source4/auth/sam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Password and authentication handling
   4    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2010
   5    Copyright (C) Gerald Carter                             2003
   6    Copyright (C) Stefan Metzmacher                         2005
   7    Copyright (C) Matthias Dieter Wallnöfer                 2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/time.h"
  25 #include "auth/auth.h"
  26 #include <ldb.h>
  27 #include "dsdb/samdb/samdb.h"
  28 #include "libcli/security/security.h"
  29 #include "auth/auth_sam.h"
  30 #include "dsdb/common/util.h"
  31 #include "libcli/ldap/ldap_ndr.h"
  32 #include "param/param.h"
  33
  34 #define KRBTGT_ATTRS \
  35         /* required for the krb5 kdc */         \
  36         "objectClass",                          \
  37         "sAMAccountName",                       \
  38         "userPrincipalName",                    \
  39         "servicePrincipalName",                 \
  40         "msDS-KeyVersionNumber",                \
  41         "msDS-SecondaryKrbTgtNumber",           \
  42         "msDS-SupportedEncryptionTypes",        \
  43         "supplementalCredentials",              \
  44         "msDS-AllowedToDelegateTo",             \
  45                                                 \
  46         /* passwords */                         \
  47         "dBCSPwd",                              \
  48         "unicodePwd",                           \
  49                                                 \
  50         "userAccountControl",                   \
  51         "msDS-User-Account-Control-Computed",   \
  52         "objectSid",                            \
  53                                                 \
  54         "pwdLastSet",                           \
  55         "msDS-UserPasswordExpiryTimeComputed",  \
  56         "accountExpires"
  57
  58 const char *krbtgt_attrs[] = {
  59         KRBTGT_ATTRS, NULL
  60 };
  61
  62 const char *server_attrs[] = {
  63         KRBTGT_ATTRS, NULL
  64 };
  65
  66 const char *user_attrs[] = {
  67         KRBTGT_ATTRS,
  68
  69         "logonHours",
  70
  71         /*
  72          * To allow us to zero the badPwdCount and lockoutTime on
  73          * successful logon, without database churn
  74          */
  75         "lockoutTime",
  76
  77         /* check 'allowed workstations' */
  78         "userWorkstations",
  79
  80         /* required for user_info_dc, not access control: */
  81         "displayName",
  82         "scriptPath",
  83         "profilePath",
  84         "homeDirectory",
  85         "homeDrive",
  86         "lastLogon",
  87         "lastLogonTimestamp",
  88         "lastLogoff",
  89         "accountExpires",
  90         "badPwdCount",
  91         "logonCount",
  92         "primaryGroupID",
  93         "memberOf",
  94         "badPasswordTime",
  95         "lmPwdHistory",
  96         "ntPwdHistory",
  97         NULL,
  98 };
  99
 100 /****************************************************************************
 101  Check if a user is allowed to logon at this time. Note this is the
 102  servers local time, as logon hours are just specified as a weekly
 103  bitmask.
 104 ****************************************************************************/
 105
 106 static bool logon_hours_ok(struct ldb_message *msg, const char *name_for_logs)
 107 {
 108         /* In logon hours first bit is Sunday from 12AM to 1AM */
 109         const struct ldb_val *hours;
 110         struct tm *utctime;
 111         time_t lasttime;
 112         const char *asct;
 113         uint8_t bitmask, bitpos;
 114
 115         hours = ldb_msg_find_ldb_val(msg, "logonHours");
 116         if (!hours) {
 117                 DEBUG(5,("logon_hours_ok: No hours restrictions for user %s\n", name_for_logs));
 118                 return true;
 119         }
 120
 121         if (hours->length != 168/8) {
 122                 DEBUG(5,("logon_hours_ok: malformed logon hours restrictions for user %s\n", name_for_logs));
 123                 return true;
 124         }
 125
 126         lasttime = time(NULL);
 127         utctime = gmtime(&lasttime);
 128         if (!utctime) {
 129                 DEBUG(1, ("logon_hours_ok: failed to get gmtime. Failing logon for user %s\n",
 130                         name_for_logs));
 131                 return false;
 132         }
 133
 134         /* find the corresponding byte and bit */
 135         bitpos = (utctime->tm_wday * 24 + utctime->tm_hour) % 168;
 136         bitmask = 1 << (bitpos % 8);
 137
 138         if (! (hours->data[bitpos/8] & bitmask)) {
 139                 struct tm *t = localtime(&lasttime);
 140                 if (!t) {
 141                         asct = "INVALID TIME";
 142                 } else {
 143                         asct = asctime(t);
 144                         if (!asct) {
 145                                 asct = "INVALID TIME";
 146                         }
 147                 }
 148
 149                 DEBUG(1, ("logon_hours_ok: Account for user %s not allowed to "
 150                           "logon at this time (%s).\n",
 151                           name_for_logs, asct ));
 152                 return false;
 153         }
 154
 155         asct = asctime(utctime);
 156         DEBUG(5,("logon_hours_ok: user %s allowed to logon at this time (%s)\n",
 157                 name_for_logs, asct ? asct : "UNKNOWN TIME" ));
 158
 159         return true;
 160 }
 161
 162 /****************************************************************************
 163  Do a specific test for a SAM_ACCOUNT being valid for this connection
 164  (ie not disabled, expired and the like).
 165 ****************************************************************************/
 166 _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
 167                                      struct ldb_context *sam_ctx,
 168                                      uint32_t logon_parameters,
 169                                      struct ldb_dn *domain_dn,
 170                                      struct ldb_message *msg,
 171                                      const char *logon_workstation,
 172                                      const char *name_for_logs,
 173                                      bool allow_domain_trust,
 174                                      bool password_change)
 175 {
 176         uint16_t acct_flags;
 177         const char *workstation_list;
 178         NTTIME acct_expiry;
 179         NTTIME must_change_time;
 180         struct timeval tv_now = timeval_current();
 181         NTTIME now = timeval_to_nttime(&tv_now);
 182
 183         DEBUG(4,("authsam_account_ok: Checking SMB password for user %s\n", name_for_logs));
 184
 185         acct_flags = samdb_result_acct_flags(msg, "msDS-User-Account-Control-Computed");
 186
 187         acct_expiry = samdb_result_account_expires(msg);
 188
 189         /* Check for when we must change this password, taking the
 190          * userAccountControl flags into account */
 191         must_change_time = samdb_result_nttime(msg,
 192                         "msDS-UserPasswordExpiryTimeComputed", 0);
 193
 194         workstation_list = ldb_msg_find_attr_as_string(msg, "userWorkstations", NULL);
 195
 196         /* Quit if the account was disabled. */
 197         if (acct_flags & ACB_DISABLED) {
 198                 DEBUG(2,("authsam_account_ok: Account for user '%s' was disabled.\n", name_for_logs));
 199                 return NT_STATUS_ACCOUNT_DISABLED;
 200         }
 201
 202         /* Quit if the account was locked out. */
 203         if (acct_flags & ACB_AUTOLOCK) {
 204                 DEBUG(2,("authsam_account_ok: Account for user %s was locked out.\n", name_for_logs));
 205                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
 206         }
 207
 208         /* Test account expire time */
 209         if (now > acct_expiry) {
 210                 DEBUG(2,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
 211                 DEBUG(3,("authsam_account_ok: Account expired at '%s'.\n",
 212                          nt_time_string(mem_ctx, acct_expiry)));
 213                 return NT_STATUS_ACCOUNT_EXPIRED;
 214         }
 215
 216         /* check for immediate expiry "must change at next logon" (but not if this is a password change request) */
 217         if ((must_change_time == 0) && !password_change) {
 218                 DEBUG(2,("sam_account_ok: Account for user '%s' password must change!.\n",
 219                          name_for_logs));
 220                 return NT_STATUS_PASSWORD_MUST_CHANGE;
 221         }
 222
 223         /* check for expired password (but not if this is a password change request) */
 224         if ((must_change_time < now) && !password_change) {
 225                 DEBUG(2,("sam_account_ok: Account for user '%s' password expired!.\n",
 226                          name_for_logs));
 227                 DEBUG(2,("sam_account_ok: Password expired at '%s' unix time.\n",
 228                          nt_time_string(mem_ctx, must_change_time)));
 229                 return NT_STATUS_PASSWORD_EXPIRED;
 230         }
 231
 232         /* Test workstation. Workstation list is comma separated. */
 233         if (logon_workstation && workstation_list && *workstation_list) {
 234                 bool invalid_ws = true;
 235                 int i;
 236                 char **workstations = str_list_make(mem_ctx, workstation_list, ",");
 237
 238                 for (i = 0; workstations && workstations[i]; i++) {
 239                         DEBUG(10,("sam_account_ok: checking for workstation match '%s' and '%s'\n",
 240                                   workstations[i], logon_workstation));
 241
 242                         if (strequal(workstations[i], logon_workstation)) {
 243                                 invalid_ws = false;
 244                                 break;
 245                         }
 246                 }
 247
 248                 talloc_free(workstations);
 249
 250                 if (invalid_ws) {
 251                         return NT_STATUS_INVALID_WORKSTATION;
 252                 }
 253         }
 254
 255         if (!logon_hours_ok(msg, name_for_logs)) {
 256                 return NT_STATUS_INVALID_LOGON_HOURS;
 257         }
 258
 259         if (!allow_domain_trust) {
 260                 if (acct_flags & ACB_DOMTRUST) {
 261                         DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", name_for_logs));
 262                         return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 263                 }
 264         }
 265         if (!(logon_parameters & MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT)) {
 266                 if (acct_flags & ACB_SVRTRUST) {
 267                         DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", name_for_logs));
 268                         return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 269                 }
 270         }
 271         if (!(logon_parameters & MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT)) {
 272                 /* TODO: this fails with current solaris client. We
 273                    need to work with Gordon to work out why */
 274                 if (acct_flags & ACB_WSTRUST) {
 275                         DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", name_for_logs));
 276                         return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 277                 }
 278         }
 279
 280         return NT_STATUS_OK;
 281 }
 282
 283 _PUBLIC_ NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx,
 284                                            struct ldb_context *sam_ctx,
 285                                            const char *netbios_name,
 286                                            const char *domain_name,
 287                                            const char *dns_domain_name,
 288                                            struct ldb_dn *domain_dn,
 289                                            struct ldb_message *msg,
 290                                            DATA_BLOB user_sess_key,
 291                                            DATA_BLOB lm_sess_key,
 292                                            struct auth_user_info_dc **_user_info_dc)
 293 {
 294         NTSTATUS status;
 295         struct auth_user_info_dc *user_info_dc;
 296         struct auth_user_info *info;
 297         const char *str, *filter;
 298         /* SIDs for the account and his primary group */
 299         struct dom_sid *account_sid;
 300         const char *primary_group_string;
 301         const char *primary_group_dn;
 302         DATA_BLOB primary_group_blob;
 303         /* SID structures for the expanded group memberships */
 304         struct dom_sid *sids = NULL;
 305         unsigned int num_sids = 0, i;
 306         struct dom_sid *domain_sid;
 307         TALLOC_CTX *tmp_ctx;
 308         struct ldb_message_element *el;
 309
 310         user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
 311         NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
 312
 313         tmp_ctx = talloc_new(user_info_dc);
 314         if (user_info_dc == NULL) {
 315                 TALLOC_FREE(user_info_dc);
 316                 return NT_STATUS_NO_MEMORY;
 317         }
 318
 319         sids = talloc_array(user_info_dc, struct dom_sid, 2);
 320         if (sids == NULL) {
 321                 TALLOC_FREE(user_info_dc);
 322                 return NT_STATUS_NO_MEMORY;
 323         }
 324
 325         num_sids = 2;
 326
 327         account_sid = samdb_result_dom_sid(user_info_dc, msg, "objectSid");
 328         if (account_sid == NULL) {
 329                 TALLOC_FREE(user_info_dc);
 330                 return NT_STATUS_NO_MEMORY;
 331         }
 332
 333         status = dom_sid_split_rid(tmp_ctx, account_sid, &domain_sid, NULL);
 334         if (!NT_STATUS_IS_OK(status)) {
 335                 talloc_free(user_info_dc);
 336                 return status;
 337         }
 338
 339         sids[PRIMARY_USER_SID_INDEX] = *account_sid;
 340         sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
 341         sid_append_rid(&sids[PRIMARY_GROUP_SID_INDEX], ldb_msg_find_attr_as_uint(msg, "primaryGroupID", ~0));
 342
 343         /* Filter out builtin groups from this token.  We will search
 344          * for builtin groups later, and not include them in the PAC
 345          * on SamLogon validation info */
 346         filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(!(groupType:1.2.840.113556.1.4.803:=%u))(groupType:1.2.840.113556.1.4.803:=%u))", GROUP_TYPE_BUILTIN_LOCAL_GROUP, GROUP_TYPE_SECURITY_ENABLED);
 347         if (filter == NULL) {
 348                 TALLOC_FREE(user_info_dc);
 349                 return NT_STATUS_NO_MEMORY;
 350         }
 351
 352         primary_group_string = dom_sid_string(tmp_ctx, &sids[PRIMARY_GROUP_SID_INDEX]);
 353         if (primary_group_string == NULL) {
 354                 TALLOC_FREE(user_info_dc);
 355                 return NT_STATUS_NO_MEMORY;
 356         }
 357
 358         primary_group_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", primary_group_string);
 359         if (primary_group_dn == NULL) {
 360                 TALLOC_FREE(user_info_dc);
 361                 return NT_STATUS_NO_MEMORY;
 362         }
 363
 364         primary_group_blob = data_blob_string_const(primary_group_dn);
 365
 366         /* Expands the primary group - this function takes in
 367          * memberOf-like values, so we fake one up with the
 368          * <SID=S-...> format of DN and then let it expand
 369          * them, as long as they meet the filter - so only
 370          * domain groups, not builtin groups
 371          *
 372          * The primary group is still treated specially, so we set the
 373          * 'only childs' flag to true
 374          */
 375         status = dsdb_expand_nested_groups(sam_ctx, &primary_group_blob, true, filter,
 376                                            user_info_dc, &sids, &num_sids);
 377         if (!NT_STATUS_IS_OK(status)) {
 378                 talloc_free(user_info_dc);
 379                 return status;
 380         }
 381
 382         /* Expands the additional groups */
 383         el = ldb_msg_find_element(msg, "memberOf");
 384         for (i = 0; el && i < el->num_values; i++) {
 385                 /* This function takes in memberOf values and expands
 386                  * them, as long as they meet the filter - so only
 387                  * domain groups, not builtin groups */
 388                 status = dsdb_expand_nested_groups(sam_ctx, &el->values[i], false, filter,
 389                                                    user_info_dc, &sids, &num_sids);
 390                 if (!NT_STATUS_IS_OK(status)) {
 391                         talloc_free(user_info_dc);
 392                         return status;
 393                 }
 394         }
 395
 396         user_info_dc->sids = sids;
 397         user_info_dc->num_sids = num_sids;
 398
 399         user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
 400         NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
 401
 402         info->account_name = talloc_steal(info,
 403                 ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL));
 404
 405         info->user_principal_name = talloc_steal(info,
 406                 ldb_msg_find_attr_as_string(msg, "userPrincipalName", NULL));
 407         if (info->user_principal_name == NULL && dns_domain_name != NULL) {
 408                 info->user_principal_name = talloc_asprintf(info, "%s@%s",
 409                                         info->account_name,
 410                                         dns_domain_name);
 411                 if (info->user_principal_name == NULL) {
 412                         TALLOC_FREE(user_info_dc);
 413                         return NT_STATUS_NO_MEMORY;
 414                 }
 415                 info->user_principal_constructed = true;
 416         }
 417
 418         info->domain_name = talloc_strdup(info, domain_name);
 419         if (info->domain_name == NULL) {
 420                 TALLOC_FREE(user_info_dc);
 421                 return NT_STATUS_NO_MEMORY;
 422         }
 423
 424         if (dns_domain_name != NULL) {
 425                 info->dns_domain_name = talloc_strdup(info, dns_domain_name);
 426                 if (info->dns_domain_name == NULL) {
 427                         TALLOC_FREE(user_info_dc);
 428                         return NT_STATUS_NO_MEMORY;
 429                 }
 430         }
 431
 432         str = ldb_msg_find_attr_as_string(msg, "displayName", "");
 433         info->full_name = talloc_strdup(info, str);
 434         if (info->full_name == NULL) {
 435                 TALLOC_FREE(user_info_dc);
 436                 return NT_STATUS_NO_MEMORY;
 437         }
 438
 439         str = ldb_msg_find_attr_as_string(msg, "scriptPath", "");
 440         info->logon_script = talloc_strdup(info, str);
 441         if (info->logon_script == NULL) {
 442                 TALLOC_FREE(user_info_dc);
 443                 return NT_STATUS_NO_MEMORY;
 444         }
 445
 446         str = ldb_msg_find_attr_as_string(msg, "profilePath", "");
 447         info->profile_path = talloc_strdup(info, str);
 448         if (info->profile_path == NULL) {
 449                 TALLOC_FREE(user_info_dc);
 450                 return NT_STATUS_NO_MEMORY;
 451         }
 452
 453         str = ldb_msg_find_attr_as_string(msg, "homeDirectory", "");
 454         info->home_directory = talloc_strdup(info, str);
 455         if (info->home_directory == NULL) {
 456                 TALLOC_FREE(user_info_dc);
 457                 return NT_STATUS_NO_MEMORY;
 458         }
 459
 460         str = ldb_msg_find_attr_as_string(msg, "homeDrive", "");
 461         info->home_drive = talloc_strdup(info, str);
 462         if (info->home_drive == NULL) {
 463                 TALLOC_FREE(user_info_dc);
 464                 return NT_STATUS_NO_MEMORY;
 465         }
 466
 467         info->logon_server = talloc_strdup(info, netbios_name);
 468         if (info->logon_server == NULL) {
 469                 TALLOC_FREE(user_info_dc);
 470                 return NT_STATUS_NO_MEMORY;
 471         }
 472
 473         info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
 474         info->last_logoff = samdb_result_last_logoff(msg);
 475         info->acct_expiry = samdb_result_account_expires(msg);
 476         info->last_password_change = samdb_result_nttime(msg,
 477                 "pwdLastSet", 0);
 478         info->allow_password_change
 479                 = samdb_result_allow_password_change(sam_ctx, mem_ctx,
 480                         domain_dn, msg, "pwdLastSet");
 481         info->force_password_change = samdb_result_nttime(msg,
 482                 "msDS-UserPasswordExpiryTimeComputed", 0);
 483         info->logon_count = ldb_msg_find_attr_as_uint(msg, "logonCount", 0);
 484         info->bad_password_count = ldb_msg_find_attr_as_uint(msg, "badPwdCount",
 485                 0);
 486
 487         info->acct_flags = samdb_result_acct_flags(msg, "msDS-User-Account-Control-Computed");
 488
 489         user_info_dc->user_session_key = data_blob_talloc(user_info_dc,
 490                                                          user_sess_key.data,
 491                                                          user_sess_key.length);
 492         if (user_sess_key.data) {
 493                 if (user_info_dc->user_session_key.data == NULL) {
 494                         TALLOC_FREE(user_info_dc);
 495                         return NT_STATUS_NO_MEMORY;
 496                 }
 497         }
 498         user_info_dc->lm_session_key = data_blob_talloc(user_info_dc,
 499                                                        lm_sess_key.data,
 500                                                        lm_sess_key.length);
 501         if (lm_sess_key.data) {
 502                 if (user_info_dc->lm_session_key.data == NULL) {
 503                         TALLOC_FREE(user_info_dc);
 504                         return NT_STATUS_NO_MEMORY;
 505                 }
 506         }
 507
 508         if (info->acct_flags & ACB_SVRTRUST) {
 509                 /* the SID_NT_ENTERPRISE_DCS SID gets added into the
 510                    PAC */
 511                 user_info_dc->sids = talloc_realloc(user_info_dc,
 512                                                    user_info_dc->sids,
 513                                                    struct dom_sid,
 514                                                    user_info_dc->num_sids+1);
 515                 if (user_info_dc->sids == NULL) {
 516                         TALLOC_FREE(user_info_dc);
 517                         return NT_STATUS_NO_MEMORY;
 518                 }
 519                 user_info_dc->sids[user_info_dc->num_sids] = global_sid_Enterprise_DCs;
 520                 user_info_dc->num_sids++;
 521         }
 522
 523         if ((info->acct_flags & (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) ==
 524             (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) {
 525                 /* the DOMAIN_RID_ENTERPRISE_READONLY_DCS PAC */
 526                 user_info_dc->sids = talloc_realloc(user_info_dc,
 527                                                    user_info_dc->sids,
 528                                                    struct dom_sid,
 529                                                    user_info_dc->num_sids+1);
 530                 if (user_info_dc->sids == NULL) {
 531                         TALLOC_FREE(user_info_dc);
 532                         return NT_STATUS_NO_MEMORY;
 533                 }
 534                 user_info_dc->sids[user_info_dc->num_sids] = *domain_sid;
 535                 sid_append_rid(&user_info_dc->sids[user_info_dc->num_sids],
 536                             DOMAIN_RID_ENTERPRISE_READONLY_DCS);
 537                 user_info_dc->num_sids++;
 538         }
 539
 540         info->authenticated = true;
 541
 542         talloc_free(tmp_ctx);
 543         *_user_info_dc = user_info_dc;
 544
 545         return NT_STATUS_OK;
 546 }
 547
 548 NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
 549                                    TALLOC_CTX *mem_ctx, const char *principal,
 550                                    const char **attrs,
 551                                    struct ldb_dn **domain_dn,
 552                                    struct ldb_message **msg)
 553 {
 554         struct ldb_dn *user_dn;
 555         NTSTATUS nt_status;
 556         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 557         int ret;
 558
 559         if (!tmp_ctx) {
 560                 return NT_STATUS_NO_MEMORY;
 561         }
 562
 563         nt_status = crack_user_principal_name(sam_ctx, tmp_ctx, principal,
 564                                               &user_dn, domain_dn);
 565         if (!NT_STATUS_IS_OK(nt_status)) {
 566                 talloc_free(tmp_ctx);
 567                 return nt_status;
 568         }
 569
 570         /* pull the user attributes */
 571         ret = dsdb_search_one(sam_ctx, tmp_ctx, msg, user_dn,
 572                               LDB_SCOPE_BASE, attrs,
 573                               DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
 574                               "(objectClass=*)");
 575         if (ret != LDB_SUCCESS) {
 576                 talloc_free(tmp_ctx);
 577                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 578         }
 579         talloc_steal(mem_ctx, *msg);
 580         talloc_steal(mem_ctx, *domain_dn);
 581         talloc_free(tmp_ctx);
 582
 583         return NT_STATUS_OK;
 584 }
 585
 586 /* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available, and for tokenGroups in the DSDB stack.
 587
 588  Supply either a principal or a DN
 589 */
 590 NTSTATUS authsam_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
 591                                            struct loadparm_context *lp_ctx,
 592                                            struct ldb_context *sam_ctx,
 593                                            const char *principal,
 594                                            struct ldb_dn *user_dn,
 595                                            struct auth_user_info_dc **user_info_dc)
 596 {
 597         NTSTATUS nt_status;
 598         DATA_BLOB user_sess_key = data_blob(NULL, 0);
 599         DATA_BLOB lm_sess_key = data_blob(NULL, 0);
 600
 601         struct ldb_message *msg;
 602         struct ldb_dn *domain_dn;
 603
 604         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 605         if (!tmp_ctx) {
 606                 return NT_STATUS_NO_MEMORY;
 607         }
 608
 609         if (principal) {
 610                 nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal,
 611                                                       user_attrs, &domain_dn, &msg);
 612                 if (!NT_STATUS_IS_OK(nt_status)) {
 613                         talloc_free(tmp_ctx);
 614                         return nt_status;
 615                 }
 616         } else if (user_dn) {
 617                 struct dom_sid *user_sid, *domain_sid;
 618                 int ret;
 619                 /* pull the user attributes */
 620                 ret = dsdb_search_one(sam_ctx, tmp_ctx, &msg, user_dn,
 621                                       LDB_SCOPE_BASE, user_attrs,
 622                                       DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
 623                                       "(objectClass=*)");
 624                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 625                         talloc_free(tmp_ctx);
 626                         return NT_STATUS_NO_SUCH_USER;
 627                 } else if (ret != LDB_SUCCESS) {
 628                         talloc_free(tmp_ctx);
 629                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 630                 }
 631
 632                 user_sid = samdb_result_dom_sid(msg, msg, "objectSid");
 633
 634                 nt_status = dom_sid_split_rid(tmp_ctx, user_sid, &domain_sid, NULL);
 635                 if (!NT_STATUS_IS_OK(nt_status)) {
 636                         return nt_status;
 637                 }
 638
 639                 domain_dn = samdb_search_dn(sam_ctx, mem_ctx, NULL,
 640                                           "(&(objectSid=%s)(objectClass=domain))",
 641                                             ldap_encode_ndr_dom_sid(tmp_ctx, domain_sid));
 642                 if (!domain_dn) {
 643                         DEBUG(3, ("authsam_get_user_info_dc_principal: Failed to find domain with: SID %s\n",
 644                                   dom_sid_string(tmp_ctx, domain_sid)));
 645                         return NT_STATUS_NO_SUCH_USER;
 646                 }
 647
 648         } else {
 649                 return NT_STATUS_INVALID_PARAMETER;
 650         }
 651
 652         nt_status = authsam_make_user_info_dc(tmp_ctx, sam_ctx,
 653                                              lpcfg_netbios_name(lp_ctx),
 654                                              lpcfg_sam_name(lp_ctx),
 655                                              lpcfg_sam_dnsname(lp_ctx),
 656                                              domain_dn,
 657                                              msg,
 658                                              user_sess_key, lm_sess_key,
 659                                              user_info_dc);
 660         if (!NT_STATUS_IS_OK(nt_status)) {
 661                 talloc_free(tmp_ctx);
 662                 return nt_status;
 663         }
 664
 665         talloc_steal(mem_ctx, *user_info_dc);
 666         talloc_free(tmp_ctx);
 667
 668         return NT_STATUS_OK;
 669 }
 670
 671 NTSTATUS authsam_update_bad_pwd_count(struct ldb_context *sam_ctx,
 672                                       struct ldb_message *msg,
 673                                       struct ldb_dn *domain_dn)
 674 {
 675         const char *attrs[] = { "lockoutThreshold",
 676                                 "lockOutObservationWindow",
 677                                 "lockoutDuration",
 678                                 "pwdProperties",
 679                                 NULL };
 680         int ret;
 681         NTSTATUS status;
 682         struct ldb_result *domain_res;
 683         struct ldb_message *msg_mod = NULL;
 684         TALLOC_CTX *mem_ctx;
 685
 686         mem_ctx = talloc_new(msg);
 687         if (mem_ctx == NULL) {
 688                 return NT_STATUS_NO_MEMORY;
 689         }
 690
 691         ret = dsdb_search_dn(sam_ctx, mem_ctx, &domain_res, domain_dn, attrs, 0);
 692         if (ret != LDB_SUCCESS) {
 693                 TALLOC_FREE(mem_ctx);
 694                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 695         }
 696
 697         status = dsdb_update_bad_pwd_count(mem_ctx, sam_ctx,
 698                                            msg, domain_res->msgs[0], &msg_mod);
 699         if (!NT_STATUS_IS_OK(status)) {
 700                 TALLOC_FREE(mem_ctx);
 701                 return status;
 702         }
 703
 704         if (msg_mod != NULL) {
 705                 struct ldb_request *req;
 706
 707                 ret = ldb_build_mod_req(&req, sam_ctx, sam_ctx,
 708                                         msg_mod,
 709                                         NULL,
 710                                         NULL,
 711                                         ldb_op_default_callback,
 712                                         NULL);
 713                 if (ret != LDB_SUCCESS) {
 714                         goto done;
 715                 }
 716
 717                 ret = ldb_request_add_control(req,
 718                                               DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE,
 719                                               false, NULL);
 720                 if (ret != LDB_SUCCESS) {
 721                         talloc_free(req);
 722                         goto done;
 723                 }
 724
 725                 ret = dsdb_autotransaction_request(sam_ctx, req);
 726                 talloc_free(req);
 727         }
 728
 729 done:
 730         if (ret != LDB_SUCCESS) {
 731                 DEBUG(0, ("Failed to update badPwdCount, badPasswordTime or set lockoutTime on %s: %s\n",
 732                           ldb_dn_get_linearized(msg_mod->dn), ldb_errstring(sam_ctx)));
 733                 TALLOC_FREE(mem_ctx);
 734                 return NT_STATUS_INTERNAL_ERROR;
 735         }
 736
 737         TALLOC_FREE(mem_ctx);
 738         return NT_STATUS_OK;
 739 }
 740
 741
 742 static NTSTATUS authsam_update_lastlogon_timestamp(struct ldb_context *sam_ctx,
 743                                             struct ldb_message *msg_mod,
 744                                             struct ldb_dn *domain_dn,
 745                                             NTTIME old_timestamp,
 746                                             NTTIME now)
 747 {
 748         /*
 749          * We only set lastLogonTimestamp if the current value is older than
 750          * now - msDS-LogonTimeSyncInterval days.
 751          *
 752          * msDS-LogonTimeSyncInterval is an int32_t number of days, while
 753          * lastLogonTimestamp is in the 64 bit 100ns NTTIME format.
 754          *
 755          * The docs say: "the initial update, after the domain functional
 756          * level is raised to DS_BEHAVIOR_WIN2003 or higher, is calculated as
 757          * 14 days minus a random percentage of 5 days", but we aren't doing
 758          * that. The blogosphere seems to think that this randomised update
 759          * happens everytime, but [MS-ADA1] doesn't agree.
 760          *
 761          * Dochelp referred us to the following blog post:
 762          * http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx
 763          *
 764          * en msDS-LogonTimeSyncInterval is zero, the lastLogonTimestamp is
 765          * not changed.
 766          */
 767         static const char *attrs[] = { "msDS-LogonTimeSyncInterval",
 768                                         NULL };
 769         int ret;
 770         struct ldb_result *domain_res = NULL;
 771         TALLOC_CTX *mem_ctx = NULL;
 772         int32_t sync_interval;
 773         NTTIME sync_interval_nt;
 774
 775         mem_ctx = talloc_new(msg_mod);
 776         if (mem_ctx == NULL) {
 777                 return NT_STATUS_NO_MEMORY;
 778         }
 779
 780         ret = dsdb_search_dn(sam_ctx, mem_ctx, &domain_res, domain_dn, attrs,
 781                              0);
 782         if (ret != LDB_SUCCESS || domain_res->count != 1) {
 783                 TALLOC_FREE(mem_ctx);
 784                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 785         }
 786
 787         sync_interval = ldb_msg_find_attr_as_int(domain_res->msgs[0],
 788                                                  "msDS-LogonTimeSyncInterval",
 789                                                  14);
 790         DEBUG(5, ("sync interval is %d\n", sync_interval));
 791         if (sync_interval == 0){
 792                 /*
 793                  * Setting msDS-LogonTimeSyncInterval to zero is how you ask
 794                  * that nothing happens here.
 795                  */
 796                 TALLOC_FREE(mem_ctx);
 797                 return NT_STATUS_OK;
 798         }
 799         else if (sync_interval >= 5){
 800                 /*
 801                  * Subtract "a random percentage of 5" days. Presumably this
 802                  * percentage is between 0 and 100, and modulus is accurate
 803                  * enough.
 804                  */
 805                 uint32_t r = generate_random() % 6;
 806                 sync_interval -= r;
 807                 DEBUG(5, ("randomised sync interval is %d (-%d)\n", sync_interval, r));
 808         }
 809         /* In the case where sync_interval < 5 there is no randomisation */
 810
 811         sync_interval_nt = sync_interval * 24LL * 3600LL * 10000000LL;
 812
 813         DEBUG(5, ("old timestamp is %lld, threshold %lld, diff %lld\n",
 814                   (long long int)old_timestamp,
 815                   (long long int)(now - sync_interval_nt),
 816                   (long long int)(old_timestamp - now + sync_interval_nt)));
 817
 818         if (old_timestamp > now){
 819                 DEBUG(0, ("lastLogonTimestamp is in the future! (%lld > %lld)\n",
 820                           (long long int)old_timestamp, (long long int)now));
 821                 /* then what? */
 822
 823         } else if (old_timestamp < now - sync_interval_nt){
 824                 DEBUG(5, ("updating lastLogonTimestamp to %lld\n",
 825                           (long long int)now));
 826
 827                 /* The time has come to update lastLogonTimestamp */
 828                 ret = samdb_msg_add_int64(sam_ctx, msg_mod, msg_mod,
 829                                           "lastLogonTimestamp", now);
 830
 831                 if (ret != LDB_SUCCESS) {
 832                         TALLOC_FREE(mem_ctx);
 833                         return NT_STATUS_NO_MEMORY;
 834                 }
 835         }
 836         TALLOC_FREE(mem_ctx);
 837         return NT_STATUS_OK;
 838 }
 839
 840
 841
 842 /* Reset the badPwdCount to zero and update the lastLogon time. */
 843 NTSTATUS authsam_logon_success_accounting(struct ldb_context *sam_ctx,
 844                                           const struct ldb_message *msg,
 845                                           struct ldb_dn *domain_dn,
 846                                           bool interactive_or_kerberos)
 847 {
 848         int ret;
 849         NTSTATUS status;
 850         int badPwdCount;
 851         int64_t lockoutTime;
 852         struct ldb_message *msg_mod;
 853         TALLOC_CTX *mem_ctx;
 854         struct timeval tv_now;
 855         NTTIME now;
 856         NTTIME lastLogonTimestamp;
 857         bool am_rodc = false;
 858
 859         mem_ctx = talloc_new(msg);
 860         if (mem_ctx == NULL) {
 861                 return NT_STATUS_NO_MEMORY;
 862         }
 863
 864         lockoutTime = ldb_msg_find_attr_as_int64(msg, "lockoutTime", 0);
 865         if (interactive_or_kerberos) {
 866                 badPwdCount = ldb_msg_find_attr_as_int(msg, "badPwdCount", 0);
 867         } else {
 868                 badPwdCount = samdb_result_effective_badPwdCount(sam_ctx, mem_ctx,
 869                                                                  domain_dn, msg);
 870         }
 871         lastLogonTimestamp =
 872                 ldb_msg_find_attr_as_int64(msg, "lastLogonTimestamp", 0);
 873
 874         DEBUG(5, ("lastLogonTimestamp is %lld\n",
 875                   (long long int)lastLogonTimestamp));
 876
 877         msg_mod = ldb_msg_new(mem_ctx);
 878         if (msg_mod == NULL) {
 879                 TALLOC_FREE(mem_ctx);
 880                 return NT_STATUS_NO_MEMORY;
 881         }
 882         msg_mod->dn = msg->dn;
 883
 884         if (lockoutTime != 0) {
 885                 /*
 886                  * This implies "badPwdCount" = 0, see samldb_lockout_time()
 887                  */
 888                 ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, "lockoutTime", 0);
 889                 if (ret != LDB_SUCCESS) {
 890                         TALLOC_FREE(mem_ctx);
 891                         return NT_STATUS_NO_MEMORY;
 892                 }
 893         } else if (badPwdCount != 0) {
 894                 ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod, "badPwdCount", 0);
 895                 if (ret != LDB_SUCCESS) {
 896                         TALLOC_FREE(mem_ctx);
 897                         return NT_STATUS_NO_MEMORY;
 898                 }
 899         }
 900
 901         tv_now = timeval_current();
 902         now = timeval_to_nttime(&tv_now);
 903
 904         if (interactive_or_kerberos ||
 905             (badPwdCount != 0 && lockoutTime == 0)) {
 906                 ret = samdb_msg_add_int64(sam_ctx, msg_mod, msg_mod,
 907                                           "lastLogon", now);
 908                 if (ret != LDB_SUCCESS) {
 909                         TALLOC_FREE(mem_ctx);
 910                         return NT_STATUS_NO_MEMORY;
 911                 }
 912         }
 913
 914         if (interactive_or_kerberos) {
 915                 int logonCount;
 916
 917                 logonCount = ldb_msg_find_attr_as_int(msg, "logonCount", 0);
 918
 919                 logonCount += 1;
 920
 921                 ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod,
 922                                         "logonCount", logonCount);
 923                 if (ret != LDB_SUCCESS) {
 924                         TALLOC_FREE(mem_ctx);
 925                         return NT_STATUS_NO_MEMORY;
 926                 }
 927         } else {
 928                 /* Set an unset logonCount to 0 on first successful login */
 929                 if (ldb_msg_find_ldb_val(msg, "logonCount") == NULL) {
 930                         ret = samdb_msg_add_int(sam_ctx, msg_mod, msg_mod,
 931                                                 "logonCount", 0);
 932                         if (ret != LDB_SUCCESS) {
 933                                 TALLOC_FREE(mem_ctx);
 934                                 return NT_STATUS_NO_MEMORY;
 935                         }
 936                 }
 937         }
 938
 939         ret = samdb_rodc(sam_ctx, &am_rodc);
 940         if (ret != LDB_SUCCESS) {
 941                 TALLOC_FREE(mem_ctx);
 942                 return NT_STATUS_INTERNAL_ERROR;
 943         }
 944
 945         if (!am_rodc) {
 946                 /* TODO Perform the (async) SendToSAM calls for MS-SAMS */
 947                 status = authsam_update_lastlogon_timestamp(sam_ctx, msg_mod, domain_dn,
 948                                                             lastLogonTimestamp, now);
 949                 if (!NT_STATUS_IS_OK(status)) {
 950                         TALLOC_FREE(mem_ctx);
 951                         return NT_STATUS_NO_MEMORY;
 952                 }
 953         }
 954
 955         if (msg_mod->num_elements > 0) {
 956                 unsigned int i;
 957                 struct ldb_request *req;
 958
 959                 /* mark all the message elements as LDB_FLAG_MOD_REPLACE */
 960                 for (i=0;i<msg_mod->num_elements;i++) {
 961                         msg_mod->elements[i].flags = LDB_FLAG_MOD_REPLACE;
 962                 }
 963
 964                 ret = ldb_build_mod_req(&req, sam_ctx, sam_ctx,
 965                                         msg_mod,
 966                                         NULL,
 967                                         NULL,
 968                                         ldb_op_default_callback,
 969                                         NULL);
 970                 if (ret != LDB_SUCCESS) {
 971                         goto done;
 972                 }
 973
 974                 ret = ldb_request_add_control(req,
 975                                               DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE,
 976                                               false, NULL);
 977                 if (ret != LDB_SUCCESS) {
 978                         talloc_free(req);
 979                         goto done;
 980                 }
 981
 982                 ret = dsdb_autotransaction_request(sam_ctx, req);
 983                 talloc_free(req);
 984         }
 985
 986 done:
 987         if (ret != LDB_SUCCESS) {
 988                 DEBUG(0, ("Failed to set badPwdCount and lockoutTime "
 989                           "to 0 and/or  lastlogon to now (%lld) "
 990                           "%s: %s\n", (long long int)now,
 991                           ldb_dn_get_linearized(msg_mod->dn),
 992                           ldb_errstring(sam_ctx)));
 993                 TALLOC_FREE(mem_ctx);
 994                 return NT_STATUS_INTERNAL_ERROR;
 995         }
 996
 997         TALLOC_FREE(mem_ctx);
 998         return NT_STATUS_OK;
 999 }