Copyright (C) Gerald (Jerry) Carter 2007
Copyright (C) Guenther Deschner 2008
+ Copyright (C) Volker Lendecke 2009
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
#include "replace.h"
#include "libwbclient.h"
+#include "../winbind_client.h"
/* Authenticate a username/password pair */
-wbcErr wbcAuthenticateUser(const char *username,
- const char *password)
+wbcErr wbcCtxAuthenticateUser(struct wbcContext *ctx,
+ const char *username, const char *password)
{
wbcErr wbc_status = WBC_ERR_SUCCESS;
struct wbcAuthUserParams params;
params.level = WBC_AUTH_USER_LEVEL_PLAIN;
params.password.plaintext = password;
- wbc_status = wbcAuthenticateUserEx(¶ms, NULL, NULL);
+ wbc_status = wbcCtxAuthenticateUserEx(ctx, ¶ms, NULL, NULL);
BAIL_ON_WBC_ERROR(wbc_status);
done:
return wbc_status;
}
-static wbcErr wbc_create_auth_info(TALLOC_CTX *mem_ctx,
- const struct winbindd_response *resp,
+wbcErr wbcAuthenticateUser(const char *username, const char *password)
+{
+ return wbcCtxAuthenticateUser(NULL, username, password);
+}
+
+static bool sid_attr_compose(struct wbcSidWithAttr *s,
+ const struct wbcDomainSid *d,
+ uint32_t rid, uint32_t attr)
+{
+ if (d->num_auths >= WBC_MAXSUBAUTHS) {
+ return false;
+ }
+ s->sid = *d;
+ s->sid.sub_auths[s->sid.num_auths++] = rid;
+ s->attributes = attr;
+ return true;
+}
+
+static void wbcAuthUserInfoDestructor(void *ptr)
+{
+ struct wbcAuthUserInfo *i = (struct wbcAuthUserInfo *)ptr;
+ free(i->account_name);
+ free(i->user_principal);
+ free(i->full_name);
+ free(i->domain_name);
+ free(i->dns_domain_name);
+ free(i->logon_server);
+ free(i->logon_script);
+ free(i->profile_path);
+ free(i->home_directory);
+ free(i->home_drive);
+ free(i->sids);
+}
+
+static wbcErr wbc_create_auth_info(const struct winbindd_response *resp,
struct wbcAuthUserInfo **_i)
{
wbcErr wbc_status = WBC_ERR_SUCCESS;
uint32_t sn = 0;
uint32_t j;
- i = talloc(mem_ctx, struct wbcAuthUserInfo);
+ i = (struct wbcAuthUserInfo *)wbcAllocateMemory(
+ 1, sizeof(struct wbcAuthUserInfo),
+ wbcAuthUserInfoDestructor);
BAIL_ON_PTR_ERROR(i, wbc_status);
i->user_flags = resp->data.auth.info3.user_flgs;
- i->account_name = talloc_strdup(i, resp->data.auth.info3.user_name);
+ i->account_name = strdup(resp->data.auth.info3.user_name);
BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
i->user_principal= NULL;
- i->full_name = talloc_strdup(i, resp->data.auth.info3.full_name);
+ i->full_name = strdup(resp->data.auth.info3.full_name);
BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
- i->domain_name = talloc_strdup(i, resp->data.auth.info3.logon_dom);
+ i->domain_name = strdup(resp->data.auth.info3.logon_dom);
BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
i->dns_domain_name= NULL;
i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
- i->logon_server = talloc_strdup(i, resp->data.auth.info3.logon_srv);
+ i->logon_server = strdup(resp->data.auth.info3.logon_srv);
BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
- i->logon_script = talloc_strdup(i, resp->data.auth.info3.logon_script);
+ i->logon_script = strdup(resp->data.auth.info3.logon_script);
BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
- i->profile_path = talloc_strdup(i, resp->data.auth.info3.profile_path);
+ i->profile_path = strdup(resp->data.auth.info3.profile_path);
BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
- i->home_directory= talloc_strdup(i, resp->data.auth.info3.home_dir);
+ i->home_directory= strdup(resp->data.auth.info3.home_dir);
BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
- i->home_drive = talloc_strdup(i, resp->data.auth.info3.dir_drive);
+ i->home_drive = strdup(resp->data.auth.info3.dir_drive);
BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
i->num_sids = 2;
i->num_sids += resp->data.auth.info3.num_groups;
i->num_sids += resp->data.auth.info3.num_other_sids;
- i->sids = talloc_array(i, struct wbcSidWithAttr, i->num_sids);
+ i->sids = (struct wbcSidWithAttr *)calloc(
+ sizeof(struct wbcSidWithAttr), i->num_sids);
BAIL_ON_PTR_ERROR(i->sids, wbc_status);
wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
&domain_sid);
BAIL_ON_WBC_ERROR(wbc_status);
-#define _SID_COMPOSE(s, d, r, a) { \
- (s).sid = d; \
- if ((s).sid.num_auths < WBC_MAXSUBAUTHS) { \
- (s).sid.sub_auths[(s).sid.num_auths++] = r; \
- } else { \
- wbc_status = WBC_ERR_INVALID_SID; \
- BAIL_ON_WBC_ERROR(wbc_status); \
- } \
- (s).attributes = a; \
-} while (0)
-
sn = 0;
- _SID_COMPOSE(i->sids[sn], domain_sid,
- resp->data.auth.info3.user_rid,
- 0);
+ if (!sid_attr_compose(&i->sids[sn], &domain_sid,
+ resp->data.auth.info3.user_rid, 0)) {
+ wbc_status = WBC_ERR_INVALID_SID;
+ goto done;
+ }
sn++;
- _SID_COMPOSE(i->sids[sn], domain_sid,
- resp->data.auth.info3.group_rid,
- 0);
+ if (!sid_attr_compose(&i->sids[sn], &domain_sid,
+ resp->data.auth.info3.group_rid, 0)) {
+ wbc_status = WBC_ERR_INVALID_SID;
+ goto done;
+ }
sn++;
p = (char *)resp->extra_data.data;
BAIL_ON_WBC_ERROR(wbc_status);
}
- _SID_COMPOSE(i->sids[sn], domain_sid,
- rid, attrs);
+ if (!sid_attr_compose(&i->sids[sn], &domain_sid,
+ rid, attrs)) {
+ wbc_status = WBC_ERR_INVALID_SID;
+ goto done;
+ }
sn++;
}
*_i = i;
i = NULL;
done:
- talloc_free(i);
+ wbcFreeMemory(i);
return wbc_status;
}
-static wbcErr wbc_create_error_info(TALLOC_CTX *mem_ctx,
- const struct winbindd_response *resp,
- struct wbcAuthErrorInfo **_e)
+static void wbcAuthErrorInfoDestructor(void *ptr)
+{
+ struct wbcAuthErrorInfo *e = (struct wbcAuthErrorInfo *)ptr;
+ free(e->nt_string);
+ free(e->display_string);
+}
+
+static wbcErr wbc_create_error_info(const struct winbindd_response *resp,
+ struct wbcAuthErrorInfo **_e)
{
wbcErr wbc_status = WBC_ERR_SUCCESS;
struct wbcAuthErrorInfo *e;
- e = talloc(mem_ctx, struct wbcAuthErrorInfo);
+ e = (struct wbcAuthErrorInfo *)wbcAllocateMemory(
+ 1, sizeof(struct wbcAuthErrorInfo),
+ wbcAuthErrorInfoDestructor);
BAIL_ON_PTR_ERROR(e, wbc_status);
e->nt_status = resp->data.auth.nt_status;
e->pam_error = resp->data.auth.pam_error;
- e->nt_string = talloc_strdup(e, resp->data.auth.nt_status_string);
+ e->authoritative = resp->data.auth.authoritative;
+ e->nt_string = strdup(resp->data.auth.nt_status_string);
BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
- e->display_string = talloc_strdup(e, resp->data.auth.error_string);
+ e->display_string = strdup(resp->data.auth.error_string);
BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
*_e = e;
e = NULL;
done:
- talloc_free(e);
+ wbcFreeMemory(e);
return wbc_status;
}
-static wbcErr wbc_create_password_policy_info(TALLOC_CTX *mem_ctx,
- const struct winbindd_response *resp,
+static wbcErr wbc_create_password_policy_info(const struct winbindd_response *resp,
struct wbcUserPasswordPolicyInfo **_i)
{
wbcErr wbc_status = WBC_ERR_SUCCESS;
struct wbcUserPasswordPolicyInfo *i;
- i = talloc(mem_ctx, struct wbcUserPasswordPolicyInfo);
+ i = (struct wbcUserPasswordPolicyInfo *)wbcAllocateMemory(
+ 1, sizeof(struct wbcUserPasswordPolicyInfo), NULL);
BAIL_ON_PTR_ERROR(i, wbc_status);
i->min_passwordage = resp->data.auth.policy.min_passwordage;
i = NULL;
done:
- talloc_free(i);
+ wbcFreeMemory(i);
return wbc_status;
}
-static wbcErr wbc_create_logon_info(TALLOC_CTX *mem_ctx,
- struct winbindd_response *resp,
+static void wbcLogonUserInfoDestructor(void *ptr)
+{
+ struct wbcLogonUserInfo *i = (struct wbcLogonUserInfo *)ptr;
+ wbcFreeMemory(i->info);
+ wbcFreeMemory(i->blobs);
+}
+
+static wbcErr wbc_create_logon_info(struct winbindd_response *resp,
struct wbcLogonUserInfo **_i)
{
wbcErr wbc_status = WBC_ERR_SUCCESS;
struct wbcLogonUserInfo *i;
- i = talloc_zero(mem_ctx, struct wbcLogonUserInfo);
+ i = (struct wbcLogonUserInfo *)wbcAllocateMemory(
+ 1, sizeof(struct wbcLogonUserInfo),
+ wbcLogonUserInfoDestructor);
BAIL_ON_PTR_ERROR(i, wbc_status);
- wbc_status = wbc_create_auth_info(i, resp, &i->info);
+ wbc_status = wbc_create_auth_info(resp, &i->info);
BAIL_ON_WBC_ERROR(wbc_status);
- if (resp->data.auth.krb5ccname) {
+ if (resp->data.auth.krb5ccname[0] != '\0') {
wbc_status = wbcAddNamedBlob(&i->num_blobs,
&i->blobs,
"krb5ccname",
BAIL_ON_WBC_ERROR(wbc_status);
}
- if (resp->data.auth.unix_username) {
+ if (resp->data.auth.unix_username[0] != '\0') {
wbc_status = wbcAddNamedBlob(&i->num_blobs,
&i->blobs,
"unix_username",
*_i = i;
i = NULL;
done:
- if (!WBC_ERROR_IS_OK(wbc_status) && i) {
- wbcFreeMemory(i->blobs);
- }
-
- talloc_free(i);
+ wbcFreeMemory(i);
return wbc_status;
}
+
/* Authenticate with more detailed information */
-wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
- struct wbcAuthUserInfo **info,
- struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxAuthenticateUserEx(struct wbcContext *ctx,
+ const struct wbcAuthUserParams *params,
+ struct wbcAuthUserInfo **info,
+ struct wbcAuthErrorInfo **error)
{
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
int cmd = 0;
BAIL_ON_WBC_ERROR(wbc_status);
}
- if (!params->account_name) {
+ if (params->level != WBC_AUTH_USER_LEVEL_PAC && !params->account_name) {
wbc_status = WBC_ERR_INVALID_PARAM;
BAIL_ON_WBC_ERROR(wbc_status);
}
ZERO_STRUCT(sep_response);
- wbc_status = wbcRequestResponse(WINBINDD_INFO,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_INFO,
NULL, &sep_response);
BAIL_ON_WBC_ERROR(wbc_status);
request.data.auth_crap.lm_resp_len =
MIN(params->password.response.lm_length,
sizeof(request.data.auth_crap.lm_resp));
- request.data.auth_crap.nt_resp_len =
- MIN(params->password.response.nt_length,
- sizeof(request.data.auth_crap.nt_resp));
if (params->password.response.lm_data) {
memcpy(request.data.auth_crap.lm_resp,
params->password.response.lm_data,
request.data.auth_crap.lm_resp_len);
}
- if (params->password.response.nt_data) {
+ request.data.auth_crap.nt_resp_len = params->password.response.nt_length;
+ if (params->password.response.nt_length > sizeof(request.data.auth_crap.nt_resp)) {
+ request.flags |= WBFLAG_BIG_NTLMV2_BLOB;
+ request.extra_len = params->password.response.nt_length;
+ request.extra_data.data = (char *)malloc(
+ request.extra_len);
+ if (request.extra_data.data == NULL) {
+ wbc_status = WBC_ERR_NO_MEMORY;
+ BAIL_ON_WBC_ERROR(wbc_status);
+ }
+ memcpy(request.extra_data.data,
+ params->password.response.nt_data,
+ request.data.auth_crap.nt_resp_len);
+ } else if (params->password.response.nt_data) {
memcpy(request.data.auth_crap.nt_resp,
params->password.response.nt_data,
request.data.auth_crap.nt_resp_len);
}
break;
+
+ case WBC_AUTH_USER_LEVEL_PAC:
+ cmd = WINBINDD_PAM_AUTH_CRAP;
+ request.flags = WBFLAG_PAM_AUTH_PAC | WBFLAG_PAM_INFO3_TEXT;
+ request.extra_data.data = malloc(params->password.pac.length);
+ if (request.extra_data.data == NULL) {
+ wbc_status = WBC_ERR_NO_MEMORY;
+ BAIL_ON_WBC_ERROR(wbc_status);
+ }
+ memcpy(request.extra_data.data, params->password.pac.data,
+ params->password.pac.length);
+ request.extra_len = params->password.pac.length;
+ break;
+
default:
break;
}
request.flags |= params->flags;
}
- wbc_status = wbcRequestResponse(cmd,
- &request,
- &response);
+ if (cmd == WINBINDD_PAM_AUTH_CRAP) {
+ wbc_status = wbcRequestResponsePriv(ctx, cmd,
+ &request, &response);
+ } else {
+ wbc_status = wbcRequestResponse(ctx, cmd,
+ &request, &response);
+ }
if (response.data.auth.nt_status != 0) {
if (error) {
- wbc_status = wbc_create_error_info(NULL,
- &response,
+ wbc_status = wbc_create_error_info(&response,
error);
BAIL_ON_WBC_ERROR(wbc_status);
}
BAIL_ON_WBC_ERROR(wbc_status);
if (info) {
- wbc_status = wbc_create_auth_info(NULL,
- &response,
- info);
+ wbc_status = wbc_create_auth_info(&response, info);
BAIL_ON_WBC_ERROR(wbc_status);
}
done:
- if (response.extra_data.data)
- free(response.extra_data.data);
+ winbindd_free_response(&response);
+
+ free(request.extra_data.data);
return wbc_status;
}
+wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
+ struct wbcAuthUserInfo **info,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxAuthenticateUserEx(NULL, params, info, error);
+}
+
/* Trigger a verification of the trust credentials of a specific domain */
+wbcErr wbcCtxCheckTrustCredentials(struct wbcContext *ctx, const char *domain,
+ struct wbcAuthErrorInfo **error)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ if (domain) {
+ strncpy(request.domain_name, domain,
+ sizeof(request.domain_name)-1);
+ }
+
+ /* Send request */
+
+ wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_CHECK_MACHACC,
+ &request, &response);
+ if (response.data.auth.nt_status != 0) {
+ if (error) {
+ wbc_status = wbc_create_error_info(&response,
+ error);
+ BAIL_ON_WBC_ERROR(wbc_status);
+ }
+
+ wbc_status = WBC_ERR_AUTH_ERROR;
+ BAIL_ON_WBC_ERROR(wbc_status);
+ }
+ BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+ return wbc_status;
+}
+
wbcErr wbcCheckTrustCredentials(const char *domain,
struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxCheckTrustCredentials(NULL, domain, error);
+}
+
+/* Trigger a change of the trust credentials for a specific domain */
+wbcErr wbcCtxChangeTrustCredentials(struct wbcContext *ctx, const char *domain,
+ struct wbcAuthErrorInfo **error)
{
struct winbindd_request request;
struct winbindd_response response;
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
if (domain) {
- /*
- * the current protocol doesn't support
- * specifying a domain
- */
- wbc_status = WBC_ERR_NOT_IMPLEMENTED;
+ strncpy(request.domain_name, domain,
+ sizeof(request.domain_name)-1);
+ }
+
+ /* Send request */
+
+ wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_CHANGE_MACHACC,
+ &request, &response);
+ if (response.data.auth.nt_status != 0) {
+ if (error) {
+ wbc_status = wbc_create_error_info(&response,
+ error);
+ BAIL_ON_WBC_ERROR(wbc_status);
+ }
+
+ wbc_status = WBC_ERR_AUTH_ERROR;
BAIL_ON_WBC_ERROR(wbc_status);
}
+ BAIL_ON_WBC_ERROR(wbc_status);
+
+ done:
+ return wbc_status;
+}
+
+wbcErr wbcChangeTrustCredentials(const char *domain,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxChangeTrustCredentials(NULL, domain, error);
+}
+
+/*
+ * Trigger a no-op NETLOGON call. Lightweight version of
+ * wbcCheckTrustCredentials
+ */
+wbcErr wbcCtxPingDc(struct wbcContext *ctx, const char *domain,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxPingDc2(ctx, domain, error, NULL);
+}
+
+wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
+{
+ return wbcPingDc2(domain, error, NULL);
+}
+
+/*
+ * Trigger a no-op NETLOGON call. Lightweight version of
+ * wbcCheckTrustCredentials, optionally return attempted DC
+ */
+wbcErr wbcCtxPingDc2(struct wbcContext *ctx, const char *domain,
+ struct wbcAuthErrorInfo **error, char **dcname)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
ZERO_STRUCT(request);
ZERO_STRUCT(response);
+ if (domain) {
+ strncpy(request.domain_name, domain,
+ sizeof(request.domain_name)-1);
+ }
+
/* Send request */
- wbc_status = wbcRequestResponse(WINBINDD_CHECK_MACHACC,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_PING_DC,
&request,
&response);
+
+ if (dcname && response.extra_data.data) {
+ size_t len;
+
+ len = response.length - sizeof(struct winbindd_response);
+ *dcname = wbcAllocateMemory(1, len, NULL);
+ BAIL_ON_PTR_ERROR(*dcname, wbc_status);
+
+ strlcpy(*dcname, response.extra_data.data, len);
+ }
+
if (response.data.auth.nt_status != 0) {
if (error) {
- wbc_status = wbc_create_error_info(NULL,
- &response,
+ wbc_status = wbc_create_error_info(&response,
error);
BAIL_ON_WBC_ERROR(wbc_status);
}
return wbc_status;
}
+wbcErr wbcPingDc2(const char *domain, struct wbcAuthErrorInfo **error,
+ char **dcname)
+{
+ return wbcCtxPingDc2(NULL, domain, error, dcname);
+}
+
/* Trigger an extended logoff notification to Winbind for a specific user */
-wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
- struct wbcAuthErrorInfo **error)
+wbcErr wbcCtxLogoffUserEx(struct wbcContext *ctx,
+ const struct wbcLogoffUserParams *params,
+ struct wbcAuthErrorInfo **error)
{
struct winbindd_request request;
struct winbindd_response response;
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
- int i;
+ size_t i;
/* validate input */
/* Send request */
- wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_LOGOFF,
&request,
&response);
/* Take the response above and return it to the caller */
if (response.data.auth.nt_status != 0) {
if (error) {
- wbc_status = wbc_create_error_info(NULL,
- &response,
+ wbc_status = wbc_create_error_info(&response,
error);
BAIL_ON_WBC_ERROR(wbc_status);
}
return wbc_status;
}
+wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
+ struct wbcAuthErrorInfo **error)
+{
+ return wbcCtxLogoffUserEx(NULL, params, error);
+}
+
/* Trigger a logoff notification to Winbind for a specific user */
-wbcErr wbcLogoffUser(const char *username,
- uid_t uid,
- const char *ccfilename)
+wbcErr wbcCtxLogoffUser(struct wbcContext *ctx,
+ const char *username, uid_t uid,
+ const char *ccfilename)
{
struct winbindd_request request;
struct winbindd_response response;
/* Send request */
- wbc_status = wbcRequestResponse(WINBINDD_PAM_LOGOFF,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_LOGOFF,
&request,
&response);
return wbc_status;
}
+wbcErr wbcLogoffUser(const char *username,
+ uid_t uid,
+ const char *ccfilename)
+{
+ return wbcCtxLogoffUser(NULL, username, uid, ccfilename);
+}
+
/* Change a password for a user with more detailed information upon failure */
-wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
- struct wbcAuthErrorInfo **error,
- enum wbcPasswordChangeRejectReason *reject_reason,
- struct wbcUserPasswordPolicyInfo **policy)
+wbcErr wbcCtxChangeUserPasswordEx(struct wbcContext *ctx,
+ const struct wbcChangePasswordParams *params,
+ struct wbcAuthErrorInfo **error,
+ enum wbcPasswordChangeRejectReason *reject_reason,
+ struct wbcUserPasswordPolicyInfo **policy)
{
struct winbindd_request request;
struct winbindd_response response;
if (!params->account_name) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (error) {
if (!params->account_name) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
strncpy(request.data.chauthtok.user, params->account_name,
if (!params->account_name || !params->domain_name) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (params->old_password.response.old_lm_hash_enc_length &&
!params->old_password.response.old_lm_hash_enc_data) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (params->old_password.response.old_lm_hash_enc_length == 0 &&
params->old_password.response.old_lm_hash_enc_data) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (params->old_password.response.old_nt_hash_enc_length &&
!params->old_password.response.old_nt_hash_enc_data) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (params->old_password.response.old_nt_hash_enc_length == 0 &&
params->old_password.response.old_nt_hash_enc_data) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (params->new_password.response.lm_length &&
!params->new_password.response.lm_data) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (params->new_password.response.lm_length == 0 &&
params->new_password.response.lm_data) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (params->new_password.response.nt_length &&
!params->new_password.response.nt_data) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
if (params->new_password.response.nt_length == 0 &&
params->new_password.response.nt_data) {
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
}
strncpy(request.data.chng_pswd_auth_crap.user,
sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
if (params->new_password.response.nt_data) {
+ request.data.chng_pswd_auth_crap.new_nt_pswd_len =
+ params->new_password.response.nt_length;
memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
params->new_password.response.nt_data,
request.data.chng_pswd_auth_crap.new_nt_pswd_len);
- request.data.chng_pswd_auth_crap.new_nt_pswd_len =
- params->new_password.response.nt_length;
}
if (params->new_password.response.lm_data) {
+ request.data.chng_pswd_auth_crap.new_lm_pswd_len =
+ params->new_password.response.lm_length;
memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
params->new_password.response.lm_data,
request.data.chng_pswd_auth_crap.new_lm_pswd_len);
- request.data.chng_pswd_auth_crap.new_lm_pswd_len =
- params->new_password.response.lm_length;
}
if (params->old_password.response.old_nt_hash_enc_data) {
+ request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
+ params->old_password.response.old_nt_hash_enc_length;
memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
params->old_password.response.old_nt_hash_enc_data,
request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
- request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
- params->old_password.response.old_nt_hash_enc_length;
}
if (params->old_password.response.old_lm_hash_enc_data) {
+ request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
+ params->old_password.response.old_lm_hash_enc_length;
memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
params->old_password.response.old_lm_hash_enc_data,
request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
- request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
- params->old_password.response.old_lm_hash_enc_length;
}
break;
default:
wbc_status = WBC_ERR_INVALID_PARAM;
- BAIL_ON_WBC_ERROR(wbc_status);
+ goto done;
break;
}
/* Send request */
- wbc_status = wbcRequestResponse(cmd,
+ wbc_status = wbcRequestResponse(ctx, cmd,
&request,
&response);
if (WBC_ERROR_IS_OK(wbc_status)) {
if (response.data.auth.nt_status != 0) {
if (error) {
- wbc_status = wbc_create_error_info(NULL,
- &response,
+ wbc_status = wbc_create_error_info(&response,
error);
BAIL_ON_WBC_ERROR(wbc_status);
}
}
if (policy) {
- wbc_status = wbc_create_password_policy_info(NULL,
- &response,
+ wbc_status = wbc_create_password_policy_info(&response,
policy);
BAIL_ON_WBC_ERROR(wbc_status);
}
return wbc_status;
}
+wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
+ struct wbcAuthErrorInfo **error,
+ enum wbcPasswordChangeRejectReason *reject_reason,
+ struct wbcUserPasswordPolicyInfo **policy)
+{
+ return wbcCtxChangeUserPasswordEx(NULL, params, error,
+ reject_reason, policy);
+}
+
/* Change a password for a user */
-wbcErr wbcChangeUserPassword(const char *username,
- const char *old_password,
- const char *new_password)
+wbcErr wbcCtxChangeUserPassword(struct wbcContext *ctx,
+ const char *username,
+ const char *old_password,
+ const char *new_password)
{
wbcErr wbc_status = WBC_ERR_SUCCESS;
struct wbcChangePasswordParams params;
params.old_password.plaintext = old_password;
params.new_password.plaintext = new_password;
- wbc_status = wbcChangeUserPasswordEx(¶ms,
- NULL,
- NULL,
- NULL);
+ wbc_status = wbcCtxChangeUserPasswordEx(ctx, ¶ms,
+ NULL,
+ NULL,
+ NULL);
BAIL_ON_WBC_ERROR(wbc_status);
done:
return wbc_status;
}
+wbcErr wbcChangeUserPassword(const char *username,
+ const char *old_password,
+ const char *new_password)
+{
+ return wbcCtxChangeUserPassword(NULL, username,
+ old_password, new_password);
+}
+
/* Logon a User */
-wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
- struct wbcLogonUserInfo **info,
- struct wbcAuthErrorInfo **error,
- struct wbcUserPasswordPolicyInfo **policy)
+wbcErr wbcCtxLogonUser(struct wbcContext *ctx,
+ const struct wbcLogonUserParams *params,
+ struct wbcLogonUserInfo **info,
+ struct wbcAuthErrorInfo **error,
+ struct wbcUserPasswordPolicyInfo **policy)
{
wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
- int cmd = 0;
struct winbindd_request request;
struct winbindd_response response;
uint32_t i;
/* Initialize request */
- cmd = WINBINDD_PAM_AUTH;
request.flags = WBFLAG_PAM_INFO3_TEXT |
WBFLAG_PAM_USER_SESSION_KEY |
WBFLAG_PAM_LMKEY;
}
}
- wbc_status = wbcRequestResponse(cmd,
+ wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_AUTH,
&request,
&response);
if (response.data.auth.nt_status != 0) {
if (error) {
- wbc_status = wbc_create_error_info(NULL,
- &response,
+ wbc_status = wbc_create_error_info(&response,
error);
BAIL_ON_WBC_ERROR(wbc_status);
}
BAIL_ON_WBC_ERROR(wbc_status);
if (info) {
- wbc_status = wbc_create_logon_info(NULL,
- &response,
+ wbc_status = wbc_create_logon_info(&response,
info);
BAIL_ON_WBC_ERROR(wbc_status);
}
if (policy) {
- wbc_status = wbc_create_password_policy_info(NULL,
- &response,
+ wbc_status = wbc_create_password_policy_info(&response,
policy);
BAIL_ON_WBC_ERROR(wbc_status);
}
done:
- if (response.extra_data.data)
- free(response.extra_data.data);
+ winbindd_free_response(&response);
return wbc_status;
}
+wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
+ struct wbcLogonUserInfo **info,
+ struct wbcAuthErrorInfo **error,
+ struct wbcUserPasswordPolicyInfo **policy)
+{
+ return wbcCtxLogonUser(NULL, params, info, error, policy);
+}
+
+static void wbcCredentialCacheInfoDestructor(void *ptr)
+{
+ struct wbcCredentialCacheInfo *i =
+ (struct wbcCredentialCacheInfo *)ptr;
+ wbcFreeMemory(i->blobs);
+}
+
/* Authenticate a user with cached credentials */
+wbcErr wbcCtxCredentialCache(struct wbcContext *ctx,
+ struct wbcCredentialCacheParams *params,
+ struct wbcCredentialCacheInfo **info,
+ struct wbcAuthErrorInfo **error)
+{
+ wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
+ struct wbcCredentialCacheInfo *result = NULL;
+ struct winbindd_request request;
+ struct winbindd_response response;
+ struct wbcNamedBlob *initial_blob = NULL;
+ struct wbcNamedBlob *challenge_blob = NULL;
+ size_t i;
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ *info = NULL;
+
+ if (error != NULL) {
+ *error = NULL;
+ }
+ if ((params == NULL)
+ || (params->account_name == NULL)
+ || (params->level != WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP)) {
+ status = WBC_ERR_INVALID_PARAM;
+ goto fail;
+ }
+
+ for (i=0; i<params->num_blobs; i++) {
+ /*
+ * Older callers may used to provide the NEGOTIATE request
+ * as "initial_blob", but it was completely ignored by winbindd.
+ *
+ * So we keep ignoring it.
+ *
+ * A new callers that is capable to support "new_spnego",
+ * will provide the NEGOTIATE request as "negotiate_blob"
+ * instead.
+ */
+ if (strcasecmp(params->blobs[i].name, "negotiate_blob") == 0) {
+ if (initial_blob != NULL) {
+ status = WBC_ERR_INVALID_PARAM;
+ goto fail;
+ }
+ initial_blob = ¶ms->blobs[i];
+ continue;
+ }
+ if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
+ if (challenge_blob != NULL) {
+ status = WBC_ERR_INVALID_PARAM;
+ goto fail;
+ }
+ challenge_blob = ¶ms->blobs[i];
+ continue;
+ }
+ }
+
+ if (params->domain_name != NULL) {
+ status = wbcRequestResponse(ctx, WINBINDD_INFO,
+ NULL, &response);
+ if (!WBC_ERROR_IS_OK(status)) {
+ goto fail;
+ }
+ snprintf(request.data.ccache_ntlm_auth.user,
+ sizeof(request.data.ccache_ntlm_auth.user)-1,
+ "%s%c%s", params->domain_name,
+ response.data.info.winbind_separator,
+ params->account_name);
+ } else {
+ strncpy(request.data.ccache_ntlm_auth.user,
+ params->account_name,
+ sizeof(request.data.ccache_ntlm_auth.user)-1);
+ }
+ request.data.ccache_ntlm_auth.uid = getuid();
+
+ request.data.ccache_ntlm_auth.initial_blob_len = 0;
+ request.data.ccache_ntlm_auth.challenge_blob_len = 0;
+ request.extra_len = 0;
+
+ if (initial_blob != NULL) {
+ request.data.ccache_ntlm_auth.initial_blob_len =
+ initial_blob->blob.length;
+ request.extra_len += initial_blob->blob.length;
+ }
+ if (challenge_blob != NULL) {
+ request.data.ccache_ntlm_auth.challenge_blob_len =
+ challenge_blob->blob.length;
+ request.extra_len += challenge_blob->blob.length;
+ }
+
+ if (request.extra_len != 0) {
+ request.extra_data.data = (char *)malloc(request.extra_len);
+ if (request.extra_data.data == NULL) {
+ status = WBC_ERR_NO_MEMORY;
+ goto fail;
+ }
+ }
+ if (initial_blob != NULL) {
+ memcpy(request.extra_data.data,
+ initial_blob->blob.data, initial_blob->blob.length);
+ }
+ if (challenge_blob != NULL) {
+ memcpy(request.extra_data.data
+ + request.data.ccache_ntlm_auth.initial_blob_len,
+ challenge_blob->blob.data,
+ challenge_blob->blob.length);
+ }
+
+ status = wbcRequestResponse(ctx, WINBINDD_CCACHE_NTLMAUTH,
+ &request, &response);
+ if (!WBC_ERROR_IS_OK(status)) {
+ goto fail;
+ }
+
+ result = (struct wbcCredentialCacheInfo *)wbcAllocateMemory(
+ 1, sizeof(struct wbcCredentialCacheInfo),
+ wbcCredentialCacheInfoDestructor);
+ if (result == NULL) {
+ status = WBC_ERR_NO_MEMORY;
+ goto fail;
+ }
+ result->num_blobs = 0;
+ result->blobs = NULL;
+ status = wbcAddNamedBlob(&result->num_blobs, &result->blobs,
+ "auth_blob", 0,
+ (uint8_t *)response.extra_data.data,
+ response.data.ccache_ntlm_auth.auth_blob_len);
+ if (!WBC_ERROR_IS_OK(status)) {
+ goto fail;
+ }
+ status = wbcAddNamedBlob(
+ &result->num_blobs, &result->blobs, "session_key", 0,
+ response.data.ccache_ntlm_auth.session_key,
+ sizeof(response.data.ccache_ntlm_auth.session_key));
+ if (!WBC_ERROR_IS_OK(status)) {
+ goto fail;
+ }
+ if (response.data.ccache_ntlm_auth.new_spnego) {
+ status = wbcAddNamedBlob(
+ &result->num_blobs, &result->blobs, "new_spnego", 0,
+ &response.data.ccache_ntlm_auth.new_spnego,
+ sizeof(response.data.ccache_ntlm_auth.new_spnego));
+ if (!WBC_ERROR_IS_OK(status)) {
+ goto fail;
+ }
+ }
+
+ *info = result;
+ result = NULL;
+ status = WBC_ERR_SUCCESS;
+fail:
+ free(request.extra_data.data);
+ winbindd_free_response(&response);
+ wbcFreeMemory(result);
+ return status;
+}
+
wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
struct wbcCredentialCacheInfo **info,
struct wbcAuthErrorInfo **error)
{
- return WBC_ERR_NOT_IMPLEMENTED;
+ return wbcCtxCredentialCache(NULL, params, info, error);
+}
+
+/* Authenticate a user with cached credentials */
+wbcErr wbcCtxCredentialSave(struct wbcContext *ctx,
+ const char *user, const char *password)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ strncpy(request.data.ccache_save.user, user,
+ sizeof(request.data.ccache_save.user)-1);
+ strncpy(request.data.ccache_save.pass, password,
+ sizeof(request.data.ccache_save.pass)-1);
+ request.data.ccache_save.uid = getuid();
+
+ return wbcRequestResponse(ctx, WINBINDD_CCACHE_SAVE, &request, &response);
+}
+
+wbcErr wbcCredentialSave(const char *user, const char *password)
+{
+ return wbcCtxCredentialSave(NULL, user, password);
}
git.samba.org / nivanova / samba-autobuild / .git / blobdiff