source: vendor/current/nsswitch/libwbclient/wbc_pam.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 37.1 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Winbind client API
5
6 Copyright (C) Gerald (Jerry) Carter 2007
7 Copyright (C) Guenther Deschner 2008
8 Copyright (C) Volker Lendecke 2009
9
10 This library is free software; you can redistribute it and/or
11 modify it under the terms of the GNU Lesser General Public
12 License as published by the Free Software Foundation; either
13 version 3 of the License, or (at your option) any later version.
14
15 This library is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Library General Public License for more details.
19
20 You should have received a copy of the GNU Lesser General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22*/
23
24/* Required Headers */
25
26#include "replace.h"
27#include "libwbclient.h"
28#include "../winbind_client.h"
29
30/* Authenticate a username/password pair */
31wbcErr wbcCtxAuthenticateUser(struct wbcContext *ctx,
32 const char *username, const char *password)
33{
34 wbcErr wbc_status = WBC_ERR_SUCCESS;
35 struct wbcAuthUserParams params;
36
37 ZERO_STRUCT(params);
38
39 params.account_name = username;
40 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
41 params.password.plaintext = password;
42
43 wbc_status = wbcCtxAuthenticateUserEx(ctx, &params, NULL, NULL);
44 BAIL_ON_WBC_ERROR(wbc_status);
45
46done:
47 return wbc_status;
48}
49
50wbcErr wbcAuthenticateUser(const char *username, const char *password)
51{
52 return wbcCtxAuthenticateUser(NULL, username, password);
53}
54
55static bool sid_attr_compose(struct wbcSidWithAttr *s,
56 const struct wbcDomainSid *d,
57 uint32_t rid, uint32_t attr)
58{
59 if (d->num_auths >= WBC_MAXSUBAUTHS) {
60 return false;
61 }
62 s->sid = *d;
63 s->sid.sub_auths[s->sid.num_auths++] = rid;
64 s->attributes = attr;
65 return true;
66}
67
68static void wbcAuthUserInfoDestructor(void *ptr)
69{
70 struct wbcAuthUserInfo *i = (struct wbcAuthUserInfo *)ptr;
71 free(i->account_name);
72 free(i->user_principal);
73 free(i->full_name);
74 free(i->domain_name);
75 free(i->dns_domain_name);
76 free(i->logon_server);
77 free(i->logon_script);
78 free(i->profile_path);
79 free(i->home_directory);
80 free(i->home_drive);
81 free(i->sids);
82}
83
84static wbcErr wbc_create_auth_info(const struct winbindd_response *resp,
85 struct wbcAuthUserInfo **_i)
86{
87 wbcErr wbc_status = WBC_ERR_SUCCESS;
88 struct wbcAuthUserInfo *i;
89 struct wbcDomainSid domain_sid;
90 char *p;
91 uint32_t sn = 0;
92 uint32_t j;
93
94 i = (struct wbcAuthUserInfo *)wbcAllocateMemory(
95 1, sizeof(struct wbcAuthUserInfo),
96 wbcAuthUserInfoDestructor);
97 BAIL_ON_PTR_ERROR(i, wbc_status);
98
99 i->user_flags = resp->data.auth.info3.user_flgs;
100
101 i->account_name = strdup(resp->data.auth.info3.user_name);
102 BAIL_ON_PTR_ERROR(i->account_name, wbc_status);
103 i->user_principal= NULL;
104 i->full_name = strdup(resp->data.auth.info3.full_name);
105 BAIL_ON_PTR_ERROR(i->full_name, wbc_status);
106 i->domain_name = strdup(resp->data.auth.info3.logon_dom);
107 BAIL_ON_PTR_ERROR(i->domain_name, wbc_status);
108 i->dns_domain_name= NULL;
109
110 i->acct_flags = resp->data.auth.info3.acct_flags;
111 memcpy(i->user_session_key,
112 resp->data.auth.user_session_key,
113 sizeof(i->user_session_key));
114 memcpy(i->lm_session_key,
115 resp->data.auth.first_8_lm_hash,
116 sizeof(i->lm_session_key));
117
118 i->logon_count = resp->data.auth.info3.logon_count;
119 i->bad_password_count = resp->data.auth.info3.bad_pw_count;
120
121 i->logon_time = resp->data.auth.info3.logon_time;
122 i->logoff_time = resp->data.auth.info3.logoff_time;
123 i->kickoff_time = resp->data.auth.info3.kickoff_time;
124 i->pass_last_set_time = resp->data.auth.info3.pass_last_set_time;
125 i->pass_can_change_time = resp->data.auth.info3.pass_can_change_time;
126 i->pass_must_change_time= resp->data.auth.info3.pass_must_change_time;
127
128 i->logon_server = strdup(resp->data.auth.info3.logon_srv);
129 BAIL_ON_PTR_ERROR(i->logon_server, wbc_status);
130 i->logon_script = strdup(resp->data.auth.info3.logon_script);
131 BAIL_ON_PTR_ERROR(i->logon_script, wbc_status);
132 i->profile_path = strdup(resp->data.auth.info3.profile_path);
133 BAIL_ON_PTR_ERROR(i->profile_path, wbc_status);
134 i->home_directory= strdup(resp->data.auth.info3.home_dir);
135 BAIL_ON_PTR_ERROR(i->home_directory, wbc_status);
136 i->home_drive = strdup(resp->data.auth.info3.dir_drive);
137 BAIL_ON_PTR_ERROR(i->home_drive, wbc_status);
138
139 i->num_sids = 2;
140 i->num_sids += resp->data.auth.info3.num_groups;
141 i->num_sids += resp->data.auth.info3.num_other_sids;
142
143 i->sids = (struct wbcSidWithAttr *)calloc(
144 sizeof(struct wbcSidWithAttr), i->num_sids);
145 BAIL_ON_PTR_ERROR(i->sids, wbc_status);
146
147 wbc_status = wbcStringToSid(resp->data.auth.info3.dom_sid,
148 &domain_sid);
149 BAIL_ON_WBC_ERROR(wbc_status);
150
151 sn = 0;
152 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
153 resp->data.auth.info3.user_rid, 0)) {
154 wbc_status = WBC_ERR_INVALID_SID;
155 goto done;
156 }
157 sn++;
158 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
159 resp->data.auth.info3.group_rid, 0)) {
160 wbc_status = WBC_ERR_INVALID_SID;
161 goto done;
162 }
163 sn++;
164
165 p = (char *)resp->extra_data.data;
166 if (!p) {
167 wbc_status = WBC_ERR_INVALID_RESPONSE;
168 BAIL_ON_WBC_ERROR(wbc_status);
169 }
170
171 for (j=0; j < resp->data.auth.info3.num_groups; j++) {
172 uint32_t rid;
173 uint32_t attrs;
174 int ret;
175 char *s = p;
176 char *e = strchr(p, '\n');
177 if (!e) {
178 wbc_status = WBC_ERR_INVALID_RESPONSE;
179 BAIL_ON_WBC_ERROR(wbc_status);
180 }
181 e[0] = '\0';
182 p = &e[1];
183
184 ret = sscanf(s, "0x%08X:0x%08X", &rid, &attrs);
185 if (ret != 2) {
186 wbc_status = WBC_ERR_INVALID_RESPONSE;
187 BAIL_ON_WBC_ERROR(wbc_status);
188 }
189
190 if (!sid_attr_compose(&i->sids[sn], &domain_sid,
191 rid, attrs)) {
192 wbc_status = WBC_ERR_INVALID_SID;
193 goto done;
194 }
195 sn++;
196 }
197
198 for (j=0; j < resp->data.auth.info3.num_other_sids; j++) {
199 uint32_t attrs;
200 int ret;
201 char *s = p;
202 char *a;
203 char *e = strchr(p, '\n');
204 if (!e) {
205 wbc_status = WBC_ERR_INVALID_RESPONSE;
206 BAIL_ON_WBC_ERROR(wbc_status);
207 }
208 e[0] = '\0';
209 p = &e[1];
210
211 e = strchr(s, ':');
212 if (!e) {
213 wbc_status = WBC_ERR_INVALID_RESPONSE;
214 BAIL_ON_WBC_ERROR(wbc_status);
215 }
216 e[0] = '\0';
217 a = &e[1];
218
219 ret = sscanf(a, "0x%08X",
220 &attrs);
221 if (ret != 1) {
222 wbc_status = WBC_ERR_INVALID_RESPONSE;
223 BAIL_ON_WBC_ERROR(wbc_status);
224 }
225
226 wbc_status = wbcStringToSid(s, &i->sids[sn].sid);
227 BAIL_ON_WBC_ERROR(wbc_status);
228
229 i->sids[sn].attributes = attrs;
230 sn++;
231 }
232
233 i->num_sids = sn;
234
235 *_i = i;
236 i = NULL;
237done:
238 wbcFreeMemory(i);
239 return wbc_status;
240}
241
242static void wbcAuthErrorInfoDestructor(void *ptr)
243{
244 struct wbcAuthErrorInfo *e = (struct wbcAuthErrorInfo *)ptr;
245 free(e->nt_string);
246 free(e->display_string);
247}
248
249static wbcErr wbc_create_error_info(const struct winbindd_response *resp,
250 struct wbcAuthErrorInfo **_e)
251{
252 wbcErr wbc_status = WBC_ERR_SUCCESS;
253 struct wbcAuthErrorInfo *e;
254
255 e = (struct wbcAuthErrorInfo *)wbcAllocateMemory(
256 1, sizeof(struct wbcAuthErrorInfo),
257 wbcAuthErrorInfoDestructor);
258 BAIL_ON_PTR_ERROR(e, wbc_status);
259
260 e->nt_status = resp->data.auth.nt_status;
261 e->pam_error = resp->data.auth.pam_error;
262 e->nt_string = strdup(resp->data.auth.nt_status_string);
263 BAIL_ON_PTR_ERROR(e->nt_string, wbc_status);
264
265 e->display_string = strdup(resp->data.auth.error_string);
266 BAIL_ON_PTR_ERROR(e->display_string, wbc_status);
267
268 *_e = e;
269 e = NULL;
270
271done:
272 wbcFreeMemory(e);
273 return wbc_status;
274}
275
276static wbcErr wbc_create_password_policy_info(const struct winbindd_response *resp,
277 struct wbcUserPasswordPolicyInfo **_i)
278{
279 wbcErr wbc_status = WBC_ERR_SUCCESS;
280 struct wbcUserPasswordPolicyInfo *i;
281
282 i = (struct wbcUserPasswordPolicyInfo *)wbcAllocateMemory(
283 1, sizeof(struct wbcUserPasswordPolicyInfo), NULL);
284 BAIL_ON_PTR_ERROR(i, wbc_status);
285
286 i->min_passwordage = resp->data.auth.policy.min_passwordage;
287 i->min_length_password = resp->data.auth.policy.min_length_password;
288 i->password_history = resp->data.auth.policy.password_history;
289 i->password_properties = resp->data.auth.policy.password_properties;
290 i->expire = resp->data.auth.policy.expire;
291
292 *_i = i;
293 i = NULL;
294
295done:
296 wbcFreeMemory(i);
297 return wbc_status;
298}
299
300static void wbcLogonUserInfoDestructor(void *ptr)
301{
302 struct wbcLogonUserInfo *i = (struct wbcLogonUserInfo *)ptr;
303 wbcFreeMemory(i->info);
304 wbcFreeMemory(i->blobs);
305}
306
307static wbcErr wbc_create_logon_info(struct winbindd_response *resp,
308 struct wbcLogonUserInfo **_i)
309{
310 wbcErr wbc_status = WBC_ERR_SUCCESS;
311 struct wbcLogonUserInfo *i;
312
313 i = (struct wbcLogonUserInfo *)wbcAllocateMemory(
314 1, sizeof(struct wbcLogonUserInfo),
315 wbcLogonUserInfoDestructor);
316 BAIL_ON_PTR_ERROR(i, wbc_status);
317
318 wbc_status = wbc_create_auth_info(resp, &i->info);
319 BAIL_ON_WBC_ERROR(wbc_status);
320
321 if (resp->data.auth.krb5ccname[0] != '\0') {
322 wbc_status = wbcAddNamedBlob(&i->num_blobs,
323 &i->blobs,
324 "krb5ccname",
325 0,
326 (uint8_t *)resp->data.auth.krb5ccname,
327 strlen(resp->data.auth.krb5ccname)+1);
328 BAIL_ON_WBC_ERROR(wbc_status);
329 }
330
331 if (resp->data.auth.unix_username[0] != '\0') {
332 wbc_status = wbcAddNamedBlob(&i->num_blobs,
333 &i->blobs,
334 "unix_username",
335 0,
336 (uint8_t *)resp->data.auth.unix_username,
337 strlen(resp->data.auth.unix_username)+1);
338 BAIL_ON_WBC_ERROR(wbc_status);
339 }
340
341 *_i = i;
342 i = NULL;
343done:
344 wbcFreeMemory(i);
345 return wbc_status;
346}
347
348
349/* Authenticate with more detailed information */
350wbcErr wbcCtxAuthenticateUserEx(struct wbcContext *ctx,
351 const struct wbcAuthUserParams *params,
352 struct wbcAuthUserInfo **info,
353 struct wbcAuthErrorInfo **error)
354{
355 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
356 int cmd = 0;
357 struct winbindd_request request;
358 struct winbindd_response response;
359
360 ZERO_STRUCT(request);
361 ZERO_STRUCT(response);
362
363 if (error) {
364 *error = NULL;
365 }
366
367 if (!params) {
368 wbc_status = WBC_ERR_INVALID_PARAM;
369 BAIL_ON_WBC_ERROR(wbc_status);
370 }
371
372 if (params->level != WBC_AUTH_USER_LEVEL_PAC && !params->account_name) {
373 wbc_status = WBC_ERR_INVALID_PARAM;
374 BAIL_ON_WBC_ERROR(wbc_status);
375 }
376
377 /* Initialize request */
378
379 switch (params->level) {
380 case WBC_AUTH_USER_LEVEL_PLAIN:
381 cmd = WINBINDD_PAM_AUTH;
382 request.flags = WBFLAG_PAM_INFO3_TEXT |
383 WBFLAG_PAM_USER_SESSION_KEY |
384 WBFLAG_PAM_LMKEY;
385
386 if (!params->password.plaintext) {
387 wbc_status = WBC_ERR_INVALID_PARAM;
388 BAIL_ON_WBC_ERROR(wbc_status);
389 }
390
391 if (params->domain_name && params->domain_name[0]) {
392 /* We need to get the winbind separator :-( */
393 struct winbindd_response sep_response;
394
395 ZERO_STRUCT(sep_response);
396
397 wbc_status = wbcRequestResponse(ctx, WINBINDD_INFO,
398 NULL, &sep_response);
399 BAIL_ON_WBC_ERROR(wbc_status);
400
401 snprintf(request.data.auth.user,
402 sizeof(request.data.auth.user)-1,
403 "%s%c%s",
404 params->domain_name,
405 sep_response.data.info.winbind_separator,
406 params->account_name);
407 } else {
408 strncpy(request.data.auth.user,
409 params->account_name,
410 sizeof(request.data.auth.user)-1);
411 }
412
413 strncpy(request.data.auth.pass,
414 params->password.plaintext,
415 sizeof(request.data.auth.pass)-1);
416 break;
417
418 case WBC_AUTH_USER_LEVEL_HASH:
419 wbc_status = WBC_ERR_NOT_IMPLEMENTED;
420 BAIL_ON_WBC_ERROR(wbc_status);
421 break;
422
423 case WBC_AUTH_USER_LEVEL_RESPONSE:
424 cmd = WINBINDD_PAM_AUTH_CRAP;
425 request.flags = WBFLAG_PAM_INFO3_TEXT |
426 WBFLAG_PAM_USER_SESSION_KEY |
427 WBFLAG_PAM_LMKEY;
428
429 if (params->password.response.lm_length &&
430 !params->password.response.lm_data) {
431 wbc_status = WBC_ERR_INVALID_PARAM;
432 BAIL_ON_WBC_ERROR(wbc_status);
433 }
434 if (params->password.response.lm_length == 0 &&
435 params->password.response.lm_data) {
436 wbc_status = WBC_ERR_INVALID_PARAM;
437 BAIL_ON_WBC_ERROR(wbc_status);
438 }
439
440 if (params->password.response.nt_length &&
441 !params->password.response.nt_data) {
442 wbc_status = WBC_ERR_INVALID_PARAM;
443 BAIL_ON_WBC_ERROR(wbc_status);
444 }
445 if (params->password.response.nt_length == 0&&
446 params->password.response.nt_data) {
447 wbc_status = WBC_ERR_INVALID_PARAM;
448 BAIL_ON_WBC_ERROR(wbc_status);
449 }
450
451 strncpy(request.data.auth_crap.user,
452 params->account_name,
453 sizeof(request.data.auth_crap.user)-1);
454 if (params->domain_name) {
455 strncpy(request.data.auth_crap.domain,
456 params->domain_name,
457 sizeof(request.data.auth_crap.domain)-1);
458 }
459 if (params->workstation_name) {
460 strncpy(request.data.auth_crap.workstation,
461 params->workstation_name,
462 sizeof(request.data.auth_crap.workstation)-1);
463 }
464
465 request.data.auth_crap.logon_parameters =
466 params->parameter_control;
467
468 memcpy(request.data.auth_crap.chal,
469 params->password.response.challenge,
470 sizeof(request.data.auth_crap.chal));
471
472 request.data.auth_crap.lm_resp_len =
473 MIN(params->password.response.lm_length,
474 sizeof(request.data.auth_crap.lm_resp));
475 if (params->password.response.lm_data) {
476 memcpy(request.data.auth_crap.lm_resp,
477 params->password.response.lm_data,
478 request.data.auth_crap.lm_resp_len);
479 }
480 request.data.auth_crap.nt_resp_len = params->password.response.nt_length;
481 if (params->password.response.nt_length > sizeof(request.data.auth_crap.nt_resp)) {
482 request.flags |= WBFLAG_BIG_NTLMV2_BLOB;
483 request.extra_len = params->password.response.nt_length;
484 request.extra_data.data = (char *)malloc(
485 request.extra_len);
486 if (request.extra_data.data == NULL) {
487 wbc_status = WBC_ERR_NO_MEMORY;
488 BAIL_ON_WBC_ERROR(wbc_status);
489 }
490 memcpy(request.extra_data.data,
491 params->password.response.nt_data,
492 request.data.auth_crap.nt_resp_len);
493 } else if (params->password.response.nt_data) {
494 memcpy(request.data.auth_crap.nt_resp,
495 params->password.response.nt_data,
496 request.data.auth_crap.nt_resp_len);
497 }
498 break;
499
500 case WBC_AUTH_USER_LEVEL_PAC:
501 cmd = WINBINDD_PAM_AUTH_CRAP;
502 request.flags = WBFLAG_PAM_AUTH_PAC | WBFLAG_PAM_INFO3_TEXT;
503 request.extra_data.data = malloc(params->password.pac.length);
504 if (request.extra_data.data == NULL) {
505 wbc_status = WBC_ERR_NO_MEMORY;
506 BAIL_ON_WBC_ERROR(wbc_status);
507 }
508 memcpy(request.extra_data.data, params->password.pac.data,
509 params->password.pac.length);
510 request.extra_len = params->password.pac.length;
511 break;
512
513 default:
514 break;
515 }
516
517 if (cmd == 0) {
518 wbc_status = WBC_ERR_INVALID_PARAM;
519 BAIL_ON_WBC_ERROR(wbc_status);
520 }
521
522 if (params->flags) {
523 request.flags |= params->flags;
524 }
525
526 if (cmd == WINBINDD_PAM_AUTH_CRAP) {
527 wbc_status = wbcRequestResponsePriv(ctx, cmd,
528 &request, &response);
529 } else {
530 wbc_status = wbcRequestResponse(ctx, cmd,
531 &request, &response);
532 }
533 if (response.data.auth.nt_status != 0) {
534 if (error) {
535 wbc_status = wbc_create_error_info(&response,
536 error);
537 BAIL_ON_WBC_ERROR(wbc_status);
538 }
539
540 wbc_status = WBC_ERR_AUTH_ERROR;
541 BAIL_ON_WBC_ERROR(wbc_status);
542 }
543 BAIL_ON_WBC_ERROR(wbc_status);
544
545 if (info) {
546 wbc_status = wbc_create_auth_info(&response, info);
547 BAIL_ON_WBC_ERROR(wbc_status);
548 }
549
550done:
551 winbindd_free_response(&response);
552
553 free(request.extra_data.data);
554
555 return wbc_status;
556}
557
558wbcErr wbcAuthenticateUserEx(const struct wbcAuthUserParams *params,
559 struct wbcAuthUserInfo **info,
560 struct wbcAuthErrorInfo **error)
561{
562 return wbcCtxAuthenticateUserEx(NULL, params, info, error);
563}
564
565/* Trigger a verification of the trust credentials of a specific domain */
566wbcErr wbcCtxCheckTrustCredentials(struct wbcContext *ctx, const char *domain,
567 struct wbcAuthErrorInfo **error)
568{
569 struct winbindd_request request;
570 struct winbindd_response response;
571 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
572
573 ZERO_STRUCT(request);
574 ZERO_STRUCT(response);
575
576 if (domain) {
577 strncpy(request.domain_name, domain,
578 sizeof(request.domain_name)-1);
579 }
580
581 /* Send request */
582
583 wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_CHECK_MACHACC,
584 &request, &response);
585 if (response.data.auth.nt_status != 0) {
586 if (error) {
587 wbc_status = wbc_create_error_info(&response,
588 error);
589 BAIL_ON_WBC_ERROR(wbc_status);
590 }
591
592 wbc_status = WBC_ERR_AUTH_ERROR;
593 BAIL_ON_WBC_ERROR(wbc_status);
594 }
595 BAIL_ON_WBC_ERROR(wbc_status);
596
597 done:
598 return wbc_status;
599}
600
601wbcErr wbcCheckTrustCredentials(const char *domain,
602 struct wbcAuthErrorInfo **error)
603{
604 return wbcCtxCheckTrustCredentials(NULL, domain, error);
605}
606
607/* Trigger a change of the trust credentials for a specific domain */
608wbcErr wbcCtxChangeTrustCredentials(struct wbcContext *ctx, const char *domain,
609 struct wbcAuthErrorInfo **error)
610{
611 struct winbindd_request request;
612 struct winbindd_response response;
613 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
614
615 ZERO_STRUCT(request);
616 ZERO_STRUCT(response);
617
618 if (domain) {
619 strncpy(request.domain_name, domain,
620 sizeof(request.domain_name)-1);
621 }
622
623 /* Send request */
624
625 wbc_status = wbcRequestResponsePriv(ctx, WINBINDD_CHANGE_MACHACC,
626 &request, &response);
627 if (response.data.auth.nt_status != 0) {
628 if (error) {
629 wbc_status = wbc_create_error_info(&response,
630 error);
631 BAIL_ON_WBC_ERROR(wbc_status);
632 }
633
634 wbc_status = WBC_ERR_AUTH_ERROR;
635 BAIL_ON_WBC_ERROR(wbc_status);
636 }
637 BAIL_ON_WBC_ERROR(wbc_status);
638
639 done:
640 return wbc_status;
641}
642
643wbcErr wbcChangeTrustCredentials(const char *domain,
644 struct wbcAuthErrorInfo **error)
645{
646 return wbcCtxChangeTrustCredentials(NULL, domain, error);
647}
648
649/*
650 * Trigger a no-op NETLOGON call. Lightweight version of
651 * wbcCheckTrustCredentials
652 */
653wbcErr wbcCtxPingDc(struct wbcContext *ctx, const char *domain,
654 struct wbcAuthErrorInfo **error)
655{
656 return wbcCtxPingDc2(ctx, domain, error, NULL);
657}
658
659wbcErr wbcPingDc(const char *domain, struct wbcAuthErrorInfo **error)
660{
661 return wbcPingDc2(domain, error, NULL);
662}
663
664/*
665 * Trigger a no-op NETLOGON call. Lightweight version of
666 * wbcCheckTrustCredentials, optionally return attempted DC
667 */
668wbcErr wbcCtxPingDc2(struct wbcContext *ctx, const char *domain,
669 struct wbcAuthErrorInfo **error, char **dcname)
670{
671 struct winbindd_request request;
672 struct winbindd_response response;
673 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
674
675 ZERO_STRUCT(request);
676 ZERO_STRUCT(response);
677
678 if (domain) {
679 strncpy(request.domain_name, domain,
680 sizeof(request.domain_name)-1);
681 }
682
683 /* Send request */
684
685 wbc_status = wbcRequestResponse(ctx, WINBINDD_PING_DC,
686 &request,
687 &response);
688
689 if (dcname && response.extra_data.data) {
690 size_t len;
691
692 len = response.length - sizeof(struct winbindd_response);
693 *dcname = wbcAllocateMemory(1, len, NULL);
694 BAIL_ON_PTR_ERROR(*dcname, wbc_status);
695
696 strlcpy(*dcname, response.extra_data.data, len);
697 }
698
699 if (response.data.auth.nt_status != 0) {
700 if (error) {
701 wbc_status = wbc_create_error_info(&response,
702 error);
703 BAIL_ON_WBC_ERROR(wbc_status);
704 }
705
706 wbc_status = WBC_ERR_AUTH_ERROR;
707 BAIL_ON_WBC_ERROR(wbc_status);
708 }
709 BAIL_ON_WBC_ERROR(wbc_status);
710
711 done:
712 return wbc_status;
713}
714
715wbcErr wbcPingDc2(const char *domain, struct wbcAuthErrorInfo **error,
716 char **dcname)
717{
718 return wbcCtxPingDc2(NULL, domain, error, dcname);
719}
720
721/* Trigger an extended logoff notification to Winbind for a specific user */
722wbcErr wbcCtxLogoffUserEx(struct wbcContext *ctx,
723 const struct wbcLogoffUserParams *params,
724 struct wbcAuthErrorInfo **error)
725{
726 struct winbindd_request request;
727 struct winbindd_response response;
728 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
729 int i;
730
731 /* validate input */
732
733 if (!params || !params->username) {
734 wbc_status = WBC_ERR_INVALID_PARAM;
735 BAIL_ON_WBC_ERROR(wbc_status);
736 }
737
738 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
739 wbc_status = WBC_ERR_INVALID_PARAM;
740 BAIL_ON_WBC_ERROR(wbc_status);
741 }
742 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
743 wbc_status = WBC_ERR_INVALID_PARAM;
744 BAIL_ON_WBC_ERROR(wbc_status);
745 }
746
747 ZERO_STRUCT(request);
748 ZERO_STRUCT(response);
749
750 strncpy(request.data.logoff.user, params->username,
751 sizeof(request.data.logoff.user)-1);
752
753 for (i=0; i<params->num_blobs; i++) {
754
755 if (strcasecmp(params->blobs[i].name, "ccfilename") == 0) {
756 if (params->blobs[i].blob.data) {
757 strncpy(request.data.logoff.krb5ccname,
758 (const char *)params->blobs[i].blob.data,
759 sizeof(request.data.logoff.krb5ccname) - 1);
760 }
761 continue;
762 }
763
764 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
765 if (params->blobs[i].blob.data) {
766 memcpy(&request.data.logoff.uid,
767 params->blobs[i].blob.data,
768 MIN(params->blobs[i].blob.length,
769 sizeof(request.data.logoff.uid)));
770 }
771 continue;
772 }
773
774 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
775 if (params->blobs[i].blob.data) {
776 memcpy(&request.flags,
777 params->blobs[i].blob.data,
778 MIN(params->blobs[i].blob.length,
779 sizeof(request.flags)));
780 }
781 continue;
782 }
783 }
784
785 /* Send request */
786
787 wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_LOGOFF,
788 &request,
789 &response);
790
791 /* Take the response above and return it to the caller */
792 if (response.data.auth.nt_status != 0) {
793 if (error) {
794 wbc_status = wbc_create_error_info(&response,
795 error);
796 BAIL_ON_WBC_ERROR(wbc_status);
797 }
798
799 wbc_status = WBC_ERR_AUTH_ERROR;
800 BAIL_ON_WBC_ERROR(wbc_status);
801 }
802 BAIL_ON_WBC_ERROR(wbc_status);
803
804 done:
805 return wbc_status;
806}
807
808wbcErr wbcLogoffUserEx(const struct wbcLogoffUserParams *params,
809 struct wbcAuthErrorInfo **error)
810{
811 return wbcCtxLogoffUserEx(NULL, params, error);
812}
813
814/* Trigger a logoff notification to Winbind for a specific user */
815wbcErr wbcCtxLogoffUser(struct wbcContext *ctx,
816 const char *username, uid_t uid,
817 const char *ccfilename)
818{
819 struct winbindd_request request;
820 struct winbindd_response response;
821 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
822
823 /* validate input */
824
825 if (!username) {
826 wbc_status = WBC_ERR_INVALID_PARAM;
827 BAIL_ON_WBC_ERROR(wbc_status);
828 }
829
830 ZERO_STRUCT(request);
831 ZERO_STRUCT(response);
832
833 strncpy(request.data.logoff.user, username,
834 sizeof(request.data.logoff.user)-1);
835 request.data.logoff.uid = uid;
836
837 if (ccfilename) {
838 strncpy(request.data.logoff.krb5ccname, ccfilename,
839 sizeof(request.data.logoff.krb5ccname)-1);
840 }
841
842 /* Send request */
843
844 wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_LOGOFF,
845 &request,
846 &response);
847
848 /* Take the response above and return it to the caller */
849
850 done:
851 return wbc_status;
852}
853
854wbcErr wbcLogoffUser(const char *username,
855 uid_t uid,
856 const char *ccfilename)
857{
858 return wbcCtxLogoffUser(NULL, username, uid, ccfilename);
859}
860
861/* Change a password for a user with more detailed information upon failure */
862wbcErr wbcCtxChangeUserPasswordEx(struct wbcContext *ctx,
863 const struct wbcChangePasswordParams *params,
864 struct wbcAuthErrorInfo **error,
865 enum wbcPasswordChangeRejectReason *reject_reason,
866 struct wbcUserPasswordPolicyInfo **policy)
867{
868 struct winbindd_request request;
869 struct winbindd_response response;
870 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
871 int cmd = 0;
872
873 /* validate input */
874
875 if (!params->account_name) {
876 wbc_status = WBC_ERR_INVALID_PARAM;
877 goto done;
878 }
879
880 if (error) {
881 *error = NULL;
882 }
883
884 if (policy) {
885 *policy = NULL;
886 }
887
888 if (reject_reason) {
889 *reject_reason = -1;
890 }
891
892 ZERO_STRUCT(request);
893 ZERO_STRUCT(response);
894
895 switch (params->level) {
896 case WBC_CHANGE_PASSWORD_LEVEL_PLAIN:
897 cmd = WINBINDD_PAM_CHAUTHTOK;
898
899 if (!params->account_name) {
900 wbc_status = WBC_ERR_INVALID_PARAM;
901 goto done;
902 }
903
904 strncpy(request.data.chauthtok.user, params->account_name,
905 sizeof(request.data.chauthtok.user) - 1);
906
907 if (params->old_password.plaintext) {
908 strncpy(request.data.chauthtok.oldpass,
909 params->old_password.plaintext,
910 sizeof(request.data.chauthtok.oldpass) - 1);
911 }
912
913 if (params->new_password.plaintext) {
914 strncpy(request.data.chauthtok.newpass,
915 params->new_password.plaintext,
916 sizeof(request.data.chauthtok.newpass) - 1);
917 }
918 break;
919
920 case WBC_CHANGE_PASSWORD_LEVEL_RESPONSE:
921 cmd = WINBINDD_PAM_CHNG_PSWD_AUTH_CRAP;
922
923 if (!params->account_name || !params->domain_name) {
924 wbc_status = WBC_ERR_INVALID_PARAM;
925 goto done;
926 }
927
928 if (params->old_password.response.old_lm_hash_enc_length &&
929 !params->old_password.response.old_lm_hash_enc_data) {
930 wbc_status = WBC_ERR_INVALID_PARAM;
931 goto done;
932 }
933
934 if (params->old_password.response.old_lm_hash_enc_length == 0 &&
935 params->old_password.response.old_lm_hash_enc_data) {
936 wbc_status = WBC_ERR_INVALID_PARAM;
937 goto done;
938 }
939
940 if (params->old_password.response.old_nt_hash_enc_length &&
941 !params->old_password.response.old_nt_hash_enc_data) {
942 wbc_status = WBC_ERR_INVALID_PARAM;
943 goto done;
944 }
945
946 if (params->old_password.response.old_nt_hash_enc_length == 0 &&
947 params->old_password.response.old_nt_hash_enc_data) {
948 wbc_status = WBC_ERR_INVALID_PARAM;
949 goto done;
950 }
951
952 if (params->new_password.response.lm_length &&
953 !params->new_password.response.lm_data) {
954 wbc_status = WBC_ERR_INVALID_PARAM;
955 goto done;
956 }
957
958 if (params->new_password.response.lm_length == 0 &&
959 params->new_password.response.lm_data) {
960 wbc_status = WBC_ERR_INVALID_PARAM;
961 goto done;
962 }
963
964 if (params->new_password.response.nt_length &&
965 !params->new_password.response.nt_data) {
966 wbc_status = WBC_ERR_INVALID_PARAM;
967 goto done;
968 }
969
970 if (params->new_password.response.nt_length == 0 &&
971 params->new_password.response.nt_data) {
972 wbc_status = WBC_ERR_INVALID_PARAM;
973 goto done;
974 }
975
976 strncpy(request.data.chng_pswd_auth_crap.user,
977 params->account_name,
978 sizeof(request.data.chng_pswd_auth_crap.user) - 1);
979
980 strncpy(request.data.chng_pswd_auth_crap.domain,
981 params->domain_name,
982 sizeof(request.data.chng_pswd_auth_crap.domain) - 1);
983
984 if (params->new_password.response.nt_data) {
985 request.data.chng_pswd_auth_crap.new_nt_pswd_len =
986 params->new_password.response.nt_length;
987 memcpy(request.data.chng_pswd_auth_crap.new_nt_pswd,
988 params->new_password.response.nt_data,
989 request.data.chng_pswd_auth_crap.new_nt_pswd_len);
990 }
991
992 if (params->new_password.response.lm_data) {
993 request.data.chng_pswd_auth_crap.new_lm_pswd_len =
994 params->new_password.response.lm_length;
995 memcpy(request.data.chng_pswd_auth_crap.new_lm_pswd,
996 params->new_password.response.lm_data,
997 request.data.chng_pswd_auth_crap.new_lm_pswd_len);
998 }
999
1000 if (params->old_password.response.old_nt_hash_enc_data) {
1001 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len =
1002 params->old_password.response.old_nt_hash_enc_length;
1003 memcpy(request.data.chng_pswd_auth_crap.old_nt_hash_enc,
1004 params->old_password.response.old_nt_hash_enc_data,
1005 request.data.chng_pswd_auth_crap.old_nt_hash_enc_len);
1006 }
1007
1008 if (params->old_password.response.old_lm_hash_enc_data) {
1009 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len =
1010 params->old_password.response.old_lm_hash_enc_length;
1011 memcpy(request.data.chng_pswd_auth_crap.old_lm_hash_enc,
1012 params->old_password.response.old_lm_hash_enc_data,
1013 request.data.chng_pswd_auth_crap.old_lm_hash_enc_len);
1014 }
1015
1016 break;
1017 default:
1018 wbc_status = WBC_ERR_INVALID_PARAM;
1019 goto done;
1020 break;
1021 }
1022
1023 /* Send request */
1024
1025 wbc_status = wbcRequestResponse(ctx, cmd,
1026 &request,
1027 &response);
1028 if (WBC_ERROR_IS_OK(wbc_status)) {
1029 goto done;
1030 }
1031
1032 /* Take the response above and return it to the caller */
1033
1034 if (response.data.auth.nt_status != 0) {
1035 if (error) {
1036 wbc_status = wbc_create_error_info(&response,
1037 error);
1038 BAIL_ON_WBC_ERROR(wbc_status);
1039 }
1040
1041 }
1042
1043 if (policy) {
1044 wbc_status = wbc_create_password_policy_info(&response,
1045 policy);
1046 BAIL_ON_WBC_ERROR(wbc_status);
1047 }
1048
1049 if (reject_reason) {
1050 *reject_reason = response.data.auth.reject_reason;
1051 }
1052
1053 wbc_status = WBC_ERR_PWD_CHANGE_FAILED;
1054 BAIL_ON_WBC_ERROR(wbc_status);
1055
1056 done:
1057 return wbc_status;
1058}
1059
1060wbcErr wbcChangeUserPasswordEx(const struct wbcChangePasswordParams *params,
1061 struct wbcAuthErrorInfo **error,
1062 enum wbcPasswordChangeRejectReason *reject_reason,
1063 struct wbcUserPasswordPolicyInfo **policy)
1064{
1065 return wbcCtxChangeUserPasswordEx(NULL, params, error,
1066 reject_reason, policy);
1067}
1068
1069/* Change a password for a user */
1070wbcErr wbcCtxChangeUserPassword(struct wbcContext *ctx,
1071 const char *username,
1072 const char *old_password,
1073 const char *new_password)
1074{
1075 wbcErr wbc_status = WBC_ERR_SUCCESS;
1076 struct wbcChangePasswordParams params;
1077
1078 ZERO_STRUCT(params);
1079
1080 params.account_name = username;
1081 params.level = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
1082 params.old_password.plaintext = old_password;
1083 params.new_password.plaintext = new_password;
1084
1085 wbc_status = wbcCtxChangeUserPasswordEx(ctx, &params,
1086 NULL,
1087 NULL,
1088 NULL);
1089 BAIL_ON_WBC_ERROR(wbc_status);
1090
1091done:
1092 return wbc_status;
1093}
1094
1095wbcErr wbcChangeUserPassword(const char *username,
1096 const char *old_password,
1097 const char *new_password)
1098{
1099 return wbcCtxChangeUserPassword(NULL, username,
1100 old_password, new_password);
1101}
1102
1103/* Logon a User */
1104wbcErr wbcCtxLogonUser(struct wbcContext *ctx,
1105 const struct wbcLogonUserParams *params,
1106 struct wbcLogonUserInfo **info,
1107 struct wbcAuthErrorInfo **error,
1108 struct wbcUserPasswordPolicyInfo **policy)
1109{
1110 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
1111 struct winbindd_request request;
1112 struct winbindd_response response;
1113 uint32_t i;
1114
1115 ZERO_STRUCT(request);
1116 ZERO_STRUCT(response);
1117
1118 if (info) {
1119 *info = NULL;
1120 }
1121 if (error) {
1122 *error = NULL;
1123 }
1124 if (policy) {
1125 *policy = NULL;
1126 }
1127
1128 if (!params) {
1129 wbc_status = WBC_ERR_INVALID_PARAM;
1130 BAIL_ON_WBC_ERROR(wbc_status);
1131 }
1132
1133 if (!params->username) {
1134 wbc_status = WBC_ERR_INVALID_PARAM;
1135 BAIL_ON_WBC_ERROR(wbc_status);
1136 }
1137
1138 if ((params->num_blobs > 0) && (params->blobs == NULL)) {
1139 wbc_status = WBC_ERR_INVALID_PARAM;
1140 BAIL_ON_WBC_ERROR(wbc_status);
1141 }
1142 if ((params->num_blobs == 0) && (params->blobs != NULL)) {
1143 wbc_status = WBC_ERR_INVALID_PARAM;
1144 BAIL_ON_WBC_ERROR(wbc_status);
1145 }
1146
1147 /* Initialize request */
1148
1149 request.flags = WBFLAG_PAM_INFO3_TEXT |
1150 WBFLAG_PAM_USER_SESSION_KEY |
1151 WBFLAG_PAM_LMKEY;
1152
1153 if (!params->password) {
1154 wbc_status = WBC_ERR_INVALID_PARAM;
1155 BAIL_ON_WBC_ERROR(wbc_status);
1156 }
1157
1158 strncpy(request.data.auth.user,
1159 params->username,
1160 sizeof(request.data.auth.user)-1);
1161
1162 strncpy(request.data.auth.pass,
1163 params->password,
1164 sizeof(request.data.auth.pass)-1);
1165
1166 for (i=0; i<params->num_blobs; i++) {
1167
1168 if (strcasecmp(params->blobs[i].name, "krb5_cc_type") == 0) {
1169 if (params->blobs[i].blob.data) {
1170 strncpy(request.data.auth.krb5_cc_type,
1171 (const char *)params->blobs[i].blob.data,
1172 sizeof(request.data.auth.krb5_cc_type) - 1);
1173 }
1174 continue;
1175 }
1176
1177 if (strcasecmp(params->blobs[i].name, "user_uid") == 0) {
1178 if (params->blobs[i].blob.data) {
1179 memcpy(&request.data.auth.uid,
1180 params->blobs[i].blob.data,
1181 MIN(sizeof(request.data.auth.uid),
1182 params->blobs[i].blob.length));
1183 }
1184 continue;
1185 }
1186
1187 if (strcasecmp(params->blobs[i].name, "flags") == 0) {
1188 if (params->blobs[i].blob.data) {
1189 uint32_t flags;
1190 memcpy(&flags,
1191 params->blobs[i].blob.data,
1192 MIN(sizeof(flags),
1193 params->blobs[i].blob.length));
1194 request.flags |= flags;
1195 }
1196 continue;
1197 }
1198
1199 if (strcasecmp(params->blobs[i].name, "membership_of") == 0) {
1200 if (params->blobs[i].blob.data &&
1201 params->blobs[i].blob.data[0] > 0) {
1202 strncpy(request.data.auth.require_membership_of_sid,
1203 (const char *)params->blobs[i].blob.data,
1204 sizeof(request.data.auth.require_membership_of_sid) - 1);
1205 }
1206 continue;
1207 }
1208 }
1209
1210 wbc_status = wbcRequestResponse(ctx, WINBINDD_PAM_AUTH,
1211 &request,
1212 &response);
1213
1214 if (response.data.auth.nt_status != 0) {
1215 if (error) {
1216 wbc_status = wbc_create_error_info(&response,
1217 error);
1218 BAIL_ON_WBC_ERROR(wbc_status);
1219 }
1220
1221 wbc_status = WBC_ERR_AUTH_ERROR;
1222 BAIL_ON_WBC_ERROR(wbc_status);
1223 }
1224 BAIL_ON_WBC_ERROR(wbc_status);
1225
1226 if (info) {
1227 wbc_status = wbc_create_logon_info(&response,
1228 info);
1229 BAIL_ON_WBC_ERROR(wbc_status);
1230 }
1231
1232 if (policy) {
1233 wbc_status = wbc_create_password_policy_info(&response,
1234 policy);
1235 BAIL_ON_WBC_ERROR(wbc_status);
1236 }
1237
1238done:
1239 winbindd_free_response(&response);
1240
1241 return wbc_status;
1242}
1243
1244wbcErr wbcLogonUser(const struct wbcLogonUserParams *params,
1245 struct wbcLogonUserInfo **info,
1246 struct wbcAuthErrorInfo **error,
1247 struct wbcUserPasswordPolicyInfo **policy)
1248{
1249 return wbcCtxLogonUser(NULL, params, info, error, policy);
1250}
1251
1252static void wbcCredentialCacheInfoDestructor(void *ptr)
1253{
1254 struct wbcCredentialCacheInfo *i =
1255 (struct wbcCredentialCacheInfo *)ptr;
1256 wbcFreeMemory(i->blobs);
1257}
1258
1259/* Authenticate a user with cached credentials */
1260wbcErr wbcCtxCredentialCache(struct wbcContext *ctx,
1261 struct wbcCredentialCacheParams *params,
1262 struct wbcCredentialCacheInfo **info,
1263 struct wbcAuthErrorInfo **error)
1264{
1265 wbcErr status = WBC_ERR_UNKNOWN_FAILURE;
1266 struct wbcCredentialCacheInfo *result = NULL;
1267 struct winbindd_request request;
1268 struct winbindd_response response;
1269 struct wbcNamedBlob *initial_blob = NULL;
1270 struct wbcNamedBlob *challenge_blob = NULL;
1271 int i;
1272
1273 ZERO_STRUCT(request);
1274 ZERO_STRUCT(response);
1275
1276 *info = NULL;
1277
1278 if (error != NULL) {
1279 *error = NULL;
1280 }
1281 if ((params == NULL)
1282 || (params->account_name == NULL)
1283 || (params->level != WBC_CREDENTIAL_CACHE_LEVEL_NTLMSSP)) {
1284 status = WBC_ERR_INVALID_PARAM;
1285 goto fail;
1286 }
1287
1288 for (i=0; i<params->num_blobs; i++) {
1289 /*
1290 * Older callers may used to provide the NEGOTIATE request
1291 * as "initial_blob", but it was completely ignored by winbindd.
1292 *
1293 * So we keep ignoring it.
1294 *
1295 * A new callers that is capable to support "new_spnego",
1296 * will provide the NEGOTIATE request as "negotiate_blob"
1297 * instead.
1298 */
1299 if (strcasecmp(params->blobs[i].name, "negotiate_blob") == 0) {
1300 if (initial_blob != NULL) {
1301 status = WBC_ERR_INVALID_PARAM;
1302 goto fail;
1303 }
1304 initial_blob = &params->blobs[i];
1305 continue;
1306 }
1307 if (strcasecmp(params->blobs[i].name, "challenge_blob") == 0) {
1308 if (challenge_blob != NULL) {
1309 status = WBC_ERR_INVALID_PARAM;
1310 goto fail;
1311 }
1312 challenge_blob = &params->blobs[i];
1313 continue;
1314 }
1315 }
1316
1317 if (params->domain_name != NULL) {
1318 status = wbcRequestResponse(ctx, WINBINDD_INFO,
1319 NULL, &response);
1320 if (!WBC_ERROR_IS_OK(status)) {
1321 goto fail;
1322 }
1323 snprintf(request.data.ccache_ntlm_auth.user,
1324 sizeof(request.data.ccache_ntlm_auth.user)-1,
1325 "%s%c%s", params->domain_name,
1326 response.data.info.winbind_separator,
1327 params->account_name);
1328 } else {
1329 strncpy(request.data.ccache_ntlm_auth.user,
1330 params->account_name,
1331 sizeof(request.data.ccache_ntlm_auth.user)-1);
1332 }
1333 request.data.ccache_ntlm_auth.uid = getuid();
1334
1335 request.data.ccache_ntlm_auth.initial_blob_len = 0;
1336 request.data.ccache_ntlm_auth.challenge_blob_len = 0;
1337 request.extra_len = 0;
1338
1339 if (initial_blob != NULL) {
1340 request.data.ccache_ntlm_auth.initial_blob_len =
1341 initial_blob->blob.length;
1342 request.extra_len += initial_blob->blob.length;
1343 }
1344 if (challenge_blob != NULL) {
1345 request.data.ccache_ntlm_auth.challenge_blob_len =
1346 challenge_blob->blob.length;
1347 request.extra_len += challenge_blob->blob.length;
1348 }
1349
1350 if (request.extra_len != 0) {
1351 request.extra_data.data = (char *)malloc(request.extra_len);
1352 if (request.extra_data.data == NULL) {
1353 status = WBC_ERR_NO_MEMORY;
1354 goto fail;
1355 }
1356 }
1357 if (initial_blob != NULL) {
1358 memcpy(request.extra_data.data,
1359 initial_blob->blob.data, initial_blob->blob.length);
1360 }
1361 if (challenge_blob != NULL) {
1362 memcpy(request.extra_data.data
1363 + request.data.ccache_ntlm_auth.initial_blob_len,
1364 challenge_blob->blob.data,
1365 challenge_blob->blob.length);
1366 }
1367
1368 status = wbcRequestResponse(ctx, WINBINDD_CCACHE_NTLMAUTH,
1369 &request, &response);
1370 if (!WBC_ERROR_IS_OK(status)) {
1371 goto fail;
1372 }
1373
1374 result = (struct wbcCredentialCacheInfo *)wbcAllocateMemory(
1375 1, sizeof(struct wbcCredentialCacheInfo),
1376 wbcCredentialCacheInfoDestructor);
1377 if (result == NULL) {
1378 status = WBC_ERR_NO_MEMORY;
1379 goto fail;
1380 }
1381 result->num_blobs = 0;
1382 result->blobs = NULL;
1383 status = wbcAddNamedBlob(&result->num_blobs, &result->blobs,
1384 "auth_blob", 0,
1385 (uint8_t *)response.extra_data.data,
1386 response.data.ccache_ntlm_auth.auth_blob_len);
1387 if (!WBC_ERROR_IS_OK(status)) {
1388 goto fail;
1389 }
1390 status = wbcAddNamedBlob(
1391 &result->num_blobs, &result->blobs, "session_key", 0,
1392 response.data.ccache_ntlm_auth.session_key,
1393 sizeof(response.data.ccache_ntlm_auth.session_key));
1394 if (!WBC_ERROR_IS_OK(status)) {
1395 goto fail;
1396 }
1397 if (response.data.ccache_ntlm_auth.new_spnego) {
1398 status = wbcAddNamedBlob(
1399 &result->num_blobs, &result->blobs, "new_spnego", 0,
1400 &response.data.ccache_ntlm_auth.new_spnego,
1401 sizeof(response.data.ccache_ntlm_auth.new_spnego));
1402 if (!WBC_ERROR_IS_OK(status)) {
1403 goto fail;
1404 }
1405 }
1406
1407 *info = result;
1408 result = NULL;
1409 status = WBC_ERR_SUCCESS;
1410fail:
1411 free(request.extra_data.data);
1412 winbindd_free_response(&response);
1413 wbcFreeMemory(result);
1414 return status;
1415}
1416
1417wbcErr wbcCredentialCache(struct wbcCredentialCacheParams *params,
1418 struct wbcCredentialCacheInfo **info,
1419 struct wbcAuthErrorInfo **error)
1420{
1421 return wbcCtxCredentialCache(NULL, params, info, error);
1422}
1423
1424/* Authenticate a user with cached credentials */
1425wbcErr wbcCtxCredentialSave(struct wbcContext *ctx,
1426 const char *user, const char *password)
1427{
1428 struct winbindd_request request;
1429 struct winbindd_response response;
1430
1431 ZERO_STRUCT(request);
1432 ZERO_STRUCT(response);
1433
1434 strncpy(request.data.ccache_save.user, user,
1435 sizeof(request.data.ccache_save.user)-1);
1436 strncpy(request.data.ccache_save.pass, password,
1437 sizeof(request.data.ccache_save.pass)-1);
1438 request.data.ccache_save.uid = getuid();
1439
1440 return wbcRequestResponse(ctx, WINBINDD_CCACHE_SAVE, &request, &response);
1441}
1442
1443wbcErr wbcCredentialSave(const char *user, const char *password)
1444{
1445 return wbcCtxCredentialSave(NULL, user, password);
1446}
Note: See TracBrowser for help on using the repository browser.