2 Unix SMB/CIFS implementation.
4 Winbind daemon - pam auth funcions
6 Copyright (C) Andrew Tridgell 2000
7 Copyright (C) Tim Potter 2001
8 Copyright (C) Andrew Bartlett 2001-2002
9 Copyright (C) Guenther Deschner 2005
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 #define DBGC_CLASS DBGC_WINBIND
30 static NTSTATUS append_info3_as_txt(TALLOC_CTX *mem_ctx,
31 struct winbindd_cli_state *state,
32 struct netr_SamInfo3 *info3)
38 state->response.data.auth.info3.logon_time =
39 nt_time_to_unix(info3->base.last_logon);
40 state->response.data.auth.info3.logoff_time =
41 nt_time_to_unix(info3->base.last_logoff);
42 state->response.data.auth.info3.kickoff_time =
43 nt_time_to_unix(info3->base.acct_expiry);
44 state->response.data.auth.info3.pass_last_set_time =
45 nt_time_to_unix(info3->base.last_password_change);
46 state->response.data.auth.info3.pass_can_change_time =
47 nt_time_to_unix(info3->base.allow_password_change);
48 state->response.data.auth.info3.pass_must_change_time =
49 nt_time_to_unix(info3->base.force_password_change);
51 state->response.data.auth.info3.logon_count = info3->base.logon_count;
52 state->response.data.auth.info3.bad_pw_count = info3->base.bad_password_count;
54 state->response.data.auth.info3.user_rid = info3->base.rid;
55 state->response.data.auth.info3.group_rid = info3->base.primary_gid;
56 sid_to_fstring(state->response.data.auth.info3.dom_sid, info3->base.domain_sid);
58 state->response.data.auth.info3.num_groups = info3->base.groups.count;
59 state->response.data.auth.info3.user_flgs = info3->base.user_flags;
61 state->response.data.auth.info3.acct_flags = info3->base.acct_flags;
62 state->response.data.auth.info3.num_other_sids = info3->sidcount;
64 fstrcpy(state->response.data.auth.info3.user_name,
65 info3->base.account_name.string);
66 fstrcpy(state->response.data.auth.info3.full_name,
67 info3->base.full_name.string);
68 fstrcpy(state->response.data.auth.info3.logon_script,
69 info3->base.logon_script.string);
70 fstrcpy(state->response.data.auth.info3.profile_path,
71 info3->base.profile_path.string);
72 fstrcpy(state->response.data.auth.info3.home_dir,
73 info3->base.home_directory.string);
74 fstrcpy(state->response.data.auth.info3.dir_drive,
75 info3->base.home_drive.string);
77 fstrcpy(state->response.data.auth.info3.logon_srv,
78 info3->base.logon_server.string);
79 fstrcpy(state->response.data.auth.info3.logon_dom,
80 info3->base.domain.string);
82 ex = talloc_strdup(mem_ctx, "");
83 NT_STATUS_HAVE_NO_MEMORY(ex);
85 for (i=0; i < info3->base.groups.count; i++) {
86 ex = talloc_asprintf_append_buffer(ex, "0x%08X:0x%08X\n",
87 info3->base.groups.rids[i].rid,
88 info3->base.groups.rids[i].attributes);
89 NT_STATUS_HAVE_NO_MEMORY(ex);
92 for (i=0; i < info3->sidcount; i++) {
95 sid = dom_sid_string(mem_ctx, info3->sids[i].sid);
96 NT_STATUS_HAVE_NO_MEMORY(sid);
98 ex = talloc_asprintf_append_buffer(ex, "%s:0x%08X\n",
100 info3->sids[i].attributes);
101 NT_STATUS_HAVE_NO_MEMORY(ex);
106 size = talloc_get_size(ex);
108 SAFE_FREE(state->response.extra_data.data);
109 state->response.extra_data.data = SMB_MALLOC(size);
110 if (!state->response.extra_data.data) {
111 return NT_STATUS_NO_MEMORY;
113 memcpy(state->response.extra_data.data, ex, size);
116 state->response.length += size;
121 static NTSTATUS append_info3_as_ndr(TALLOC_CTX *mem_ctx,
122 struct winbindd_cli_state *state,
123 struct netr_SamInfo3 *info3)
126 enum ndr_err_code ndr_err;
128 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, info3,
129 (ndr_push_flags_fn_t)ndr_push_netr_SamInfo3);
130 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
131 DEBUG(0,("append_info3_as_ndr: failed to append\n"));
132 return ndr_map_error2ntstatus(ndr_err);
135 SAFE_FREE(state->response.extra_data.data);
136 state->response.extra_data.data = SMB_MALLOC(blob.length);
137 if (!state->response.extra_data.data) {
138 data_blob_free(&blob);
139 return NT_STATUS_NO_MEMORY;
142 memset(state->response.extra_data.data, '\0', blob.length);
143 memcpy(state->response.extra_data.data, blob.data, blob.length);
144 state->response.length += blob.length;
146 data_blob_free(&blob);
151 static NTSTATUS append_unix_username(TALLOC_CTX *mem_ctx,
152 struct winbindd_cli_state *state,
153 const struct netr_SamInfo3 *info3,
154 const char *name_domain,
155 const char *name_user)
157 /* We've been asked to return the unix username, per
158 'winbind use default domain' settings and the like */
160 fstring username_out;
161 const char *nt_username, *nt_domain;
163 nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
165 /* If the server didn't give us one, just use the one
167 nt_domain = name_domain;
170 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
172 /* If the server didn't give us one, just use the one
174 nt_username = name_user;
177 fill_domain_username(username_out, nt_domain, nt_username,
180 DEBUG(5,("Setting unix username to [%s]\n", username_out));
182 SAFE_FREE(state->response.extra_data.data);
183 state->response.extra_data.data = SMB_STRDUP(username_out);
184 if (!state->response.extra_data.data) {
185 return NT_STATUS_NO_MEMORY;
187 state->response.length +=
188 strlen((const char *)state->response.extra_data.data)+1;
193 static NTSTATUS append_afs_token(TALLOC_CTX *mem_ctx,
194 struct winbindd_cli_state *state,
195 const struct netr_SamInfo3 *info3,
196 const char *name_domain,
197 const char *name_user)
199 char *afsname = NULL;
202 afsname = talloc_strdup(mem_ctx, lp_afs_username_map());
203 if (afsname == NULL) {
204 return NT_STATUS_NO_MEMORY;
207 afsname = talloc_string_sub(mem_ctx,
208 lp_afs_username_map(),
210 afsname = talloc_string_sub(mem_ctx, afsname,
212 afsname = talloc_string_sub(mem_ctx, afsname,
219 sid_copy(&user_sid, info3->base.domain_sid);
220 sid_append_rid(&user_sid, info3->base.rid);
221 sid_to_fstring(sidstr, &user_sid);
222 afsname = talloc_string_sub(mem_ctx, afsname,
226 if (afsname == NULL) {
227 return NT_STATUS_NO_MEMORY;
232 DEBUG(10, ("Generating token for user %s\n", afsname));
234 cell = strchr(afsname, '@');
237 return NT_STATUS_NO_MEMORY;
243 /* Append an AFS token string */
244 SAFE_FREE(state->response.extra_data.data);
245 state->response.extra_data.data =
246 afs_createtoken_str(afsname, cell);
248 if (state->response.extra_data.data != NULL) {
249 state->response.length +=
250 strlen((const char *)state->response.extra_data.data)+1;
256 static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx,
257 struct netr_SamInfo3 *info3,
258 const char *group_sid)
260 * Check whether a user belongs to a group or list of groups.
262 * @param mem_ctx talloc memory context.
263 * @param info3 user information, including group membership info.
264 * @param group_sid One or more groups , separated by commas.
266 * @return NT_STATUS_OK on success,
267 * NT_STATUS_LOGON_FAILURE if the user does not belong,
268 * or other NT_STATUS_IS_ERR(status) for other kinds of failure.
271 DOM_SID *require_membership_of_sid;
272 size_t num_require_membership_of_sid;
277 struct nt_user_token *token;
278 TALLOC_CTX *frame = NULL;
281 /* Parse the 'required group' SID */
283 if (!group_sid || !group_sid[0]) {
284 /* NO sid supplied, all users may access */
288 if (!(token = TALLOC_ZERO_P(mem_ctx, struct nt_user_token))) {
289 DEBUG(0, ("talloc failed\n"));
290 return NT_STATUS_NO_MEMORY;
293 num_require_membership_of_sid = 0;
294 require_membership_of_sid = NULL;
298 frame = talloc_stackframe();
299 while (next_token_talloc(frame, &p, &req_sid, ",")) {
300 if (!string_to_sid(&sid, req_sid)) {
301 DEBUG(0, ("check_info3_in_group: could not parse %s "
302 "as a SID!", req_sid));
304 return NT_STATUS_INVALID_PARAMETER;
307 status = add_sid_to_array(mem_ctx, &sid,
308 &require_membership_of_sid,
309 &num_require_membership_of_sid);
310 if (!NT_STATUS_IS_OK(status)) {
311 DEBUG(0, ("add_sid_to_array failed\n"));
319 status = sid_array_from_info3(mem_ctx, info3,
323 if (!NT_STATUS_IS_OK(status)) {
327 if (!NT_STATUS_IS_OK(status = add_aliases(get_global_sam_sid(),
329 || !NT_STATUS_IS_OK(status = add_aliases(&global_sid_Builtin,
331 DEBUG(3, ("could not add aliases: %s\n",
336 debug_nt_user_token(DBGC_CLASS, 10, token);
338 for (i=0; i<num_require_membership_of_sid; i++) {
339 DEBUG(10, ("Checking SID %s\n", sid_string_dbg(
340 &require_membership_of_sid[i])));
341 if (nt_token_check_sid(&require_membership_of_sid[i],
343 DEBUG(10, ("Access ok\n"));
348 /* Do not distinguish this error from a wrong username/pw */
350 return NT_STATUS_LOGON_FAILURE;
353 struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
354 const char *domain_name)
356 struct winbindd_domain *domain;
359 domain = find_domain_from_name_noinit(domain_name);
360 if (domain == NULL) {
361 DEBUG(3, ("Authentication for domain [%s] refused "
362 "as it is not a trusted domain\n",
368 if (is_myname(domain_name)) {
369 DEBUG(3, ("Authentication for domain %s (local domain "
370 "to this server) not supported at this "
371 "stage\n", domain_name));
375 /* we can auth against trusted domains */
376 if (state->request.flags & WBFLAG_PAM_CONTACT_TRUSTDOM) {
377 domain = find_domain_from_name_noinit(domain_name);
378 if (domain == NULL) {
379 DEBUG(3, ("Authentication for domain [%s] skipped "
380 "as it is not a trusted domain\n",
387 return find_our_domain();
390 static void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
392 resp->data.auth.nt_status = NT_STATUS_V(result);
393 fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result));
395 /* we might have given a more useful error above */
396 if (*resp->data.auth.error_string == '\0')
397 fstrcpy(resp->data.auth.error_string,
398 get_friendly_nt_error_msg(result));
399 resp->data.auth.pam_error = nt_status_to_pam(result);
402 static NTSTATUS fillup_password_policy(struct winbindd_domain *domain,
403 struct winbindd_cli_state *state)
405 struct winbindd_methods *methods;
406 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
407 struct samr_DomInfo1 password_policy;
409 if ( !winbindd_can_contact_domain( domain ) ) {
410 DEBUG(5,("fillup_password_policy: No inbound trust to "
411 "contact domain %s\n", domain->name));
412 return NT_STATUS_NOT_SUPPORTED;
415 methods = domain->methods;
417 status = methods->password_policy(domain, state->mem_ctx, &password_policy);
418 if (NT_STATUS_IS_ERR(status)) {
422 state->response.data.auth.policy.min_length_password =
423 password_policy.min_password_length;
424 state->response.data.auth.policy.password_history =
425 password_policy.password_history_length;
426 state->response.data.auth.policy.password_properties =
427 password_policy.password_properties;
428 state->response.data.auth.policy.expire =
429 nt_time_to_unix_abs((NTTIME *)&(password_policy.max_password_age));
430 state->response.data.auth.policy.min_passwordage =
431 nt_time_to_unix_abs((NTTIME *)&(password_policy.min_password_age));
436 static NTSTATUS get_max_bad_attempts_from_lockout_policy(struct winbindd_domain *domain,
438 uint16 *lockout_threshold)
440 struct winbindd_methods *methods;
441 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
442 struct samr_DomInfo12 lockout_policy;
444 *lockout_threshold = 0;
446 methods = domain->methods;
448 status = methods->lockout_policy(domain, mem_ctx, &lockout_policy);
449 if (NT_STATUS_IS_ERR(status)) {
453 *lockout_threshold = lockout_policy.lockout_threshold;
458 static NTSTATUS get_pwd_properties(struct winbindd_domain *domain,
460 uint32 *password_properties)
462 struct winbindd_methods *methods;
463 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
464 struct samr_DomInfo1 password_policy;
466 *password_properties = 0;
468 methods = domain->methods;
470 status = methods->password_policy(domain, mem_ctx, &password_policy);
471 if (NT_STATUS_IS_ERR(status)) {
475 *password_properties = password_policy.password_properties;
482 static const char *generate_krb5_ccache(TALLOC_CTX *mem_ctx,
485 bool *internal_ccache)
487 /* accept FILE and WRFILE as krb5_cc_type from the client and then
488 * build the full ccname string based on the user's uid here -
491 const char *gen_cc = NULL;
493 *internal_ccache = True;
499 if (!type || type[0] == '\0') {
503 if (strequal(type, "FILE")) {
504 gen_cc = talloc_asprintf(mem_ctx, "FILE:/tmp/krb5cc_%d", uid);
505 } else if (strequal(type, "WRFILE")) {
506 gen_cc = talloc_asprintf(mem_ctx, "WRFILE:/tmp/krb5cc_%d", uid);
508 DEBUG(10,("we don't allow to set a %s type ccache\n", type));
512 *internal_ccache = False;
516 gen_cc = talloc_strdup(mem_ctx, "MEMORY:winbindd_pam_ccache");
519 if (gen_cc == NULL) {
520 DEBUG(0,("out of memory\n"));
524 DEBUG(10,("using ccache: %s %s\n", gen_cc, *internal_ccache ? "(internal)":""));
529 static void setup_return_cc_name(struct winbindd_cli_state *state, const char *cc)
531 const char *type = state->request.data.auth.krb5_cc_type;
533 state->response.data.auth.krb5ccname[0] = '\0';
535 if (type[0] == '\0') {
539 if (!strequal(type, "FILE") &&
540 !strequal(type, "WRFILE")) {
541 DEBUG(10,("won't return krbccname for a %s type ccache\n",
546 fstrcpy(state->response.data.auth.krb5ccname, cc);
551 static uid_t get_uid_from_state(struct winbindd_cli_state *state)
555 uid = state->request.data.auth.uid;
558 DEBUG(1,("invalid uid: '%d'\n", uid));
564 /**********************************************************************
565 Authenticate a user with a clear text password using Kerberos and fill up
567 **********************************************************************/
569 static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
570 struct winbindd_cli_state *state,
571 struct netr_SamInfo3 **info3)
574 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
575 krb5_error_code krb5_ret;
576 const char *cc = NULL;
577 const char *principal_s = NULL;
578 const char *service = NULL;
580 fstring name_domain, name_user;
581 time_t ticket_lifetime = 0;
582 time_t renewal_until = 0;
585 time_t time_offset = 0;
586 bool internal_ccache = True;
593 * prepare a krb5_cc_cache string for the user */
595 uid = get_uid_from_state(state);
597 DEBUG(0,("no valid uid\n"));
600 cc = generate_krb5_ccache(state->mem_ctx,
601 state->request.data.auth.krb5_cc_type,
602 state->request.data.auth.uid,
605 return NT_STATUS_NO_MEMORY;
610 * get kerberos properties */
612 if (domain->private_data) {
613 ads = (ADS_STRUCT *)domain->private_data;
614 time_offset = ads->auth.time_offset;
619 * do kerberos auth and setup ccache as the user */
621 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
623 realm = domain->alt_name;
626 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
627 if (principal_s == NULL) {
628 return NT_STATUS_NO_MEMORY;
631 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
632 if (service == NULL) {
633 return NT_STATUS_NO_MEMORY;
636 /* if this is a user ccache, we need to act as the user to let the krb5
637 * library handle the chown, etc. */
639 /************************ ENTERING NON-ROOT **********************/
641 if (!internal_ccache) {
642 set_effective_uid(uid);
643 DEBUG(10,("winbindd_raw_kerberos_login: uid is %d\n", uid));
646 result = kerberos_return_info3_from_pac(state->mem_ctx,
648 state->request.data.auth.pass,
655 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
657 if (!internal_ccache) {
658 gain_root_privilege();
661 /************************ RETURNED TO ROOT **********************/
663 if (!NT_STATUS_IS_OK(result)) {
667 DEBUG(10,("winbindd_raw_kerberos_login: winbindd validated ticket of %s\n",
670 /* if we had a user's ccache then return that string for the pam
673 if (!internal_ccache) {
675 setup_return_cc_name(state, cc);
677 result = add_ccache_to_list(principal_s,
680 state->request.data.auth.user,
688 if (!NT_STATUS_IS_OK(result)) {
689 DEBUG(10,("winbindd_raw_kerberos_login: failed to add ccache to list: %s\n",
694 /* need to delete the memory cred cache, it is not used anymore */
696 krb5_ret = ads_kdestroy(cc);
698 DEBUG(3,("winbindd_raw_kerberos_login: "
699 "could not destroy krb5 credential cache: "
700 "%s\n", error_message(krb5_ret)));
709 /* we could have created a new credential cache with a valid tgt in it
710 * but we werent able to get or verify the service ticket for this
711 * local host and therefor didn't get the PAC, we need to remove that
712 * cache entirely now */
714 krb5_ret = ads_kdestroy(cc);
716 DEBUG(3,("winbindd_raw_kerberos_login: "
717 "could not destroy krb5 credential cache: "
718 "%s\n", error_message(krb5_ret)));
721 if (!NT_STATUS_IS_OK(remove_ccache(state->request.data.auth.user))) {
722 DEBUG(3,("winbindd_raw_kerberos_login: "
723 "could not remove ccache for user %s\n",
724 state->request.data.auth.user));
729 return NT_STATUS_NOT_SUPPORTED;
730 #endif /* HAVE_KRB5 */
733 /****************************************************************
734 ****************************************************************/
736 static bool check_request_flags(uint32_t flags)
738 uint32_t flags_edata = WBFLAG_PAM_AFS_TOKEN |
739 WBFLAG_PAM_UNIX_NAME |
740 WBFLAG_PAM_INFO3_TEXT |
741 WBFLAG_PAM_INFO3_NDR;
743 if ( ( (flags & flags_edata) == WBFLAG_PAM_AFS_TOKEN) ||
744 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_NDR) ||
745 ( (flags & flags_edata) == WBFLAG_PAM_INFO3_TEXT)||
746 ( (flags & flags_edata) == WBFLAG_PAM_UNIX_NAME) ||
747 !(flags & flags_edata) ) {
751 DEBUG(1,("check_request_flags: invalid request flags[0x%08X]\n",flags));
756 /****************************************************************
757 ****************************************************************/
759 static NTSTATUS append_data(struct winbindd_cli_state *state,
760 struct netr_SamInfo3 *info3,
761 const char *name_domain,
762 const char *name_user)
765 uint32_t flags = state->request.flags;
767 if (flags & WBFLAG_PAM_USER_SESSION_KEY) {
768 memcpy(state->response.data.auth.user_session_key,
770 sizeof(state->response.data.auth.user_session_key)
774 if (flags & WBFLAG_PAM_LMKEY) {
775 memcpy(state->response.data.auth.first_8_lm_hash,
776 info3->base.LMSessKey.key,
777 sizeof(state->response.data.auth.first_8_lm_hash)
781 if (flags & WBFLAG_PAM_INFO3_TEXT) {
782 result = append_info3_as_txt(state->mem_ctx, state, info3);
783 if (!NT_STATUS_IS_OK(result)) {
784 DEBUG(10,("Failed to append INFO3 (TXT): %s\n",
790 /* currently, anything from here on potentially overwrites extra_data. */
792 if (flags & WBFLAG_PAM_INFO3_NDR) {
793 result = append_info3_as_ndr(state->mem_ctx, state, info3);
794 if (!NT_STATUS_IS_OK(result)) {
795 DEBUG(10,("Failed to append INFO3 (NDR): %s\n",
801 if (flags & WBFLAG_PAM_UNIX_NAME) {
802 result = append_unix_username(state->mem_ctx, state, info3,
803 name_domain, name_user);
804 if (!NT_STATUS_IS_OK(result)) {
805 DEBUG(10,("Failed to append Unix Username: %s\n",
811 if (flags & WBFLAG_PAM_AFS_TOKEN) {
812 result = append_afs_token(state->mem_ctx, state, info3,
813 name_domain, name_user);
814 if (!NT_STATUS_IS_OK(result)) {
815 DEBUG(10,("Failed to append AFS token: %s\n",
824 void winbindd_pam_auth(struct winbindd_cli_state *state)
826 struct winbindd_domain *domain;
827 fstring name_domain, name_user;
830 /* Ensure null termination */
831 state->request.data.auth.user
832 [sizeof(state->request.data.auth.user)-1]='\0';
834 /* Ensure null termination */
835 state->request.data.auth.pass
836 [sizeof(state->request.data.auth.pass)-1]='\0';
838 DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid,
839 state->request.data.auth.user));
841 if (!check_request_flags(state->request.flags)) {
842 result = NT_STATUS_INVALID_PARAMETER_MIX;
846 /* Parse domain and username */
848 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
850 if (!canonicalize_username(state->request.data.auth.user,
851 name_domain, name_user)) {
852 result = NT_STATUS_NO_SUCH_USER;
856 domain = find_auth_domain(state, name_domain);
858 if (domain == NULL) {
859 result = NT_STATUS_NO_SUCH_USER;
863 sendto_domain(state, domain);
866 set_auth_errors(&state->response, result);
867 DEBUG(5, ("Plain text authentication for %s returned %s "
869 state->request.data.auth.user,
870 state->response.data.auth.nt_status_string,
871 state->response.data.auth.pam_error));
872 request_error(state);
875 NTSTATUS winbindd_dual_pam_auth_cached(struct winbindd_domain *domain,
876 struct winbindd_cli_state *state,
877 struct netr_SamInfo3 **info3)
879 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
880 uint16 max_allowed_bad_attempts;
881 fstring name_domain, name_user;
883 enum lsa_SidType type;
884 uchar new_nt_pass[NT_HASH_LEN];
885 const uint8 *cached_nt_pass;
886 const uint8 *cached_salt;
887 struct netr_SamInfo3 *my_info3;
888 time_t kickoff_time, must_change_time;
889 bool password_good = False;
891 struct winbindd_tdc_domain *tdc_domain = NULL;
898 DEBUG(10,("winbindd_dual_pam_auth_cached\n"));
900 /* Parse domain and username */
902 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
905 if (!lookup_cached_name(state->mem_ctx,
910 DEBUG(10,("winbindd_dual_pam_auth_cached: no such user in the cache\n"));
911 return NT_STATUS_NO_SUCH_USER;
914 if (type != SID_NAME_USER) {
915 DEBUG(10,("winbindd_dual_pam_auth_cached: not a user (%s)\n", sid_type_lookup(type)));
916 return NT_STATUS_LOGON_FAILURE;
919 result = winbindd_get_creds(domain,
925 if (!NT_STATUS_IS_OK(result)) {
926 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get creds: %s\n", nt_errstr(result)));
932 E_md4hash(state->request.data.auth.pass, new_nt_pass);
934 dump_data_pw("new_nt_pass", new_nt_pass, NT_HASH_LEN);
935 dump_data_pw("cached_nt_pass", cached_nt_pass, NT_HASH_LEN);
937 dump_data_pw("cached_salt", cached_salt, NT_HASH_LEN);
941 /* In this case we didn't store the nt_hash itself,
942 but the MD5 combination of salt + nt_hash. */
943 uchar salted_hash[NT_HASH_LEN];
944 E_md5hash(cached_salt, new_nt_pass, salted_hash);
946 password_good = (memcmp(cached_nt_pass, salted_hash, NT_HASH_LEN) == 0) ?
949 /* Old cached cred - direct store of nt_hash (bad bad bad !). */
950 password_good = (memcmp(cached_nt_pass, new_nt_pass, NT_HASH_LEN) == 0) ?
956 /* User *DOES* know the password, update logon_time and reset
959 my_info3->base.user_flags |= NETLOGON_CACHED_ACCOUNT;
961 if (my_info3->base.acct_flags & ACB_AUTOLOCK) {
962 return NT_STATUS_ACCOUNT_LOCKED_OUT;
965 if (my_info3->base.acct_flags & ACB_DISABLED) {
966 return NT_STATUS_ACCOUNT_DISABLED;
969 if (my_info3->base.acct_flags & ACB_WSTRUST) {
970 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
973 if (my_info3->base.acct_flags & ACB_SVRTRUST) {
974 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
977 if (my_info3->base.acct_flags & ACB_DOMTRUST) {
978 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
981 if (!(my_info3->base.acct_flags & ACB_NORMAL)) {
982 DEBUG(0,("winbindd_dual_pam_auth_cached: whats wrong with that one?: 0x%08x\n",
983 my_info3->base.acct_flags));
984 return NT_STATUS_LOGON_FAILURE;
987 kickoff_time = nt_time_to_unix(my_info3->base.acct_expiry);
988 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
989 return NT_STATUS_ACCOUNT_EXPIRED;
992 must_change_time = nt_time_to_unix(my_info3->base.force_password_change);
993 if (must_change_time != 0 && must_change_time < time(NULL)) {
994 /* we allow grace logons when the password has expired */
995 my_info3->base.user_flags |= NETLOGON_GRACE_LOGON;
996 /* return NT_STATUS_PASSWORD_EXPIRED; */
1001 if ((state->request.flags & WBFLAG_PAM_KRB5) &&
1002 ((tdc_domain = wcache_tdc_fetch_domain(state->mem_ctx, name_domain)) != NULL) &&
1003 (tdc_domain->trust_type & NETR_TRUST_TYPE_UPLEVEL)) {
1006 const char *cc = NULL;
1008 const char *principal_s = NULL;
1009 const char *service = NULL;
1010 bool internal_ccache = False;
1012 uid = get_uid_from_state(state);
1014 DEBUG(0,("winbindd_dual_pam_auth_cached: invalid uid\n"));
1015 return NT_STATUS_INVALID_PARAMETER;
1018 cc = generate_krb5_ccache(state->mem_ctx,
1019 state->request.data.auth.krb5_cc_type,
1020 state->request.data.auth.uid,
1023 return NT_STATUS_NO_MEMORY;
1026 realm = domain->alt_name;
1029 principal_s = talloc_asprintf(state->mem_ctx, "%s@%s", name_user, realm);
1030 if (principal_s == NULL) {
1031 return NT_STATUS_NO_MEMORY;
1034 service = talloc_asprintf(state->mem_ctx, "%s/%s@%s", KRB5_TGS_NAME, realm, realm);
1035 if (service == NULL) {
1036 return NT_STATUS_NO_MEMORY;
1039 if (!internal_ccache) {
1041 setup_return_cc_name(state, cc);
1043 result = add_ccache_to_list(principal_s,
1046 state->request.data.auth.user,
1050 time(NULL) + lp_winbind_cache_time(),
1051 time(NULL) + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME,
1054 if (!NT_STATUS_IS_OK(result)) {
1055 DEBUG(10,("winbindd_dual_pam_auth_cached: failed "
1056 "to add ccache to list: %s\n",
1057 nt_errstr(result)));
1061 #endif /* HAVE_KRB5 */
1063 /* FIXME: we possibly should handle logon hours as well (does xp when
1064 * offline?) see auth/auth_sam.c:sam_account_ok for details */
1066 unix_to_nt_time(&my_info3->base.last_logon, time(NULL));
1067 my_info3->base.bad_password_count = 0;
1069 result = winbindd_update_creds_by_info3(domain,
1071 state->request.data.auth.user,
1072 state->request.data.auth.pass,
1074 if (!NT_STATUS_IS_OK(result)) {
1075 DEBUG(1,("winbindd_dual_pam_auth_cached: failed to update creds: %s\n",
1076 nt_errstr(result)));
1080 return NT_STATUS_OK;
1084 /* User does *NOT* know the correct password, modify info3 accordingly */
1086 /* failure of this is not critical */
1087 result = get_max_bad_attempts_from_lockout_policy(domain, state->mem_ctx, &max_allowed_bad_attempts);
1088 if (!NT_STATUS_IS_OK(result)) {
1089 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get max_allowed_bad_attempts. "
1090 "Won't be able to honour account lockout policies\n"));
1093 /* increase counter */
1094 my_info3->base.bad_password_count++;
1096 if (max_allowed_bad_attempts == 0) {
1101 if (my_info3->base.bad_password_count >= max_allowed_bad_attempts) {
1103 uint32 password_properties;
1105 result = get_pwd_properties(domain, state->mem_ctx, &password_properties);
1106 if (!NT_STATUS_IS_OK(result)) {
1107 DEBUG(10,("winbindd_dual_pam_auth_cached: failed to get password properties.\n"));
1110 if ((my_info3->base.rid != DOMAIN_USER_RID_ADMIN) ||
1111 (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)) {
1112 my_info3->base.acct_flags |= ACB_AUTOLOCK;
1117 result = winbindd_update_creds_by_info3(domain,
1119 state->request.data.auth.user,
1123 if (!NT_STATUS_IS_OK(result)) {
1124 DEBUG(0,("winbindd_dual_pam_auth_cached: failed to update creds %s\n",
1125 nt_errstr(result)));
1128 return NT_STATUS_LOGON_FAILURE;
1131 NTSTATUS winbindd_dual_pam_auth_kerberos(struct winbindd_domain *domain,
1132 struct winbindd_cli_state *state,
1133 struct netr_SamInfo3 **info3)
1135 struct winbindd_domain *contact_domain;
1136 fstring name_domain, name_user;
1139 DEBUG(10,("winbindd_dual_pam_auth_kerberos\n"));
1141 /* Parse domain and username */
1143 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1145 /* what domain should we contact? */
1148 if (!(contact_domain = find_domain_from_name(name_domain))) {
1149 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1150 state->request.data.auth.user, name_domain, name_user, name_domain));
1151 result = NT_STATUS_NO_SUCH_USER;
1156 if (is_myname(name_domain)) {
1157 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1158 result = NT_STATUS_NO_SUCH_USER;
1162 contact_domain = find_domain_from_name(name_domain);
1163 if (contact_domain == NULL) {
1164 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1165 state->request.data.auth.user, name_domain, name_user, name_domain));
1167 contact_domain = find_our_domain();
1171 if (contact_domain->initialized &&
1172 contact_domain->active_directory) {
1176 if (!contact_domain->initialized) {
1177 init_dc_connection(contact_domain);
1180 if (!contact_domain->active_directory) {
1181 DEBUG(3,("krb5 auth requested but domain is not Active Directory\n"));
1182 return NT_STATUS_INVALID_LOGON_TYPE;
1185 result = winbindd_raw_kerberos_login(contact_domain, state, info3);
1190 NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
1191 struct winbindd_cli_state *state,
1192 struct netr_SamInfo3 **info3)
1195 struct rpc_pipe_client *netlogon_pipe;
1200 unsigned char local_lm_response[24];
1201 unsigned char local_nt_response[24];
1202 struct winbindd_domain *contact_domain;
1203 fstring name_domain, name_user;
1206 struct netr_SamInfo3 *my_info3 = NULL;
1210 DEBUG(10,("winbindd_dual_pam_auth_samlogon\n"));
1212 /* Parse domain and username */
1214 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1216 /* do password magic */
1219 generate_random_buffer(chal, 8);
1220 if (lp_client_ntlmv2_auth()) {
1221 DATA_BLOB server_chal;
1222 DATA_BLOB names_blob;
1223 DATA_BLOB nt_response;
1224 DATA_BLOB lm_response;
1225 server_chal = data_blob_talloc(state->mem_ctx, chal, 8);
1227 /* note that the 'workgroup' here is a best guess - we don't know
1228 the server's domain at this point. The 'server name' is also
1231 names_blob = NTLMv2_generate_names_blob(global_myname(), lp_workgroup());
1233 if (!SMBNTLMv2encrypt(name_user, name_domain,
1234 state->request.data.auth.pass,
1237 &lm_response, &nt_response, NULL)) {
1238 data_blob_free(&names_blob);
1239 data_blob_free(&server_chal);
1240 DEBUG(0, ("winbindd_pam_auth: SMBNTLMv2encrypt() failed!\n"));
1241 result = NT_STATUS_NO_MEMORY;
1244 data_blob_free(&names_blob);
1245 data_blob_free(&server_chal);
1246 lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data,
1247 lm_response.length);
1248 nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data,
1249 nt_response.length);
1250 data_blob_free(&lm_response);
1251 data_blob_free(&nt_response);
1254 if (lp_client_lanman_auth()
1255 && SMBencrypt(state->request.data.auth.pass,
1257 local_lm_response)) {
1258 lm_resp = data_blob_talloc(state->mem_ctx,
1260 sizeof(local_lm_response));
1262 lm_resp = data_blob_null;
1264 SMBNTencrypt(state->request.data.auth.pass,
1268 nt_resp = data_blob_talloc(state->mem_ctx,
1270 sizeof(local_nt_response));
1273 /* what domain should we contact? */
1276 if (!(contact_domain = find_domain_from_name(name_domain))) {
1277 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1278 state->request.data.auth.user, name_domain, name_user, name_domain));
1279 result = NT_STATUS_NO_SUCH_USER;
1284 if (is_myname(name_domain)) {
1285 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1286 result = NT_STATUS_NO_SUCH_USER;
1290 contact_domain = find_our_domain();
1293 /* check authentication loop */
1297 ZERO_STRUCTP(my_info3);
1300 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1302 if (!NT_STATUS_IS_OK(result)) {
1303 DEBUG(3, ("could not open handle to NETLOGON pipe\n"));
1307 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1310 contact_domain->dcname, /* server name */
1311 name_user, /* user name */
1312 name_domain, /* target domain */
1313 global_myname(), /* workstation */
1320 /* We have to try a second time as cm_connect_netlogon
1321 might not yet have noticed that the DC has killed
1324 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1329 /* if we get access denied, a possible cause was that we had
1330 and open connection to the DC, but someone changed our
1331 machine account password out from underneath us using 'net
1332 rpc changetrustpw' */
1334 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1335 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1336 "ACCESS_DENIED. Maybe the trust account "
1337 "password was changed and we didn't know it. "
1338 "Killing connections to domain %s\n",
1340 invalidate_cm_connection(&contact_domain->conn);
1344 } while ( (attempts < 2) && retry );
1346 /* handle the case where a NT4 DC does not fill in the acct_flags in
1347 * the samlogon reply info3. When accurate info3 is required by the
1348 * caller, we look up the account flags ourselve - gd */
1350 if ((state->request.flags & WBFLAG_PAM_INFO3_TEXT) &&
1351 (my_info3->base.acct_flags == 0) && NT_STATUS_IS_OK(result)) {
1353 struct rpc_pipe_client *samr_pipe;
1354 POLICY_HND samr_domain_handle, user_pol;
1355 union samr_UserInfo *info = NULL;
1356 NTSTATUS status_tmp;
1359 status_tmp = cm_connect_sam(contact_domain, state->mem_ctx,
1360 &samr_pipe, &samr_domain_handle);
1362 if (!NT_STATUS_IS_OK(status_tmp)) {
1363 DEBUG(3, ("could not open handle to SAMR pipe: %s\n",
1364 nt_errstr(status_tmp)));
1368 status_tmp = rpccli_samr_OpenUser(samr_pipe, state->mem_ctx,
1369 &samr_domain_handle,
1370 MAXIMUM_ALLOWED_ACCESS,
1374 if (!NT_STATUS_IS_OK(status_tmp)) {
1375 DEBUG(3, ("could not open user handle on SAMR pipe: %s\n",
1376 nt_errstr(status_tmp)));
1380 status_tmp = rpccli_samr_QueryUserInfo(samr_pipe, state->mem_ctx,
1385 if (!NT_STATUS_IS_OK(status_tmp)) {
1386 DEBUG(3, ("could not query user info on SAMR pipe: %s\n",
1387 nt_errstr(status_tmp)));
1388 rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1392 acct_flags = info->info16.acct_flags;
1394 if (acct_flags == 0) {
1395 rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1399 my_info3->base.acct_flags = acct_flags;
1401 DEBUG(10,("successfully retrieved acct_flags 0x%x\n", acct_flags));
1403 rpccli_samr_Close(samr_pipe, state->mem_ctx, &user_pol);
1411 enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain,
1412 struct winbindd_cli_state *state)
1414 NTSTATUS result = NT_STATUS_LOGON_FAILURE;
1415 NTSTATUS krb5_result = NT_STATUS_OK;
1416 fstring name_domain, name_user;
1417 struct netr_SamInfo3 *info3 = NULL;
1419 /* Ensure null termination */
1420 state->request.data.auth.user[sizeof(state->request.data.auth.user)-1]='\0';
1422 /* Ensure null termination */
1423 state->request.data.auth.pass[sizeof(state->request.data.auth.pass)-1]='\0';
1425 DEBUG(3, ("[%5lu]: dual pam auth %s\n", (unsigned long)state->pid,
1426 state->request.data.auth.user));
1428 if (!check_request_flags(state->request.flags)) {
1429 result = NT_STATUS_INVALID_PARAMETER_MIX;
1433 /* Parse domain and username */
1435 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1437 parse_domain_user(state->request.data.auth.user, name_domain, name_user);
1439 if (domain->online == False) {
1440 result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
1441 if (domain->startup) {
1442 /* Logons are very important to users. If we're offline and
1443 we get a request within the first 30 seconds of startup,
1444 try very hard to find a DC and go online. */
1446 DEBUG(10,("winbindd_dual_pam_auth: domain: %s offline and auth "
1447 "request in startup mode.\n", domain->name ));
1449 winbindd_flush_negative_conn_cache(domain);
1450 result = init_dc_connection(domain);
1454 DEBUG(10,("winbindd_dual_pam_auth: domain: %s last was %s\n", domain->name, domain->online ? "online":"offline"));
1456 /* Check for Kerberos authentication */
1457 if (domain->online && (state->request.flags & WBFLAG_PAM_KRB5)) {
1459 result = winbindd_dual_pam_auth_kerberos(domain, state, &info3);
1460 /* save for later */
1461 krb5_result = result;
1464 if (NT_STATUS_IS_OK(result)) {
1465 DEBUG(10,("winbindd_dual_pam_auth_kerberos succeeded\n"));
1466 goto process_result;
1468 DEBUG(10,("winbindd_dual_pam_auth_kerberos failed: %s\n", nt_errstr(result)));
1471 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1472 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1473 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
1474 DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
1475 set_domain_offline( domain );
1479 /* there are quite some NT_STATUS errors where there is no
1480 * point in retrying with a samlogon, we explictly have to take
1481 * care not to increase the bad logon counter on the DC */
1483 if (NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_DISABLED) ||
1484 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_EXPIRED) ||
1485 NT_STATUS_EQUAL(result, NT_STATUS_ACCOUNT_LOCKED_OUT) ||
1486 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_LOGON_HOURS) ||
1487 NT_STATUS_EQUAL(result, NT_STATUS_INVALID_WORKSTATION) ||
1488 NT_STATUS_EQUAL(result, NT_STATUS_LOGON_FAILURE) ||
1489 NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) ||
1490 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED) ||
1491 NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) ||
1492 NT_STATUS_EQUAL(result, NT_STATUS_WRONG_PASSWORD)) {
1493 goto process_result;
1496 if (state->request.flags & WBFLAG_PAM_FALLBACK_AFTER_KRB5) {
1497 DEBUG(3,("falling back to samlogon\n"));
1505 /* Check for Samlogon authentication */
1506 if (domain->online) {
1507 result = winbindd_dual_pam_auth_samlogon(domain, state, &info3);
1509 if (NT_STATUS_IS_OK(result)) {
1510 DEBUG(10,("winbindd_dual_pam_auth_samlogon succeeded\n"));
1511 /* add the Krb5 err if we have one */
1512 if ( NT_STATUS_EQUAL(krb5_result, NT_STATUS_TIME_DIFFERENCE_AT_DC ) ) {
1513 info3->base.user_flags |= LOGON_KRB5_FAIL_CLOCK_SKEW;
1515 goto process_result;
1518 DEBUG(10,("winbindd_dual_pam_auth_samlogon failed: %s\n",
1519 nt_errstr(result)));
1521 if (NT_STATUS_EQUAL(result, NT_STATUS_NO_LOGON_SERVERS) ||
1522 NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT) ||
1523 NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND))
1525 DEBUG(10,("winbindd_dual_pam_auth_samlogon setting domain to offline\n"));
1526 set_domain_offline( domain );
1530 if (domain->online) {
1531 /* We're still online - fail. */
1537 /* Check for Cached logons */
1538 if (!domain->online && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN) &&
1539 lp_winbind_offline_logon()) {
1541 result = winbindd_dual_pam_auth_cached(domain, state, &info3);
1543 if (NT_STATUS_IS_OK(result)) {
1544 DEBUG(10,("winbindd_dual_pam_auth_cached succeeded\n"));
1545 goto process_result;
1547 DEBUG(10,("winbindd_dual_pam_auth_cached failed: %s\n", nt_errstr(result)));
1554 if (NT_STATUS_IS_OK(result)) {
1558 /* In all codepaths where result == NT_STATUS_OK info3 must have
1559 been initialized. */
1561 result = NT_STATUS_INTERNAL_ERROR;
1565 netsamlogon_cache_store(name_user, info3);
1566 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1568 /* save name_to_sid info as early as possible (only if
1569 this is our primary domain so we don't invalidate
1570 the cache entry by storing the seq_num for the wrong
1572 if ( domain->primary ) {
1573 sid_compose(&user_sid, info3->base.domain_sid,
1575 cache_name2sid(domain, name_domain, name_user,
1576 SID_NAME_USER, &user_sid);
1579 /* Check if the user is in the right group */
1581 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1582 state->request.data.auth.require_membership_of_sid))) {
1583 DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n",
1584 state->request.data.auth.user,
1585 state->request.data.auth.require_membership_of_sid));
1589 result = append_data(state, info3, name_domain, name_user);
1590 if (!NT_STATUS_IS_OK(result)) {
1594 if ((state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
1596 /* Store in-memory creds for single-signon using ntlm_auth. */
1597 result = winbindd_add_memory_creds(state->request.data.auth.user,
1598 get_uid_from_state(state),
1599 state->request.data.auth.pass);
1601 if (!NT_STATUS_IS_OK(result)) {
1602 DEBUG(10,("Failed to store memory creds: %s\n", nt_errstr(result)));
1606 if (lp_winbind_offline_logon()) {
1607 result = winbindd_store_creds(domain,
1609 state->request.data.auth.user,
1610 state->request.data.auth.pass,
1612 if (!NT_STATUS_IS_OK(result)) {
1614 /* Release refcount. */
1615 winbindd_delete_memory_creds(state->request.data.auth.user);
1617 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
1624 if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
1625 result = fillup_password_policy(domain, state);
1627 if (!NT_STATUS_IS_OK(result)
1628 && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
1630 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
1635 result = NT_STATUS_OK;
1639 /* give us a more useful (more correct?) error code */
1640 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1641 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1642 result = NT_STATUS_NO_LOGON_SERVERS;
1645 state->response.data.auth.nt_status = NT_STATUS_V(result);
1646 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1648 /* we might have given a more useful error above */
1649 if (!*state->response.data.auth.error_string)
1650 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1651 state->response.data.auth.pam_error = nt_status_to_pam(result);
1653 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2, ("Plain-text authentication for user %s returned %s (PAM: %d)\n",
1654 state->request.data.auth.user,
1655 state->response.data.auth.nt_status_string,
1656 state->response.data.auth.pam_error));
1658 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1662 /**********************************************************************
1663 Challenge Response Authentication Protocol
1664 **********************************************************************/
1666 void winbindd_pam_auth_crap(struct winbindd_cli_state *state)
1668 struct winbindd_domain *domain = NULL;
1669 const char *domain_name = NULL;
1672 if (!check_request_flags(state->request.flags)) {
1673 result = NT_STATUS_INVALID_PARAMETER_MIX;
1677 if (!state->privileged) {
1678 char *error_string = NULL;
1679 DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access "
1681 DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions "
1682 "on %s are set correctly.\n",
1683 get_winbind_priv_pipe_dir()));
1684 /* send a better message than ACCESS_DENIED */
1685 error_string = talloc_asprintf(state->mem_ctx,
1686 "winbind client not authorized "
1687 "to use winbindd_pam_auth_crap."
1688 " Ensure permissions on %s "
1689 "are set correctly.",
1690 get_winbind_priv_pipe_dir());
1691 fstrcpy(state->response.data.auth.error_string, error_string);
1692 result = NT_STATUS_ACCESS_DENIED;
1696 /* Ensure null termination */
1697 state->request.data.auth_crap.user
1698 [sizeof(state->request.data.auth_crap.user)-1]=0;
1699 state->request.data.auth_crap.domain
1700 [sizeof(state->request.data.auth_crap.domain)-1]=0;
1702 DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n",
1703 (unsigned long)state->pid,
1704 state->request.data.auth_crap.domain,
1705 state->request.data.auth_crap.user));
1707 if (*state->request.data.auth_crap.domain != '\0') {
1708 domain_name = state->request.data.auth_crap.domain;
1709 } else if (lp_winbind_use_default_domain()) {
1710 domain_name = lp_workgroup();
1713 if (domain_name != NULL)
1714 domain = find_auth_domain(state, domain_name);
1716 if (domain != NULL) {
1717 sendto_domain(state, domain);
1721 result = NT_STATUS_NO_SUCH_USER;
1724 set_auth_errors(&state->response, result);
1725 DEBUG(5, ("CRAP authentication for %s\\%s returned %s (PAM: %d)\n",
1726 state->request.data.auth_crap.domain,
1727 state->request.data.auth_crap.user,
1728 state->response.data.auth.nt_status_string,
1729 state->response.data.auth.pam_error));
1730 request_error(state);
1735 enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
1736 struct winbindd_cli_state *state)
1739 struct netr_SamInfo3 *info3 = NULL;
1740 struct rpc_pipe_client *netlogon_pipe;
1741 const char *name_user = NULL;
1742 const char *name_domain = NULL;
1743 const char *workstation;
1744 struct winbindd_domain *contact_domain;
1748 DATA_BLOB lm_resp, nt_resp;
1750 /* This is child-only, so no check for privileged access is needed
1753 /* Ensure null termination */
1754 state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0;
1755 state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0;
1757 if (!check_request_flags(state->request.flags)) {
1758 result = NT_STATUS_INVALID_PARAMETER_MIX;
1762 name_user = state->request.data.auth_crap.user;
1764 if (*state->request.data.auth_crap.domain) {
1765 name_domain = state->request.data.auth_crap.domain;
1766 } else if (lp_winbind_use_default_domain()) {
1767 name_domain = lp_workgroup();
1769 DEBUG(5,("no domain specified with username (%s) - failing auth\n",
1771 result = NT_STATUS_NO_SUCH_USER;
1775 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n", (unsigned long)state->pid,
1776 name_domain, name_user));
1778 if (*state->request.data.auth_crap.workstation) {
1779 workstation = state->request.data.auth_crap.workstation;
1781 workstation = global_myname();
1784 if (state->request.data.auth_crap.lm_resp_len > sizeof(state->request.data.auth_crap.lm_resp)
1785 || state->request.data.auth_crap.nt_resp_len > sizeof(state->request.data.auth_crap.nt_resp)) {
1786 DEBUG(0, ("winbindd_pam_auth_crap: invalid password length %u/%u\n",
1787 state->request.data.auth_crap.lm_resp_len,
1788 state->request.data.auth_crap.nt_resp_len));
1789 result = NT_STATUS_INVALID_PARAMETER;
1793 lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp,
1794 state->request.data.auth_crap.lm_resp_len);
1795 nt_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.nt_resp,
1796 state->request.data.auth_crap.nt_resp_len);
1798 /* what domain should we contact? */
1801 if (!(contact_domain = find_domain_from_name(name_domain))) {
1802 DEBUG(3, ("Authentication for domain for [%s] -> [%s]\\[%s] failed as %s is not a trusted domain\n",
1803 state->request.data.auth_crap.user, name_domain, name_user, name_domain));
1804 result = NT_STATUS_NO_SUCH_USER;
1808 if (is_myname(name_domain)) {
1809 DEBUG(3, ("Authentication for domain %s (local domain to this server) not supported at this stage\n", name_domain));
1810 result = NT_STATUS_NO_SUCH_USER;
1813 contact_domain = find_our_domain();
1819 netlogon_pipe = NULL;
1820 result = cm_connect_netlogon(contact_domain, &netlogon_pipe);
1822 if (!NT_STATUS_IS_OK(result)) {
1823 DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n",
1824 nt_errstr(result)));
1828 result = rpccli_netlogon_sam_network_logon(netlogon_pipe,
1830 state->request.data.auth_crap.logon_parameters,
1831 contact_domain->dcname,
1834 /* Bug #3248 - found by Stefan Burkei. */
1835 workstation, /* We carefully set this above so use it... */
1836 state->request.data.auth_crap.chal,
1843 /* We have to try a second time as cm_connect_netlogon
1844 might not yet have noticed that the DC has killed
1847 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
1852 /* if we get access denied, a possible cause was that we had and open
1853 connection to the DC, but someone changed our machine account password
1854 out from underneath us using 'net rpc changetrustpw' */
1856 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
1857 DEBUG(3,("winbindd_pam_auth: sam_logon returned "
1858 "ACCESS_DENIED. Maybe the trust account "
1859 "password was changed and we didn't know it. "
1860 "Killing connections to domain %s\n",
1862 invalidate_cm_connection(&contact_domain->conn);
1866 } while ( (attempts < 2) && retry );
1868 if (NT_STATUS_IS_OK(result)) {
1870 netsamlogon_cache_store(name_user, info3);
1871 wcache_invalidate_samlogon(find_domain_from_name(name_domain), info3);
1873 /* Check if the user is in the right group */
1875 if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, info3,
1876 state->request.data.auth_crap.require_membership_of_sid))) {
1877 DEBUG(3, ("User %s is not in the required group (%s), so "
1878 "crap authentication is rejected\n",
1879 state->request.data.auth_crap.user,
1880 state->request.data.auth_crap.require_membership_of_sid));
1884 result = append_data(state, info3, name_domain, name_user);
1885 if (!NT_STATUS_IS_OK(result)) {
1892 /* give us a more useful (more correct?) error code */
1893 if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) ||
1894 (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))) {
1895 result = NT_STATUS_NO_LOGON_SERVERS;
1898 if (state->request.flags & WBFLAG_PAM_NT_STATUS_SQUASH) {
1899 result = nt_status_squash(result);
1902 state->response.data.auth.nt_status = NT_STATUS_V(result);
1903 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
1905 /* we might have given a more useful error above */
1906 if (!*state->response.data.auth.error_string) {
1907 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
1909 state->response.data.auth.pam_error = nt_status_to_pam(result);
1911 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
1912 ("NTLM CRAP authentication for user [%s]\\[%s] returned %s (PAM: %d)\n",
1915 state->response.data.auth.nt_status_string,
1916 state->response.data.auth.pam_error));
1918 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
1921 /* Change a user password */
1923 void winbindd_pam_chauthtok(struct winbindd_cli_state *state)
1925 fstring domain, user;
1926 struct winbindd_domain *contact_domain;
1928 DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid,
1929 state->request.data.chauthtok.user));
1933 ws_name_return( state->request.data.auth.user, WB_REPLACE_CHAR );
1935 if (!canonicalize_username(state->request.data.chauthtok.user, domain, user)) {
1936 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1937 DEBUG(5, ("winbindd_pam_chauthtok: canonicalize_username %s failed with %s"
1939 state->request.data.auth.user,
1940 state->response.data.auth.nt_status_string,
1941 state->response.data.auth.pam_error));
1942 request_error(state);
1946 contact_domain = find_domain_from_name(domain);
1947 if (!contact_domain) {
1948 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
1949 DEBUG(3, ("Cannot change password for [%s] -> [%s]\\[%s] as %s is not a trusted domain\n",
1950 state->request.data.chauthtok.user, domain, user, domain));
1951 request_error(state);
1955 sendto_domain(state, contact_domain);
1958 enum winbindd_result winbindd_dual_pam_chauthtok(struct winbindd_domain *contact_domain,
1959 struct winbindd_cli_state *state)
1962 char *newpass = NULL;
1964 struct rpc_pipe_client *cli;
1965 bool got_info = False;
1966 struct samr_DomInfo1 *info = NULL;
1967 struct samr_ChangeReject *reject = NULL;
1968 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1969 fstring domain, user;
1971 DEBUG(3, ("[%5lu]: dual pam chauthtok %s\n", (unsigned long)state->pid,
1972 state->request.data.auth.user));
1974 if (!parse_domain_user(state->request.data.chauthtok.user, domain, user)) {
1978 /* Change password */
1980 oldpass = state->request.data.chauthtok.oldpass;
1981 newpass = state->request.data.chauthtok.newpass;
1983 /* Initialize reject reason */
1984 state->response.data.auth.reject_reason = Undefined;
1986 /* Get sam handle */
1988 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli,
1990 if (!NT_STATUS_IS_OK(result)) {
1991 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
1995 result = rpccli_samr_chgpasswd3(cli, state->mem_ctx,
2002 /* Windows 2003 returns NT_STATUS_PASSWORD_RESTRICTION */
2004 if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION) ) {
2005 state->response.data.auth.policy.min_length_password =
2006 info->min_password_length;
2007 state->response.data.auth.policy.password_history =
2008 info->password_history_length;
2009 state->response.data.auth.policy.password_properties =
2010 info->password_properties;
2011 state->response.data.auth.policy.expire =
2012 nt_time_to_unix_abs((NTTIME *)&info->max_password_age);
2013 state->response.data.auth.policy.min_passwordage =
2014 nt_time_to_unix_abs((NTTIME *)&info->min_password_age);
2016 state->response.data.auth.reject_reason =
2022 /* only fallback when the chgpasswd3 call is not supported */
2023 if ((NT_STATUS_EQUAL(result, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR))) ||
2024 (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) ||
2025 (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED))) {
2027 DEBUG(10,("Password change with chgpasswd3 failed with: %s, retrying chgpasswd_user\n",
2028 nt_errstr(result)));
2030 result = rpccli_samr_chgpasswd_user(cli, state->mem_ctx, user, newpass, oldpass);
2032 /* Windows 2000 returns NT_STATUS_ACCOUNT_RESTRICTION.
2033 Map to the same status code as Windows 2003. */
2035 if ( NT_STATUS_EQUAL(NT_STATUS_ACCOUNT_RESTRICTION, result ) ) {
2036 result = NT_STATUS_PASSWORD_RESTRICTION;
2042 if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
2044 /* Update the single sign-on memory creds. */
2045 result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
2048 if (!NT_STATUS_IS_OK(result)) {
2049 DEBUG(10,("Failed to replace memory creds: %s\n", nt_errstr(result)));
2050 goto process_result;
2053 if (lp_winbind_offline_logon()) {
2054 result = winbindd_update_creds_by_name(contact_domain,
2055 state->mem_ctx, user,
2057 if (!NT_STATUS_IS_OK(result)) {
2058 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
2059 goto process_result;
2064 if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {
2066 NTSTATUS policy_ret;
2068 policy_ret = fillup_password_policy(contact_domain, state);
2070 /* failure of this is non critical, it will just provide no
2071 * additional information to the client why the change has
2072 * failed - Guenther */
2074 if (!NT_STATUS_IS_OK(policy_ret)) {
2075 DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(policy_ret)));
2076 goto process_result;
2082 state->response.data.auth.nt_status = NT_STATUS_V(result);
2083 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2084 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2085 state->response.data.auth.pam_error = nt_status_to_pam(result);
2087 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2088 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2091 state->response.data.auth.nt_status_string,
2092 state->response.data.auth.pam_error));
2094 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2097 void winbindd_pam_logoff(struct winbindd_cli_state *state)
2099 struct winbindd_domain *domain;
2100 fstring name_domain, user;
2101 uid_t caller_uid = (uid_t)-1;
2102 uid_t request_uid = state->request.data.logoff.uid;
2104 DEBUG(3, ("[%5lu]: pam logoff %s\n", (unsigned long)state->pid,
2105 state->request.data.logoff.user));
2107 /* Ensure null termination */
2108 state->request.data.logoff.user
2109 [sizeof(state->request.data.logoff.user)-1]='\0';
2111 state->request.data.logoff.krb5ccname
2112 [sizeof(state->request.data.logoff.krb5ccname)-1]='\0';
2114 if (request_uid == (gid_t)-1) {
2118 if (!canonicalize_username(state->request.data.logoff.user, name_domain, user)) {
2122 if ((domain = find_auth_domain(state, name_domain)) == NULL) {
2126 if ((sys_getpeereid(state->sock, &caller_uid)) != 0) {
2127 DEBUG(1,("winbindd_pam_logoff: failed to check peerid: %s\n",
2132 switch (caller_uid) {
2136 /* root must be able to logoff any user - gd */
2137 state->request.data.logoff.uid = request_uid;
2140 if (caller_uid != request_uid) {
2141 DEBUG(1,("winbindd_pam_logoff: caller requested invalid uid\n"));
2144 state->request.data.logoff.uid = caller_uid;
2148 sendto_domain(state, domain);
2152 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2153 DEBUG(5, ("Pam Logoff for %s returned %s "
2155 state->request.data.logoff.user,
2156 state->response.data.auth.nt_status_string,
2157 state->response.data.auth.pam_error));
2158 request_error(state);
2162 enum winbindd_result winbindd_dual_pam_logoff(struct winbindd_domain *domain,
2163 struct winbindd_cli_state *state)
2165 NTSTATUS result = NT_STATUS_NOT_SUPPORTED;
2167 DEBUG(3, ("[%5lu]: pam dual logoff %s\n", (unsigned long)state->pid,
2168 state->request.data.logoff.user));
2170 if (!(state->request.flags & WBFLAG_PAM_KRB5)) {
2171 result = NT_STATUS_OK;
2172 goto process_result;
2175 if (state->request.data.logoff.krb5ccname[0] == '\0') {
2176 result = NT_STATUS_OK;
2177 goto process_result;
2182 if (state->request.data.logoff.uid < 0) {
2183 DEBUG(0,("winbindd_pam_logoff: invalid uid\n"));
2184 goto process_result;
2187 /* what we need here is to find the corresponding krb5 ccache name *we*
2188 * created for a given username and destroy it */
2190 if (!ccache_entry_exists(state->request.data.logoff.user)) {
2191 result = NT_STATUS_OK;
2192 DEBUG(10,("winbindd_pam_logoff: no entry found.\n"));
2193 goto process_result;
2196 if (!ccache_entry_identical(state->request.data.logoff.user,
2197 state->request.data.logoff.uid,
2198 state->request.data.logoff.krb5ccname)) {
2199 DEBUG(0,("winbindd_pam_logoff: cached entry differs.\n"));
2200 goto process_result;
2203 result = remove_ccache(state->request.data.logoff.user);
2204 if (!NT_STATUS_IS_OK(result)) {
2205 DEBUG(0,("winbindd_pam_logoff: failed to remove ccache: %s\n",
2206 nt_errstr(result)));
2207 goto process_result;
2211 result = NT_STATUS_NOT_SUPPORTED;
2216 winbindd_delete_memory_creds(state->request.data.logoff.user);
2218 state->response.data.auth.nt_status = NT_STATUS_V(result);
2219 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2220 fstrcpy(state->response.data.auth.error_string, get_friendly_nt_error_msg(result));
2221 state->response.data.auth.pam_error = nt_status_to_pam(result);
2223 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
2226 /* Change user password with auth crap*/
2228 void winbindd_pam_chng_pswd_auth_crap(struct winbindd_cli_state *state)
2230 struct winbindd_domain *domain = NULL;
2231 const char *domain_name = NULL;
2233 /* Ensure null termination */
2234 state->request.data.chng_pswd_auth_crap.user[
2235 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2236 state->request.data.chng_pswd_auth_crap.domain[
2237 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2239 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2240 (unsigned long)state->pid,
2241 state->request.data.chng_pswd_auth_crap.domain,
2242 state->request.data.chng_pswd_auth_crap.user));
2244 if (*state->request.data.chng_pswd_auth_crap.domain != '\0') {
2245 domain_name = state->request.data.chng_pswd_auth_crap.domain;
2246 } else if (lp_winbind_use_default_domain()) {
2247 domain_name = lp_workgroup();
2250 if (domain_name != NULL)
2251 domain = find_domain_from_name(domain_name);
2253 if (domain != NULL) {
2254 DEBUG(7, ("[%5lu]: pam auth crap changing pswd in domain: "
2255 "%s\n", (unsigned long)state->pid,domain->name));
2256 sendto_domain(state, domain);
2260 set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER);
2261 DEBUG(5, ("CRAP change password for %s\\%s returned %s (PAM: %d)\n",
2262 state->request.data.chng_pswd_auth_crap.domain,
2263 state->request.data.chng_pswd_auth_crap.user,
2264 state->response.data.auth.nt_status_string,
2265 state->response.data.auth.pam_error));
2266 request_error(state);
2270 enum winbindd_result winbindd_dual_pam_chng_pswd_auth_crap(struct winbindd_domain *domainSt, struct winbindd_cli_state *state)
2273 DATA_BLOB new_nt_password;
2274 DATA_BLOB old_nt_hash_enc;
2275 DATA_BLOB new_lm_password;
2276 DATA_BLOB old_lm_hash_enc;
2277 fstring domain,user;
2279 struct winbindd_domain *contact_domain = domainSt;
2280 struct rpc_pipe_client *cli;
2282 /* Ensure null termination */
2283 state->request.data.chng_pswd_auth_crap.user[
2284 sizeof(state->request.data.chng_pswd_auth_crap.user)-1]=0;
2285 state->request.data.chng_pswd_auth_crap.domain[
2286 sizeof(state->request.data.chng_pswd_auth_crap.domain)-1]=0;
2290 DEBUG(3, ("[%5lu]: pam change pswd auth crap domain: %s user: %s\n",
2291 (unsigned long)state->pid,
2292 state->request.data.chng_pswd_auth_crap.domain,
2293 state->request.data.chng_pswd_auth_crap.user));
2295 if (lp_winbind_offline_logon()) {
2296 DEBUG(0,("Refusing password change as winbind offline logons are enabled. "));
2297 DEBUGADD(0,("Changing passwords here would risk inconsistent logons\n"));
2298 result = NT_STATUS_ACCESS_DENIED;
2302 if (*state->request.data.chng_pswd_auth_crap.domain) {
2303 fstrcpy(domain,state->request.data.chng_pswd_auth_crap.domain);
2305 parse_domain_user(state->request.data.chng_pswd_auth_crap.user,
2309 DEBUG(3,("no domain specified with username (%s) - "
2311 state->request.data.chng_pswd_auth_crap.user));
2312 result = NT_STATUS_NO_SUCH_USER;
2317 if (!*domain && lp_winbind_use_default_domain()) {
2318 fstrcpy(domain,(char *)lp_workgroup());
2322 fstrcpy(user, state->request.data.chng_pswd_auth_crap.user);
2325 DEBUG(3, ("[%5lu]: pam auth crap domain: %s user: %s\n",
2326 (unsigned long)state->pid, domain, user));
2328 /* Change password */
2329 new_nt_password = data_blob_talloc(
2331 state->request.data.chng_pswd_auth_crap.new_nt_pswd,
2332 state->request.data.chng_pswd_auth_crap.new_nt_pswd_len);
2334 old_nt_hash_enc = data_blob_talloc(
2336 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc,
2337 state->request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
2339 if(state->request.data.chng_pswd_auth_crap.new_lm_pswd_len > 0) {
2340 new_lm_password = data_blob_talloc(
2342 state->request.data.chng_pswd_auth_crap.new_lm_pswd,
2343 state->request.data.chng_pswd_auth_crap.new_lm_pswd_len);
2345 old_lm_hash_enc = data_blob_talloc(
2347 state->request.data.chng_pswd_auth_crap.old_lm_hash_enc,
2348 state->request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
2350 new_lm_password.length = 0;
2351 old_lm_hash_enc.length = 0;
2354 /* Get sam handle */
2356 result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, &dom_pol);
2357 if (!NT_STATUS_IS_OK(result)) {
2358 DEBUG(1, ("could not get SAM handle on DC for %s\n", domain));
2362 result = rpccli_samr_chng_pswd_auth_crap(
2363 cli, state->mem_ctx, user, new_nt_password, old_nt_hash_enc,
2364 new_lm_password, old_lm_hash_enc);
2367 state->response.data.auth.nt_status = NT_STATUS_V(result);
2368 fstrcpy(state->response.data.auth.nt_status_string, nt_errstr(result));
2369 fstrcpy(state->response.data.auth.error_string,
2370 get_friendly_nt_error_msg(result));
2371 state->response.data.auth.pam_error = nt_status_to_pam(result);
2373 DEBUG(NT_STATUS_IS_OK(result) ? 5 : 2,
2374 ("Password change for user [%s]\\[%s] returned %s (PAM: %d)\n",
2376 state->response.data.auth.nt_status_string,
2377 state->response.data.auth.pam_error));
2379 return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;