source: trunk/server/source3/auth/auth.c@ 637

Last change on this file since 637 was 414, checked in by Herwig Bauernfeind, 16 years ago

Samba 3.5.0: Initial import
File size: 17.1 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett 2001-2002
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18*/
19
20#include "includes.h"
21
22#undef DBGC_CLASS
23#define DBGC_CLASS DBGC_AUTH
24
25static_decl_auth;
26
27static struct auth_init_function_entry *backends = NULL;
28
29static struct auth_init_function_entry *auth_find_backend_entry(const char *name);
30
31NTSTATUS smb_register_auth(int version, const char *name, auth_init_function init)
32{
33 struct auth_init_function_entry *entry = backends;
34
35 if (version != AUTH_INTERFACE_VERSION) {
36 DEBUG(0,("Can't register auth_method!\n"
37 "You tried to register an auth module with AUTH_INTERFACE_VERSION %d, while this version of samba uses %d\n",
38 version,AUTH_INTERFACE_VERSION));
39 return NT_STATUS_OBJECT_TYPE_MISMATCH;
40 }
41
42 if (!name || !init) {
43 return NT_STATUS_INVALID_PARAMETER;
44 }
45
46 DEBUG(5,("Attempting to register auth backend %s\n", name));
47
48 if (auth_find_backend_entry(name)) {
49 DEBUG(0,("There already is an auth method registered with the name %s!\n", name));
50 return NT_STATUS_OBJECT_NAME_COLLISION;
51 }
52
53 entry = SMB_XMALLOC_P(struct auth_init_function_entry);
54 entry->name = smb_xstrdup(name);
55 entry->init = init;
56
57 DLIST_ADD(backends, entry);
58 DEBUG(5,("Successfully added auth method '%s'\n", name));
59 return NT_STATUS_OK;
60}
61
62static struct auth_init_function_entry *auth_find_backend_entry(const char *name)
63{
64 struct auth_init_function_entry *entry = backends;
65
66 while(entry) {
67 if (strcmp(entry->name, name)==0) return entry;
68 entry = entry->next;
69 }
70
71 return NULL;
72}
73
74/****************************************************************************
75 Try to get a challenge out of the various authentication modules.
76 Returns a const char of length 8 bytes.
77****************************************************************************/
78
79static void get_ntlm_challenge(struct auth_context *auth_context,
80 uint8_t chal[8])
81{
82 DATA_BLOB challenge = data_blob_null;
83 const char *challenge_set_by = NULL;
84 auth_methods *auth_method;
85
86 if (auth_context->challenge.length) {
87 DEBUG(5, ("get_ntlm_challenge (auth subsystem): returning previous challenge by module %s (normal)\n",
88 auth_context->challenge_set_by));
89 memcpy(chal, auth_context->challenge.data, 8);
90 return;
91 }
92
93 auth_context->challenge_may_be_modified = False;
94
95 for (auth_method = auth_context->auth_method_list; auth_method; auth_method = auth_method->next) {
96 if (auth_method->get_chal == NULL) {
97 DEBUG(5, ("auth_get_challenge: module %s did not want to specify a challenge\n", auth_method->name));
98 continue;
99 }
100
101 DEBUG(5, ("auth_get_challenge: getting challenge from module %s\n", auth_method->name));
102 if (challenge_set_by != NULL) {
103 DEBUG(1, ("auth_get_challenge: CONFIGURATION ERROR: authentication method %s has already specified a challenge. Challenge by %s ignored.\n",
104 challenge_set_by, auth_method->name));
105 continue;
106 }
107
108 challenge = auth_method->get_chal(auth_context, &auth_method->private_data,
109 auth_context->mem_ctx);
110 if (!challenge.length) {
111 DEBUG(3, ("auth_get_challenge: getting challenge from authentication method %s FAILED.\n",
112 auth_method->name));
113 } else {
114 DEBUG(5, ("auth_get_challenge: successfully got challenge from module %s\n", auth_method->name));
115 auth_context->challenge = challenge;
116 challenge_set_by = auth_method->name;
117 auth_context->challenge_set_method = auth_method;
118 }
119 }
120
121 if (!challenge_set_by) {
122 uchar tmp[8];
123
124 generate_random_buffer(tmp, sizeof(tmp));
125 auth_context->challenge = data_blob_talloc(auth_context->mem_ctx,
126 tmp, sizeof(tmp));
127
128 challenge_set_by = "random";
129 auth_context->challenge_may_be_modified = True;
130 }
131
132 DEBUG(5, ("auth_context challenge created by %s\n", challenge_set_by));
133 DEBUG(5, ("challenge is: \n"));
134 dump_data(5, auth_context->challenge.data, auth_context->challenge.length);
135
136 SMB_ASSERT(auth_context->challenge.length == 8);
137
138 auth_context->challenge_set_by=challenge_set_by;
139
140 memcpy(chal, auth_context->challenge.data, 8);
141}
142
143
144/**
145 * Check user is in correct domain (if required)
146 *
147 * @param user Only used to fill in the debug message
148 *
149 * @param domain The domain to be verified
150 *
151 * @return True if the user can connect with that domain,
152 * False otherwise.
153**/
154
155static bool check_domain_match(const char *user, const char *domain)
156{
157 /*
158 * If we aren't serving to trusted domains, we must make sure that
159 * the validation request comes from an account in the same domain
160 * as the Samba server
161 */
162
163 if (!lp_allow_trusted_domains() &&
164 !(strequal("", domain) ||
165 strequal(lp_workgroup(), domain) ||
166 is_myname(domain))) {
167 DEBUG(1, ("check_domain_match: Attempt to connect as user %s from domain %s denied.\n", user, domain));
168 return False;
169 } else {
170 return True;
171 }
172}
173
174/**
175 * Check a user's Plaintext, LM or NTLM password.
176 *
177 * Check a user's password, as given in the user_info struct and return various
178 * interesting details in the server_info struct.
179 *
180 * This function does NOT need to be in a become_root()/unbecome_root() pair
181 * as it makes the calls itself when needed.
182 *
183 * The return value takes precedence over the contents of the server_info
184 * struct. When the return is other than NT_STATUS_OK the contents
185 * of that structure is undefined.
186 *
187 * @param user_info Contains the user supplied components, including the passwords.
188 * Must be created with make_user_info() or one of its wrappers.
189 *
190 * @param auth_context Supplies the challenges and some other data.
191 * Must be created with make_auth_context(), and the challenges should be
192 * filled in, either at creation or by calling the challenge geneation
193 * function auth_get_challenge().
194 *
195 * @param server_info If successful, contains information about the authentication,
196 * including a struct samu struct describing the user.
197 *
198 * @return An NTSTATUS with NT_STATUS_OK or an appropriate error.
199 *
200 **/
201
202static NTSTATUS check_ntlm_password(const struct auth_context *auth_context,
203 const struct auth_usersupplied_info *user_info,
204 struct auth_serversupplied_info **server_info)
205{
206 /* if all the modules say 'not for me' this is reasonable */
207 NTSTATUS nt_status = NT_STATUS_NO_SUCH_USER;
208 const char *unix_username;
209 auth_methods *auth_method;
210 TALLOC_CTX *mem_ctx;
211
212 if (!user_info || !auth_context || !server_info)
213 return NT_STATUS_LOGON_FAILURE;
214
215 DEBUG(3, ("check_ntlm_password: Checking password for unmapped user [%s]\\[%s]@[%s] with the new password interface\n",
216 user_info->client_domain, user_info->smb_name, user_info->wksta_name));
217
218 DEBUG(3, ("check_ntlm_password: mapped user is: [%s]\\[%s]@[%s]\n",
219 user_info->domain, user_info->internal_username, user_info->wksta_name));
220
221 if (auth_context->challenge.length != 8) {
222 DEBUG(0, ("check_ntlm_password: Invalid challenge stored for this auth context - cannot continue\n"));
223 return NT_STATUS_LOGON_FAILURE;
224 }
225
226 if (auth_context->challenge_set_by)
227 DEBUG(10, ("check_ntlm_password: auth_context challenge created by %s\n",
228 auth_context->challenge_set_by));
229
230 DEBUG(10, ("challenge is: \n"));
231 dump_data(5, auth_context->challenge.data, auth_context->challenge.length);
232
233#ifdef DEBUG_PASSWORD
234 DEBUG(100, ("user_info has passwords of length %d and %d\n",
235 (int)user_info->lm_resp.length, (int)user_info->nt_resp.length));
236 DEBUG(100, ("lm:\n"));
237 dump_data(100, user_info->lm_resp.data, user_info->lm_resp.length);
238 DEBUG(100, ("nt:\n"));
239 dump_data(100, user_info->nt_resp.data, user_info->nt_resp.length);
240#endif
241
242 /* This needs to be sorted: If it doesn't match, what should we do? */
243 if (!check_domain_match(user_info->smb_name, user_info->domain))
244 return NT_STATUS_LOGON_FAILURE;
245
246 for (auth_method = auth_context->auth_method_list;auth_method; auth_method = auth_method->next) {
247 NTSTATUS result;
248
249 mem_ctx = talloc_init("%s authentication for user %s\\%s", auth_method->name,
250 user_info->domain, user_info->smb_name);
251
252 result = auth_method->auth(auth_context, auth_method->private_data, mem_ctx, user_info, server_info);
253
254 /* check if the module did anything */
255 if ( NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED) ) {
256 DEBUG(10,("check_ntlm_password: %s had nothing to say\n", auth_method->name));
257 talloc_destroy(mem_ctx);
258 continue;
259 }
260
261 nt_status = result;
262
263 if (NT_STATUS_IS_OK(nt_status)) {
264 DEBUG(3, ("check_ntlm_password: %s authentication for user [%s] succeeded\n",
265 auth_method->name, user_info->smb_name));
266 } else {
267 DEBUG(5, ("check_ntlm_password: %s authentication for user [%s] FAILED with error %s\n",
268 auth_method->name, user_info->smb_name, nt_errstr(nt_status)));
269 }
270
271 talloc_destroy(mem_ctx);
272
273 if ( NT_STATUS_IS_OK(nt_status))
274 {
275 break;
276 }
277 }
278
279 /* successful authentication */
280
281 if (NT_STATUS_IS_OK(nt_status)) {
282 unix_username = (*server_info)->unix_name;
283 if (!(*server_info)->guest) {
284 /* We might not be root if we are an RPC call */
285 become_root();
286 nt_status = smb_pam_accountcheck(unix_username);
287 unbecome_root();
288
289 if (NT_STATUS_IS_OK(nt_status)) {
290 DEBUG(5, ("check_ntlm_password: PAM Account for user [%s] succeeded\n",
291 unix_username));
292 } else {
293 DEBUG(3, ("check_ntlm_password: PAM Account for user [%s] FAILED with error %s\n",
294 unix_username, nt_errstr(nt_status)));
295 }
296 }
297
298 if (NT_STATUS_IS_OK(nt_status)) {
299 DEBUG((*server_info)->guest ? 5 : 2,
300 ("check_ntlm_password: %sauthentication for user [%s] -> [%s] -> [%s] succeeded\n",
301 (*server_info)->guest ? "guest " : "",
302 user_info->smb_name,
303 user_info->internal_username,
304 unix_username));
305 }
306
307 return nt_status;
308 }
309
310 /* failed authentication; check for guest lapping */
311
312 DEBUG(2, ("check_ntlm_password: Authentication for user [%s] -> [%s] FAILED with error %s\n",
313 user_info->smb_name, user_info->internal_username,
314 nt_errstr(nt_status)));
315 ZERO_STRUCTP(server_info);
316
317 return nt_status;
318}
319
320/***************************************************************************
321 Clear out a auth_context, and destroy the attached TALLOC_CTX
322***************************************************************************/
323
324static void free_auth_context(struct auth_context **auth_context)
325{
326 auth_methods *auth_method;
327
328 if (*auth_context) {
329 /* Free private data of context's authentication methods */
330 for (auth_method = (*auth_context)->auth_method_list; auth_method; auth_method = auth_method->next) {
331 TALLOC_FREE(auth_method->private_data);
332 }
333
334 talloc_destroy((*auth_context)->mem_ctx);
335 *auth_context = NULL;
336 }
337}
338
339/***************************************************************************
340 Make a auth_info struct
341***************************************************************************/
342
343static NTSTATUS make_auth_context(struct auth_context **auth_context)
344{
345 TALLOC_CTX *mem_ctx;
346
347 mem_ctx = talloc_init("authentication context");
348
349 *auth_context = TALLOC_P(mem_ctx, struct auth_context);
350 if (!*auth_context) {
351 DEBUG(0,("make_auth_context: talloc failed!\n"));
352 talloc_destroy(mem_ctx);
353 return NT_STATUS_NO_MEMORY;
354 }
355 ZERO_STRUCTP(*auth_context);
356
357 (*auth_context)->mem_ctx = mem_ctx;
358 (*auth_context)->check_ntlm_password = check_ntlm_password;
359 (*auth_context)->get_ntlm_challenge = get_ntlm_challenge;
360 (*auth_context)->free = free_auth_context;
361
362 return NT_STATUS_OK;
363}
364
365bool load_auth_module(struct auth_context *auth_context,
366 const char *module, auth_methods **ret)
367{
368 static bool initialised_static_modules = False;
369
370 struct auth_init_function_entry *entry;
371 char *module_name = smb_xstrdup(module);
372 char *module_params = NULL;
373 char *p;
374 bool good = False;
375
376 /* Initialise static modules if not done so yet */
377 if(!initialised_static_modules) {
378 static_init_auth;
379 initialised_static_modules = True;
380 }
381
382 DEBUG(5,("load_auth_module: Attempting to find an auth method to match %s\n",
383 module));
384
385 p = strchr(module_name, ':');
386 if (p) {
387 *p = 0;
388 module_params = p+1;
389 trim_char(module_params, ' ', ' ');
390 }
391
392 trim_char(module_name, ' ', ' ');
393
394 entry = auth_find_backend_entry(module_name);
395
396 if (entry == NULL) {
397 if (NT_STATUS_IS_OK(smb_probe_module("auth", module_name))) {
398 entry = auth_find_backend_entry(module_name);
399 }
400 }
401
402 if (entry != NULL) {
403 if (!NT_STATUS_IS_OK(entry->init(auth_context, module_params, ret))) {
404 DEBUG(0,("load_auth_module: auth method %s did not correctly init\n",
405 module_name));
406 } else {
407 DEBUG(5,("load_auth_module: auth method %s has a valid init\n",
408 module_name));
409 good = True;
410 }
411 } else {
412 DEBUG(0,("load_auth_module: can't find auth method %s!\n", module_name));
413 }
414
415 SAFE_FREE(module_name);
416 return good;
417}
418
419/***************************************************************************
420 Make a auth_info struct for the auth subsystem
421***************************************************************************/
422
423static NTSTATUS make_auth_context_text_list(struct auth_context **auth_context, char **text_list)
424{
425 auth_methods *list = NULL;
426 auth_methods *t = NULL;
427 NTSTATUS nt_status;
428
429 if (!text_list) {
430 DEBUG(2,("make_auth_context_text_list: No auth method list!?\n"));
431 return NT_STATUS_UNSUCCESSFUL;
432 }
433
434 if (!NT_STATUS_IS_OK(nt_status = make_auth_context(auth_context)))
435 return nt_status;
436
437 for (;*text_list; text_list++) {
438 if (load_auth_module(*auth_context, *text_list, &t)) {
439 DLIST_ADD_END(list, t, auth_methods *);
440 }
441 }
442
443 (*auth_context)->auth_method_list = list;
444
445 return nt_status;
446}
447
448/***************************************************************************
449 Make a auth_context struct for the auth subsystem
450***************************************************************************/
451
452NTSTATUS make_auth_context_subsystem(struct auth_context **auth_context)
453{
454 char **auth_method_list = NULL;
455 NTSTATUS nt_status;
456
457 if (lp_auth_methods()
458 && !(auth_method_list = str_list_copy(talloc_tos(),
459 lp_auth_methods()))) {
460 return NT_STATUS_NO_MEMORY;
461 }
462
463 if (auth_method_list == NULL) {
464 switch (lp_security())
465 {
466 case SEC_DOMAIN:
467 DEBUG(5,("Making default auth method list for security=domain\n"));
468 auth_method_list = str_list_make_v3(
469 talloc_tos(), "guest sam winbind:ntdomain",
470 NULL);
471 break;
472 case SEC_SERVER:
473 DEBUG(5,("Making default auth method list for security=server\n"));
474 auth_method_list = str_list_make_v3(
475 talloc_tos(), "guest sam smbserver",
476 NULL);
477 break;
478 case SEC_USER:
479 if (lp_encrypted_passwords()) {
480 if ((lp_server_role() == ROLE_DOMAIN_PDC) || (lp_server_role() == ROLE_DOMAIN_BDC)) {
481 DEBUG(5,("Making default auth method list for DC, security=user, encrypt passwords = yes\n"));
482 auth_method_list = str_list_make_v3(
483 talloc_tos(),
484 "guest sam winbind:trustdomain",
485 NULL);
486 } else {
487 DEBUG(5,("Making default auth method list for standalone security=user, encrypt passwords = yes\n"));
488 auth_method_list = str_list_make_v3(
489 talloc_tos(), "guest sam",
490 NULL);
491 }
492 } else {
493 DEBUG(5,("Making default auth method list for security=user, encrypt passwords = no\n"));
494 auth_method_list = str_list_make_v3(
495 talloc_tos(), "guest unix", NULL);
496 }
497 break;
498 case SEC_SHARE:
499 if (lp_encrypted_passwords()) {
500 DEBUG(5,("Making default auth method list for security=share, encrypt passwords = yes\n"));
501 auth_method_list = str_list_make_v3(
502 talloc_tos(), "guest sam", NULL);
503 } else {
504 DEBUG(5,("Making default auth method list for security=share, encrypt passwords = no\n"));
505 auth_method_list = str_list_make_v3(
506 talloc_tos(), "guest unix", NULL);
507 }
508 break;
509 case SEC_ADS:
510 DEBUG(5,("Making default auth method list for security=ADS\n"));
511 auth_method_list = str_list_make_v3(
512 talloc_tos(), "guest sam winbind:ntdomain",
513 NULL);
514 break;
515 default:
516 DEBUG(5,("Unknown auth method!\n"));
517 return NT_STATUS_UNSUCCESSFUL;
518 }
519 } else {
520 DEBUG(5,("Using specified auth order\n"));
521 }
522
523 nt_status = make_auth_context_text_list(auth_context,
524 auth_method_list);
525
526 TALLOC_FREE(auth_method_list);
527 return nt_status;
528}
529
530/***************************************************************************
531 Make a auth_info struct with a fixed challenge
532***************************************************************************/
533
534NTSTATUS make_auth_context_fixed(struct auth_context **auth_context, uchar chal[8])
535{
536 NTSTATUS nt_status;
537 if (!NT_STATUS_IS_OK(nt_status = make_auth_context_subsystem(auth_context))) {
538 return nt_status;
539 }
540
541 (*auth_context)->challenge = data_blob_talloc((*auth_context)->mem_ctx, chal, 8);
542 (*auth_context)->challenge_set_by = "fixed";
543 return nt_status;
544}
545
546
Note: See TracBrowser for help on using the repository browser.