data.auth_crap.logon_parameters,
1804                                                            contact_domain->dcname,
1805                                                            name_user,
1806                                                            name_domain,
1807                                                                         /* Bug #3248 - found by Stefan Burkei. */
1808                                                            workstation, /* We carefully set this above so use it... */
1809                                                            state->request.data.auth_crap.chal,
1810                                                            lm_resp,
1811                                                            nt_resp,
1812                                                            &info3);
1813
1814                 attempts += 1;
1815
1816                 /* We have to try a second time as cm_connect_netlogon
1817                    might not yet have noticed that the DC has killed
1818                    our connection. */
1819
1820                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1821                         retry = True;
1822                         continue;
1823                 }
1824
1825                 /* if we get access denied, a possible cause was that we had and open
1826                    connection to the DC, but someone changed our machine account password
1827                    out from underneath us using 'net rpc changetrustpw' */
1828
1829                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1830                         DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1831                                  "ACCESS_DENIED.  Maybe the trust account "
1832                                 "password was changed and we didn't know it. "
1833                                  "Killing connections to domain %s\n",
1834                                 name_domain));
1835                         invalidate_cm_connection(&contact_domain->conn);
1836                         retry = True;
1837                 }
1838
1839         } while ( (attempts < 2) && retry );
1840
1841         if (NT_STATUS_IS_OK(result)) {
1842
1843                 netsamlogon_cache_store(name_user, &info3);
1844                 wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3);
1845
1846                 /* Check if the user is in the right group */
1847
1848                 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3,
1849                                                         state->request.data.auth_crap.require_membership_of_sid))) {
1850                         DEBUG(3, ("User %s is not in the required group (%s), so "
1851                                   "crap authentication is rejected\n",
1852                                   state->request.data.auth_crap.user,
1853                                   state->request.data.auth_crap.require_membership_of_sid));
1854                         goto done;
1855                 }
1856
1857                 result = append_data(state, &info3, name_domain, name_user);
1858                 if (!NT_STATUS_IS_OK(result)) {
1859                         goto done;
1860                 }
1861         }
1862
1863 done:
1864
1865         /* give us a more useful (more correct?) error code */
1866         if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1867             (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1868                 result = NT_STATUS_NO_LOGON_SERVERS;
1869         }
1870
1871         if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1872                 result = nt_status_squash(result);
1873         }
1874
1875         state->response.data.auth.nt_status = NT_STATUS_V(result);
1876         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1877
1878         /* we might have given a more useful error above */
1879         if (!*state->response.data.auth.error_string) {
1880                 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1881         }
1882         state->response.data.auth.pam_error = nt_status_to_pam(result);
1883
1884         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1885               ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1886                name_domain,
1887                name_user,
1888                state->response.data.auth.nt_status_string,
1889                state->response.data.auth.pam_error));
1890
1891         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1892 }
1893
1894 /* Change a user password */
1895
1896 void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
1897 {
1898         fstring domain, user;
1899         struct winbindd_domain *contact_domain;
1900
1901         DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
1902                 state->request.data.chauthtok.user));
1903
1904         /* Setup crap */
1905
1906         ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1907
1908         if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
1909                 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1910                 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
1911                           "(PAM: %d)\n",
1912                           state->request.data.auth.user,
1913                           state->response.data.auth.nt_status_string,
1914                           state->response.data.auth.pam_error));
1915                 request_error(state);
1916                 return;
1917         }
1918
1919         contact_domain = find_domain_from_name(domain);
1920         if (!contact_domain) {
1921                 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1922                 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
1923                           state->request.data.chauthtok.user, domain, user, domain));
1924                 request_error(state);
1925                 return;
1926         }
1927
1928         sendto_domain(state, contact_domain);
1929 }
1930
1931 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1932                                                  struct winbindd_cli_state *state)
1933 {
1934         char *oldpass;
1935         char *newpass = NULL;
1936         POLICY_HND dom_pol;
1937         struct rpc_pipe_client *cli;
1938         bool got_info = False;
1939         SAM_UNK_INFO_1 info;
1940         SAMR_CHANGE_REJECT reject;
1941         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1942         fstring domain, user;
1943
1944         DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1945                   state->request.data.auth.user));
1946
1947         if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
1948                 goto done;
1949         }
1950
1951         /* Change password */
1952
1953         oldpass = state->request.data.chauthtok.oldpass;
1954         newpass = state->request.data.chauthtok.newpass;
1955
1956         /* Initialize reject reason */
1957         state->response.data.auth.reject_reason = Undefined;
1958
1959         /* Get sam handle */
1960
1961         result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
1962                                 &dom_pol);
1963         if (!NT_STATUS_IS_OK(result)) {
1964                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
1965                 goto done;
1966         }
1967
1968         result = rpccli_samr_chgpasswd3(cli, state->mem_ctx, user, newpass, oldpass, &info, &reject);
1969
1970         /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
1971
1972         if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
1973                 state->response.data.auth.policy.min_length_password =
1974                         info.min_length_password;
1975                 state->response.data.auth.policy.password_history =
1976                         info.password_history;
1977                 state->response.data.auth.policy.password_properties =
1978                         info.password_properties;
1979                 state->response.data.auth.policy.expire =
1980                         nt_time_to_unix_abs(&info.expire);
1981                 state->response.data.auth.policy.min_passwordage =
1982                         nt_time_to_unix_abs(&info.min_passwordage);
1983
1984                 state->response.data.auth.reject_reason =
1985                         reject.reject_reason;
1986
1987                 got_info = True;
1988         }
1989
1990         /* only fallback when the chgpasswd3 call is not supported */
1991         if ((NT_STATUS_EQUAL(result, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR))) ||
1992                    (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) ||
1993                    (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED))) {
1994
1995                 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
1996                         nt_errstr(result)));
1997
1998                 result = rpccli_samr_chgpasswd_user(cli, state->mem_ctx, user, newpass, oldpass);
1999
2000                 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2001                    Map to the same status code as Windows 2003. */
2002
2003                 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2004                         result = NT_STATUS_PASSWORD_RESTRICTION;
2005                 }
2006         }
2007
2008 done:
2009
2010         if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
2011
2012                 /* Update the single sign-on memory creds. */
2013                 result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
2014                                                         newpass);
2015
2016                 if (!NT_STATUS_IS_OK(result)) {
2017                         DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
2018                         goto process_result;
2019                 }
2020
2021                 if (lp_winbind_offline_logon()) {
2022                         result = winbindd_update_creds_by_name(contact_domain,
2023                                                          state->mem_ctx, user,
2024                                                          newpass);
2025                         if (!NT_STATUS_IS_OK(result)) {
2026                                 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
2027                                 goto process_result;
2028                         }
2029                 }
2030         }
2031
2032         if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2033
2034                 NTSTATUS policy_ret;
2035
2036                 policy_ret = fillup_password_policy(contact_domain, state);
2037
2038                 /* failure of this is non critical, it will just provide no
2039                  * additional information to the client why the change has
2040                  * failed - Guenther */
2041
2042                 if (!NT_STATUS_IS_OK(policy_ret)) {
2043                         DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2044                         goto process_result;
2045                 }
2046         }
2047
2048 process_result:
2049
2050         state->response.data.auth.nt_status = NT_STATUS_V(result);
2051         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2052         fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2053         state->response.data.auth.pam_error = nt_status_to_pam(result);
2054
2055         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2056               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2057                domain,
2058                user,
2059                state->response.data.auth.nt_status_string,
2060                state->response.data.auth.pam_error));
2061
2062         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2063 }
2064
2065 void winbindd_pam_logoff(struct winbindd_cli_state *state)
2066 {
2067         struct winbindd_domain *domain;
2068         fstring name_domain, user;
2069         uid_t caller_uid = (uid_t)-1;
2070         uid_t request_uid = state->request.data.logoff.uid;
2071
2072         DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
2073                 state->request.data.logoff.user));
2074
2075         /* Ensure null termination */
2076         state->request.data.logoff.user
2077                 [sizeof(state->request.data.logoff.user)-1]='\0';
2078
2079         state->request.data.logoff.krb5ccname
2080                 [sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
2081
2082         if (request_uid == (gid_t)-1) {
2083                 goto failed;
2084         }
2085
2086         if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
2087                 goto failed;
2088         }
2089
2090         if ((domain = find_auth_domain(state, name_domain)) == NULL) {
2091                 goto failed;
2092         }
2093
2094         if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
2095                 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2096                         strerror(errno)));
2097                 goto failed;
2098         }
2099
2100         switch (caller_uid) {
2101                 case -1:
2102                         goto failed;
2103                 case 0:
2104                         /* root must be able to logoff any user - gd */
2105                         state->request.data.logoff.uid = request_uid;
2106                         break;
2107                 default:
2108                         if (caller_uid != request_uid) {
2109                                 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2110                                 goto failed;
2111                         }
2112                         state->request.data.logoff.uid = caller_uid;
2113                         break;
2114         }
2115
2116         sendto_domain(state, domain);
2117         return;
2118
2119  failed:
2120         set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2121         DEBUG(5, ("Pam Logoff for %s returned %s "
2122                   "(PAM: %d)\n",
2123                   state->request.data.logoff.user,
2124                   state->response.data.auth.nt_status_string,
2125                   state->response.data.auth.pam_error));
2126         request_error(state);
2127         return;
2128 }
2129
2130 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2131                                               struct winbindd_cli_state *state)
2132 {
2133         NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2134
2135         DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2136                 state->request.data.logoff.user));
2137
2138         if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
2139                 result = NT_STATUS_OK;
2140                 goto process_result;
2141         }
2142
2143         if (state->request.data.logoff.krb5ccname[0] == '\0') {
2144                 result = NT_STATUS_OK;
2145                 goto process_result;
2146         }
2147
2148 #ifdef HAVE_KRB5
2149
2150         if (state->request.data.logoff.uid < 0) {
2151                 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2152                 goto process_result;
2153         }
2154
2155         /* what we need here is to find the corresponding krb5 ccache name *we*
2156          * created for a given username and destroy it */
2157
2158         if (!ccache_entry_exists(state->request.data.logoff.user)) {
2159                 result = NT_STATUS_OK;
2160                 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2161                 goto process_result;
2162         }
2163
2164         if (!ccache_entry_identical(state->request.data.logoff.user,
2165                                         state->request.data.logoff.uid,
2166                                         state->request.data.logoff.krb5ccname)) {
2167                 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2168                 goto process_result;
2169         }
2170
2171         result = remove_ccache(state->request.data.logoff.user);
2172         if (!NT_STATUS_IS_OK(result)) {
2173                 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2174                         nt_errstr(result)));
2175                 goto process_result;
2176         }
2177
2178 #else
2179         result = NT_STATUS_NOT_SUPPORTED;
2180 #endif
2181
2182 process_result:
2183
2184         winbindd_delete_memory_creds(state->request.data.logoff.user);
2185
2186         state->response.data.auth.nt_status = NT_STATUS_V(result);
2187         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2188         fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2189         state->response.data.auth.pam_error = nt_status_to_pam(result);
2190
2191         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2192 }
2193
2194 /* Change user password with auth crap*/
2195
2196 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
2197 {
2198         struct winbindd_domain *domain = NULL;
2199         const char *domain_name = NULL;
2200
2201         /* Ensure null termination */
2202         state->request.data.chng_pswd_auth_crap.user[
2203                 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2204         state->request.data.chng_pswd_auth_crap.domain[
2205                 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2206
2207         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2208                   (unsigned long)state->pid,
2209                   state->request.data.chng_pswd_auth_crap.domain,
2210                   state->request.data.chng_pswd_auth_crap.user));
2211
2212         if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
2213                 domain_name = state->request.data.chng_pswd_auth_crap.domain;
2214         } else if (lp_winbind_use_default_domain()) {
2215                 domain_name = lp_workgroup();
2216         }
2217
2218         if (domain_name != NULL)
2219                 domain = find_domain_from_name(domain_name);
2220
2221         if (domain != NULL) {
2222                 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2223                           "%s\n", (unsigned long)state->pid,domain->name));
2224                 sendto_domain(state, domain);
2225                 return;
2226         }
2227
2228         set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2229         DEBUG(5, ("CRAP change password  for %s\\%s returned %s (PAM: %d)\n",
2230                   state->request.data.chng_pswd_auth_crap.domain,
2231                   state->request.data.chng_pswd_auth_crap.user,
2232                   state->response.data.auth.nt_status_string,
2233                   state->response.data.auth.pam_error));
2234         request_error(state);
2235         return;
2236 }
2237
2238 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2239 {
2240         NTSTATUS result;
2241         DATA_BLOB new_nt_password;
2242         DATA_BLOB old_nt_hash_enc;
2243         DATA_BLOB new_lm_password;
2244         DATA_BLOB old_lm_hash_enc;
2245         fstring  domain,user;
2246         POLICY_HND dom_pol;
2247         struct winbindd_domain *contact_domain = domainSt;
2248         struct rpc_pipe_client *cli;
2249
2250         /* Ensure null termination */
2251         state->request.data.chng_pswd_auth_crap.user[
2252                 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2253         state->request.data.chng_pswd_auth_crap.domain[
2254                 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2255         *domain = 0;
2256         *user = 0;
2257
2258         DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2259                   (unsigned long)state->pid,
2260                   state->request.data.chng_pswd_auth_crap.domain,
2261                   state->request.data.chng_pswd_auth_crap.user));
2262
2263         if (lp_winbind_offline_logon()) {
2264                 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2265                 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2266                 result = NT_STATUS_ACCESS_DENIED;
2267                 goto done;
2268         }
2269
2270         if (*state->request.data.chng_pswd_auth_crap.domain) {
2271                 fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
2272         } else {
2273                 parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
2274                                   domain, user);
2275
2276                 if(!*domain) {
2277                         DEBUG(3,("no domain specified with username (%s) - "
2278                                  "failing auth\n",
2279                                  state->request.data.chng_pswd_auth_crap.user));
2280                         result = NT_STATUS_NO_SUCH_USER;
2281                         goto done;
2282                 }
2283         }
2284
2285         if (!*domain && lp_winbind_use_default_domain()) {
2286                 fstrcpy(domain,(char *)lp_workgroup());
2287         }
2288
2289         if(!*user) {
2290                 fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
2291         }
2292
2293         DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2294                   (unsigned long)state->pid, domain, user));
2295
2296         /* Change password */
2297         new_nt_password = data_blob_talloc(
2298                 state->mem_ctx,
2299                 state->request.data.chng_pswd_auth_crap.new_nt_pswd,
2300                 state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
2301
2302         old_nt_hash_enc = data_blob_talloc(
2303                 state->mem_ctx,
2304                 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
2305                 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2306
2307         if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2308                 new_lm_password = data_blob_talloc(
2309                         state->mem_ctx,
2310                         state->request.data.chng_pswd_auth_crap.new_lm_pswd,
2311                         state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
2312
2313                 old_lm_hash_enc = data_blob_talloc(
2314                         state->mem_ctx,
2315                         state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
2316                         state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2317         } else {
2318                 new_lm_password.length = 0;
2319                 old_lm_hash_enc.length = 0;
2320         }
2321
2322         /* Get sam handle */
2323
2324         result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2325         if (!NT_STATUS_IS_OK(result)) {
2326                 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2327                 goto done;
2328         }
2329
2330         result = rpccli_samr_chng_pswd_auth_crap(
2331                 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2332                 new_lm_password, old_lm_hash_enc);
2333
2334  done:
2335         state->response.data.auth.nt_status = NT_STATUS_V(result);
2336         fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2337         fstrcpy(state->response.data.auth.error_string,
2338                 get_friendly_nt_error_msg(result));
2339         state->response.data.auth.pam_error = nt_status_to_pam(result);
2340
2341         DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2342               ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2343                domain, user,
2344                state->response.data.auth.nt_status_string,
2345                state->response.data.auth.pam_error));
2346
2347         return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2348 }