r685: The SAM is dead! Long live the new SAM! ;-)

This commit kills passdb, which was only hosting the auth subsystem.

With the work tridge has done on Samba4's SAM backend, this can (and
now is) all hosted on ldb.  The auth_sam.c file now references this
backend.

You will need to assign your users passwords in ldb - adding a new line:

unicodePwd: myPass

to a record, using ldbedit, should be sufficient.  Naturally, this
assumes you have had your personal SAMR provisioning tutorial from
tridge.  Everybody else can still use the anonymous logins.

Andrew Bartlett
(This used to be commit 2aa0b55fb86648731d5f2201fa5a6aa993b7ca48)

1 files changed, 143 insertions, 51 deletions

diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 028fda74fe..6f61820ae5 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -33,17 +33,14 @@
 
 static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
 				TALLOC_CTX *mem_ctx,
-				SAM_ACCOUNT *sampass, 
+				const char *username,
+				uint16 acct_flags,
+				const uint8 lm_pw[16], const uint8 nt_pw[16],
 				const auth_usersupplied_info *user_info, 
 				DATA_BLOB *user_sess_key, 
 				DATA_BLOB *lm_sess_key)
 {
-	uint16 acct_ctrl;
-	const uint8 *lm_pw, *nt_pw;
-	const char *username = pdb_get_username(sampass);
-
-	acct_ctrl = pdb_get_acct_ctrl(sampass);
-	if (acct_ctrl & ACB_PWNOTREQ) {
+	if (acct_flags & ACB_PWNOTREQ) {
 		if (lp_null_passwords()) {
 			DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", username));
 			return NT_STATUS_OK;
@@ -53,9 +50,6 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
 		}		
 	}
 
-	lm_pw = pdb_get_lanman_passwd(sampass);
-	nt_pw = pdb_get_nt_passwd(sampass);
-
 	return ntlm_password_check(mem_ctx, &auth_context->challenge, 
 				   &user_info->lm_resp, &user_info->nt_resp, 
 				   &user_info->lm_interactive_pwd, &user_info->nt_interactive_pwd,
@@ -72,49 +66,51 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
 ****************************************************************************/
 
 static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
-			       SAM_ACCOUNT *sampass, 
+			       const char *username,
+			       uint16 acct_flags,
+			       struct ldb_message **msgs,
 			       const auth_usersupplied_info *user_info)
 {
-	uint16	acct_ctrl = pdb_get_acct_ctrl(sampass);
 	char *workstation_list;
 	time_t kickoff_time;
 	
-	DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass)));
+	DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n", username));
 
 	/* Quit if the account was disabled. */
-	if (acct_ctrl & ACB_DISABLED) {
-		DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_DISABLED) {
+		DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", username));
 		return NT_STATUS_ACCOUNT_DISABLED;
 	}
 
 	/* Quit if the account was locked out. */
-	if (acct_ctrl & ACB_AUTOLOCK) {
-		DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_AUTOLOCK) {
+		DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", username));
 		return NT_STATUS_ACCOUNT_LOCKED_OUT;
 	}
 
+#if 0
 	/* Test account expire time */
 	
 	kickoff_time = pdb_get_kickoff_time(sampass);
 	if (kickoff_time != 0 && time(NULL) > kickoff_time) {
-		DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", pdb_get_username(sampass)));
+		DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", username));
 		DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time));
 		return NT_STATUS_ACCOUNT_EXPIRED;
 	}
 
-	if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP)) {
+	if (!(acct_flags & ACB_PWNOEXP)) {
 		time_t must_change_time = pdb_get_pass_must_change_time(sampass);
 		time_t last_set_time = pdb_get_pass_last_set_time(sampass);
 
 		/* check for immediate expiry "must change at next logon" */
 		if (must_change_time == 0 && last_set_time != 0) {
-			DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", pdb_get_username(sampass)));
+			DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", username));
 			return NT_STATUS_PASSWORD_MUST_CHANGE;
 		}
 
 		/* check for expired password */
 		if (must_change_time < time(NULL) && must_change_time != 0) {
-			DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", pdb_get_username(sampass)));
+			DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", username));
 			DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", timestring(mem_ctx, must_change_time), (long)must_change_time));
 			return NT_STATUS_PASSWORD_EXPIRED;
 		}
@@ -144,19 +140,19 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
 		if (invalid_ws) 
 			return NT_STATUS_INVALID_WORKSTATION;
 	}
-
-	if (acct_ctrl & ACB_DOMTRUST) {
-		DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass)));
+#endif
+	if (acct_flags & ACB_DOMTRUST) {
+		DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", username));
 		return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 	}
 	
-	if (acct_ctrl & ACB_SVRTRUST) {
-		DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_SVRTRUST) {
+		DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", username));
 		return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 	}
 	
-	if (acct_ctrl & ACB_WSTRUST) {
-		DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_WSTRUST) {
+		DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", username));
 		return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 	}
 	
@@ -175,60 +171,156 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 				   const auth_usersupplied_info *user_info, 
 				   auth_serversupplied_info **server_info)
 {
-	SAM_ACCOUNT *sampass=NULL;
+	struct ldb_message **msgs;
+	void *sam_ctx;
+	uint16 acct_flags;
+	char *username = user_info->internal_username.str;
 	BOOL ret;
 	NTSTATUS nt_status;
 	DATA_BLOB user_sess_key = data_blob(NULL, 0);
 	DATA_BLOB lm_sess_key = data_blob(NULL, 0);
+	const uint8 *lm_pwd, *nt_pwd;
+	const char *unicodePwd;
+	struct samr_Hash lmPwdHash_u, ntPwdHash_u;
+	struct samr_Hash *lmPwdHash, *ntPwdHash;
+	uint_t num_lm, num_nt;
 
 	if (!user_info || !auth_context) {
 		return NT_STATUS_UNSUCCESSFUL;
 	}
-
-	/* Can't use the talloc version here, because the returned struct gets
-	   kept on the server_info */
-	if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) {
-		return nt_status;
+	
+	sam_ctx = samdb_connect();
+	if (sam_ctx == NULL) {
+		return NT_STATUS_INVALID_SYSTEM_SERVICE;
 	}
-
-	/* get the account information */
-
-	become_root();
-	ret = pdb_getsampwnam(sampass, user_info->internal_username.str);
-	unbecome_root();
-
-	if (ret == False) {
-		DEBUG(3,("check_sam_security: Couldn't find user '%s' in passdb file.\n", user_info->internal_username.str));
-		pdb_free_sam(&sampass);
+	/* pull all the user attributes */
+	ret = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, NULL,
+			   "(&(sAMAccountName=%s)(objectclass=user))", 
+			   username);
+
+	if (ret == 0) {
+		DEBUG(3,("check_sam_security: Couldn't find user [%s] in passdb file.\n", 
+			 username));
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
+	if (ret > 1) {
+		DEBUG(1,("Found %d records matching user [%s]\n", ret, username));
+		return NT_STATUS_INTERNAL_DB_CORRUPTION;
+	}
+	
+	acct_flags = samdb_result_acct_flags(msgs[0], "sAMAcctFlags");
+	
 	/* Quit if the account was locked out. */
-	if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
-		DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", pdb_get_username(sampass)));
+	if (acct_flags & ACB_AUTOLOCK) {
+		DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", 
+			 username));
 		return NT_STATUS_ACCOUNT_LOCKED_OUT;
 	}
 
-	nt_status = sam_password_ok(auth_context, mem_ctx, sampass, 
+	unicodePwd = samdb_result_string(msgs[0], "unicodePwd", NULL);
+	
+	if (unicodePwd) {
+		BOOL lm_hash_ok;
+		/* compute the new nt and lm hashes */
+		lm_hash_ok = E_deshash(unicodePwd, lmPwdHash_u.hash);
+		E_md4hash(unicodePwd, ntPwdHash_u.hash);
+
+		if (lm_hash_ok) {
+			lm_pwd = lmPwdHash_u.hash;
+		} else {
+			lm_pwd = NULL;
+		}
+
+		nt_pwd = ntPwdHash_u.hash;
+		
+	} else {
+		num_lm = samdb_result_hashes(mem_ctx, msgs[0], "lmPwdHash", &lmPwdHash);
+		if (num_lm == 0) {
+			lm_pwd = NULL;
+		} else if (num_lm > 1) {
+			return NT_STATUS_INTERNAL_DB_CORRUPTION;
+		} else {
+			lm_pwd = lmPwdHash[0].hash;
+		}
+		
+		num_nt = samdb_result_hashes(mem_ctx, msgs[0], "ntPwdHash", &ntPwdHash);
+		if (num_nt == 0) {
+			nt_pwd = NULL;
+		} else if (num_nt > 1) {
+			return NT_STATUS_INTERNAL_DB_CORRUPTION;
+		} else {
+			nt_pwd = ntPwdHash[0].hash;
+		}
+	}
+
+	nt_status = sam_password_ok(auth_context, mem_ctx, 
+				    username, acct_flags, 
+				    lm_pwd, nt_pwd,
 				    user_info, &user_sess_key, &lm_sess_key);
 	
 	if (!NT_STATUS_IS_OK(nt_status)) {
-		pdb_free_sam(&sampass);
 		return nt_status;
 	}
 
-	nt_status = sam_account_ok(mem_ctx, sampass, user_info);
+	nt_status = sam_account_ok(mem_ctx, username, acct_flags, msgs, user_info);
 
 	if (!NT_STATUS_IS_OK(nt_status)) {
-		pdb_free_sam(&sampass);
 		return nt_status;
 	}
 
-	if (!NT_STATUS_IS_OK(nt_status = make_server_info_sam(server_info, sampass))) {		
+	if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, username))) {		
 		DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
 		return nt_status;
 	}
 
+	{
+		struct ldb_message **group_msgs;
+		char *dn = msgs[0]->dn;
+		int group_ret;
+		const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL }; 
+		/* find list of sids */
+		struct dom_sid **groupSIDs = NULL;
+		struct dom_sid *user_sid;
+		struct dom_sid *group_sid;
+		const char *sidstr;
+		int i;
+
+		group_ret = samdb_search(sam_ctx,
+					 mem_ctx, NULL, &group_msgs, group_attrs,
+					 "(&(member=%s)(sAMAccountType=*))", 
+					 dn);
+		
+		if (!(groupSIDs = talloc_realloc_p((*server_info)->mem_ctx, groupSIDs, 
+						   struct dom_sid *, group_ret))) {
+			talloc_destroy((*server_info)->mem_ctx);
+			return NT_STATUS_NO_MEMORY;
+		}
+
+		/* Need to unroll some nested groups, but not aliases */
+		for (i = 0; i < group_ret; i++) {
+			sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
+			groupSIDs[i] = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+		}
+		
+		sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
+		user_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+		group_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+		group_sid->sub_auths[group_sid->num_auths-1] 
+			= samdb_result_uint(msgs[0], "primaryGroupID", 0);
+
+		if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx, 
+								     user_sid, group_sid, 
+								     group_ret, groupSIDs, 
+								     False, &(*server_info)->ptok))) {
+			DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
+			free_server_info(server_info);
+			return nt_status;
+		}
+	}
+
+	(*server_info)->guest = False;
+
 	(*server_info)->user_session_key = user_sess_key;
 	(*server_info)->lm_session_key = lm_sess_key;