source: vendor/current/source3/auth/user_krb5.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 8.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Simo Sorce 2010
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18*/
19
20#include "includes.h"
21#include "auth.h"
22#include "librpc/gen_ndr/krb5pac.h"
23#include "nsswitch/libwbclient/wbclient.h"
24#include "passdb.h"
25#include "lib/param/loadparm.h"
26
27#undef DBGC_CLASS
28#define DBGC_CLASS DBGC_AUTH
29
30#ifdef HAVE_KRB5
31NTSTATUS get_user_from_kerberos_info(TALLOC_CTX *mem_ctx,
32 const char *cli_name,
33 const char *princ_name,
34 struct PAC_LOGON_INFO *logon_info,
35 bool *is_mapped,
36 bool *mapped_to_guest,
37 char **ntuser,
38 char **ntdomain,
39 char **username,
40 struct passwd **_pw)
41{
42 NTSTATUS status;
43 char *domain = NULL;
44 char *realm = NULL;
45 char *user = NULL;
46 char *p;
47 char *fuser = NULL;
48 char *unixuser = NULL;
49 struct passwd *pw = NULL;
50
51 DEBUG(3, ("Kerberos ticket principal name is [%s]\n", princ_name));
52
53 p = strchr_m(princ_name, '@');
54 if (!p) {
55 DEBUG(3, ("[%s] Doesn't look like a valid principal\n",
56 princ_name));
57 return NT_STATUS_LOGON_FAILURE;
58 }
59
60 user = talloc_strndup(mem_ctx, princ_name, p - princ_name);
61 if (!user) {
62 return NT_STATUS_NO_MEMORY;
63 }
64
65 realm = talloc_strdup(talloc_tos(), p + 1);
66 if (!realm) {
67 return NT_STATUS_NO_MEMORY;
68 }
69
70 if (!strequal(realm, lp_realm())) {
71 DEBUG(3, ("Ticket for foreign realm %s@%s\n", user, realm));
72 if (!lp_allow_trusted_domains()) {
73 return NT_STATUS_LOGON_FAILURE;
74 }
75 }
76
77 if (logon_info && logon_info->info3.base.logon_domain.string) {
78 domain = talloc_strdup(mem_ctx,
79 logon_info->info3.base.logon_domain.string);
80 if (!domain) {
81 return NT_STATUS_NO_MEMORY;
82 }
83 DEBUG(10, ("Domain is [%s] (using PAC)\n", domain));
84 } else {
85
86 /* If we have winbind running, we can (and must) shorten the
87 username by using the short netbios name. Otherwise we will
88 have inconsistent user names. With Kerberos, we get the
89 fully qualified realm, with ntlmssp we get the short
90 name. And even w2k3 does use ntlmssp if you for example
91 connect to an ip address. */
92
93 wbcErr wbc_status;
94 struct wbcDomainInfo *info = NULL;
95
96 DEBUG(10, ("Mapping [%s] to short name using winbindd\n",
97 realm));
98
99 wbc_status = wbcDomainInfo(realm, &info);
100
101 if (WBC_ERROR_IS_OK(wbc_status)) {
102 domain = talloc_strdup(mem_ctx,
103 info->short_name);
104 wbcFreeMemory(info);
105 } else {
106 DEBUG(3, ("Could not find short name: %s\n",
107 wbcErrorString(wbc_status)));
108 domain = talloc_strdup(mem_ctx, realm);
109 }
110 if (!domain) {
111 return NT_STATUS_NO_MEMORY;
112 }
113 DEBUG(10, ("Domain is [%s] (using Winbind)\n", domain));
114 }
115
116 fuser = talloc_asprintf(mem_ctx,
117 "%s%c%s",
118 domain,
119 *lp_winbind_separator(),
120 user);
121 if (!fuser) {
122 return NT_STATUS_NO_MEMORY;
123 }
124
125 *is_mapped = map_username(mem_ctx, fuser, &fuser);
126 if (!fuser) {
127 return NT_STATUS_NO_MEMORY;
128 }
129 *mapped_to_guest = false;
130
131 pw = smb_getpwnam(mem_ctx, fuser, &unixuser, true);
132 if (pw) {
133 if (!unixuser) {
134 return NT_STATUS_NO_MEMORY;
135 }
136 /* if a real user check pam account restrictions */
137 /* only really perfomed if "obey pam restriction" is true */
138 /* do this before an eventual mapping to guest occurs */
139 status = smb_pam_accountcheck(pw->pw_name, cli_name);
140 if (!NT_STATUS_IS_OK(status)) {
141 DEBUG(1, ("PAM account restrictions prevent user "
142 "[%s] login\n", unixuser));
143 return status;
144 }
145 }
146 if (!pw) {
147
148 /* this was originally the behavior of Samba 2.2, if a user
149 did not have a local uid but has been authenticated, then
150 map them to a guest account */
151
152 if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID) {
153 *mapped_to_guest = true;
154 fuser = talloc_strdup(mem_ctx, lp_guest_account());
155 if (!fuser) {
156 return NT_STATUS_NO_MEMORY;
157 }
158 pw = smb_getpwnam(mem_ctx, fuser, &unixuser, true);
159 }
160
161 /* extra sanity check that the guest account is valid */
162 if (!pw) {
163 DBG_NOTICE("Username %s is invalid on this system\n",
164 fuser);
165 return NT_STATUS_LOGON_FAILURE;
166 }
167 }
168
169 if (!unixuser) {
170 return NT_STATUS_NO_MEMORY;
171 }
172
173 *username = talloc_strdup(mem_ctx, unixuser);
174 if (!*username) {
175 return NT_STATUS_NO_MEMORY;
176 }
177 *ntuser = user;
178 *ntdomain = domain;
179 *_pw = pw;
180
181 return NT_STATUS_OK;
182}
183
184NTSTATUS make_session_info_krb5(TALLOC_CTX *mem_ctx,
185 char *ntuser,
186 char *ntdomain,
187 char *username,
188 struct passwd *pw,
189 const struct netr_SamInfo3 *info3,
190 bool mapped_to_guest, bool username_was_mapped,
191 DATA_BLOB *session_key,
192 struct auth_session_info **session_info)
193{
194 NTSTATUS status;
195 struct auth_serversupplied_info *server_info;
196
197 if (mapped_to_guest) {
198 status = make_server_info_guest(mem_ctx, &server_info);
199 if (!NT_STATUS_IS_OK(status)) {
200 DEBUG(1, ("make_server_info_guest failed: %s!\n",
201 nt_errstr(status)));
202 return status;
203 }
204
205 } else if (info3) {
206 /* pass the unmapped username here since map_username()
207 will be called again in make_server_info_info3() */
208
209 status = make_server_info_info3(mem_ctx,
210 ntuser, ntdomain,
211 &server_info,
212 info3);
213 if (!NT_STATUS_IS_OK(status)) {
214 DEBUG(1, ("make_server_info_info3 failed: %s!\n",
215 nt_errstr(status)));
216 return status;
217 }
218
219 } else {
220 /*
221 * We didn't get a PAC, we have to make up the user
222 * ourselves. Try to ask the pdb backend to provide
223 * SID consistency with ntlmssp session setup
224 */
225 struct samu *sampass;
226
227 sampass = samu_new(talloc_tos());
228 if (sampass == NULL) {
229 return NT_STATUS_NO_MEMORY;
230 }
231
232 if (pdb_getsampwnam(sampass, username)) {
233 DEBUG(10, ("found user %s in passdb, calling "
234 "make_server_info_sam\n", username));
235 status = make_server_info_sam(mem_ctx,
236 sampass,
237 &server_info);
238 } else {
239 /*
240 * User not in passdb, make it up artificially
241 */
242 DEBUG(10, ("didn't find user %s in passdb, calling "
243 "make_server_info_pw\n", username));
244 status = make_server_info_pw(mem_ctx,
245 username,
246 pw,
247 &server_info);
248 }
249
250 TALLOC_FREE(sampass);
251
252 if (!NT_STATUS_IS_OK(status)) {
253 DEBUG(1, ("make_server_info_[sam|pw] failed: %s!\n",
254 nt_errstr(status)));
255 return status;
256 }
257
258 /* make_server_info_pw does not set the domain. Without this
259 * we end up with the local netbios name in substitutions for
260 * %D. */
261
262 if (server_info->info3 != NULL) {
263 server_info->info3->base.logon_domain.string =
264 talloc_strdup(server_info->info3, ntdomain);
265 }
266 }
267
268 server_info->nss_token |= username_was_mapped;
269
270 status = create_local_token(mem_ctx, server_info, session_key, ntuser, session_info);
271 talloc_free(server_info);
272 if (!NT_STATUS_IS_OK(status)) {
273 DEBUG(10,("failed to create local token: %s\n",
274 nt_errstr(status)));
275 return status;
276 }
277
278 return NT_STATUS_OK;
279}
280
281#else /* HAVE_KRB5 */
282NTSTATUS get_user_from_kerberos_info(TALLOC_CTX *mem_ctx,
283 const char *cli_name,
284 const char *princ_name,
285 struct PAC_LOGON_INFO *logon_info,
286 bool *is_mapped,
287 bool *mapped_to_guest,
288 char **ntuser,
289 char **ntdomain,
290 char **username,
291 struct passwd **_pw)
292{
293 return NT_STATUS_NOT_IMPLEMENTED;
294}
295
296NTSTATUS make_session_info_krb5(TALLOC_CTX *mem_ctx,
297 char *ntuser,
298 char *ntdomain,
299 char *username,
300 struct passwd *pw,
301 const struct netr_SamInfo3 *info3,
302 bool mapped_to_guest, bool username_was_mapped,
303 DATA_BLOB *session_key,
304 struct auth_session_info **session_info)
305{
306 return NT_STATUS_NOT_IMPLEMENTED;
307}
308
309#endif /* HAVE_KRB5 */
Note: See TracBrowser for help on using the repository browser.