diff options
| -rw-r--r-- | source4/auth/auth_sam.c | 174 | ||||
| -rw-r--r-- | source4/kdc/hdb-ldb.c | 65 |
2 files changed, 127 insertions, 112 deletions
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c index 3bf0d24e38..000de0486c 100644 --- a/source4/auth/auth_sam.c +++ b/source4/auth/auth_sam.c @@ -26,30 +26,45 @@ #include "auth/auth.h" #include "lib/ldb/include/ldb.h" -const char *user_attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash", - "userAccountControl", - "pwdLastSet", - "accountExpires", - "objectSid", - "userWorkstations", +const char *user_attrs[] = { + /* requried for the krb5 kdc*/ + "objectClass", + "sAMAccountName", + "userPrincipalName", + "servicePrincipalName", + "msDS-KeyVersionNumber", + + /* passwords */ + "unicodePwd", + "lmPwdHash", + "ntPwdHash", + + "userAccountControl", + + "pwdLastSet", + "accountExpires", + + "objectSid", + + /* check 'allowed workstations' */ + "userWorkstations", - /* required for server_info, not access control: */ - "sAMAccountName", - "displayName", - "scriptPath", - "profilePath", - "homeDirectory", - "homeDrive", - "lastLogon", - "lastLogoff", - "accountExpires", - "badPwdCount", - "logonCount", - "primaryGroupID", - NULL, + /* required for server_info, not access control: */ + "displayName", + "scriptPath", + "profilePath", + "homeDirectory", + "homeDrive", + "lastLogon", + "lastLogoff", + "accountExpires", + "badPwdCount", + "logonCount", + "primaryGroupID", + NULL, }; -const char *domain_ref_attrs[] = {"nETBIOSName", "nCName", NULL}; +const char *domain_ref_attrs[] = {"nETBIOSName", "nCName", "dnsRoot", NULL}; /**************************************************************************** Do a specific test for an smb password being correct, given a smb_password and @@ -134,17 +149,33 @@ static NTSTATUS authsam_password_ok(struct auth_context *auth_context, (ie not disabled, expired and the like). ****************************************************************************/ static NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx, + struct ldb_context *sam_ctx, uint32_t logon_parameters, - uint16_t acct_flags, - NTTIME acct_expiry, - NTTIME must_change_time, - NTTIME last_set_time, - const char *workstation_list, + struct ldb_message **msgs, + struct ldb_message **msgs_domain_ref, const struct auth_usersupplied_info *user_info) { + uint16_t acct_flags; + const char *workstation_list; + NTTIME acct_expiry; + NTTIME must_change_time; + NTTIME last_set_time; + + struct ldb_dn *domain_dn = samdb_result_dn(mem_ctx, msgs_domain_ref[0], "nCName", ldb_dn_new(mem_ctx)); + NTTIME now; DEBUG(4,("authsam_account_ok: Checking SMB password for user %s\n", user_info->mapped.account_name)); + acct_flags = samdb_result_acct_flags(msgs[0], "userAccountControl"); + + acct_expiry = samdb_result_nttime(msgs[0], "accountExpires", 0); + must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx, + domain_dn, msgs[0], + "pwdLastSet"); + last_set_time = samdb_result_nttime(msgs[0], "pwdLastSet", 0); + + workstation_list = samdb_result_string(msgs[0], "userWorkstations", NULL); + /* Quit if the account was disabled. */ if (acct_flags & ACB_DISABLED) { DEBUG(1,("authsam_account_ok: Account for user '%s' was disabled.\n", user_info->mapped.account_name)); @@ -348,20 +379,13 @@ static NTSTATUS authsam_search_account(TALLOC_CTX *mem_ctx, struct ldb_context * static NTSTATUS authsam_authenticate(struct auth_context *auth_context, TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx, struct ldb_message **msgs, - struct ldb_message **msgs_domain, + struct ldb_message **msgs_domain_ref, const struct auth_usersupplied_info *user_info, DATA_BLOB *user_sess_key, DATA_BLOB *lm_sess_key) { - uint16_t acct_flags; - const char *workstation_list; - NTTIME acct_expiry; - NTTIME must_change_time; - NTTIME last_set_time; struct samr_Password *lm_pwd, *nt_pwd; NTSTATUS nt_status; - struct ldb_dn *domain_dn = samdb_result_dn(mem_ctx, msgs_domain[0], "nCName", ldb_dn_new(mem_ctx)); - - acct_flags = samdb_result_acct_flags(msgs[0], "userAccountControl"); + uint16_t acct_flags = samdb_result_acct_flags(msgs[0], "userAccountControl"); /* Quit if the account was locked out. */ if (acct_flags & ACB_AUTOLOCK) { @@ -385,21 +409,10 @@ static NTSTATUS authsam_authenticate(struct auth_context *auth_context, user_info, user_sess_key, lm_sess_key); NT_STATUS_NOT_OK_RETURN(nt_status); - acct_expiry = samdb_result_nttime(msgs[0], "accountExpires", 0); - must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx, - domain_dn, msgs[0], - "pwdLastSet"); - last_set_time = samdb_result_nttime(msgs[0], "pwdLastSet", 0); - - workstation_list = samdb_result_string(msgs[0], "userWorkstations", NULL); - - nt_status = authsam_account_ok(mem_ctx, + nt_status = authsam_account_ok(mem_ctx, sam_ctx, user_info->logon_parameters, - acct_flags, - acct_expiry, - must_change_time, - last_set_time, - workstation_list, + msgs, + msgs_domain_ref, user_info); return nt_status; @@ -528,31 +541,20 @@ static NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_context return NT_STATUS_OK; } -NTSTATUS sam_get_server_info_principal(TALLOC_CTX *mem_ctx, const char *principal, - struct auth_serversupplied_info **server_info) -{ - NTSTATUS nt_status; - DATA_BLOB user_sess_key = data_blob(NULL, 0); - DATA_BLOB lm_sess_key = data_blob(NULL, 0); - +NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx, + TALLOC_CTX *mem_ctx, const char *principal, + struct ldb_message ***msgs, + struct ldb_message ***msgs_domain_ref) +{ struct ldb_dn *user_dn, *domain_dn; - struct ldb_message **msgs; - struct ldb_message **msgs_domain_ref; - struct ldb_context *sam_ctx; - + NTSTATUS nt_status; + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); int ret; - TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); if (!tmp_ctx) { return NT_STATUS_NO_MEMORY; } - sam_ctx = samdb_connect(tmp_ctx, system_session(tmp_ctx)); - if (sam_ctx == NULL) { - talloc_free(tmp_ctx); - return NT_STATUS_INVALID_SYSTEM_SERVICE; - } - nt_status = crack_user_principal_name(sam_ctx, tmp_ctx, principal, &user_dn, &domain_dn); if (!NT_STATUS_IS_OK(nt_status)) { talloc_free(tmp_ctx); @@ -560,7 +562,7 @@ NTSTATUS sam_get_server_info_principal(TALLOC_CTX *mem_ctx, const char *principa } /* grab domain info from the reference */ - ret = gendb_search(sam_ctx, tmp_ctx, NULL, &msgs_domain_ref, domain_ref_attrs, + ret = gendb_search(sam_ctx, tmp_ctx, NULL, msgs_domain_ref, domain_ref_attrs, "(ncName=%s)", ldb_dn_linearize(tmp_ctx, domain_dn)); if (ret != 1) { @@ -570,11 +572,45 @@ NTSTATUS sam_get_server_info_principal(TALLOC_CTX *mem_ctx, const char *principa /* pull the user attributes */ ret = gendb_search_dn(sam_ctx, tmp_ctx, - user_dn, &msgs, user_attrs); + user_dn, msgs, user_attrs); if (ret != 1) { talloc_free(tmp_ctx); return NT_STATUS_INTERNAL_DB_CORRUPTION; } + talloc_steal(mem_ctx, *msgs); + talloc_steal(mem_ctx, *msgs_domain_ref); + + return NT_STATUS_OK; +} + + +NTSTATUS sam_get_server_info_principal(TALLOC_CTX *mem_ctx, const char *principal, + struct auth_serversupplied_info **server_info) +{ + NTSTATUS nt_status; + DATA_BLOB user_sess_key = data_blob(NULL, 0); + DATA_BLOB lm_sess_key = data_blob(NULL, 0); + + struct ldb_message **msgs; + struct ldb_message **msgs_domain_ref; + struct ldb_context *sam_ctx; + + TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx); + if (!tmp_ctx) { + return NT_STATUS_NO_MEMORY; + } + + sam_ctx = samdb_connect(tmp_ctx, system_session(tmp_ctx)); + if (sam_ctx == NULL) { + talloc_free(tmp_ctx); + return NT_STATUS_INVALID_SYSTEM_SERVICE; + } + + nt_status = sam_get_results_principal(sam_ctx, mem_ctx, principal, + &msgs, &msgs_domain_ref); + if (!NT_STATUS_IS_OK(nt_status)) { + return nt_status; + } nt_status = authsam_make_server_info(mem_ctx, sam_ctx, msgs, msgs_domain_ref, user_sess_key, lm_sess_key, diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c index 57218d72d9..80e8cdc74e 100644 --- a/source4/kdc/hdb-ldb.c +++ b/source4/kdc/hdb-ldb.c @@ -45,31 +45,23 @@ enum hdb_ldb_ent_type static const char * const krb5_attrs[] = { "objectClass", - "cn", "sAMAccountName", "userPrincipalName", "servicePrincipalName", - "userAccountControl", - "unicodePwd", "lmPwdHash", "ntPwdHash", - "badPwdCount", - "badPasswordTime", - "lastLogoff", - "lastLogon", + "userAccountControl", + "pwdLastSet", "accountExpires", - "logonCount", - "objectGUID", "whenCreated", "whenChanged", - "uSNCreated", - "uSNChanged", + "msDS-KeyVersionNumber", NULL }; @@ -211,8 +203,9 @@ static HDBFlags uf2HDBFlags(krb5_context context, int userAccountControl, enum h */ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, TALLOC_CTX *mem_ctx, krb5_const_principal principal, - enum hdb_ldb_ent_type ent_type, struct ldb_message *realm_ref_msg, + enum hdb_ldb_ent_type ent_type, struct ldb_message *msg, + struct ldb_message *realm_ref_msg, hdb_entry *ent) { const char *unicodePwd; @@ -222,16 +215,17 @@ static krb5_error_code LDB_message2entry(krb5_context context, HDB *db, const char *dnsdomain = ldb_msg_find_string(realm_ref_msg, "dnsRoot", NULL); char *realm = strupper_talloc(mem_ctx, dnsdomain); + + memset(ent, 0, sizeof(*ent)); + + krb5_warnx(context, "LDB_message2entry:\n"); + if (!realm) { krb5_set_error_string(context, "talloc_strdup: out of memory"); ret = ENOMEM; goto out; } - krb5_warnx(context, "LDB_message2entry:\n"); - - memset(ent, 0, sizeof(*ent)); - userAccountControl = ldb_msg_find_int(msg, "userAccountControl", 0); ent->principal = malloc(sizeof(*(ent->principal))); @@ -644,9 +638,7 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, switch (ent_type) { case HDB_ENT_TYPE_CLIENT: { - int ldb_ret; NTSTATUS nt_status; - struct ldb_dn *user_dn, *domain_dn; char *principal_string; ldb_ent_type = HDB_LDB_ENT_TYPE_CLIENT; @@ -657,34 +649,20 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, return ret; } - nt_status = crack_user_principal_name((struct ldb_context *)db->hdb_db, + nt_status = sam_get_results_principal((struct ldb_context *)db->hdb_db, mem_ctx, principal_string, - &user_dn, &domain_dn); - free(principal_string); - - if (!NT_STATUS_IS_OK(nt_status)) { - talloc_free(mem_ctx); - return HDB_ERR_NOENTRY; - } - - ldb_ret = gendb_search_dn((struct ldb_context *)db->hdb_db, - mem_ctx, user_dn, &msg, krb5_attrs); - - if (ldb_ret != 1) { - return HDB_ERR_NOENTRY; - } - - ldb_ret = gendb_search((struct ldb_context *)db->hdb_db, - mem_ctx, NULL, &realm_ref_msg, realm_ref_attrs, - "ncName=%s", ldb_dn_linearize(mem_ctx, domain_dn)); - - if (ldb_ret != 1) { + &msg, &realm_ref_msg); + if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) { return HDB_ERR_NOENTRY; + } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MEMORY)) { + return ENOMEM; + } else if (!NT_STATUS_IS_OK(nt_status)) { + return EINVAL; } ret = LDB_message2entry(context, db, mem_ctx, principal, ldb_ent_type, - realm_ref_msg[0], msg[0], entry); + msg[0], realm_ref_msg[0], entry); talloc_free(mem_ctx); return ret; } @@ -763,7 +741,7 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, ret = LDB_message2entry(context, db, mem_ctx, principal, ldb_ent_type, - realm_ref_msg[0], msg[0], entry); + msg[0], realm_ref_msg[0], entry); talloc_free(mem_ctx); return ret; @@ -806,7 +784,7 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags, } else { ret = LDB_message2entry(context, db, mem_ctx, principal, ldb_ent_type, - realm_ref_msg[0], msg[0], entry); + msg[0], realm_ref_msg[0], entry); if (ret != 0) { krb5_warnx(context, "LDB_fetch: message2entry failed\n"); } @@ -853,7 +831,8 @@ static krb5_error_code LDB_seq(krb5_context context, HDB *db, unsigned flags, hd if (priv->index < priv->count) { ret = LDB_message2entry(context, db, mem_ctx, NULL, HDB_LDB_ENT_TYPE_ANY, - priv->realm_ref_msgs[0], priv->msgs[priv->index++], entry); + priv->msgs[priv->index++], + priv->realm_ref_msgs[0], entry); } else { ret = HDB_ERR_NOENTRY; } |