source/nsswitch/winbindd_creds.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon - cached credentials funcions
   5
   6    Copyright (C) Guenther Deschner 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "winbindd.h"
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_WINBIND
  27
  28 #define MAX_CACHED_LOGINS 10
  29
  30 NTSTATUS winbindd_get_creds(struct winbindd_domain *domain,
  31                             TALLOC_CTX *mem_ctx,
  32                             const DOM_SID *sid,
  33                             NET_USER_INFO_3 **info3,
  34                             const uint8 *cached_nt_pass[NT_HASH_LEN])
  35 {
  36         NET_USER_INFO_3 *info;
  37         NTSTATUS status;
  38
  39         status = wcache_get_creds(domain, mem_ctx, sid, cached_nt_pass);
  40         if (!NT_STATUS_IS_OK(status)) {
  41                 return status;
  42         }
  43
  44         info = netsamlogon_cache_get(mem_ctx, sid);
  45         if (info == NULL) {
  46                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
  47         }
  48
  49         *info3 = info;
  50
  51         return NT_STATUS_OK;
  52 }
  53
  54
  55 NTSTATUS winbindd_store_creds(struct winbindd_domain *domain,
  56                               TALLOC_CTX *mem_ctx,
  57                               const char *user,
  58                               const char *pass,
  59                               NET_USER_INFO_3 *info3,
  60                               const DOM_SID *user_sid)
  61 {
  62         NTSTATUS status;
  63         uchar nt_pass[NT_HASH_LEN];
  64         DOM_SID cred_sid;
  65
  66         if (info3 != NULL) {
  67
  68                 DOM_SID sid;
  69                 sid_copy(&sid, &(info3->dom_sid.sid));
  70                 sid_append_rid(&sid, info3->user_rid);
  71                 sid_copy(&cred_sid, &sid);
  72                 info3->user_flgs |= LOGON_CACHED_ACCOUNT;
  73
  74         } else if (user_sid != NULL) {
  75
  76                 sid_copy(&cred_sid, user_sid);
  77
  78         } else if (user != NULL) {
  79
  80                 /* do lookup ourself */
  81
  82                 enum SID_NAME_USE type;
  83
  84                 if (!lookup_cached_name(mem_ctx,
  85                                         domain->name,
  86                                         user,
  87                                         &cred_sid,
  88                                         &type)) {
  89                         return NT_STATUS_NO_SUCH_USER;
  90                 }
  91         } else {
  92                 return NT_STATUS_INVALID_PARAMETER;
  93         }
  94
  95         if (pass) {
  96
  97                 int count = 0;
  98
  99                 status = wcache_count_cached_creds(domain, &count);
 100                 if (!NT_STATUS_IS_OK(status)) {
 101                         return status;
 102                 }
 103
 104                 DEBUG(11,("we have %d cached creds\n", count));
 105
 106                 if (count + 1 > MAX_CACHED_LOGINS) {
 107
 108                         DEBUG(10,("need to delete the oldest cached login\n"));
 109
 110                         status = wcache_remove_oldest_cached_creds(domain, &cred_sid);
 111                         if (!NT_STATUS_IS_OK(status)) {
 112                                 DEBUG(10,("failed to remove oldest cached cred: %s\n",
 113                                         nt_errstr(status)));
 114                                 return status;
 115                         }
 116                 }
 117
 118                 E_md4hash(pass, nt_pass);
 119
 120 #if DEBUG_PASSWORD
 121                 dump_data(100, (const char *)nt_pass, NT_HASH_LEN);
 122 #endif
 123
 124                 status = wcache_save_creds(domain, mem_ctx, &cred_sid, nt_pass);
 125                 if (!NT_STATUS_IS_OK(status)) {
 126                         return status;
 127                 }
 128         }
 129
 130         if (info3 != NULL && user != NULL) {
 131                 if (!netsamlogon_cache_store(user, info3)) {
 132                         return NT_STATUS_ACCESS_DENIED;
 133                 }
 134         }
 135
 136         return NT_STATUS_OK;
 137 }
 138
 139 NTSTATUS winbindd_update_creds_by_info3(struct winbindd_domain *domain,
 140                                         TALLOC_CTX *mem_ctx,
 141                                         const char *user,
 142                                         const char *pass,
 143                                         NET_USER_INFO_3 *info3)
 144 {
 145         return winbindd_store_creds(domain, mem_ctx, user, pass, info3, NULL);
 146 }
 147
 148 NTSTATUS winbindd_update_creds_by_sid(struct winbindd_domain *domain,
 149                                       TALLOC_CTX *mem_ctx,
 150                                       const DOM_SID *sid,
 151                                       const char *pass)
 152 {
 153         return winbindd_store_creds(domain, mem_ctx, NULL, pass, NULL, sid);
 154 }
 155
 156 NTSTATUS winbindd_update_creds_by_name(struct winbindd_domain *domain,
 157                                        TALLOC_CTX *mem_ctx,
 158                                        const char *user,
 159                                        const char *pass)
 160 {
 161         return winbindd_store_creds(domain, mem_ctx, user, pass, NULL, NULL);
 162 }
 163
 164