source: vendor/current/source3/auth/auth_domain.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 12.9 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Authenticate against a remote domain
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22#include "auth.h"
23#include "../libcli/auth/libcli_auth.h"
24#include "../librpc/gen_ndr/ndr_netlogon.h"
25#include "rpc_client/cli_pipe.h"
26#include "rpc_client/cli_netlogon.h"
27#include "secrets.h"
28#include "passdb.h"
29#include "libsmb/libsmb.h"
30#include "libcli/auth/netlogon_creds_cli.h"
31
32#undef DBGC_CLASS
33#define DBGC_CLASS DBGC_AUTH
34
35static struct named_mutex *mutex;
36
37/**
38 * Connect to a remote server for (inter)domain security authenticaion.
39 *
40 * @param cli the cli to return containing the active connection
41 * @param server either a machine name or text IP address to
42 * connect to.
43 * @param setup_creds_as domain account to setup credentials as
44 * @param sec_chan a switch value to distinguish between domain
45 * member and interdomain authentication
46 * @param trust_passwd the trust password to establish the
47 * credentials with.
48 *
49 **/
50
51static NTSTATUS connect_to_domain_password_server(struct cli_state **cli_ret,
52 const char *domain,
53 const char *dc_name,
54 const struct sockaddr_storage *dc_ss,
55 struct rpc_pipe_client **pipe_ret,
56 TALLOC_CTX *mem_ctx,
57 struct netlogon_creds_cli_context **creds_ret)
58{
59 TALLOC_CTX *frame = talloc_stackframe();
60 struct messaging_context *msg_ctx = server_messaging_context();
61 NTSTATUS result;
62 struct cli_state *cli = NULL;
63 struct rpc_pipe_client *netlogon_pipe = NULL;
64 struct netlogon_creds_cli_context *netlogon_creds = NULL;
65
66 *cli_ret = NULL;
67 *pipe_ret = NULL;
68 *creds_ret = NULL;
69
70 /* TODO: Send a SAMLOGON request to determine whether this is a valid
71 logonserver. We can avoid a 30-second timeout if the DC is down
72 if the SAMLOGON request fails as it is only over UDP. */
73
74 /* we use a mutex to prevent two connections at once - when a
75 Win2k PDC get two connections where one hasn't completed a
76 session setup yet it will send a TCP reset to the first
77 connection (tridge) */
78
79 /*
80 * With NT4.x DC's *all* authentication must be serialized to avoid
81 * ACCESS_DENIED errors if 2 auths are done from the same machine. JRA.
82 */
83
84 mutex = grab_named_mutex(NULL, dc_name, 10);
85 if (mutex == NULL) {
86 TALLOC_FREE(frame);
87 return NT_STATUS_NO_LOGON_SERVERS;
88 }
89
90 /* Attempt connection */
91 result = cli_full_connection(&cli, lp_netbios_name(), dc_name, dc_ss, 0,
92 "IPC$", "IPC", "", "", "", 0, SMB_SIGNING_IPC_DEFAULT);
93
94 if (!NT_STATUS_IS_OK(result)) {
95 /* map to something more useful */
96 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
97 result = NT_STATUS_NO_LOGON_SERVERS;
98 }
99
100 TALLOC_FREE(mutex);
101 TALLOC_FREE(frame);
102 return result;
103 }
104
105 /*
106 * We now have an anonymous connection to IPC$ on the domain password server.
107 */
108
109 result = cli_rpc_pipe_open_schannel(cli,
110 msg_ctx,
111 &ndr_table_netlogon,
112 NCACN_NP,
113 domain,
114 &netlogon_pipe,
115 frame,
116 &netlogon_creds);
117 if (!NT_STATUS_IS_OK(result)) {
118 DEBUG(0,("connect_to_domain_password_server: "
119 "unable to open the domain client session to "
120 "machine %s. Error was : %s.\n",
121 dc_name, nt_errstr(result)));
122 cli_shutdown(cli);
123 TALLOC_FREE(mutex);
124 TALLOC_FREE(frame);
125 return NT_STATUS_NO_LOGON_SERVERS;
126 }
127
128 /* We exit here with the mutex *locked*. JRA */
129
130 *cli_ret = cli;
131 *pipe_ret = netlogon_pipe;
132 *creds_ret = talloc_move(mem_ctx, &netlogon_creds);
133
134 TALLOC_FREE(frame);
135 return NT_STATUS_OK;
136}
137
138/***********************************************************************
139 Do the same as security=server, but using NT Domain calls and a session
140 key from the machine password. If the server parameter is specified
141 use it, otherwise figure out a server from the 'password server' param.
142************************************************************************/
143
144static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx,
145 const struct auth_usersupplied_info *user_info,
146 const char *domain,
147 uchar chal[8],
148 struct auth_serversupplied_info **server_info,
149 const char *dc_name,
150 const struct sockaddr_storage *dc_ss)
151
152{
153 TALLOC_CTX *frame = talloc_stackframe();
154 struct netr_SamInfo3 *info3 = NULL;
155 struct cli_state *cli = NULL;
156 struct rpc_pipe_client *netlogon_pipe = NULL;
157 struct netlogon_creds_cli_context *netlogon_creds = NULL;
158 NTSTATUS nt_status = NT_STATUS_NO_LOGON_SERVERS;
159 int i;
160 uint8_t authoritative = 0;
161 uint32_t flags = 0;
162
163 /*
164 * At this point, smb_apasswd points to the lanman response to
165 * the challenge in local_challenge, and smb_ntpasswd points to
166 * the NT response to the challenge in local_challenge. Ship
167 * these over the secure channel to a domain controller and
168 * see if they were valid.
169 */
170
171 /* rety loop for robustness */
172
173 for (i = 0; !NT_STATUS_IS_OK(nt_status) && (i < 3); i++) {
174 nt_status = connect_to_domain_password_server(&cli,
175 domain,
176 dc_name,
177 dc_ss,
178 &netlogon_pipe,
179 frame,
180 &netlogon_creds);
181 }
182
183 if ( !NT_STATUS_IS_OK(nt_status) ) {
184 DEBUG(0,("domain_client_validate: Domain password server not available.\n"));
185 TALLOC_FREE(frame);
186 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
187 return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
188 }
189 return nt_status;
190 }
191
192 /* store a successful connection */
193
194 saf_store(domain, dc_name);
195
196 /*
197 * If this call succeeds, we now have lots of info about the user
198 * in the info3 structure.
199 */
200
201 nt_status = rpccli_netlogon_network_logon(netlogon_creds,
202 netlogon_pipe->binding_handle,
203 mem_ctx,
204 user_info->logon_parameters, /* flags such as 'allow workstation logon' */
205 user_info->client.account_name, /* user name logging on. */
206 user_info->client.domain_name, /* domain name */
207 user_info->workstation_name, /* workstation name */
208 chal, /* 8 byte challenge. */
209 user_info->password.response.lanman, /* lanman 24 byte response */
210 user_info->password.response.nt, /* nt 24 byte response */
211 &authoritative,
212 &flags,
213 &info3); /* info3 out */
214
215 /* Let go as soon as possible so we avoid any potential deadlocks
216 with winbind lookup up users or groups. */
217
218 TALLOC_FREE(mutex);
219
220 if (!NT_STATUS_IS_OK(nt_status)) {
221 DEBUG(0,("domain_client_validate: unable to validate password "
222 "for user %s in domain %s to Domain controller %s. "
223 "Error was %s.\n", user_info->client.account_name,
224 user_info->client.domain_name, dc_name,
225 nt_errstr(nt_status)));
226
227 /* map to something more useful */
228 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_UNSUCCESSFUL)) {
229 nt_status = NT_STATUS_NO_LOGON_SERVERS;
230 }
231 } else {
232 nt_status = make_server_info_info3(mem_ctx,
233 user_info->client.account_name,
234 domain,
235 server_info,
236 info3);
237
238 if (NT_STATUS_IS_OK(nt_status)) {
239 (*server_info)->nss_token |= user_info->was_mapped;
240 netsamlogon_cache_store(user_info->client.account_name, info3);
241 TALLOC_FREE(info3);
242 }
243 }
244
245 /* Note - once the cli stream is shutdown the mem_ctx used
246 to allocate the other_sids and gids structures has been deleted - so
247 these pointers are no longer valid..... */
248
249 cli_shutdown(cli);
250 TALLOC_FREE(frame);
251 return nt_status;
252}
253
254/****************************************************************************
255 Check for a valid username and password in security=domain mode.
256****************************************************************************/
257
258static NTSTATUS check_ntdomain_security(const struct auth_context *auth_context,
259 void *my_private_data,
260 TALLOC_CTX *mem_ctx,
261 const struct auth_usersupplied_info *user_info,
262 struct auth_serversupplied_info **server_info)
263{
264 NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
265 const char *domain = lp_workgroup();
266 fstring dc_name;
267 struct sockaddr_storage dc_ss;
268
269 if ( lp_server_role() != ROLE_DOMAIN_MEMBER ) {
270 DEBUG(0,("check_ntdomain_security: Configuration error! Cannot use "
271 "ntdomain auth method when not a member of a domain.\n"));
272 return NT_STATUS_NOT_IMPLEMENTED;
273 }
274
275 if (!user_info || !server_info || !auth_context) {
276 DEBUG(1,("check_ntdomain_security: Critical variables not present. Failing.\n"));
277 return NT_STATUS_INVALID_PARAMETER;
278 }
279
280 DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
281
282 /*
283 * Check that the requested domain is not our own machine name.
284 * If it is, we should never check the PDC here, we use our own local
285 * password file.
286 */
287
288 if(strequal(get_global_sam_name(), user_info->mapped.domain_name)) {
289 DEBUG(3,("check_ntdomain_security: Requested domain was for this machine.\n"));
290 return NT_STATUS_NOT_IMPLEMENTED;
291 }
292
293 /* we need our DC to send the net_sam_logon() request to */
294
295 if ( !get_dc_name(domain, NULL, dc_name, &dc_ss) ) {
296 DEBUG(5,("check_ntdomain_security: unable to locate a DC for domain %s\n",
297 user_info->mapped.domain_name));
298 return NT_STATUS_NO_LOGON_SERVERS;
299 }
300
301 nt_status = domain_client_validate(mem_ctx,
302 user_info,
303 domain,
304 (uchar *)auth_context->challenge.data,
305 server_info,
306 dc_name,
307 &dc_ss);
308
309 return nt_status;
310}
311
312/* module initialisation */
313static NTSTATUS auth_init_ntdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method)
314{
315 struct auth_methods *result;
316
317 result = talloc_zero(auth_context, struct auth_methods);
318 if (result == NULL) {
319 return NT_STATUS_NO_MEMORY;
320 }
321 result->name = "ntdomain";
322 result->auth = check_ntdomain_security;
323
324 *auth_method = result;
325 return NT_STATUS_OK;
326}
327
328
329/****************************************************************************
330 Check for a valid username and password in a trusted domain
331****************************************************************************/
332
333static NTSTATUS check_trustdomain_security(const struct auth_context *auth_context,
334 void *my_private_data,
335 TALLOC_CTX *mem_ctx,
336 const struct auth_usersupplied_info *user_info,
337 struct auth_serversupplied_info **server_info)
338{
339 NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
340 fstring dc_name;
341 struct sockaddr_storage dc_ss;
342
343 if (!user_info || !server_info || !auth_context) {
344 DEBUG(1,("check_trustdomain_security: Critical variables not present. Failing.\n"));
345 return NT_STATUS_INVALID_PARAMETER;
346 }
347
348 DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
349
350 /*
351 * Check that the requested domain is not our own machine name or domain name.
352 */
353
354 if( strequal(get_global_sam_name(), user_info->mapped.domain_name)) {
355 DEBUG(3,("check_trustdomain_security: Requested domain [%s] was for this machine.\n",
356 user_info->mapped.domain_name));
357 return NT_STATUS_NOT_IMPLEMENTED;
358 }
359
360 /* No point is bothering if this is not a trusted domain.
361 This return makes "map to guest = bad user" work again.
362 The logic is that if we know nothing about the domain, that
363 user is not known to us and does not exist */
364
365 if ( !is_trusted_domain( user_info->mapped.domain_name ) )
366 return NT_STATUS_NOT_IMPLEMENTED;
367
368 /* use get_dc_name() for consistency even through we know that it will be
369 a netbios name */
370
371 if ( !get_dc_name(user_info->mapped.domain_name, NULL, dc_name, &dc_ss) ) {
372 DEBUG(5,("check_trustdomain_security: unable to locate a DC for domain %s\n",
373 user_info->mapped.domain_name));
374 return NT_STATUS_NO_LOGON_SERVERS;
375 }
376
377 nt_status = domain_client_validate(mem_ctx,
378 user_info,
379 user_info->mapped.domain_name,
380 (uchar *)auth_context->challenge.data,
381 server_info,
382 dc_name,
383 &dc_ss);
384
385 return nt_status;
386}
387
388/* module initialisation */
389static NTSTATUS auth_init_trustdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method)
390{
391 struct auth_methods *result;
392
393 result = talloc_zero(auth_context, struct auth_methods);
394 if (result == NULL) {
395 return NT_STATUS_NO_MEMORY;
396 }
397 result->name = "trustdomain";
398 result->auth = check_trustdomain_security;
399
400 *auth_method = result;
401 return NT_STATUS_OK;
402}
403
404NTSTATUS auth_domain_init(void)
405{
406 smb_register_auth(AUTH_INTERFACE_VERSION, "trustdomain", auth_init_trustdomain);
407 smb_register_auth(AUTH_INTERFACE_VERSION, "ntdomain", auth_init_ntdomain);
408 return NT_STATUS_OK;
409}
Note: See TracBrowser for help on using the repository browser.