Changeset 745 for trunk/server/source4/auth/ntlm

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/auth/ntlm/auth.c (modified) (21 diffs)
• source4/auth/ntlm/auth_anonymous.c (modified) (1 diff)
• source4/auth/ntlm/auth_developer.c (modified) (5 diffs)
• source4/auth/ntlm/auth_proto.h (deleted)
• source4/auth/ntlm/auth_sam.c (modified) (19 diffs)
• source4/auth/ntlm/auth_server.c (modified) (10 diffs)
• source4/auth/ntlm/auth_server_service.c (copied) (copied from vendor/current/source4/auth/ntlm/auth_server_service.c )
• source4/auth/ntlm/auth_simple.c (modified) (5 diffs)
• source4/auth/ntlm/auth_unix.c (modified) (8 diffs)
• source4/auth/ntlm/auth_util.c (modified) (8 diffs)
• source4/auth/ntlm/auth_winbind.c (modified) (13 diffs)
• source4/auth/ntlm/config.mk (deleted)
• source4/auth/ntlm/pam_errors.c (deleted)
• source4/auth/ntlm/pam_errors.h (deleted)
• source4/auth/ntlm/wscript_build (copied) (copied from vendor/current/source4/auth/ntlm/wscript_build )

trunk/server/source4/auth/ntlm/auth.c

@@ -20 +20 @@
 
 #include "includes.h"
+#include <tevent.h>
+#include "../lib/util/tevent_ntstatus.h"
 #include "../lib/util/dlinklist.h"
 #include "auth/auth.h"
 #include "auth/ntlm/auth_proto.h"
-#include "lib/events/events.h"
 #include "param/param.h"
+#include "dsdb/samdb/samdb.h"
+
 
 /***************************************************************************
@@ -43 +46 @@
  Set a fixed challenge
 ***************************************************************************/
-bool auth_challenge_may_be_modified(struct auth_context *auth_ctx) 
+_PUBLIC_ bool auth_challenge_may_be_modified(struct auth_context *auth_ctx)
 {
         return auth_ctx->challenge.may_be_modified;
@@ -52 +55 @@
  Returns a const char of length 8 bytes.
 ****************************************************************************/
-_PUBLIC_ NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, const uint8_t **_chal)
+_PUBLIC_ NTSTATUS auth_get_challenge(struct auth_context *auth_ctx, uint8_t chal[8])
 {
         NTSTATUS nt_status;
         struct auth_method_context *method;
 
-        if (auth_ctx->challenge.data.length) {
+        if (auth_ctx->challenge.data.length == 8) {
                 DEBUG(5, ("auth_get_challenge: returning previous challenge by module %s (normal)\n", 
                           auth_ctx->challenge.set_by));
-                *_chal = auth_ctx->challenge.data.data;
+                memcpy(chal, auth_ctx->challenge.data.data, 8);
                 return NT_STATUS_OK;
         }
 
         for (method = auth_ctx->methods; method; method = method->next) {
-                DATA_BLOB challenge = data_blob(NULL,0);
-
-                nt_status = method->ops->get_challenge(method, auth_ctx, &challenge);
+                nt_status = method->ops->get_challenge(method, auth_ctx, chal);
                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOT_IMPLEMENTED)) {
                         continue;
@@ -74 +75 @@
                 NT_STATUS_NOT_OK_RETURN(nt_status);
 
-                if (challenge.length != 8) {
-                        DEBUG(0, ("auth_get_challenge: invalid challenge (length %u) by mothod [%s]\n",
-                                (unsigned)challenge.length, method->ops->name));
-                        return NT_STATUS_INTERNAL_ERROR;
-                }
-
-                auth_ctx->challenge.data        = challenge;
+                auth_ctx->challenge.data        = data_blob_talloc(auth_ctx, chal, 8);
+                NT_STATUS_HAVE_NO_MEMORY(auth_ctx->challenge.data.data);
                 auth_ctx->challenge.set_by      = method->ops->name;
 
@@ -87 +83 @@
 
         if (!auth_ctx->challenge.set_by) {
-                uint8_t chal[8];
                 generate_random_buffer(chal, 8);
 
@@ -100 +95 @@
                  auth_ctx->challenge.set_by));
 
-        *_chal = auth_ctx->challenge.data.data;
         return NT_STATUS_OK;
 }
 
 /****************************************************************************
- Try to get a challenge out of the various authentication modules.
- Returns a const char of length 8 bytes.
+Used in the gensec_gssapi and gensec_krb5 server-side code, where the
+PAC isn't available, and for tokenGroups in the DSDB stack.
+
+ Supply either a principal or a DN
 ****************************************************************************/
-_PUBLIC_ NTSTATUS auth_get_server_info_principal(TALLOC_CTX *mem_ctx, 
-                                                  struct auth_context *auth_ctx,
-                                                  const char *principal,
-                                                  struct auth_serversupplied_info **server_info)
+_PUBLIC_ NTSTATUS auth_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
+                                                 struct auth_context *auth_ctx,
+                                                 const char *principal,
+                                                 struct ldb_dn *user_dn,
+                                                 struct auth_user_info_dc **user_info_dc)
 {
         NTSTATUS nt_status;
@@ -117 +114 @@
 
         for (method = auth_ctx->methods; method; method = method->next) {
-                if (!method->ops->get_server_info_principal) {
+                if (!method->ops->get_user_info_dc_principal) {
                         continue;
                 }
 
-                nt_status = method->ops->get_server_info_principal(mem_ctx, auth_ctx, principal, server_info);
+                nt_status = method->ops->get_user_info_dc_principal(mem_ctx, auth_ctx, principal, user_dn, user_info_dc);
                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NOT_IMPLEMENTED)) {
                         continue;
                 }
 
-                NT_STATUS_NOT_OK_RETURN(nt_status);
-
-                break;
-        }
-
-        return NT_STATUS_OK;
-}
-
-struct auth_check_password_sync_state {
-        bool finished;
-        NTSTATUS status;
-        struct auth_serversupplied_info *server_info;
-};
-
-static void auth_check_password_sync_callback(struct auth_check_password_request *req,
-                                              void *private_data)
-{
-        struct auth_check_password_sync_state *s = talloc_get_type(private_data,
-                                                   struct auth_check_password_sync_state);
-
-        s->finished = true;
-        s->status = auth_check_password_recv(req, s, &s->server_info);
+                return nt_status;
+        }
+
+        return NT_STATUS_NOT_IMPLEMENTED;
 }
 
@@ -155 +134 @@
  *
  * Check a user's password, as given in the user_info struct and return various
- * interesting details in the server_info struct.
- *
- * The return value takes precedence over the contents of the server_info 
+ * interesting details in the user_info_dc struct.
+ *
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents 
  * of that structure is undefined.
@@ -168 +147 @@
  * @param user_info Contains the user supplied components, including the passwords.
  *
- * @param mem_ctx The parent memory context for the server_info structure
- *
- * @param server_info If successful, contains information about the authentication, 
+ * @param mem_ctx The parent memory context for the user_info_dc structure
+ *
+ * @param user_info_dc If successful, contains information about the authentication,
  *                    including a SAM_ACCOUNT struct describing the user.
  *
@@ -180 +159 @@
                              TALLOC_CTX *mem_ctx,
                              const struct auth_usersupplied_info *user_info, 
-                             struct auth_serversupplied_info **server_info)
-{
-        struct auth_check_password_sync_state *sync_state;
+                             struct auth_user_info_dc **user_info_dc)
+{
+        struct tevent_req *subreq;
+        struct tevent_context *ev;
+        bool ok;
         NTSTATUS status;
 
-        sync_state = talloc_zero(auth_ctx, struct auth_check_password_sync_state);
-        NT_STATUS_HAVE_NO_MEMORY(sync_state);
-
-        auth_check_password_send(auth_ctx, user_info, auth_check_password_sync_callback, sync_state);
-
-        while (!sync_state->finished) {
-                event_loop_once(auth_ctx->event_ctx);
-        }
-
-        status = sync_state->status;
-
-        if (NT_STATUS_IS_OK(status)) {
-                *server_info = talloc_steal(mem_ctx, sync_state->server_info);
-        }
-
-        talloc_free(sync_state);
+        /*TODO: create a new event context here! */
+        ev = auth_ctx->event_ctx;
+
+        subreq = auth_check_password_send(mem_ctx,
+                                          ev,
+                                          auth_ctx,
+                                          user_info);
+        if (subreq == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        ok = tevent_req_poll(subreq, ev);
+        if (!ok) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        status = auth_check_password_recv(subreq, mem_ctx, user_info_dc);
+        TALLOC_FREE(subreq);
+
         return status;
 }
 
-struct auth_check_password_request {
+struct auth_check_password_state {
         struct auth_context *auth_ctx;
         const struct auth_usersupplied_info *user_info;
-        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
         struct auth_method_context *method;
-        NTSTATUS status;
-        struct {
-                void (*fn)(struct auth_check_password_request *req, void *private_data);
-                void *private_data;
-        } callback;
 };
 
-static void auth_check_password_async_timed_handler(struct tevent_context *ev, struct tevent_timer *te,
-                                                    struct timeval t, void *ptr)
-{
-        struct auth_check_password_request *req = talloc_get_type(ptr, struct auth_check_password_request);
-        req->status = req->method->ops->check_password(req->method, req, req->user_info, &req->server_info);
-        req->callback.fn(req, req->callback.private_data);
-}
-
+static void auth_check_password_async_trigger(struct tevent_context *ev,
+                                              struct tevent_immediate *im,
+                                              void *private_data);
 /**
  * Check a user's Plaintext, LM or NTLM password.
@@ -229 +203 @@
  *
  * Check a user's password, as given in the user_info struct and return various
- * interesting details in the server_info struct.
- *
- * The return value takes precedence over the contents of the server_info 
+ * interesting details in the user_info_dc struct.
+ *
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents 
  * of that structure is undefined.
+ *
+ * @param mem_ctx The memory context the request should operate on
+ *
+ * @param ev The tevent context the request should operate on
  *
  * @param auth_ctx Supplies the challenges and some other data. 
@@ -242 +220 @@
  * @param user_info Contains the user supplied components, including the passwords.
  *
- * @param callback A callback function which will be called when the operation is finished.
- *                 The callback function needs to call auth_check_password_recv() to get the return values
- *
- * @param private_data A private pointer which will ba passed to the callback function
+ * @return The request handle or NULL on no memory error.
  *
  **/
 
-_PUBLIC_ void auth_check_password_send(struct auth_context *auth_ctx,
-                              const struct auth_usersupplied_info *user_info,
-                              void (*callback)(struct auth_check_password_request *req, void *private_data),
-                              void *private_data)
-{
+_PUBLIC_ struct tevent_req *auth_check_password_send(TALLOC_CTX *mem_ctx,
+                                struct tevent_context *ev,
+                                struct auth_context *auth_ctx,
+                                const struct auth_usersupplied_info *user_info)
+{
+        struct tevent_req *req;
+        struct auth_check_password_state *state;
         /* if all the modules say 'not for me' this is reasonable */
         NTSTATUS nt_status;
+        uint8_t chal[8];
+        struct auth_usersupplied_info *user_info_tmp;
+        struct tevent_immediate *im;
+
+        DEBUG(3,("auth_check_password_send: "
+                 "Checking password for unmapped user [%s]\\[%s]@[%s]\n",
+                 user_info->client.domain_name, user_info->client.account_name,
+                 user_info->workstation_name));
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct auth_check_password_state);
+        if (req == NULL) {
+                return NULL;
+        }
+
+        state->auth_ctx         = auth_ctx;
+        state->user_info        = user_info;
+
+        if (!user_info->mapped_state) {
+                nt_status = map_user_info(req, lpcfg_workgroup(auth_ctx->lp_ctx),
+                                          user_info, &user_info_tmp);
+                if (tevent_req_nterror(req, nt_status)) {
+                        return tevent_req_post(req, ev);
+                }
+                user_info = user_info_tmp;
+                state->user_info = user_info_tmp;
+        }
+
+        DEBUGADD(3,("auth_check_password_send: "
+                    "mapped user is: [%s]\\[%s]@[%s]\n",
+                    user_info->mapped.domain_name,
+                    user_info->mapped.account_name,
+                    user_info->workstation_name));
+
+        nt_status = auth_get_challenge(auth_ctx, chal);
+        if (tevent_req_nterror(req, nt_status)) {
+                DEBUG(0,("auth_check_password_send: "
+                         "Invalid challenge (length %u) stored for "
+                         "this auth context set_by %s - cannot continue: %s\n",
+                        (unsigned)auth_ctx->challenge.data.length,
+                        auth_ctx->challenge.set_by,
+                        nt_errstr(nt_status)));
+                return tevent_req_post(req, ev);
+        }
+
+        if (auth_ctx->challenge.set_by) {
+                DEBUG(10,("auth_check_password_send: "
+                          "auth_context challenge created by %s\n",
+                          auth_ctx->challenge.set_by));
+        }
+
+        DEBUG(10, ("auth_check_password_send: challenge is: \n"));
+        dump_data(5, auth_ctx->challenge.data.data,
+                  auth_ctx->challenge.data.length);
+
+        im = tevent_create_immediate(state);
+        if (tevent_req_nomem(im, req)) {
+                return tevent_req_post(req, ev);
+        }
+
+        tevent_schedule_immediate(im,
+                                  auth_ctx->event_ctx,
+                                  auth_check_password_async_trigger,
+                                  req);
+        return req;
+}
+
+static void auth_check_password_async_trigger(struct tevent_context *ev,
+                                              struct tevent_immediate *im,
+                                              void *private_data)
+{
+        struct tevent_req *req =
+                talloc_get_type_abort(private_data, struct tevent_req);
+        struct auth_check_password_state *state =
+                tevent_req_data(req, struct auth_check_password_state);
+        NTSTATUS status;
         struct auth_method_context *method;
-        const uint8_t *challenge;
-        struct auth_usersupplied_info *user_info_tmp;
-        struct auth_check_password_request *req = NULL;
-
-        DEBUG(3,   ("auth_check_password_send:  Checking password for unmapped user [%s]\\[%s]@[%s]\n", 
-                    user_info->client.domain_name, user_info->client.account_name, user_info->workstation_name));
-
-        req = talloc_zero(auth_ctx, struct auth_check_password_request);
-        if (!req) {
-                callback(NULL, private_data);
+
+        status = NT_STATUS_OK;
+
+        for (method=state->auth_ctx->methods; method; method = method->next) {
+
+                /* we fill in state->method here so debug messages in
+                   the callers know which method failed */
+                state->method = method;
+
+                /* check if the module wants to check the password */
+                status = method->ops->want_check(method, req, state->user_info);
+                if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                        DEBUG(11,("auth_check_password_send: "
+                                  "%s had nothing to say\n",
+                                  method->ops->name));
+                        continue;
+                }
+
+                if (tevent_req_nterror(req, status)) {
+                        return;
+                }
+
+                status = method->ops->check_password(method,
+                                                     state,
+                                                     state->user_info,
+                                                     &state->user_info_dc);
+                if (!NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                        /* the backend has handled the request */
+                        break;
+                }
+        }
+
+        if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
+                /* don't expose the NT_STATUS_NOT_IMPLEMENTED
+                   internals */
+                status = NT_STATUS_NO_SUCH_USER;
+        }
+
+        if (tevent_req_nterror(req, status)) {
                 return;
         }
-        req->auth_ctx                   = auth_ctx;
-        req->user_info                  = user_info;
-        req->callback.fn                = callback;
-        req->callback.private_data      = private_data;
-
-        if (!user_info->mapped_state) {
-                nt_status = map_user_info(req, lp_workgroup(auth_ctx->lp_ctx), user_info, &user_info_tmp);
-                if (!NT_STATUS_IS_OK(nt_status)) goto failed;
-                user_info = user_info_tmp;
-                req->user_info  = user_info_tmp;
-        }
-
-        DEBUGADD(3,("auth_check_password_send:  mapped user is: [%s]\\[%s]@[%s]\n", 
-                    user_info->mapped.domain_name, user_info->mapped.account_name, user_info->workstation_name));
-
-        nt_status = auth_get_challenge(auth_ctx, &challenge);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(0, ("auth_check_password_send:  Invalid challenge (length %u) stored for this auth context set_by %s - cannot continue: %s\n",
-                        (unsigned)auth_ctx->challenge.data.length, auth_ctx->challenge.set_by, nt_errstr(nt_status)));
-                goto failed;
-        }
-
-        if (auth_ctx->challenge.set_by) {
-                DEBUG(10, ("auth_check_password_send: auth_context challenge created by %s\n",
-                                        auth_ctx->challenge.set_by));
-        }
-
-        DEBUG(10, ("auth_check_password_send: challenge is: \n"));
-        dump_data(5, auth_ctx->challenge.data.data, auth_ctx->challenge.data.length);
-
-        nt_status = NT_STATUS_NO_SUCH_USER; /* If all the modules say 'not for me', then this is reasonable */
-        for (method = auth_ctx->methods; method; method = method->next) {
-                NTSTATUS result;
-                struct tevent_timer *te = NULL;
-
-                /* check if the module wants to chek the password */
-                result = method->ops->want_check(method, req, user_info);
-                if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
-                        DEBUG(11,("auth_check_password_send: %s had nothing to say\n", method->ops->name));
-                        continue;
-                }
-
-                nt_status = result;
-                req->method     = method;
-
-                if (!NT_STATUS_IS_OK(nt_status)) break;
-
-                te = event_add_timed(auth_ctx->event_ctx, req,
-                                     timeval_zero(),
-                                     auth_check_password_async_timed_handler, req);
-                if (!te) {
-                        nt_status = NT_STATUS_NO_MEMORY;
-                        goto failed;
-                }
-                return;
-        }
-
-failed:
-        req->status = nt_status;
-        req->callback.fn(req, req->callback.private_data);
+
+        tevent_req_done(req);
 }
 
@@ -335 +359 @@
  * async receive function
  *
- * The return value takes precedence over the contents of the server_info 
+ * The return value takes precedence over the contents of the user_info_dc
  * struct.  When the return is other than NT_STATUS_OK the contents 
  * of that structure is undefined.
  *
  *
- * @param req The async auth_check_password state, passes to the callers callback function
- *
- * @param mem_ctx The parent memory context for the server_info structure
- *
- * @param server_info If successful, contains information about the authentication, 
+ * @param req The async request state
+ *
+ * @param mem_ctx The parent memory context for the user_info_dc structure
+ *
+ * @param user_info_dc If successful, contains information about the authentication,
  *                    including a SAM_ACCOUNT struct describing the user.
  *
@@ -351 +375 @@
  **/
 
-_PUBLIC_ NTSTATUS auth_check_password_recv(struct auth_check_password_request *req,
+_PUBLIC_ NTSTATUS auth_check_password_recv(struct tevent_req *req,
                                   TALLOC_CTX *mem_ctx,
-                                  struct auth_serversupplied_info **server_info)
-{
+                                  struct auth_user_info_dc **user_info_dc)
+{
+        struct auth_check_password_state *state =
+                tevent_req_data(req, struct auth_check_password_state);
         NTSTATUS status;
 
-        NT_STATUS_HAVE_NO_MEMORY(req);
-
-        if (NT_STATUS_IS_OK(req->status)) {
-                DEBUG(5,("auth_check_password_recv: %s authentication for user [%s\\%s] succeeded\n",
-                         req->method->ops->name, req->server_info->domain_name, req->server_info->account_name));
-
-                *server_info = talloc_steal(mem_ctx, req->server_info);
-        } else {
-                DEBUG(2,("auth_check_password_recv: %s authentication for user [%s\\%s] FAILED with error %s\n", 
-                         (req->method ? req->method->ops->name : "NO_METHOD"),
-                         req->user_info->mapped.domain_name,
-                         req->user_info->mapped.account_name, 
-                         nt_errstr(req->status)));
-        }
-
-        status = req->status;
-        talloc_free(req);
-        return status;
+        if (tevent_req_is_nterror(req, &status)) {
+                DEBUG(2,("auth_check_password_recv: "
+                         "%s authentication for user [%s\\%s] "
+                         "FAILED with error %s\n",
+                         (state->method ? state->method->ops->name : "NO_METHOD"),
+                         state->user_info->mapped.domain_name,
+                         state->user_info->mapped.account_name,
+                         nt_errstr(status)));
+                tevent_req_received(req);
+                return status;
+        }
+
+        DEBUG(5,("auth_check_password_recv: "
+                 "%s authentication for user [%s\\%s] succeeded\n",
+                 state->method->ops->name,
+                 state->user_info_dc->info->domain_name,
+                 state->user_info_dc->info->account_name));
+
+        *user_info_dc = talloc_move(mem_ctx, &state->user_info_dc);
+
+        tevent_req_received(req);
+        return NT_STATUS_OK;
+}
+
+/* Wrapper because we don't want to expose all callers to needing to
+ * know that session_info is generated from the main ldb */
+static NTSTATUS auth_generate_session_info_wrapper(TALLOC_CTX *mem_ctx,
+                                                   struct auth_context *auth_context,
+                                                   struct auth_user_info_dc *user_info_dc,
+                                                   uint32_t session_info_flags,
+                                                   struct auth_session_info **session_info)
+{
+        return auth_generate_session_info(mem_ctx, auth_context->lp_ctx,
+                                          auth_context->sam_ctx, user_info_dc,
+                                          session_info_flags, session_info);
 }
 
 /***************************************************************************
  Make a auth_info struct for the auth subsystem
- - Allow the caller to specify the methods to use
+ - Allow the caller to specify the methods to use, including optionally the SAM to use
 ***************************************************************************/
 _PUBLIC_ NTSTATUS auth_context_create_methods(TALLOC_CTX *mem_ctx, const char **methods, 
-                                     struct tevent_context *ev,
-                                     struct messaging_context *msg,
-                                     struct loadparm_context *lp_ctx,
-                                     struct auth_context **auth_ctx)
+                                              struct tevent_context *ev,
+                                              struct messaging_context *msg,
+                                              struct loadparm_context *lp_ctx,
+                                              struct ldb_context *sam_ctx,
+                                              struct auth_context **auth_ctx)
 {
         int i;
         struct auth_context *ctx;
 
-        auth_init();
-
-        if (!methods) {
-                DEBUG(0,("auth_context_create: No auth method list!?\n"));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
+        auth4_init();
 
         if (!ev) {
                 DEBUG(0,("auth_context_create: called with out event context\n"));
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
-        if (!msg) {
-                DEBUG(0,("auth_context_create: called with out messaging context\n"));
                 return NT_STATUS_INTERNAL_ERROR;
         }
@@ -417 +451 @@
         ctx->lp_ctx                     = lp_ctx;
 
-        for (i=0; methods[i] ; i++) {
+        if (sam_ctx) {
+                ctx->sam_ctx = sam_ctx;
+        } else {
+                ctx->sam_ctx = samdb_connect(ctx, ctx->event_ctx, ctx->lp_ctx, system_session(ctx->lp_ctx), 0);
+        }
+
+        for (i=0; methods && methods[i] ; i++) {
                 struct auth_method_context *method;
 
@@ -434 +474 @@
         }
 
-        if (!ctx->methods) {
-                return NT_STATUS_INTERNAL_ERROR;
-        }
-
         ctx->check_password = auth_check_password;
         ctx->get_challenge = auth_get_challenge;
         ctx->set_challenge = auth_context_set_challenge;
         ctx->challenge_may_be_modified = auth_challenge_may_be_modified;
-        ctx->get_server_info_principal = auth_get_server_info_principal;
+        ctx->get_user_info_dc_principal = auth_get_user_info_dc_principal;
+        ctx->generate_session_info = auth_generate_session_info_wrapper;
 
         *auth_ctx = ctx;
@@ -448 +485 @@
         return NT_STATUS_OK;
 }
+
+const char **auth_methods_from_lp(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx)
+{
+        const char **auth_methods = NULL;
+        switch (lpcfg_server_role(lp_ctx)) {
+        case ROLE_STANDALONE:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "standalone", NULL);
+                break;
+        case ROLE_DOMAIN_MEMBER:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "member server", NULL);
+                break;
+        case ROLE_DOMAIN_CONTROLLER:
+                auth_methods = lpcfg_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "domain controller", NULL);
+                break;
+        }
+        return auth_methods;
+}
+
 /***************************************************************************
  Make a auth_info struct for the auth subsystem
  - Uses default auth_methods, depending on server role and smb.conf settings
 ***************************************************************************/
-_PUBLIC_ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx, 
+_PUBLIC_ NTSTATUS auth_context_create(TALLOC_CTX *mem_ctx,
                              struct tevent_context *ev,
                              struct messaging_context *msg,
@@ -458 +513 @@
                              struct auth_context **auth_ctx)
 {
-        const char **auth_methods = NULL;
-        switch (lp_server_role(lp_ctx)) {
-        case ROLE_STANDALONE:
-                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "standalone", NULL);
-                break;
-        case ROLE_DOMAIN_MEMBER:
-                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "member server", NULL);
-                break;
-        case ROLE_DOMAIN_CONTROLLER:
-                auth_methods = lp_parm_string_list(mem_ctx, lp_ctx, NULL, "auth methods", "domain controller", NULL);
-                break;
-        }
-        return auth_context_create_methods(mem_ctx, auth_methods, ev, msg, lp_ctx, auth_ctx);
-}
-
+        NTSTATUS status;
+        const char **auth_methods;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        auth_methods = auth_methods_from_lp(tmp_ctx, lp_ctx);
+        if (!auth_methods) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        status = auth_context_create_methods(mem_ctx, auth_methods, ev, msg, lp_ctx, NULL, auth_ctx);
+        talloc_free(tmp_ctx);
+        return status;
+}
+
+/* Create an auth context from an open LDB.
+
+   This allows us not to re-open the LDB when we need to do a some authentication logic (such as tokenGroups)
+
+ */
+NTSTATUS auth_context_create_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb, struct auth_context **auth_ctx)
+{
+        NTSTATUS status;
+        const char **auth_methods;
+        struct loadparm_context *lp_ctx = talloc_get_type_abort(ldb_get_opaque(ldb, "loadparm"), struct loadparm_context);
+        struct tevent_context *ev = ldb_get_event_context(ldb);
+
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        auth_methods = auth_methods_from_lp(tmp_ctx, lp_ctx);
+        if (!auth_methods) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        status = auth_context_create_methods(mem_ctx, auth_methods, ev, NULL, lp_ctx, ldb, auth_ctx);
+        talloc_free(tmp_ctx);
+        return status;
+}
 
 /* the list of currently registered AUTH backends */
@@ -545 +626 @@
                 sizeof(struct auth_context),
                 sizeof(struct auth_usersupplied_info),
-                sizeof(struct auth_serversupplied_info)
+                sizeof(struct auth_user_info_dc)
         };
 
@@ -551 +632 @@
 }
 
-_PUBLIC_ NTSTATUS auth_init(void)
+_PUBLIC_ NTSTATUS auth4_init(void)
 {
         static bool initialized = false;
-        extern NTSTATUS auth_developer_init(void);
-        extern NTSTATUS auth_winbind_init(void);
-        extern NTSTATUS auth_anonymous_init(void);
-        extern NTSTATUS auth_unix_init(void);
-        extern NTSTATUS auth_sam_init(void);
-        extern NTSTATUS auth_server_init(void);
-
-        init_module_fn static_init[] = { STATIC_auth_MODULES };
+#define _MODULE_PROTO(init) extern NTSTATUS init(void);
+        STATIC_auth4_MODULES_PROTO;
+        init_module_fn static_init[] = { STATIC_auth4_MODULES };
         
         if (initialized) return NT_STATUS_OK;
@@ -570 +646 @@
         return NT_STATUS_OK;    
 }
-
-NTSTATUS server_service_auth_init(void)
-{
-        return auth_init();
-}

trunk/server/source4/auth/ntlm/auth_anonymous.c

@@ -53 +53 @@
                                          TALLOC_CTX *mem_ctx,
                                          const struct auth_usersupplied_info *user_info, 
-                                         struct auth_serversupplied_info **_server_info)
+                                         struct auth_user_info_dc **_user_info_dc)
 {
-        return auth_anonymous_server_info(mem_ctx, lp_netbios_name(ctx->auth_ctx->lp_ctx), _server_info);
+        return auth_anonymous_user_info_dc(mem_ctx, lpcfg_netbios_name(ctx->auth_ctx->lp_ctx), _user_info_dc);
 }
 

trunk/server/source4/auth/ntlm/auth_developer.c

@@ -24 +24 @@
 #include "auth/ntlm/auth_proto.h"
 #include "libcli/security/security.h"
-#include "librpc/gen_ndr/ndr_samr.h"
 
 static NTSTATUS name_to_ntstatus_want_check(struct auth_method_context *ctx,
@@ -49 +48 @@
                                                 TALLOC_CTX *mem_ctx,
                                                 const struct auth_usersupplied_info *user_info, 
-                                                struct auth_serversupplied_info **_server_info)
+                                                struct auth_user_info_dc **_user_info_dc)
 {
         NTSTATUS nt_status;
-        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
         uint32_t error_num;
         const char *user;
@@ -67 +67 @@
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
-        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
-        NT_STATUS_HAVE_NO_MEMORY(server_info);
-
-        server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_ANONYMOUS);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
-
-        /* is this correct? */
-        server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_GUESTS);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
-
-        server_info->n_domain_groups = 0;
-        server_info->domain_groups = NULL;
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+
+        /* This returns a pointer to a struct dom_sid, which is the
+         * same as a 1 element list of struct dom_sid */
+        user_info_dc->num_sids = 1;
+        user_info_dc->sids = dom_sid_parse_talloc(user_info_dc, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->sids);
 
         /* annoying, but the Anonymous really does have a session key, 
            and it is all zeros! */
-        server_info->user_session_key = data_blob_talloc(server_info, NULL, 16);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->user_session_key.data);
-
-        server_info->lm_session_key = data_blob_talloc(server_info, NULL, 16);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->lm_session_key.data);
-
-        data_blob_clear(&server_info->user_session_key);
-        data_blob_clear(&server_info->lm_session_key);
-
-        server_info->account_name = talloc_asprintf(server_info, "NAME TO NTSTATUS %s ANONYMOUS LOGON", user);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
-
-        server_info->domain_name = talloc_strdup(server_info, "NT AUTHORITY");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
-
-        server_info->full_name = talloc_asprintf(server_info, "NAME TO NTSTATUS %s Anonymous Logon", user);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
-
-        server_info->logon_script = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
-
-        server_info->profile_path = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
-
-        server_info->home_directory = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
-
-        server_info->home_drive = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
-
-        server_info->last_logon = 0;
-        server_info->last_logoff = 0;
-        server_info->acct_expiry = 0;
-        server_info->last_password_change = 0;
-        server_info->allow_password_change = 0;
-        server_info->force_password_change = 0;
-
-        server_info->logon_count = 0;
-        server_info->bad_password_count = 0;
-
-        server_info->acct_flags = ACB_NORMAL;
-
-        server_info->authenticated = false;
-
-        *_server_info = server_info;
+        user_info_dc->user_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->user_session_key.data);
+
+        user_info_dc->lm_session_key = data_blob_talloc(user_info_dc, NULL, 16);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->lm_session_key.data);
+
+        data_blob_clear(&user_info_dc->user_session_key);
+        data_blob_clear(&user_info_dc->lm_session_key);
+
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+
+        info->account_name = talloc_asprintf(user_info_dc, "NAME TO NTSTATUS %s ANONYMOUS LOGON", user);
+        NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+
+        info->domain_name = talloc_strdup(user_info_dc, "NT AUTHORITY");
+        NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
+
+        info->full_name = talloc_asprintf(user_info_dc, "NAME TO NTSTATUS %s Anonymous Logon", user);
+        NT_STATUS_HAVE_NO_MEMORY(info->full_name);
+
+        info->logon_script = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+
+        info->profile_path = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+
+        info->home_directory = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+
+        info->home_drive = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+
+        info->acct_flags = ACB_NORMAL;
+
+        info->authenticated = true;
+
+        *_user_info_dc = user_info_dc;
 
         return nt_status;
@@ -152 +151 @@
  * @return NT_STATUS_UNSUCCESSFUL
  **/
-static NTSTATUS fixed_challenge_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *_blob)
-{
-        DATA_BLOB blob;
+static NTSTATUS fixed_challenge_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8])
+{
         const char *challenge = "I am a teapot";
 
-        blob = data_blob_talloc(mem_ctx, challenge, 8);
-        NT_STATUS_HAVE_NO_MEMORY(blob.data);
-
-        *_blob = blob;
+        memcpy(chal, challenge, 8);
+
         return NT_STATUS_OK;
 }
@@ -175 +171 @@
                                                TALLOC_CTX *mem_ctx,
                                                const struct auth_usersupplied_info *user_info,
-                                               struct auth_serversupplied_info **_server_info)
+                                               struct auth_user_info_dc **_user_info_dc)
 {
         /* don't handle any users */

trunk/server/source4/auth/ntlm/auth_sam.c

@@ -21 +21 @@
 
 #include "includes.h"
-#include "librpc/gen_ndr/ndr_netlogon.h"
 #include "system/time.h"
-#include "lib/ldb/include/ldb.h"
-#include "../lib/util/util_ldb.h"
+#include <ldb.h>
+#include "libcli/ldap/ldap_ndr.h"
+#include "libcli/security/security.h"
 #include "auth/auth.h"
 #include "../libcli/auth/ntlm_check.h"
@@ -30 +30 @@
 #include "auth/auth_sam.h"
 #include "dsdb/samdb/samdb.h"
-#include "libcli/security/security.h"
-#include "libcli/ldap/ldap_ndr.h"
+#include "dsdb/common/util.h"
 #include "param/param.h"
+#include "librpc/gen_ndr/ndr_irpc_c.h"
+#include "lib/messaging/irpc.h"
 
 extern const char *user_attrs[];
@@ -49 +50 @@
 
         /* pull the user attributes */
-        ret = gendb_search_single_extended_dn(sam_ctx, mem_ctx, domain_dn, LDB_SCOPE_SUBTREE,
-                                              ret_msg, user_attrs,
-                                              "(&(sAMAccountName=%s)(objectclass=user))", 
-                                              ldb_binary_encode_string(mem_ctx, account_name));
+        ret = dsdb_search_one(sam_ctx, mem_ctx, ret_msg, domain_dn, LDB_SCOPE_SUBTREE,
+                              user_attrs,
+                              DSDB_SEARCH_SHOW_EXTENDED_DN,
+                              "(&(sAMAccountName=%s)(objectclass=user))",
+                              ldb_binary_encode_string(mem_ctx, account_name));
         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
                 DEBUG(3,("sam_search_user: Couldn't find user [%s] in samdb, under %s\n", 
@@ -99 +101 @@
                 *user_sess_key = data_blob(NULL, 0);
                 status = hash_password_check(mem_ctx, 
-                                             lp_lanman_auth(auth_context->lp_ctx),
+                                             lpcfg_lanman_auth(auth_context->lp_ctx),
                                              user_info->password.hash.lanman,
                                              user_info->password.hash.nt,
@@ -109 +111 @@
         case AUTH_PASSWORD_RESPONSE:
                 status = ntlm_password_check(mem_ctx, 
-                                             lp_lanman_auth(auth_context->lp_ctx),
-                                                 lp_ntlm_auth(auth_context->lp_ctx),
+                                             lpcfg_lanman_auth(auth_context->lp_ctx),
+                                                 lpcfg_ntlm_auth(auth_context->lp_ctx),
                                              user_info->logon_parameters, 
                                              &auth_context->challenge.data, 
@@ -135 +137 @@
 
 
+/*
+  send a message to the drepl server telling it to initiate a
+  REPL_SECRET getncchanges extended op to fetch the users secrets
+ */
+static void auth_sam_trigger_repl_secret(TALLOC_CTX *mem_ctx, struct auth_context *auth_context,
+                                         struct ldb_dn *user_dn)
+{
+        struct dcerpc_binding_handle *irpc_handle;
+        struct drepl_trigger_repl_secret r;
+        struct tevent_req *req;
+
+        irpc_handle = irpc_binding_handle_by_name(mem_ctx, auth_context->msg_ctx,
+                                                  "dreplsrv",
+                                                  &ndr_table_irpc);
+        if (irpc_handle == NULL) {
+                DEBUG(1,(__location__ ": Unable to get binding handle for dreplsrv\n"));
+                return;
+        }
+
+        r.in.user_dn = ldb_dn_get_linearized(user_dn);
+
+        req = dcerpc_drepl_trigger_repl_secret_r_send(mem_ctx,
+                                                      auth_context->event_ctx,
+                                                      irpc_handle,
+                                                      &r);
+
+        /* we aren't interested in a reply */
+        talloc_free(req);
+        talloc_free(irpc_handle);
+}
+
 
 static NTSTATUS authsam_authenticate(struct auth_context *auth_context, 
@@ -146 +179 @@
         NTSTATUS nt_status;
 
-        uint16_t acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
+        uint16_t acct_flags = samdb_result_acct_flags(auth_context->sam_ctx, mem_ctx, msg, domain_dn);
         
         /* Quit if the account was locked out. */
@@ -165 +198 @@
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
+        if (lm_pwd == NULL && nt_pwd == NULL) {
+                bool am_rodc;
+                if (samdb_rodc(auth_context->sam_ctx, &am_rodc) == LDB_SUCCESS && am_rodc) {
+                        /* we don't have passwords for this
+                         * account. We are an RODC, and this account
+                         * may be one for which we either are denied
+                         * REPL_SECRET replication or we haven't yet
+                         * done the replication. We return
+                         * NT_STATUS_NOT_IMPLEMENTED which tells the
+                         * auth code to try the next authentication
+                         * mechanism. We also send a message to our
+                         * drepl server to tell it to try and
+                         * replicate the secrets for this account.
+                         */
+                        auth_sam_trigger_repl_secret(mem_ctx, auth_context, msg->dn);
+                        return NT_STATUS_NOT_IMPLEMENTED;
+                }
+        }
+
         nt_status = authsam_password_ok(auth_context, mem_ctx, 
                                         acct_flags, lm_pwd, nt_pwd,
@@ -170 +222 @@
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
-        nt_status = authsam_account_ok(mem_ctx, sam_ctx, 
+        nt_status = authsam_account_ok(mem_ctx, auth_context->sam_ctx,
                                        user_info->logon_parameters,
                                        domain_dn,
@@ -186 +238 @@
                                                  TALLOC_CTX *mem_ctx,
                                                  const struct auth_usersupplied_info *user_info, 
-                                                 struct auth_serversupplied_info **server_info)
+                                                 struct auth_user_info_dc **user_info_dc)
 {
         NTSTATUS nt_status;
         const char *account_name = user_info->mapped.account_name;
         struct ldb_message *msg;
-        struct ldb_context *sam_ctx;
         struct ldb_dn *domain_dn;
         DATA_BLOB user_sess_key, lm_sess_key;
         TALLOC_CTX *tmp_ctx;
 
+        if (ctx->auth_ctx->sam_ctx == NULL) {
+                DEBUG(0, ("No SAM available, cannot log in users\n"));
+                return NT_STATUS_INVALID_SYSTEM_SERVICE;
+        }
+
         if (!account_name || !*account_name) {
                 /* 'not for me' */
@@ -206 +262 @@
         }
 
-        sam_ctx = samdb_connect(tmp_ctx, ctx->auth_ctx->event_ctx, ctx->auth_ctx->lp_ctx, system_session(mem_ctx, ctx->auth_ctx->lp_ctx));
-        if (sam_ctx == NULL) {
-                talloc_free(tmp_ctx);
-                return NT_STATUS_INVALID_SYSTEM_SERVICE;
-        }
-
-        domain_dn = ldb_get_default_basedn(sam_ctx);
+        domain_dn = ldb_get_default_basedn(ctx->auth_ctx->sam_ctx);
         if (domain_dn == NULL) {
                 talloc_free(tmp_ctx);
@@ -218 +268 @@
         }
 
-        nt_status = authsam_search_account(tmp_ctx, sam_ctx, account_name, domain_dn, &msg);
+        nt_status = authsam_search_account(tmp_ctx, ctx->auth_ctx->sam_ctx, account_name, domain_dn, &msg);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
@@ -224 +274 @@
         }
 
-        nt_status = authsam_authenticate(ctx->auth_ctx, tmp_ctx, sam_ctx, domain_dn, msg, user_info,
+        nt_status = authsam_authenticate(ctx->auth_ctx, tmp_ctx, ctx->auth_ctx->sam_ctx, domain_dn, msg, user_info,
                                          &user_sess_key, &lm_sess_key);
         if (!NT_STATUS_IS_OK(nt_status)) {
@@ -231 +281 @@
         }
 
-        nt_status = authsam_make_server_info(tmp_ctx, sam_ctx, lp_netbios_name(ctx->auth_ctx->lp_ctx), 
-                                             lp_sam_name(ctx->auth_ctx->lp_ctx),
+        nt_status = authsam_make_user_info_dc(tmp_ctx, ctx->auth_ctx->sam_ctx, lpcfg_netbios_name(ctx->auth_ctx->lp_ctx),
+                                             lpcfg_sam_name(ctx->auth_ctx->lp_ctx),
                                              domain_dn,
                                              msg,
                                              user_sess_key, lm_sess_key,
-                                             server_info);
+                                             user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
@@ -242 +292 @@
         }
 
-        talloc_steal(mem_ctx, *server_info);
+        talloc_steal(mem_ctx, *user_info_dc);
         talloc_free(tmp_ctx);
 
@@ -272 +322 @@
         }
 
-        is_local_name = lp_is_myname(ctx->auth_ctx->lp_ctx, 
+        is_local_name = lpcfg_is_myname(ctx->auth_ctx->lp_ctx,
                                   user_info->mapped.domain_name);
-        is_my_domain  = lp_is_mydomain(ctx->auth_ctx->lp_ctx, 
+        is_my_domain  = lpcfg_is_mydomain(ctx->auth_ctx->lp_ctx,
                                        user_info->mapped.domain_name); 
 
         /* check whether or not we service this domain/workgroup name */
-        switch (lp_server_role(ctx->auth_ctx->lp_ctx)) {
+        switch (lpcfg_server_role(ctx->auth_ctx->lp_ctx)) {
                 case ROLE_STANDALONE:
                         return NT_STATUS_OK;
@@ -299 +349 @@
         }
 
-        DEBUG(6,("authsam_check_password: lp_server_role() has an undefined value\n"));
+        DEBUG(6,("authsam_check_password: lpcfg_server_role() has an undefined value\n"));
         return NT_STATUS_NOT_IMPLEMENTED;
 }
 
                                    
-/* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available */
-NTSTATUS authsam_get_server_info_principal(TALLOC_CTX *mem_ctx, 
-                                           struct auth_context *auth_context,
-                                           const char *principal,
-                                           struct auth_serversupplied_info **server_info)
-{
-        NTSTATUS nt_status;
-        DATA_BLOB user_sess_key = data_blob(NULL, 0);
-        DATA_BLOB lm_sess_key = data_blob(NULL, 0);
-
-        struct ldb_message *msg;
-        struct ldb_context *sam_ctx;
-        struct ldb_dn *domain_dn;
-        
-        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
-        if (!tmp_ctx) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        sam_ctx = samdb_connect(tmp_ctx, auth_context->event_ctx, auth_context->lp_ctx, 
-                                system_session(tmp_ctx, auth_context->lp_ctx));
-        if (sam_ctx == NULL) {
-                talloc_free(tmp_ctx);
-                return NT_STATUS_INVALID_SYSTEM_SERVICE;
-        }
-
-        nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal, 
-                                              user_attrs, &domain_dn, &msg);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
-
-        nt_status = authsam_make_server_info(tmp_ctx, sam_ctx, 
-                                             lp_netbios_name(auth_context->lp_ctx),
-                                             lp_workgroup(auth_context->lp_ctx),
-                                             domain_dn, 
-                                             msg,
-                                             user_sess_key, lm_sess_key,
-                                             server_info);
-        if (NT_STATUS_IS_OK(nt_status)) {
-                talloc_steal(mem_ctx, *server_info);
-        }
-        talloc_free(tmp_ctx);
-        return nt_status;
-}
-
+/* Wrapper for the auth subsystem pointer */
+static NTSTATUS authsam_get_user_info_dc_principal_wrapper(TALLOC_CTX *mem_ctx,
+                                                          struct auth_context *auth_context,
+                                                          const char *principal,
+                                                          struct ldb_dn *user_dn,
+                                                          struct auth_user_info_dc **user_info_dc)
+{
+        return authsam_get_user_info_dc_principal(mem_ctx, auth_context->lp_ctx, auth_context->sam_ctx,
+                                                 principal, user_dn, user_info_dc);
+}
 static const struct auth_operations sam_ignoredomain_ops = {
         .name                      = "sam_ignoredomain",
@@ -355 +369 @@
         .want_check                = authsam_ignoredomain_want_check,
         .check_password            = authsam_check_password_internals,
-        .get_server_info_principal = authsam_get_server_info_principal
+        .get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper
 };
 
@@ -363 +377 @@
         .want_check                = authsam_want_check,
         .check_password            = authsam_check_password_internals,
-        .get_server_info_principal = authsam_get_server_info_principal
+        .get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper
 };
 

trunk/server/source4/auth/ntlm/auth_server.c

@@ -22 +22 @@
 #include "includes.h"
 #include "auth/auth.h"
-#include "auth/ntlm/auth_proto.h"
 #include "auth/credentials/credentials.h"
 #include "libcli/security/security.h"
-#include "librpc/gen_ndr/ndr_samr.h"
 #include "libcli/smb_composite/smb_composite.h"
 #include "param/param.h"
@@ -43 +41 @@
  * The challenge from the target server, when operating in security=server
  **/
-static NTSTATUS server_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *_blob)
+static NTSTATUS server_get_challenge(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8])
 {
         struct smb_composite_connect io;
@@ -52 +50 @@
         /* Make a connection to the target server, found by 'password server' in smb.conf */
         
-        lp_smbcli_options(ctx->auth_ctx->lp_ctx, &smb_options);
+        lpcfg_smbcli_options(ctx->auth_ctx->lp_ctx, &smb_options);
 
         /* Make a negprot, WITHOUT SPNEGO, so we get a challenge nice an easy */
@@ -58 +56 @@
 
         /* Hope we don't get * (the default), as this won't work... */
-        host_list = lp_passwordserver(ctx->auth_ctx->lp_ctx); 
+        host_list = lpcfg_passwordserver(ctx->auth_ctx->lp_ctx);
         if (!host_list) {
                 return NT_STATUS_INTERNAL_ERROR;
@@ -66 +64 @@
                 return NT_STATUS_INTERNAL_ERROR;
         }
-        io.in.dest_ports = lp_smb_ports(ctx->auth_ctx->lp_ctx); 
-        io.in.socket_options = lp_socket_options(ctx->auth_ctx->lp_ctx);
-        io.in.gensec_settings = lp_gensec_settings(mem_ctx, ctx->auth_ctx->lp_ctx);
+        io.in.dest_ports = lpcfg_smb_ports(ctx->auth_ctx->lp_ctx);
+        io.in.socket_options = lpcfg_socket_options(ctx->auth_ctx->lp_ctx);
+        io.in.gensec_settings = lpcfg_gensec_settings(mem_ctx, ctx->auth_ctx->lp_ctx);
 
         io.in.called_name = strupper_talloc(mem_ctx, io.in.dest_host);
@@ -75 +73 @@
         io.in.credentials = cli_credentials_init_anon(mem_ctx);
         cli_credentials_set_workstation(io.in.credentials,
-                                        lp_netbios_name(ctx->auth_ctx->lp_ctx),
+                                        lpcfg_netbios_name(ctx->auth_ctx->lp_ctx),
                                         CRED_SPECIFIED);
 
@@ -84 +82 @@
         io.in.options = smb_options;
         
-        io.in.iconv_convenience = lp_iconv_convenience(ctx->auth_ctx->lp_ctx);
-        lp_smbcli_session_options(ctx->auth_ctx->lp_ctx, &io.in.session_options);
-
-        status = smb_composite_connect(&io, mem_ctx, lp_resolve_context(ctx->auth_ctx->lp_ctx),
+        lpcfg_smbcli_session_options(ctx->auth_ctx->lp_ctx, &io.in.session_options);
+
+        status = smb_composite_connect(&io, mem_ctx, lpcfg_resolve_context(ctx->auth_ctx->lp_ctx),
                                        ctx->auth_ctx->event_ctx);
         NT_STATUS_NOT_OK_RETURN(status);
 
-        *_blob = io.out.tree->session->transport->negotiate.secblob;
+        if (io.out.tree->session->transport->negotiate.secblob.length != 8) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        memcpy(chal, io.out.tree->session->transport->negotiate.secblob.data, 8);
         ctx->private_data = talloc_steal(ctx, io.out.tree->session);
         return NT_STATUS_OK;
@@ -112 +112 @@
                                       TALLOC_CTX *mem_ctx,
                                       const struct auth_usersupplied_info *user_info, 
-                                      struct auth_serversupplied_info **_server_info)
+                                      struct auth_user_info_dc **_user_info_dc)
 {
         NTSTATUS nt_status;
-        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
         struct cli_credentials *creds;
         struct smb_composite_sesssetup session_setup;
@@ -148 +149 @@
         session_setup.in.credentials = creds;
         session_setup.in.workgroup = ""; /* Only used with SPNEGO, which we are not doing */
-        session_setup.in.gensec_settings = lp_gensec_settings(session, ctx->auth_ctx->lp_ctx);
+        session_setup.in.gensec_settings = lpcfg_gensec_settings(session, ctx->auth_ctx->lp_ctx);
 
         /* Check password with remove server - this should be async some day */
@@ -157 +158 @@
         }
 
-        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
-        NT_STATUS_HAVE_NO_MEMORY(server_info);
-
-        server_info->account_sid = dom_sid_parse_talloc(server_info, SID_NT_ANONYMOUS);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->account_sid);
-
-        /* is this correct? */
-        server_info->primary_group_sid = dom_sid_parse_talloc(server_info, SID_BUILTIN_GUESTS);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->primary_group_sid);
-
-        server_info->n_domain_groups = 0;
-        server_info->domain_groups = NULL;
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+
+        user_info_dc->num_sids = 1;
+
+        /* This returns a pointer to a struct dom_sid, which is the
+         * same as a 1 element list of struct dom_sid */
+        user_info_dc->sids = dom_sid_parse_talloc(user_info_dc, SID_NT_ANONYMOUS);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->sids);
 
         /* annoying, but the Anonymous really does have a session key, 
            and it is all zeros! */
-        server_info->user_session_key = data_blob(NULL, 0);
-        server_info->lm_session_key = data_blob(NULL, 0);
-
-        server_info->account_name = talloc_strdup(server_info, user_info->client.account_name);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
-
-        server_info->domain_name = talloc_strdup(server_info, user_info->client.domain_name);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
-
-        server_info->full_name = NULL;
-
-        server_info->logon_script = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
-
-        server_info->profile_path = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
-
-        server_info->home_directory = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
-
-        server_info->home_drive = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
-
-        server_info->last_logon = 0;
-        server_info->last_logoff = 0;
-        server_info->acct_expiry = 0;
-        server_info->last_password_change = 0;
-        server_info->allow_password_change = 0;
-        server_info->force_password_change = 0;
-
-        server_info->logon_count = 0;
-        server_info->bad_password_count = 0;
-
-        server_info->acct_flags = ACB_NORMAL;
-
-        server_info->authenticated = false;
-
-        *_server_info = server_info;
+        user_info_dc->user_session_key = data_blob(NULL, 0);
+        user_info_dc->lm_session_key = data_blob(NULL, 0);
+
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+
+        info->account_name = talloc_strdup(user_info_dc, user_info->client.account_name);
+        NT_STATUS_HAVE_NO_MEMORY(info->account_name);
+
+        info->domain_name = talloc_strdup(user_info_dc, user_info->client.domain_name);
+        NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
+
+        info->full_name = NULL;
+
+        info->logon_script = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+
+        info->profile_path = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+
+        info->home_directory = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+
+        info->home_drive = talloc_strdup(user_info_dc, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+
+        info->acct_flags = ACB_NORMAL;
+
+        info->authenticated = false;
+
+        *_user_info_dc = user_info_dc;
 
         return nt_status;

trunk/server/source4/auth/ntlm/auth_simple.c

@@ -24 +24 @@
 #include "includes.h"
 #include "auth/auth.h"
-#include "lib/events/events.h"
-#include "param/param.h"
-#include "auth/session_proto.h"
 
 /*
@@ -39 +36 @@
                                            const char *nt4_username,
                                            const char *password,
+                                           const uint32_t logon_parameters,
                                            struct auth_session_info **session_info) 
 {
         struct auth_context *auth_context;
         struct auth_usersupplied_info *user_info;
-        struct auth_serversupplied_info *server_info;
+        struct auth_user_info_dc *user_info_dc;
         NTSTATUS nt_status;
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
@@ -60 +58 @@
         }
 
-        user_info = talloc(tmp_ctx, struct auth_usersupplied_info);
+        user_info = talloc_zero(tmp_ctx, struct auth_usersupplied_info);
         if (!user_info) {
                 talloc_free(tmp_ctx);
@@ -82 +80 @@
                 USER_INFO_DONT_CHECK_UNIX_ACCOUNT;
 
-        user_info->logon_parameters = 0;
+        user_info->logon_parameters = logon_parameters |
+                MSV1_0_CLEARTEXT_PASSWORD_ALLOWED |
+                MSV1_0_CLEARTEXT_PASSWORD_SUPPLIED;
 
-        nt_status = auth_check_password(auth_context, tmp_ctx, user_info, &server_info);
+        nt_status = auth_check_password(auth_context, tmp_ctx, user_info, &user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(tmp_ctx);
@@ -91 +91 @@
 
         if (session_info) {
-                nt_status = auth_generate_session_info(tmp_ctx, ev, lp_ctx, server_info, session_info);
+                uint32_t flags = AUTH_SESSION_INFO_DEFAULT_GROUPS;
+                if (user_info_dc->info->authenticated) {
+                        flags |= AUTH_SESSION_INFO_AUTHENTICATED;
+                }
+                nt_status = auth_context->generate_session_info(tmp_ctx, auth_context,
+                                                                user_info_dc,
+                                                                flags,
+                                                                session_info);
 
                 if (NT_STATUS_IS_OK(nt_status)) {

trunk/server/source4/auth/ntlm/auth_unix.c

@@ -24 +24 @@
 #include "auth/ntlm/auth_proto.h"
 #include "system/passwd.h" /* needed by some systems for struct passwd */
-#include "lib/socket/socket.h" 
-#include "auth/ntlm/pam_errors.h"
+#include "lib/socket/socket.h"
+#include "lib/tsocket/tsocket.h"
+#include "../libcli/auth/pam_errors.h"
 #include "param/param.h"
 
@@ -31 +32 @@
  * except in case USER_INFO_DONT_CHECK_UNIX_ACCOUNT is set
  */
-static NTSTATUS authunix_make_server_info(TALLOC_CTX *mem_ctx,
+static NTSTATUS authunix_make_user_info_dc(TALLOC_CTX *mem_ctx,
                                           const char *netbios_name,
                                           const struct auth_usersupplied_info *user_info,
                                           struct passwd *pwd,
-                                          struct auth_serversupplied_info **_server_info)
-{
-        struct auth_serversupplied_info *server_info;
+                                          struct auth_user_info_dc **_user_info_dc)
+{
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
         NTSTATUS status;
 
         /* This is a real, real hack */
         if (pwd->pw_uid == 0) {
-                status = auth_system_server_info(mem_ctx, netbios_name, &server_info);
+                status = auth_system_user_info_dc(mem_ctx, netbios_name, &user_info_dc);
                 if (!NT_STATUS_IS_OK(status)) {
                         return status;
                 }
 
-                server_info->account_name = talloc_steal(server_info, pwd->pw_name);
-                NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+                user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+                NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+
+                info->account_name = talloc_steal(info, pwd->pw_name);
+                NT_STATUS_HAVE_NO_MEMORY(info->account_name);
                 
-                server_info->domain_name = talloc_strdup(server_info, "unix");
-                NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+                info->domain_name = talloc_strdup(info, "unix");
+                NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
         } else {
-                server_info = talloc(mem_ctx, struct auth_serversupplied_info);
-                NT_STATUS_HAVE_NO_MEMORY(server_info);
+                user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+                NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
                 
-                server_info->authenticated = true;
+                user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+                NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+
+                info->authenticated = true;
                 
-                server_info->account_name = talloc_steal(server_info, pwd->pw_name);
-                NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+                info->account_name = talloc_steal(info, pwd->pw_name);
+                NT_STATUS_HAVE_NO_MEMORY(info->account_name);
                 
-                server_info->domain_name = talloc_strdup(server_info, "unix");
-                NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+                info->domain_name = talloc_strdup(info, "unix");
+                NT_STATUS_HAVE_NO_MEMORY(info->domain_name);
 
                 /* This isn't in any way correct.. */
-                server_info->account_sid = NULL;
-                server_info->primary_group_sid = NULL;
-                server_info->n_domain_groups = 0;
-                server_info->domain_groups = NULL;
-        }
-        server_info->user_session_key = data_blob(NULL,0);
-        server_info->lm_session_key = data_blob(NULL,0);
-
-        server_info->full_name = talloc_steal(server_info, pwd->pw_gecos);
-        NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
-        server_info->logon_script = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
-        server_info->profile_path = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->profile_path);
-        server_info->home_directory = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->home_directory);
-        server_info->home_drive = talloc_strdup(server_info, "");
-        NT_STATUS_HAVE_NO_MEMORY(server_info->home_drive);
-
-        server_info->last_logon = 0;
-        server_info->last_logoff = 0;
-        server_info->acct_expiry = 0;
-        server_info->last_password_change = 0;
-        server_info->allow_password_change = 0;
-        server_info->force_password_change = 0;
-        server_info->logon_count = 0;
-        server_info->bad_password_count = 0;
-        server_info->acct_flags = 0;
-
-        *_server_info = server_info;
+                user_info_dc->num_sids = 0;
+                user_info_dc->sids = NULL;
+        }
+        user_info_dc->user_session_key = data_blob(NULL,0);
+        user_info_dc->lm_session_key = data_blob(NULL,0);
+
+        info->full_name = talloc_steal(info, pwd->pw_gecos);
+        NT_STATUS_HAVE_NO_MEMORY(info->full_name);
+        info->logon_script = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->logon_script);
+        info->profile_path = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->profile_path);
+        info->home_directory = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_directory);
+        info->home_drive = talloc_strdup(info, "");
+        NT_STATUS_HAVE_NO_MEMORY(info->home_drive);
+
+        info->last_logon = 0;
+        info->last_logoff = 0;
+        info->acct_expiry = 0;
+        info->last_password_change = 0;
+        info->allow_password_change = 0;
+        info->force_password_change = 0;
+        info->logon_count = 0;
+        info->bad_password_count = 0;
+        info->acct_flags = 0;
+
+        *_user_info_dc = user_info_dc;
 
         return NT_STATUS_OK;
@@ -430 +436 @@
 }
 
-static NTSTATUS check_unix_password(TALLOC_CTX *ctx, struct loadparm_context *lp_ctx, 
+static NTSTATUS check_unix_password(TALLOC_CTX *ctx, struct loadparm_context *lp_ctx,
                                     const struct auth_usersupplied_info *user_info, struct passwd **pws)
 {
@@ -459 +465 @@
          */
 
-        nt_status = smb_pam_start(&pamh, user_info->mapped.account_name, user_info->remote_host ? user_info->remote_host->addr : NULL, pamconv);
+        nt_status = smb_pam_start(&pamh, user_info->mapped.account_name,
+                        user_info->remote_host ? tsocket_address_inet_addr_string(user_info->remote_host, ctx) : NULL, pamconv);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 return nt_status;
         }
 
-        nt_status = smb_pam_auth(pamh, lp_null_passwords(lp_ctx), user_info->mapped.account_name);
+        nt_status = smb_pam_auth(pamh, lpcfg_null_passwords(lp_ctx), user_info->mapped.account_name);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 smb_pam_end(pamh);
@@ -604 +611 @@
         struct passwd *pws;
         NTSTATUS nt_status;
-        int level = lp_passwordlevel(lp_ctx);
+        int level = lpcfg_passwordlevel(lp_ctx);
 
         *ret_passwd = NULL;
@@ -707 +714 @@
 
         if (crypted[0] == '\0') {
-                if (!lp_null_passwords(lp_ctx)) {
+                if (!lpcfg_null_passwords(lp_ctx)) {
                         DEBUG(2, ("Disallowing %s with null password\n", username));
                         return NT_STATUS_LOGON_FAILURE;
@@ -792 +799 @@
                                         TALLOC_CTX *mem_ctx,
                                         const struct auth_usersupplied_info *user_info,
-                                        struct auth_serversupplied_info **server_info)
+                                        struct auth_user_info_dc **user_info_dc)
 {
         TALLOC_CTX *check_ctx;
@@ -813 +820 @@
         }
 
-        nt_status = authunix_make_server_info(mem_ctx, lp_netbios_name(ctx->auth_ctx->lp_ctx),
-                                              user_info, pwd, server_info);
+        nt_status = authunix_make_user_info_dc(mem_ctx, lpcfg_netbios_name(ctx->auth_ctx->lp_ctx),
+                                              user_info, pwd, user_info_dc);
         if (!NT_STATUS_IS_OK(nt_status)) {
                 talloc_free(check_ctx);

trunk/server/source4/auth/ntlm/auth_util.c

@@ -24 +24 @@
 #include "includes.h"
 #include "auth/auth.h"
-#include "auth/auth_proto.h"
-#include "libcli/security/security.h"
 #include "libcli/auth/libcli_auth.h"
-#include "dsdb/samdb/samdb.h"
-#include "auth/credentials/credentials.h"
 #include "param/param.h"
 
@@ -34 +30 @@
  * which don't want to set a challenge
  */
-NTSTATUS auth_get_challenge_not_implemented(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, DATA_BLOB *challenge)
+NTSTATUS auth_get_challenge_not_implemented(struct auth_method_context *ctx, TALLOC_CTX *mem_ctx, uint8_t chal[8])
 {
         /* we don't want to set a challenge */
@@ -79 +75 @@
         }
 
-        *user_info_mapped = talloc(mem_ctx, struct auth_usersupplied_info);
+        *user_info_mapped = talloc_zero(mem_ctx, struct auth_usersupplied_info);
         if (!*user_info_mapped) {
                 return NT_STATUS_NO_MEMORY;
@@ -127 +123 @@
                 case AUTH_PASSWORD_HASH:
                 {
-                        const uint8_t *challenge;
+                        uint8_t chal[8];
                         DATA_BLOB chall_blob;
-                        user_info_temp = talloc(mem_ctx, struct auth_usersupplied_info);
+                        user_info_temp = talloc_zero(mem_ctx, struct auth_usersupplied_info);
                         if (!user_info_temp) {
                                 return NT_STATUS_NO_MEMORY;
@@ -139 +135 @@
                         user_info_temp->mapped_state = to_state;
                         
-                        nt_status = auth_get_challenge(auth_context, &challenge);
+                        nt_status = auth_get_challenge(auth_context, chal);
                         if (!NT_STATUS_IS_OK(nt_status)) {
                                 return nt_status;
                         }
                         
-                        chall_blob = data_blob_talloc(mem_ctx, challenge, 8);
-                        if (lp_client_ntlmv2_auth(auth_context->lp_ctx)) {
-                                DATA_BLOB names_blob = NTLMv2_generate_names_blob(mem_ctx,  lp_netbios_name(auth_context->lp_ctx), lp_workgroup(auth_context->lp_ctx));
+                        chall_blob = data_blob_talloc(mem_ctx, chal, 8);
+                        if (lpcfg_client_ntlmv2_auth(auth_context->lp_ctx)) {
+                                DATA_BLOB names_blob = NTLMv2_generate_names_blob(mem_ctx,  lpcfg_netbios_name(auth_context->lp_ctx), lpcfg_workgroup(auth_context->lp_ctx));
                                 DATA_BLOB lmv2_response, ntlmv2_response, lmv2_session_key, ntlmv2_session_key;
                                 
@@ -167 +163 @@
                         } else {
                                 DATA_BLOB blob = data_blob_talloc(mem_ctx, NULL, 24);
-                                SMBOWFencrypt(user_info_in->password.hash.nt->hash, challenge, blob.data);
+                                SMBOWFencrypt(user_info_in->password.hash.nt->hash, chal, blob.data);
 
                                 user_info_temp->password.response.nt = blob;
-                                if (lp_client_lanman_auth(auth_context->lp_ctx) && user_info_in->password.hash.lanman) {
+                                if (lpcfg_client_lanman_auth(auth_context->lp_ctx) && user_info_in->password.hash.lanman) {
                                         DATA_BLOB lm_blob = data_blob_talloc(mem_ctx, NULL, 24);
-                                        SMBOWFencrypt(user_info_in->password.hash.lanman->hash, challenge, blob.data);
+                                        SMBOWFencrypt(user_info_in->password.hash.lanman->hash, chal, blob.data);
                                         user_info_temp->password.response.lanman = lm_blob;
                                 } else {
@@ -195 +191 @@
                         struct samr_Password nt;
                         
-                        user_info_temp = talloc(mem_ctx, struct auth_usersupplied_info);
+                        user_info_temp = talloc_zero(mem_ctx, struct auth_usersupplied_info);
                         if (!user_info_temp) {
                                 return NT_STATUS_NO_MEMORY;
@@ -236 +232 @@
         return NT_STATUS_OK;
 }
-
-
-/**
- * Squash an NT_STATUS in line with security requirements.
- * In an attempt to avoid giving the whole game away when users
- * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and 
- * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations 
- * (session setups in particular).
- *
- * @param nt_status NTSTATUS input for squashing.
- * @return the 'squashed' nt_status
- **/
-_PUBLIC_ NTSTATUS auth_nt_status_squash(NTSTATUS nt_status)
-{
-        if NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) {
-                /* Match WinXP and don't give the game away */
-                return NT_STATUS_LOGON_FAILURE;
-        } else if NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD) {
-                /* Match WinXP and don't give the game away */
-                return NT_STATUS_LOGON_FAILURE;
-        }
-
-        return nt_status;
-}

trunk/server/source4/auth/ntlm/auth_winbind.c

@@ -26 +26 @@
 #include "auth/ntlm/auth_proto.h"
 #include "auth/auth_sam_reply.h"
-#include "nsswitch/winbind_client.h"
-#include "librpc/gen_ndr/ndr_netlogon.h"
-#include "librpc/gen_ndr/ndr_winbind.h"
+#include "librpc/gen_ndr/ndr_winbind_c.h"
 #include "lib/messaging/irpc.h"
 #include "param/param.h"
 #include "nsswitch/libwbclient/wbclient.h"
-#include "libcli/security/dom_sid.h"
-
-static NTSTATUS get_info3_from_ndr(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, struct winbindd_response *response, struct netr_SamInfo3 *info3)
-{
-        size_t len = response->length - sizeof(struct winbindd_response);
-        if (len > 4) {
-                enum ndr_err_code ndr_err;
-                DATA_BLOB blob;
-                blob.length = len - 4;
-                blob.data = (uint8_t *)(((char *)response->extra_data.data) + 4);
-
-                ndr_err = ndr_pull_struct_blob(&blob, mem_ctx, 
-                               iconv_convenience, info3,
-                              (ndr_pull_flags_fn_t)ndr_pull_netr_SamInfo3);
-                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                        return ndr_map_error2ntstatus(ndr_err);
-                }
-
-                return NT_STATUS_OK;
-        } else {
-                DEBUG(2, ("get_info3_from_ndr: No info3 struct found!\n"));
-                return NT_STATUS_UNSUCCESSFUL;
-        }
-}
+#include "libcli/security/security.h"
 
 static NTSTATUS get_info3_from_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
-                                               struct smb_iconv_convenience *ic,
                                                struct wbcAuthUserInfo *info,
                                                struct netr_SamInfo3 *info3)
@@ -64 +38 @@
         int i, j;
         struct samr_RidWithAttribute *rids = NULL;
+        struct dom_sid *user_sid;
+        struct dom_sid *group_sid;
+
+        user_sid = (struct dom_sid *)(void *)&info->sids[0].sid;
+        group_sid = (struct dom_sid *)(void *)&info->sids[1].sid;
 
         info3->base.last_logon = info->logon_time;
@@ -103 +82 @@
         }
 
-        dom_sid_split_rid(mem_ctx, (struct dom_sid2 *) &info->sids[0].sid,
+        dom_sid_split_rid(mem_ctx, user_sid,
                           &info3->base.domain_sid,
                           &info3->base.rid);
-        dom_sid_split_rid(mem_ctx, (struct dom_sid2 *) &info->sids[1].sid, NULL,
+        dom_sid_split_rid(mem_ctx, group_sid, NULL,
                           &info3->base.primary_gid);
 
@@ -117 +96 @@
 
         for (i = 2, j = 0; i < info->num_sids; ++i, ++j) {
+                struct dom_sid *tmp_sid;
+                tmp_sid = (struct dom_sid *)(void *)&info->sids[1].sid;
+
                 rids[j].attributes = info->sids[i].attributes;
-                dom_sid_split_rid(mem_ctx,
-                                  (struct dom_sid2 *) &info->sids[i].sid,
+                dom_sid_split_rid(mem_ctx, tmp_sid,
                                   NULL, &rids[j].rid);
         }
@@ -138 +119 @@
         /* TODO: maybe limit the user scope to remote users only */
         return NT_STATUS_OK;
-}
-
-/*
- Authenticate a user with a challenge/response
- using the samba3 winbind protocol
-*/
-static NTSTATUS winbind_check_password_samba3(struct auth_method_context *ctx,
-                                              TALLOC_CTX *mem_ctx,
-                                              const struct auth_usersupplied_info *user_info, 
-                                              struct auth_serversupplied_info **server_info)
-{
-        struct winbindd_request request;
-        struct winbindd_response response;
-        NSS_STATUS result;
-        NTSTATUS nt_status;
-        struct netr_SamInfo3 info3;             
-
-        /* Send off request */
-        const struct auth_usersupplied_info *user_info_temp;    
-        nt_status = encrypt_user_info(mem_ctx, ctx->auth_ctx, 
-                                      AUTH_PASSWORD_RESPONSE, 
-                                      user_info, &user_info_temp);
-        if (!NT_STATUS_IS_OK(nt_status)) {
-                return nt_status;
-        }
-        user_info = user_info_temp;
-
-        ZERO_STRUCT(request);
-        ZERO_STRUCT(response);
-        request.flags = WBFLAG_PAM_INFO3_NDR;
-
-        request.data.auth_crap.logon_parameters = user_info->logon_parameters;
-
-        safe_strcpy(request.data.auth_crap.user,
-                       user_info->client.account_name, sizeof(fstring));
-        safe_strcpy(request.data.auth_crap.domain,
-                       user_info->client.domain_name, sizeof(fstring));
-        safe_strcpy(request.data.auth_crap.workstation,
-                       user_info->workstation_name, sizeof(fstring));
-
-        memcpy(request.data.auth_crap.chal, ctx->auth_ctx->challenge.data.data, sizeof(request.data.auth_crap.chal));
-
-        request.data.auth_crap.lm_resp_len = MIN(user_info->password.response.lanman.length,
-                                                 sizeof(request.data.auth_crap.lm_resp));
-        request.data.auth_crap.nt_resp_len = MIN(user_info->password.response.nt.length, 
-                                                 sizeof(request.data.auth_crap.nt_resp));
-
-        memcpy(request.data.auth_crap.lm_resp, user_info->password.response.lanman.data,
-               request.data.auth_crap.lm_resp_len);
-        memcpy(request.data.auth_crap.nt_resp, user_info->password.response.nt.data,
-               request.data.auth_crap.nt_resp_len);
-
-        result = winbindd_request_response(WINBINDD_PAM_AUTH_CRAP, &request, &response);
-
-        nt_status = NT_STATUS(response.data.auth.nt_status);
-        NT_STATUS_NOT_OK_RETURN(nt_status);
-
-        if (result == NSS_STATUS_SUCCESS && response.extra_data.data) {
-                union netr_Validation validation;
-
-                nt_status = get_info3_from_ndr(mem_ctx, lp_iconv_convenience(ctx->auth_ctx->lp_ctx), &response, &info3);
-                SAFE_FREE(response.extra_data.data);
-                NT_STATUS_NOT_OK_RETURN(nt_status); 
-
-                validation.sam3 = &info3;
-                nt_status = make_server_info_netlogon_validation(mem_ctx, 
-                                                                 user_info->client.account_name, 
-                                                                 3, &validation,
-                                                                 server_info);
-                return nt_status;
-        } else if (result == NSS_STATUS_SUCCESS && !response.extra_data.data) {
-                DEBUG(0, ("Winbindd authenticated the user [%s]\\[%s], "
-                          "but did not include the required info3 reply!\n", 
-                          user_info->client.domain_name, user_info->client.account_name));
-                return NT_STATUS_INSUFFICIENT_LOGON_INFO;
-        } else if (NT_STATUS_IS_OK(nt_status)) {
-                DEBUG(1, ("Winbindd authentication for [%s]\\[%s] failed, "
-                          "but no error code is available!\n", 
-                          user_info->client.domain_name, user_info->client.account_name));
-                return NT_STATUS_NO_LOGON_SERVERS;
-        }
-
-        return nt_status;
 }
 
@@ -234 +132 @@
                                        TALLOC_CTX *mem_ctx,
                                        const struct auth_usersupplied_info *user_info, 
-                                       struct auth_serversupplied_info **server_info)
+                                       struct auth_user_info_dc **user_info_dc)
 {
         NTSTATUS status;
-        struct server_id *winbind_servers;
+        struct dcerpc_binding_handle *irpc_handle;
         struct winbind_check_password_state *s;
         const struct auth_usersupplied_info *user_info_new;
         struct netr_IdentityInfo *identity_info;
 
+        if (!ctx->auth_ctx->msg_ctx) {
+                DEBUG(0,("winbind_check_password: auth_context_create was called with out messaging context\n"));
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
         s = talloc(mem_ctx, struct winbind_check_password_state);
         NT_STATUS_HAVE_NO_MEMORY(s);
 
-        winbind_servers = irpc_servers_byname(ctx->auth_ctx->msg_ctx, s, "winbind_server");
-        if ((winbind_servers == NULL) || (winbind_servers[0].id == 0)) {
+        irpc_handle = irpc_binding_handle_by_name(s, ctx->auth_ctx->msg_ctx,
+                                                  "winbind_server",
+                                                  &ndr_table_winbind);
+        if (irpc_handle == NULL) {
                 DEBUG(0, ("Winbind authentication for [%s]\\[%s] failed, " 
                           "no winbind_server running!\n",
@@ -272 +177 @@
         } else {
                 struct netr_NetworkInfo *network_info;
-                const uint8_t *challenge;
+                uint8_t chal[8];
 
                 status = encrypt_user_info(s, ctx->auth_ctx, AUTH_PASSWORD_RESPONSE,
@@ -282 +187 @@
                 NT_STATUS_HAVE_NO_MEMORY(network_info);
 
-                status = auth_get_challenge(ctx->auth_ctx, &challenge);
+                status = auth_get_challenge(ctx->auth_ctx, chal);
                 NT_STATUS_NOT_OK_RETURN(status);
 
-                memcpy(network_info->challenge, challenge, sizeof(network_info->challenge));
+                memcpy(network_info->challenge, chal, sizeof(network_info->challenge));
 
                 network_info->nt.length = user_info->password.response.nt.length;
@@ -307 +212 @@
         s->req.in.validation_level      = 3;
 
-        status = IRPC_CALL(ctx->auth_ctx->msg_ctx, winbind_servers[0],
-                           winbind, WINBIND_SAMLOGON,
-                           &s->req, s);
+        status = dcerpc_winbind_SamLogon_r(irpc_handle, s, &s->req);
         NT_STATUS_NOT_OK_RETURN(status);
 
-        status = make_server_info_netlogon_validation(mem_ctx,
+        status = make_user_info_dc_netlogon_validation(mem_ctx,
                                                       user_info->client.account_name,
                                                       s->req.in.validation_level,
                                                       &s->req.out.validation,
-                                                      server_info);
+                                                      user_info_dc);
         NT_STATUS_NOT_OK_RETURN(status);
 
@@ -329 +232 @@
                                                 TALLOC_CTX *mem_ctx,
                                                 const struct auth_usersupplied_info *user_info,
-                                                struct auth_serversupplied_info **server_info)
+                                                struct auth_user_info_dc **user_info_dc)
 {
         struct wbcAuthUserParams params;
@@ -382 +285 @@
 
         wbc_status = wbcAuthenticateUserEx(&params, &info, &err);
-        if (!WBC_ERROR_IS_OK(wbc_status)) {
+        if (wbc_status == WBC_ERR_AUTH_ERROR) {
                 DEBUG(1, ("error was %s (0x%08x)\nerror message was '%s'\n",
                       err->nt_string, err->nt_status, err->display_string));
@@ -389 +292 @@
                 wbcFreeMemory(err);
                 NT_STATUS_NOT_OK_RETURN(nt_status);
-        }
-        nt_status = get_info3_from_wbcAuthUserInfo(mem_ctx,
-                                lp_iconv_convenience(ctx->auth_ctx->lp_ctx),
-                                info, &info3);
+        } else if (!WBC_ERROR_IS_OK(wbc_status)) {
+                DEBUG(1, ("wbcAuthenticateUserEx: failed with %u - %s\n",
+                        wbc_status, wbcErrorString(wbc_status)));
+                return NT_STATUS_LOGON_FAILURE;
+        }
+        nt_status = get_info3_from_wbcAuthUserInfo(mem_ctx, info, &info3);
         wbcFreeMemory(info);
         NT_STATUS_NOT_OK_RETURN(nt_status);
 
         validation.sam3 = &info3;
-        nt_status = make_server_info_netlogon_validation(mem_ctx,
+        nt_status = make_user_info_dc_netlogon_validation(mem_ctx,
                                         user_info->client.account_name,
-                                        3, &validation, server_info);
+                                        3, &validation, user_info_dc);
         return nt_status;
 
 }
-
-static const struct auth_operations winbind_samba3_ops = {
-        .name           = "winbind_samba3",
-        .get_challenge  = auth_get_challenge_not_implemented,
-        .want_check     = winbind_want_check,
-        .check_password = winbind_check_password_samba3
-};
 
 static const struct auth_operations winbind_ops = {
@@ -429 +327 @@
         NTSTATUS ret;
 
-        ret = auth_register(&winbind_samba3_ops);
-        if (!NT_STATUS_IS_OK(ret)) {
-                DEBUG(0,("Failed to register 'winbind_samba3' auth backend!\n"));
-                return ret;
-        }
-
         ret = auth_register(&winbind_ops);
         if (!NT_STATUS_IS_OK(ret)) {