source: branches/samba-3.5.x/source4/auth/ntlm/auth_sam.c

Last change on this file was 414, checked in by Herwig Bauernfeind, 16 years ago

Samba 3.5.0: Initial import
File size: 11.9 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2009
5 Copyright (C) Gerald Carter 2003
6 Copyright (C) Stefan Metzmacher 2005
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22#include "includes.h"
23#include "librpc/gen_ndr/ndr_netlogon.h"
24#include "system/time.h"
25#include "lib/ldb/include/ldb.h"
26#include "../lib/util/util_ldb.h"
27#include "auth/auth.h"
28#include "../libcli/auth/ntlm_check.h"
29#include "auth/ntlm/auth_proto.h"
30#include "auth/auth_sam.h"
31#include "dsdb/samdb/samdb.h"
32#include "libcli/security/security.h"
33#include "libcli/ldap/ldap_ndr.h"
34#include "param/param.h"
35
36extern const char *user_attrs[];
37extern const char *domain_ref_attrs[];
38
39/****************************************************************************
40 Look for the specified user in the sam, return ldb result structures
41****************************************************************************/
42
43static NTSTATUS authsam_search_account(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
44 const char *account_name,
45 struct ldb_dn *domain_dn,
46 struct ldb_message **ret_msg)
47{
48 int ret;
49
50 /* pull the user attributes */
51 ret = gendb_search_single_extended_dn(sam_ctx, mem_ctx, domain_dn, LDB_SCOPE_SUBTREE,
52 ret_msg, user_attrs,
53 "(&(sAMAccountName=%s)(objectclass=user))",
54 ldb_binary_encode_string(mem_ctx, account_name));
55 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
56 DEBUG(3,("sam_search_user: Couldn't find user [%s] in samdb, under %s\n",
57 account_name, ldb_dn_get_linearized(domain_dn)));
58 return NT_STATUS_NO_SUCH_USER;
59 }
60 if (ret != LDB_SUCCESS) {
61 return NT_STATUS_INTERNAL_DB_CORRUPTION;
62 }
63
64 return NT_STATUS_OK;
65}
66
67/****************************************************************************
68 Do a specific test for an smb password being correct, given a smb_password and
69 the lanman and NT responses.
70****************************************************************************/
71static NTSTATUS authsam_password_ok(struct auth_context *auth_context,
72 TALLOC_CTX *mem_ctx,
73 uint16_t acct_flags,
74 const struct samr_Password *lm_pwd,
75 const struct samr_Password *nt_pwd,
76 const struct auth_usersupplied_info *user_info,
77 DATA_BLOB *user_sess_key,
78 DATA_BLOB *lm_sess_key)
79{
80 NTSTATUS status;
81
82 switch (user_info->password_state) {
83 case AUTH_PASSWORD_PLAIN:
84 {
85 const struct auth_usersupplied_info *user_info_temp;
86 status = encrypt_user_info(mem_ctx, auth_context,
87 AUTH_PASSWORD_HASH,
88 user_info, &user_info_temp);
89 if (!NT_STATUS_IS_OK(status)) {
90 DEBUG(1, ("Failed to convert plaintext password to password HASH: %s\n", nt_errstr(status)));
91 return status;
92 }
93 user_info = user_info_temp;
94
95 /*fall through*/
96 }
97 case AUTH_PASSWORD_HASH:
98 *lm_sess_key = data_blob(NULL, 0);
99 *user_sess_key = data_blob(NULL, 0);
100 status = hash_password_check(mem_ctx,
101 lp_lanman_auth(auth_context->lp_ctx),
102 user_info->password.hash.lanman,
103 user_info->password.hash.nt,
104 user_info->mapped.account_name,
105 lm_pwd, nt_pwd);
106 NT_STATUS_NOT_OK_RETURN(status);
107 break;
108
109 case AUTH_PASSWORD_RESPONSE:
110 status = ntlm_password_check(mem_ctx,
111 lp_lanman_auth(auth_context->lp_ctx),
112 lp_ntlm_auth(auth_context->lp_ctx),
113 user_info->logon_parameters,
114 &auth_context->challenge.data,
115 &user_info->password.response.lanman,
116 &user_info->password.response.nt,
117 user_info->mapped.account_name,
118 user_info->client.account_name,
119 user_info->client.domain_name,
120 lm_pwd, nt_pwd,
121 user_sess_key, lm_sess_key);
122 NT_STATUS_NOT_OK_RETURN(status);
123 break;
124 }
125
126 if (user_sess_key && user_sess_key->data) {
127 talloc_steal(auth_context, user_sess_key->data);
128 }
129 if (lm_sess_key && lm_sess_key->data) {
130 talloc_steal(auth_context, lm_sess_key->data);
131 }
132
133 return NT_STATUS_OK;
134}
135
136
137
138static NTSTATUS authsam_authenticate(struct auth_context *auth_context,
139 TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx,
140 struct ldb_dn *domain_dn,
141 struct ldb_message *msg,
142 const struct auth_usersupplied_info *user_info,
143 DATA_BLOB *user_sess_key, DATA_BLOB *lm_sess_key)
144{
145 struct samr_Password *lm_pwd, *nt_pwd;
146 NTSTATUS nt_status;
147
148 uint16_t acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
149
150 /* Quit if the account was locked out. */
151 if (acct_flags & ACB_AUTOLOCK) {
152 DEBUG(3,("check_sam_security: Account for user %s was locked out.\n",
153 user_info->mapped.account_name));
154 return NT_STATUS_ACCOUNT_LOCKED_OUT;
155 }
156
157 /* You can only do an interactive login to normal accounts */
158 if (user_info->flags & USER_INFO_INTERACTIVE_LOGON) {
159 if (!(acct_flags & ACB_NORMAL)) {
160 return NT_STATUS_NO_SUCH_USER;
161 }
162 }
163
164 nt_status = samdb_result_passwords(mem_ctx, auth_context->lp_ctx, msg, &lm_pwd, &nt_pwd);
165 NT_STATUS_NOT_OK_RETURN(nt_status);
166
167 nt_status = authsam_password_ok(auth_context, mem_ctx,
168 acct_flags, lm_pwd, nt_pwd,
169 user_info, user_sess_key, lm_sess_key);
170 NT_STATUS_NOT_OK_RETURN(nt_status);
171
172 nt_status = authsam_account_ok(mem_ctx, sam_ctx,
173 user_info->logon_parameters,
174 domain_dn,
175 msg,
176 user_info->workstation_name,
177 user_info->mapped.account_name,
178 false, false);
179
180 return nt_status;
181}
182
183
184
185static NTSTATUS authsam_check_password_internals(struct auth_method_context *ctx,
186 TALLOC_CTX *mem_ctx,
187 const struct auth_usersupplied_info *user_info,
188 struct auth_serversupplied_info **server_info)
189{
190 NTSTATUS nt_status;
191 const char *account_name = user_info->mapped.account_name;
192 struct ldb_message *msg;
193 struct ldb_context *sam_ctx;
194 struct ldb_dn *domain_dn;
195 DATA_BLOB user_sess_key, lm_sess_key;
196 TALLOC_CTX *tmp_ctx;
197
198 if (!account_name || !*account_name) {
199 /* 'not for me' */
200 return NT_STATUS_NOT_IMPLEMENTED;
201 }
202
203 tmp_ctx = talloc_new(mem_ctx);
204 if (!tmp_ctx) {
205 return NT_STATUS_NO_MEMORY;
206 }
207
208 sam_ctx = samdb_connect(tmp_ctx, ctx->auth_ctx->event_ctx, ctx->auth_ctx->lp_ctx, system_session(mem_ctx, ctx->auth_ctx->lp_ctx));
209 if (sam_ctx == NULL) {
210 talloc_free(tmp_ctx);
211 return NT_STATUS_INVALID_SYSTEM_SERVICE;
212 }
213
214 domain_dn = ldb_get_default_basedn(sam_ctx);
215 if (domain_dn == NULL) {
216 talloc_free(tmp_ctx);
217 return NT_STATUS_NO_SUCH_DOMAIN;
218 }
219
220 nt_status = authsam_search_account(tmp_ctx, sam_ctx, account_name, domain_dn, &msg);
221 if (!NT_STATUS_IS_OK(nt_status)) {
222 talloc_free(tmp_ctx);
223 return nt_status;
224 }
225
226 nt_status = authsam_authenticate(ctx->auth_ctx, tmp_ctx, sam_ctx, domain_dn, msg, user_info,
227 &user_sess_key, &lm_sess_key);
228 if (!NT_STATUS_IS_OK(nt_status)) {
229 talloc_free(tmp_ctx);
230 return nt_status;
231 }
232
233 nt_status = authsam_make_server_info(tmp_ctx, sam_ctx, lp_netbios_name(ctx->auth_ctx->lp_ctx),
234 lp_sam_name(ctx->auth_ctx->lp_ctx),
235 domain_dn,
236 msg,
237 user_sess_key, lm_sess_key,
238 server_info);
239 if (!NT_STATUS_IS_OK(nt_status)) {
240 talloc_free(tmp_ctx);
241 return nt_status;
242 }
243
244 talloc_steal(mem_ctx, *server_info);
245 talloc_free(tmp_ctx);
246
247 return NT_STATUS_OK;
248}
249
250static NTSTATUS authsam_ignoredomain_want_check(struct auth_method_context *ctx,
251 TALLOC_CTX *mem_ctx,
252 const struct auth_usersupplied_info *user_info)
253{
254 if (!user_info->mapped.account_name || !*user_info->mapped.account_name) {
255 return NT_STATUS_NOT_IMPLEMENTED;
256 }
257
258 return NT_STATUS_OK;
259}
260
261/****************************************************************************
262Check SAM security (above) but with a few extra checks.
263****************************************************************************/
264static NTSTATUS authsam_want_check(struct auth_method_context *ctx,
265 TALLOC_CTX *mem_ctx,
266 const struct auth_usersupplied_info *user_info)
267{
268 bool is_local_name, is_my_domain;
269
270 if (!user_info->mapped.account_name || !*user_info->mapped.account_name) {
271 return NT_STATUS_NOT_IMPLEMENTED;
272 }
273
274 is_local_name = lp_is_myname(ctx->auth_ctx->lp_ctx,
275 user_info->mapped.domain_name);
276 is_my_domain = lp_is_mydomain(ctx->auth_ctx->lp_ctx,
277 user_info->mapped.domain_name);
278
279 /* check whether or not we service this domain/workgroup name */
280 switch (lp_server_role(ctx->auth_ctx->lp_ctx)) {
281 case ROLE_STANDALONE:
282 return NT_STATUS_OK;
283
284 case ROLE_DOMAIN_MEMBER:
285 if (!is_local_name) {
286 DEBUG(6,("authsam_check_password: %s is not one of my local names (DOMAIN_MEMBER)\n",
287 user_info->mapped.domain_name));
288 return NT_STATUS_NOT_IMPLEMENTED;
289 }
290 return NT_STATUS_OK;
291
292 case ROLE_DOMAIN_CONTROLLER:
293 if (!is_local_name && !is_my_domain) {
294 DEBUG(6,("authsam_check_password: %s is not one of my local names or domain name (DC)\n",
295 user_info->mapped.domain_name));
296 return NT_STATUS_NOT_IMPLEMENTED;
297 }
298 return NT_STATUS_OK;
299 }
300
301 DEBUG(6,("authsam_check_password: lp_server_role() has an undefined value\n"));
302 return NT_STATUS_NOT_IMPLEMENTED;
303}
304
305
306/* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available */
307NTSTATUS authsam_get_server_info_principal(TALLOC_CTX *mem_ctx,
308 struct auth_context *auth_context,
309 const char *principal,
310 struct auth_serversupplied_info **server_info)
311{
312 NTSTATUS nt_status;
313 DATA_BLOB user_sess_key = data_blob(NULL, 0);
314 DATA_BLOB lm_sess_key = data_blob(NULL, 0);
315
316 struct ldb_message *msg;
317 struct ldb_context *sam_ctx;
318 struct ldb_dn *domain_dn;
319
320 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
321 if (!tmp_ctx) {
322 return NT_STATUS_NO_MEMORY;
323 }
324
325 sam_ctx = samdb_connect(tmp_ctx, auth_context->event_ctx, auth_context->lp_ctx,
326 system_session(tmp_ctx, auth_context->lp_ctx));
327 if (sam_ctx == NULL) {
328 talloc_free(tmp_ctx);
329 return NT_STATUS_INVALID_SYSTEM_SERVICE;
330 }
331
332 nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal,
333 user_attrs, &domain_dn, &msg);
334 if (!NT_STATUS_IS_OK(nt_status)) {
335 return nt_status;
336 }
337
338 nt_status = authsam_make_server_info(tmp_ctx, sam_ctx,
339 lp_netbios_name(auth_context->lp_ctx),
340 lp_workgroup(auth_context->lp_ctx),
341 domain_dn,
342 msg,
343 user_sess_key, lm_sess_key,
344 server_info);
345 if (NT_STATUS_IS_OK(nt_status)) {
346 talloc_steal(mem_ctx, *server_info);
347 }
348 talloc_free(tmp_ctx);
349 return nt_status;
350}
351
352static const struct auth_operations sam_ignoredomain_ops = {
353 .name = "sam_ignoredomain",
354 .get_challenge = auth_get_challenge_not_implemented,
355 .want_check = authsam_ignoredomain_want_check,
356 .check_password = authsam_check_password_internals,
357 .get_server_info_principal = authsam_get_server_info_principal
358};
359
360static const struct auth_operations sam_ops = {
361 .name = "sam",
362 .get_challenge = auth_get_challenge_not_implemented,
363 .want_check = authsam_want_check,
364 .check_password = authsam_check_password_internals,
365 .get_server_info_principal = authsam_get_server_info_principal
366};
367
368_PUBLIC_ NTSTATUS auth_sam_init(void)
369{
370 NTSTATUS ret;
371
372 ret = auth_register(&sam_ops);
373 if (!NT_STATUS_IS_OK(ret)) {
374 DEBUG(0,("Failed to register 'sam' auth backend!\n"));
375 return ret;
376 }
377
378 ret = auth_register(&sam_ignoredomain_ops);
379 if (!NT_STATUS_IS_OK(ret)) {
380 DEBUG(0,("Failed to register 'sam_ignoredomain' auth backend!\n"));
381 return ret;
382 }
383
384 return ret;
385}
Note: See TracBrowser for help on using the repository browser.