source/nsswitch/winbindd_cred_cache.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - krb5 credential cache functions
   5    and in-memory cache functions.
   6
   7    Copyright (C) Guenther Deschner 2005-2006
   8    Copyright (C) Jeremy Allison 2006
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_WINBIND
  29
  30 #define MAX_CCACHES 100
  31
  32 static struct WINBINDD_CCACHE_ENTRY *ccache_list;
  33
  34 /****************************************************************
  35  Find an entry by name.
  36 ****************************************************************/
  37
  38 static struct WINBINDD_CCACHE_ENTRY *get_ccache_by_username(const char *username)
  39 {
  40         struct WINBINDD_CCACHE_ENTRY *entry;
  41
  42         for (entry = ccache_list; entry; entry = entry->next) {
  43                 if (strequal(entry->username, username)) {
  44                         return entry;
  45                 }
  46         }
  47         return NULL;
  48 }
  49
  50 /****************************************************************
  51  How many do we have ?
  52 ****************************************************************/
  53
  54 static int ccache_entry_count(void)
  55 {
  56         struct WINBINDD_CCACHE_ENTRY *entry;
  57         int i = 0;
  58
  59         for (entry = ccache_list; entry; entry = entry->next) {
  60                 i++;
  61         }
  62         return i;
  63 }
  64
  65 /****************************************************************
  66  Do the work of refreshing the ticket.
  67 ****************************************************************/
  68
  69 static void krb5_ticket_refresh_handler(struct timed_event *te,
  70                                         const struct timeval *now,
  71                                         void *private_data)
  72 {
  73         struct WINBINDD_CCACHE_ENTRY *entry =
  74                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
  75 #ifdef HAVE_KRB5
  76         int ret;
  77         time_t new_start;
  78         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
  79 #endif
  80
  81         DEBUG(10,("krb5_ticket_refresh_handler called\n"));
  82         DEBUGADD(10,("event called for: %s, %s\n", entry->ccname, entry->username));
  83
  84         TALLOC_FREE(entry->event);
  85
  86 #ifdef HAVE_KRB5
  87
  88         /* Kinit again if we have the user password and we can't renew the old
  89          * tgt anymore */
  90
  91         if ((entry->renew_until < time(NULL)) && cred_ptr && cred_ptr->pass) {
  92
  93                 set_effective_uid(entry->uid);
  94
  95                 ret = kerberos_kinit_password_ext(entry->principal_name,
  96                                                   cred_ptr->pass,
  97                                                   0, /* hm, can we do time correction here ? */
  98                                                   &entry->refresh_time,
  99                                                   &entry->renew_until,
 100                                                   entry->ccname,
 101                                                   False, /* no PAC required anymore */
 102                                                   True,
 103                                                   WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
 104                 gain_root_privilege();
 105
 106                 if (ret) {
 107                         DEBUG(3,("krb5_ticket_refresh_handler: could not re-kinit: %s\n",
 108                                 error_message(ret)));
 109                         TALLOC_FREE(entry->event);
 110                         return;
 111                 }
 112
 113                 DEBUG(10,("krb5_ticket_refresh_handler: successful re-kinit "
 114                         "for: %s in ccache: %s\n",
 115                         entry->principal_name, entry->ccname));
 116
 117                 new_start = entry->refresh_time;
 118
 119                 goto done;
 120         }
 121
 122         set_effective_uid(entry->uid);
 123
 124         ret = smb_krb5_renew_ticket(entry->ccname,
 125                                     entry->principal_name,
 126                                     entry->service,
 127                                     &new_start);
 128         gain_root_privilege();
 129
 130         if (ret) {
 131                 DEBUG(3,("krb5_ticket_refresh_handler: could not renew tickets: %s\n",
 132                         error_message(ret)));
 133                 /* maybe we are beyond the renewing window */
 134
 135                 /* avoid breaking the renewal chain: retry in lp_winbind_cache_time()
 136                  * seconds when the KDC was not available right now. */
 137
 138                 if (ret == KRB5_KDC_UNREACH) {
 139                         new_start = time(NULL) + MAX(30, lp_winbind_cache_time());
 140                         goto done;
 141                 }
 142
 143                 return;
 144         }
 145
 146 done:
 147
 148         entry->event = add_timed_event(entry,
 149                                        timeval_set(new_start, 0),
 150                                        "krb5_ticket_refresh_handler",
 151                                        krb5_ticket_refresh_handler,
 152                                        entry);
 153
 154 #endif
 155 }
 156
 157 /****************************************************************
 158  Do the work of regaining a ticket when coming from offline auth.
 159 ****************************************************************/
 160
 161 static void krb5_ticket_gain_handler(struct timed_event *te,
 162                                         const struct timeval *now,
 163                                         void *private_data)
 164 {
 165         struct WINBINDD_CCACHE_ENTRY *entry =
 166                 talloc_get_type_abort(private_data, struct WINBINDD_CCACHE_ENTRY);
 167 #ifdef HAVE_KRB5
 168         int ret;
 169         time_t new_start;
 170         struct timeval t;
 171         struct WINBINDD_MEMORY_CREDS *cred_ptr = entry->cred_ptr;
 172         struct winbindd_domain *domain = NULL;
 173 #endif
 174
 175         DEBUG(10,("krb5_ticket_gain_handler called\n"));
 176         DEBUGADD(10,("event called for: %s, %s\n", entry->ccname, entry->username));
 177
 178         TALLOC_FREE(entry->event);
 179
 180 #ifdef HAVE_KRB5
 181
 182         if (!cred_ptr || !cred_ptr->pass) {
 183                 DEBUG(10,("krb5_ticket_gain_handler: no memory creds\n"));
 184                 return;
 185         }
 186
 187         if ((domain = find_domain_from_name(entry->realm)) == NULL) {
 188                 DEBUG(0,("krb5_ticket_gain_handler: unknown domain\n"));
 189                 return;
 190         }
 191
 192         if (domain->online) {
 193
 194                 set_effective_uid(entry->uid);
 195
 196                 ret = kerberos_kinit_password_ext(entry->principal_name,
 197                                                 cred_ptr->pass,
 198                                                 0, /* hm, can we do time correction here ? */
 199                                                 &entry->refresh_time,
 200                                                 &entry->renew_until,
 201                                                 entry->ccname,
 202                                                 False, /* no PAC required anymore */
 203                                                 True,
 204                                                 WINBINDD_PAM_AUTH_KRB5_RENEW_TIME);
 205                 gain_root_privilege();
 206
 207                 if (ret) {
 208                         DEBUG(3,("krb5_ticket_gain_handler: could not kinit: %s\n",
 209                                 error_message(ret)));
 210                         goto retry_later;
 211                 }
 212
 213                 DEBUG(10,("krb5_ticket_gain_handler: successful kinit for: %s in ccache: %s\n",
 214                         entry->principal_name, entry->ccname));
 215
 216                 new_start = entry->refresh_time;
 217
 218                 goto got_ticket;
 219         }
 220
 221   retry_later:
 222
 223         entry->event = add_timed_event(entry,
 224                                         timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0),
 225                                         "krb5_ticket_gain_handler",
 226                                         krb5_ticket_gain_handler,
 227                                         entry);
 228
 229         return;
 230
 231   got_ticket:
 232
 233 #if 0 /* TESTING */
 234         t = timeval_set(time(NULL) + 30, 0);
 235 #else
 236         t = timeval_set(new_start, 0);
 237 #endif /* TESTING */
 238
 239         entry->event = add_timed_event(entry,
 240                                         t,
 241                                         "krb5_ticket_refresh_handler",
 242                                         krb5_ticket_refresh_handler,
 243                                         entry);
 244
 245         return;
 246 #endif
 247 }
 248
 249 /****************************************************************
 250  Ensure we're changing the correct entry.
 251 ****************************************************************/
 252
 253 BOOL ccache_entry_identical(const char *username, uid_t uid, const char *ccname)
 254 {
 255         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 256
 257         if (!entry) {
 258                 return False;
 259         }
 260
 261         if (entry->uid != uid) {
 262                 DEBUG(0,("cache_entry_identical: uid's differ: %u != %u\n",
 263                         (unsigned int)entry->uid, (unsigned int)uid ));
 264                 return False;
 265         }
 266         if (!strcsequal(entry->ccname, ccname)) {
 267                 DEBUG(0,("cache_entry_identical: ccnames differ: (cache) %s != (client) %s\n",
 268                         entry->ccname, ccname));
 269                 return False;
 270         }
 271         return True;
 272 }
 273
 274 NTSTATUS add_ccache_to_list(const char *princ_name,
 275                             const char *ccname,
 276                             const char *service,
 277                             const char *username,
 278                             const char *realm,
 279                             uid_t uid,
 280                             time_t create_time,
 281                             time_t ticket_end,
 282                             time_t renew_until,
 283                             BOOL schedule_refresh_event,
 284                             BOOL postponed_request)
 285 {
 286         struct WINBINDD_CCACHE_ENTRY *entry = NULL;
 287
 288         if ((username == NULL && princ_name == NULL) || ccname == NULL || uid < 0) {
 289                 return NT_STATUS_INVALID_PARAMETER;
 290         }
 291
 292         if (ccache_entry_count() + 1 > MAX_CCACHES) {
 293                 DEBUG(10,("add_ccache_to_list: max number of ccaches reached\n"));
 294                 return NT_STATUS_NO_MORE_ENTRIES;
 295         }
 296
 297         /* Reference count old entries */
 298         entry = get_ccache_by_username(username);
 299         if (entry) {
 300                 /* Check cached entries are identical. */
 301                 if (!ccache_entry_identical(username, uid, ccname)) {
 302                         return NT_STATUS_INVALID_PARAMETER;
 303                 }
 304                 entry->ref_count++;
 305                 DEBUG(10,("add_ccache_to_list: ref count on entry %s is now %d\n",
 306                         username, entry->ref_count));
 307                 return NT_STATUS_OK;
 308         }
 309
 310         entry = TALLOC_P(NULL, struct WINBINDD_CCACHE_ENTRY);
 311         if (!entry) {
 312                 return NT_STATUS_NO_MEMORY;
 313         }
 314
 315         ZERO_STRUCTP(entry);
 316
 317         if (username) {
 318                 entry->username = talloc_strdup(entry, username);
 319                 if (!entry->username) {
 320                         goto no_mem;
 321                 }
 322         }
 323         if (princ_name) {
 324                 entry->principal_name = talloc_strdup(entry, princ_name);
 325                 if (!entry->principal_name) {
 326                         goto no_mem;
 327                 }
 328         }
 329         if (service) {
 330                 entry->service = talloc_strdup(entry, service);
 331                 if (!entry->service) {
 332                         goto no_mem;
 333                 }
 334         }
 335
 336         entry->ccname = talloc_strdup(entry, ccname);
 337         if (!entry->ccname) {
 338                 goto no_mem;
 339         }
 340
 341         entry->realm = talloc_strdup(entry, realm);
 342         if (!entry->realm) {
 343                 goto no_mem;
 344         }
 345
 346         entry->create_time = create_time;
 347         entry->renew_until = renew_until;
 348         entry->uid = uid;
 349         entry->ref_count = 1;
 350
 351         if (schedule_refresh_event && renew_until > 0) {
 352                 if (postponed_request) {
 353                         entry->event = add_timed_event(entry,
 354                                                 timeval_current_ofs(MAX(30, lp_winbind_cache_time()), 0),
 355                                                 "krb5_ticket_gain_handler",
 356                                                 krb5_ticket_gain_handler,
 357                                                 entry);
 358                 } else {
 359                         entry->event = add_timed_event(entry,
 360                                                 timeval_set((ticket_end - 1), 0),
 361                                                 "krb5_ticket_refresh_handler",
 362                                                 krb5_ticket_refresh_handler,
 363                                                 entry);
 364                 }
 365
 366                 if (!entry->event) {
 367                         goto no_mem;
 368                 }
 369
 370                 DEBUG(10,("add_ccache_to_list: added krb5_ticket handler\n"));
 371         }
 372
 373         DLIST_ADD(ccache_list, entry);
 374
 375         DEBUG(10,("add_ccache_to_list: added ccache [%s] for user [%s] to the list\n", ccname, username));
 376
 377         return NT_STATUS_OK;
 378
 379  no_mem:
 380
 381         TALLOC_FREE(entry);
 382         return NT_STATUS_NO_MEMORY;
 383 }
 384
 385 /*******************************************************************
 386  Remove a WINBINDD_CCACHE_ENTRY entry and the krb5 ccache if no longer referenced.
 387 *******************************************************************/
 388
 389 NTSTATUS remove_ccache(const char *username)
 390 {
 391         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 392         NTSTATUS status;
 393 #ifdef HAVE_KRB5
 394         krb5_error_code ret;
 395 #endif
 396
 397         if (!entry) {
 398                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 399         }
 400
 401         if (entry->ref_count <= 0) {
 402                 DEBUG(0,("remove_ccache: logic error. ref count for user %s = %d\n",
 403                         username, entry->ref_count));
 404                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 405         }
 406
 407         entry->ref_count--;
 408
 409         if (entry->ref_count > 0) {
 410                 DEBUG(10,("remove_ccache: entry %s ref count now %d\n",
 411                         username, entry->ref_count ));
 412                 return NT_STATUS_OK;
 413         }
 414
 415         /* no references any more */
 416
 417         DLIST_REMOVE(ccache_list, entry);
 418         TALLOC_FREE(entry->event); /* unregisters events */
 419
 420 #ifdef HAVE_KRB5
 421         ret = ads_kdestroy(entry->ccname);
 422
 423         /* we ignore the error when there has been no credential cache */
 424         if (ret == KRB5_FCC_NOFILE) {
 425                 ret = 0;
 426         } else if (ret) {
 427                 DEBUG(0,("remove_ccache: failed to destroy user krb5 ccache %s with: %s\n",
 428                         entry->ccname, error_message(ret)));
 429         } else {
 430                 DEBUG(10,("remove_ccache: successfully destroyed krb5 ccache %s for user %s\n",
 431                         entry->ccname, username));
 432         }
 433         status = krb5_to_nt_status(ret);
 434 #endif
 435
 436         TALLOC_FREE(entry);
 437         DEBUG(10,("remove_ccache: removed ccache for user %s\n", username));
 438
 439         return status;
 440 }
 441
 442 /*******************************************************************
 443  In memory credentials cache code.
 444 *******************************************************************/
 445
 446 static struct WINBINDD_MEMORY_CREDS *memory_creds_list;
 447
 448 /***********************************************************
 449  Find an entry on the list by name.
 450 ***********************************************************/
 451
 452 struct WINBINDD_MEMORY_CREDS *find_memory_creds_by_name(const char *username)
 453 {
 454         struct WINBINDD_MEMORY_CREDS *p;
 455
 456         for (p = memory_creds_list; p; p = p->next) {
 457                 if (strequal(p->username, username)) {
 458                         return p;
 459                 }
 460         }
 461         return NULL;
 462 }
 463
 464 /***********************************************************
 465  Store the required creds and mlock them.
 466 ***********************************************************/
 467
 468 static NTSTATUS store_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp, const char *pass)
 469 {
 470 #if !defined(HAVE_MLOCK)
 471         return NT_STATUS_OK;
 472 #else
 473         /* new_entry->nt_hash is the base pointer for the block
 474            of memory pointed into by new_entry->lm_hash and
 475            new_entry->pass (if we're storing plaintext). */
 476
 477         memcredp->len = NT_HASH_LEN + LM_HASH_LEN;
 478         if (pass) {
 479                 memcredp->len += strlen(pass)+1;
 480         }
 481
 482         memcredp->nt_hash = (unsigned char *)TALLOC_ZERO(memcredp, memcredp->len);
 483         if (!memcredp->nt_hash) {
 484                 return NT_STATUS_NO_MEMORY;
 485         }
 486
 487         memcredp->lm_hash = memcredp->nt_hash + NT_HASH_LEN;
 488 #ifdef DEBUG_PASSWORD
 489         DEBUG(10,("mlocking memory: %p\n", memcredp->nt_hash));
 490 #endif
 491
 492         if ((mlock(memcredp->nt_hash, memcredp->len)) == -1) {
 493                 DEBUG(0,("failed to mlock memory: %s (%d)\n",
 494                         strerror(errno), errno));
 495                 return map_nt_error_from_unix(errno);
 496         }
 497
 498 #ifdef DEBUG_PASSWORD
 499         DEBUG(10,("mlocked memory: %p\n", memcredp->nt_hash));
 500 #endif
 501
 502         /* Create and store the password hashes. */
 503         E_md4hash(pass, memcredp->nt_hash);
 504         E_deshash(pass, memcredp->lm_hash);
 505
 506         if (pass) {
 507                 memcredp->pass = (char *)memcredp->lm_hash + LM_HASH_LEN;
 508                 memcpy(memcredp->pass, pass, memcredp->len - NT_HASH_LEN - LM_HASH_LEN);
 509         }
 510
 511         return NT_STATUS_OK;
 512 #endif
 513 }
 514
 515 /***********************************************************
 516  Destroy existing creds.
 517 ***********************************************************/
 518
 519 static NTSTATUS delete_memory_creds(struct WINBINDD_MEMORY_CREDS *memcredp)
 520 {
 521 #if !defined(HAVE_MUNLOCK)
 522         return NT_STATUS_OK;
 523 #else
 524         if (munlock(memcredp->nt_hash, memcredp->len) == -1) {
 525                 DEBUG(0,("failed to munlock memory: %s (%d)\n",
 526                         strerror(errno), errno));
 527                 return map_nt_error_from_unix(errno);
 528         }
 529         memset(memcredp->nt_hash, '\0', memcredp->len);
 530         TALLOC_FREE(memcredp->nt_hash);
 531         memcredp->lm_hash = NULL;
 532         memcredp->pass = NULL;
 533         memcredp->len = 0;
 534         return NT_STATUS_OK;
 535 #endif
 536 }
 537
 538 /***********************************************************
 539  Replace the required creds with new ones (password change).
 540 ***********************************************************/
 541
 542 static NTSTATUS winbindd_replace_memory_creds_internal(struct WINBINDD_MEMORY_CREDS *memcredp,
 543                                                 const char *pass)
 544 {
 545         NTSTATUS status = delete_memory_creds(memcredp);
 546         if (!NT_STATUS_IS_OK(status)) {
 547                 return status;
 548         }
 549         return store_memory_creds(memcredp, pass);
 550 }
 551
 552 /*************************************************************
 553  Store credentials in memory in a list.
 554 *************************************************************/
 555
 556 static NTSTATUS winbindd_add_memory_creds_internal(const char *username, uid_t uid, const char *pass)
 557 {
 558         /* Shortcut to ensure we don't store if no mlock. */
 559 #if !defined(HAVE_MLOCK) || !defined(HAVE_MUNLOCK)
 560         return NT_STATUS_OK;
 561 #else
 562         NTSTATUS status;
 563         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 564
 565         if (uid == (uid_t)-1) {
 566                 DEBUG(0,("winbindd_add_memory_creds_internal: invalid uid for user %s.\n",
 567                         username ));
 568                 return NT_STATUS_INVALID_PARAMETER;
 569         }
 570
 571         if (memcredp) {
 572                 /* Already exists. Increment the reference count and replace stored creds. */
 573                 if (uid != memcredp->uid) {
 574                         DEBUG(0,("winbindd_add_memory_creds_internal: uid %u for user %s doesn't "
 575                                 "match stored uid %u. Replacing.\n",
 576                                 (unsigned int)uid, username, (unsigned int)memcredp->uid ));
 577                         memcredp->uid = uid;
 578                 }
 579                 memcredp->ref_count++;
 580                 DEBUG(10,("winbindd_add_memory_creds_internal: ref count for user %s is now %d\n",
 581                         username, memcredp->ref_count ));
 582                 return winbindd_replace_memory_creds_internal(memcredp, pass);
 583         }
 584
 585         memcredp = TALLOC_ZERO_P(NULL, struct WINBINDD_MEMORY_CREDS);
 586         if (!memcredp) {
 587                 return NT_STATUS_NO_MEMORY;
 588         }
 589         memcredp->username = talloc_strdup(memcredp, username);
 590         if (!memcredp->username) {
 591                 talloc_destroy(memcredp);
 592                 return NT_STATUS_NO_MEMORY;
 593         }
 594
 595         status = store_memory_creds(memcredp, pass);
 596         if (!NT_STATUS_IS_OK(status)) {
 597                 talloc_destroy(memcredp);
 598                 return status;
 599         }
 600
 601         memcredp->uid = uid;
 602         memcredp->ref_count = 1;
 603         DLIST_ADD(memory_creds_list, memcredp);
 604
 605         DEBUG(10,("winbindd_add_memory_creds_internal: added entry for user %s\n",
 606                 username ));
 607
 608         return NT_STATUS_OK;
 609 #endif
 610 }
 611
 612 /*************************************************************
 613  Store users credentials in memory. If we also have a
 614  struct WINBINDD_CCACHE_ENTRY for this username with a
 615  refresh timer, then store the plaintext of the password
 616  and associate the new credentials with the struct WINBINDD_CCACHE_ENTRY.
 617 *************************************************************/
 618
 619 NTSTATUS winbindd_add_memory_creds(const char *username, uid_t uid, const char *pass)
 620 {
 621         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 622         NTSTATUS status;
 623
 624         status = winbindd_add_memory_creds_internal(username, uid, pass);
 625         if (!NT_STATUS_IS_OK(status)) {
 626                 return status;
 627         }
 628
 629         if (entry) {
 630                 struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 631                 if (memcredp) {
 632                         entry->cred_ptr = memcredp;
 633                 }
 634         }
 635
 636         return status;
 637 }
 638
 639 /*************************************************************
 640  Decrement the in-memory ref count - delete if zero.
 641 *************************************************************/
 642
 643 NTSTATUS winbindd_delete_memory_creds(const char *username)
 644 {
 645         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 646         struct WINBINDD_CCACHE_ENTRY *entry = get_ccache_by_username(username);
 647         NTSTATUS status = NT_STATUS_OK;
 648
 649         if (!memcredp) {
 650                 DEBUG(10,("winbindd_delete_memory_creds: unknown user %s\n",
 651                         username ));
 652                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 653         }
 654
 655         if (memcredp->ref_count <= 0) {
 656                 DEBUG(0,("winbindd_delete_memory_creds: logic error. ref count for user %s = %d\n",
 657                         username, memcredp->ref_count));
 658                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 659         }
 660
 661         memcredp->ref_count--;
 662         if (memcredp->ref_count <= 0) {
 663                 delete_memory_creds(memcredp);
 664                 DLIST_REMOVE(memory_creds_list, memcredp);
 665                 talloc_destroy(memcredp);
 666                 DEBUG(10,("winbindd_delete_memory_creds: deleted entry for user %s\n",
 667                         username));
 668         } else {
 669                 DEBUG(10,("winbindd_delete_memory_creds: entry for user %s ref_count now %d\n",
 670                         username, memcredp->ref_count));
 671         }
 672
 673         if (entry) {
 674                 entry->cred_ptr = NULL; /* Ensure we have no dangling references to this. */
 675         }
 676         return status;
 677 }
 678
 679 /***********************************************************
 680  Replace the required creds with new ones (password change).
 681 ***********************************************************/
 682
 683 NTSTATUS winbindd_replace_memory_creds(const char *username, const char *pass)
 684 {
 685         struct WINBINDD_MEMORY_CREDS *memcredp = find_memory_creds_by_name(username);
 686
 687         if (!memcredp) {
 688                 DEBUG(10,("winbindd_replace_memory_creds: unknown user %s\n",
 689                         username ));
 690                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 691         }
 692
 693         DEBUG(10,("winbindd_replace_memory_creds: replaced creds for user %s\n",
 694                 username ));
 695
 696         return winbindd_replace_memory_creds_internal(memcredp, pass);
 697 }