/* [<][>][^][v][top][bottom][index][help] */
DEFINITIONS
This source file includes following definitions.
- wbc_error_to_pam_error
- _pam_error_code_str
- textdomain_init
- _pam_get_item
- _pam_get_data
- _pam_log_int
- _pam_log_int
- _pam_log_is_silent
- _pam_log
- __pam_log
- _pam_log_is_debug_enabled
- _pam_log_is_debug_state_enabled
- _pam_log_debug
- __pam_log_debug
- _pam_log_state_datum
- _pam_log_state
- _pam_parse
- _pam_winbind_free_context
- _pam_winbind_init_context
- _pam_winbind_cleanup_func
- _get_ntstatus_error_string
- converse
- _make_remark
- _make_remark_v
- _make_remark_format
- pam_winbind_request_log
- wbc_auth_error_to_pam_error
- _pam_winbind_change_pwd
- _pam_winbind_change_pwd
- _pam_send_password_expiry_message
- _pam_warn_password_expiry
- safe_append_string
- winbind_name_to_sid_string
- winbind_name_list_to_sid_string_list
- _pam_setup_krb5_env
- _pam_setup_unix_username
- _pam_set_data_string
- _pam_set_data_info3
- _pam_free_data_info3
- _pam_warn_logon_type
- _pam_warn_krb5_failure
- _pam_check_remark_auth_err
- _pam_compose_pwd_restriction_string
- _pam_create_homedir
- _pam_chown_homedir
- _pam_mkhomedir
- winbind_auth_request
- winbind_chauthtok_request
- valid_user
- _pam_delete
- _winbind_read_password
- get_conf_item_string
- get_config_item_int
- get_krb5_cc_type_from_config
- get_member_from_config
- get_warn_pwd_expire_from_config
- winbind_get_separator
- winbind_upn_to_username
- _pam_delete_cred
- pam_sm_authenticate
- pam_sm_setcred
- pam_sm_acct_mgmt
- pam_sm_open_session
- pam_sm_close_session
- _pam_require_krb5_auth_after_chauthtok
- pam_sm_chauthtok
1 /* pam_winbind module
2
3 Copyright Andrew Tridgell <tridge@samba.org> 2000
4 Copyright Tim Potter <tpot@samba.org> 2000
5 Copyright Andrew Bartlett <abartlet@samba.org> 2002
6 Copyright Guenther Deschner <gd@samba.org> 2005-2008
7
8 largely based on pam_userdb by Cristian Gafton <gafton@redhat.com> also
9 contains large slabs of code from pam_unix by Elliot Lee
10 <sopwith@redhat.com> (see copyright below for full details)
11 */
12
13 #include "pam_winbind.h"
14
15 static int wbc_error_to_pam_error(wbcErr status)
/* [<][>][^][v][top][bottom][index][help] */
16 {
17 switch (status) {
18 case WBC_ERR_SUCCESS:
19 return PAM_SUCCESS;
20 case WBC_ERR_NOT_IMPLEMENTED:
21 return PAM_SERVICE_ERR;
22 case WBC_ERR_UNKNOWN_FAILURE:
23 break;
24 case WBC_ERR_NO_MEMORY:
25 return PAM_BUF_ERR;
26 case WBC_ERR_INVALID_SID:
27 case WBC_ERR_INVALID_PARAM:
28 break;
29 case WBC_ERR_WINBIND_NOT_AVAILABLE:
30 return PAM_AUTHINFO_UNAVAIL;
31 case WBC_ERR_DOMAIN_NOT_FOUND:
32 return PAM_AUTHINFO_UNAVAIL;
33 case WBC_ERR_INVALID_RESPONSE:
34 return PAM_BUF_ERR;
35 case WBC_ERR_NSS_ERROR:
36 return PAM_USER_UNKNOWN;
37 case WBC_ERR_AUTH_ERROR:
38 return PAM_AUTH_ERR;
39 case WBC_ERR_UNKNOWN_USER:
40 return PAM_USER_UNKNOWN;
41 case WBC_ERR_UNKNOWN_GROUP:
42 return PAM_USER_UNKNOWN;
43 case WBC_ERR_PWD_CHANGE_FAILED:
44 break;
45 }
46
47 /* be paranoid */
48 return PAM_AUTH_ERR;
49 }
50
51 static const char *_pam_error_code_str(int err)
/* [<][>][^][v][top][bottom][index][help] */
52 {
53 switch (err) {
54 case PAM_SUCCESS:
55 return "PAM_SUCCESS";
56 case PAM_OPEN_ERR:
57 return "PAM_OPEN_ERR";
58 case PAM_SYMBOL_ERR:
59 return "PAM_SYMBOL_ERR";
60 case PAM_SERVICE_ERR:
61 return "PAM_SERVICE_ERR";
62 case PAM_SYSTEM_ERR:
63 return "PAM_SYSTEM_ERR";
64 case PAM_BUF_ERR:
65 return "PAM_BUF_ERR";
66 case PAM_PERM_DENIED:
67 return "PAM_PERM_DENIED";
68 case PAM_AUTH_ERR:
69 return "PAM_AUTH_ERR";
70 case PAM_CRED_INSUFFICIENT:
71 return "PAM_CRED_INSUFFICIENT";
72 case PAM_AUTHINFO_UNAVAIL:
73 return "PAM_AUTHINFO_UNAVAIL";
74 case PAM_USER_UNKNOWN:
75 return "PAM_USER_UNKNOWN";
76 case PAM_MAXTRIES:
77 return "PAM_MAXTRIES";
78 case PAM_NEW_AUTHTOK_REQD:
79 return "PAM_NEW_AUTHTOK_REQD";
80 case PAM_ACCT_EXPIRED:
81 return "PAM_ACCT_EXPIRED";
82 case PAM_SESSION_ERR:
83 return "PAM_SESSION_ERR";
84 case PAM_CRED_UNAVAIL:
85 return "PAM_CRED_UNAVAIL";
86 case PAM_CRED_EXPIRED:
87 return "PAM_CRED_EXPIRED";
88 case PAM_CRED_ERR:
89 return "PAM_CRED_ERR";
90 case PAM_NO_MODULE_DATA:
91 return "PAM_NO_MODULE_DATA";
92 case PAM_CONV_ERR:
93 return "PAM_CONV_ERR";
94 case PAM_AUTHTOK_ERR:
95 return "PAM_AUTHTOK_ERR";
96 case PAM_AUTHTOK_RECOVER_ERR:
97 return "PAM_AUTHTOK_RECOVER_ERR";
98 case PAM_AUTHTOK_LOCK_BUSY:
99 return "PAM_AUTHTOK_LOCK_BUSY";
100 case PAM_AUTHTOK_DISABLE_AGING:
101 return "PAM_AUTHTOK_DISABLE_AGING";
102 case PAM_TRY_AGAIN:
103 return "PAM_TRY_AGAIN";
104 case PAM_IGNORE:
105 return "PAM_IGNORE";
106 case PAM_ABORT:
107 return "PAM_ABORT";
108 case PAM_AUTHTOK_EXPIRED:
109 return "PAM_AUTHTOK_EXPIRED";
110 #ifdef PAM_MODULE_UNKNOWN
111 case PAM_MODULE_UNKNOWN:
112 return "PAM_MODULE_UNKNOWN";
113 #endif
114 #ifdef PAM_BAD_ITEM
115 case PAM_BAD_ITEM:
116 return "PAM_BAD_ITEM";
117 #endif
118 #ifdef PAM_CONV_AGAIN
119 case PAM_CONV_AGAIN:
120 return "PAM_CONV_AGAIN";
121 #endif
122 #ifdef PAM_INCOMPLETE
123 case PAM_INCOMPLETE:
124 return "PAM_INCOMPLETE";
125 #endif
126 default:
127 return NULL;
128 }
129 }
130
131 #define _PAM_LOG_FUNCTION_ENTER(function, ctx) \
132 do { \
133 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] ENTER: " \
134 function " (flags: 0x%04x)", ctx->pamh, ctx->flags); \
135 _pam_log_state(ctx); \
136 } while (0)
137
138 #define _PAM_LOG_FUNCTION_LEAVE(function, ctx, retval) \
139 do { \
140 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] LEAVE: " \
141 function " returning %d (%s)", ctx->pamh, retval, \
142 _pam_error_code_str(retval)); \
143 _pam_log_state(ctx); \
144 } while (0)
145
146 /* data tokens */
147
148 #define MAX_PASSWD_TRIES 3
149
150 #ifdef HAVE_GETTEXT
151 static char initialized = 0;
152
153 static inline void textdomain_init(void);
154 static inline void textdomain_init(void)
/* [<][>][^][v][top][bottom][index][help] */
155 {
156 if (!initialized) {
157 bindtextdomain(MODULE_NAME, dyn_LOCALEDIR);
158 initialized = 1;
159 }
160 return;
161 }
162 #endif
163
164
165 /*
166 * Work around the pam API that has functions with void ** as parameters
167 * These lead to strict aliasing warnings with gcc.
168 */
169 static int _pam_get_item(const pam_handle_t *pamh,
/* [<][>][^][v][top][bottom][index][help] */
170 int item_type,
171 const void *_item)
172 {
173 const void **item = (const void **)_item;
174 return pam_get_item(pamh, item_type, item);
175 }
176 static int _pam_get_data(const pam_handle_t *pamh,
/* [<][>][^][v][top][bottom][index][help] */
177 const char *module_data_name,
178 const void *_data)
179 {
180 const void **data = (const void **)_data;
181 return pam_get_data(pamh, module_data_name, data);
182 }
183
184 /* some syslogging */
185
186 #ifdef HAVE_PAM_VSYSLOG
187 static void _pam_log_int(const pam_handle_t *pamh,
/* [<][>][^][v][top][bottom][index][help] */
188 int err,
189 const char *format,
190 va_list args)
191 {
192 pam_vsyslog(pamh, err, format, args);
193 }
194 #else
195 static void _pam_log_int(const pam_handle_t *pamh,
/* [<][>][^][v][top][bottom][index][help] */
196 int err,
197 const char *format,
198 va_list args)
199 {
200 char *format2 = NULL;
201 const char *service;
202
203 _pam_get_item(pamh, PAM_SERVICE, &service);
204
205 format2 = (char *)malloc(strlen(MODULE_NAME)+strlen(format)+strlen(service)+5);
206 if (format2 == NULL) {
207 /* what else todo ? */
208 vsyslog(err, format, args);
209 return;
210 }
211
212 sprintf(format2, "%s(%s): %s", MODULE_NAME, service, format);
213 vsyslog(err, format2, args);
214 SAFE_FREE(format2);
215 }
216 #endif /* HAVE_PAM_VSYSLOG */
217
218 static bool _pam_log_is_silent(int ctrl)
/* [<][>][^][v][top][bottom][index][help] */
219 {
220 return on(ctrl, WINBIND_SILENT);
221 }
222
223 static void _pam_log(struct pwb_context *r, int err, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
/* [<][>][^][v][top][bottom][index][help] */
224 static void _pam_log(struct pwb_context *r, int err, const char *format, ...)
225 {
226 va_list args;
227
228 if (_pam_log_is_silent(r->ctrl)) {
229 return;
230 }
231
232 va_start(args, format);
233 _pam_log_int(r->pamh, err, format, args);
234 va_end(args);
235 }
236 static void __pam_log(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...) PRINTF_ATTRIBUTE(4,5);
/* [<][>][^][v][top][bottom][index][help] */
237 static void __pam_log(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...)
238 {
239 va_list args;
240
241 if (_pam_log_is_silent(ctrl)) {
242 return;
243 }
244
245 va_start(args, format);
246 _pam_log_int(pamh, err, format, args);
247 va_end(args);
248 }
249
250 static bool _pam_log_is_debug_enabled(int ctrl)
/* [<][>][^][v][top][bottom][index][help] */
251 {
252 if (ctrl == -1) {
253 return false;
254 }
255
256 if (_pam_log_is_silent(ctrl)) {
257 return false;
258 }
259
260 if (!(ctrl & WINBIND_DEBUG_ARG)) {
261 return false;
262 }
263
264 return true;
265 }
266
267 static bool _pam_log_is_debug_state_enabled(int ctrl)
/* [<][>][^][v][top][bottom][index][help] */
268 {
269 if (!(ctrl & WINBIND_DEBUG_STATE)) {
270 return false;
271 }
272
273 return _pam_log_is_debug_enabled(ctrl);
274 }
275
276 static void _pam_log_debug(struct pwb_context *r, int err, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
/* [<][>][^][v][top][bottom][index][help] */
277 static void _pam_log_debug(struct pwb_context *r, int err, const char *format, ...)
278 {
279 va_list args;
280
281 if (!_pam_log_is_debug_enabled(r->ctrl)) {
282 return;
283 }
284
285 va_start(args, format);
286 _pam_log_int(r->pamh, err, format, args);
287 va_end(args);
288 }
289 static void __pam_log_debug(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...) PRINTF_ATTRIBUTE(4,5);
/* [<][>][^][v][top][bottom][index][help] */
290 static void __pam_log_debug(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...)
291 {
292 va_list args;
293
294 if (!_pam_log_is_debug_enabled(ctrl)) {
295 return;
296 }
297
298 va_start(args, format);
299 _pam_log_int(pamh, err, format, args);
300 va_end(args);
301 }
302
303 static void _pam_log_state_datum(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
304 int item_type,
305 const char *key,
306 int is_string)
307 {
308 const void *data = NULL;
309 if (item_type != 0) {
310 pam_get_item(ctx->pamh, item_type, &data);
311 } else {
312 pam_get_data(ctx->pamh, key, &data);
313 }
314 if (data != NULL) {
315 const char *type = (item_type != 0) ? "ITEM" : "DATA";
316 if (is_string != 0) {
317 _pam_log_debug(ctx, LOG_DEBUG,
318 "[pamh: %p] STATE: %s(%s) = \"%s\" (%p)",
319 ctx->pamh, type, key, (const char *)data,
320 data);
321 } else {
322 _pam_log_debug(ctx, LOG_DEBUG,
323 "[pamh: %p] STATE: %s(%s) = %p",
324 ctx->pamh, type, key, data);
325 }
326 }
327 }
328
329 #define _PAM_LOG_STATE_DATA_POINTER(ctx, module_data_name) \
330 _pam_log_state_datum(ctx, 0, module_data_name, 0)
331
332 #define _PAM_LOG_STATE_DATA_STRING(ctx, module_data_name) \
333 _pam_log_state_datum(ctx, 0, module_data_name, 1)
334
335 #define _PAM_LOG_STATE_ITEM_POINTER(ctx, item_type) \
336 _pam_log_state_datum(ctx, item_type, #item_type, 0)
337
338 #define _PAM_LOG_STATE_ITEM_STRING(ctx, item_type) \
339 _pam_log_state_datum(ctx, item_type, #item_type, 1)
340
341 #ifdef DEBUG_PASSWORD
342 #define _LOG_PASSWORD_AS_STRING 1
343 #else
344 #define _LOG_PASSWORD_AS_STRING 0
345 #endif
346
347 #define _PAM_LOG_STATE_ITEM_PASSWORD(ctx, item_type) \
348 _pam_log_state_datum(ctx, item_type, #item_type, \
349 _LOG_PASSWORD_AS_STRING)
350
351 static void _pam_log_state(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
352 {
353 if (!_pam_log_is_debug_state_enabled(ctx->ctrl)) {
354 return;
355 }
356
357 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_SERVICE);
358 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_USER);
359 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_TTY);
360 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_RHOST);
361 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_RUSER);
362 _PAM_LOG_STATE_ITEM_PASSWORD(ctx, PAM_OLDAUTHTOK);
363 _PAM_LOG_STATE_ITEM_PASSWORD(ctx, PAM_AUTHTOK);
364 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_USER_PROMPT);
365 _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_CONV);
366 #ifdef PAM_FAIL_DELAY
367 _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_FAIL_DELAY);
368 #endif
369 #ifdef PAM_REPOSITORY
370 _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_REPOSITORY);
371 #endif
372
373 _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_HOMEDIR);
374 _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_LOGONSCRIPT);
375 _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_LOGONSERVER);
376 _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_PROFILEPATH);
377 _PAM_LOG_STATE_DATA_STRING(ctx,
378 PAM_WINBIND_NEW_AUTHTOK_REQD);
379 /* Use atoi to get PAM result code */
380 _PAM_LOG_STATE_DATA_STRING(ctx,
381 PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH);
382 _PAM_LOG_STATE_DATA_POINTER(ctx, PAM_WINBIND_PWD_LAST_SET);
383 }
384
385 static int _pam_parse(const pam_handle_t *pamh,
/* [<][>][^][v][top][bottom][index][help] */
386 int flags,
387 int argc,
388 const char **argv,
389 dictionary **result_d)
390 {
391 int ctrl = 0;
392 const char *config_file = NULL;
393 int i;
394 const char **v;
395 dictionary *d = NULL;
396
397 if (flags & PAM_SILENT) {
398 ctrl |= WINBIND_SILENT;
399 }
400
401 for (i=argc,v=argv; i-- > 0; ++v) {
402 if (!strncasecmp(*v, "config", strlen("config"))) {
403 ctrl |= WINBIND_CONFIG_FILE;
404 config_file = v[i];
405 break;
406 }
407 }
408
409 if (config_file == NULL) {
410 config_file = PAM_WINBIND_CONFIG_FILE;
411 }
412
413 d = iniparser_load(config_file);
414 if (d == NULL) {
415 goto config_from_pam;
416 }
417
418 if (iniparser_getboolean(d, "global:debug", false)) {
419 ctrl |= WINBIND_DEBUG_ARG;
420 }
421
422 if (iniparser_getboolean(d, "global:debug_state", false)) {
423 ctrl |= WINBIND_DEBUG_STATE;
424 }
425
426 if (iniparser_getboolean(d, "global:cached_login", false)) {
427 ctrl |= WINBIND_CACHED_LOGIN;
428 }
429
430 if (iniparser_getboolean(d, "global:krb5_auth", false)) {
431 ctrl |= WINBIND_KRB5_AUTH;
432 }
433
434 if (iniparser_getboolean(d, "global:silent", false)) {
435 ctrl |= WINBIND_SILENT;
436 }
437
438 if (iniparser_getstr(d, "global:krb5_ccache_type") != NULL) {
439 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
440 }
441
442 if ((iniparser_getstr(d, "global:require-membership-of") != NULL) ||
443 (iniparser_getstr(d, "global:require_membership_of") != NULL)) {
444 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
445 }
446
447 if (iniparser_getboolean(d, "global:try_first_pass", false)) {
448 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
449 }
450
451 if (iniparser_getint(d, "global:warn_pwd_expire", 0)) {
452 ctrl |= WINBIND_WARN_PWD_EXPIRE;
453 }
454
455 if (iniparser_getboolean(d, "global:mkhomedir", false)) {
456 ctrl |= WINBIND_MKHOMEDIR;
457 }
458
459 config_from_pam:
460 /* step through arguments */
461 for (i=argc,v=argv; i-- > 0; ++v) {
462
463 /* generic options */
464 if (!strcmp(*v,"debug"))
465 ctrl |= WINBIND_DEBUG_ARG;
466 else if (!strcasecmp(*v, "debug_state"))
467 ctrl |= WINBIND_DEBUG_STATE;
468 else if (!strcasecmp(*v, "silent"))
469 ctrl |= WINBIND_SILENT;
470 else if (!strcasecmp(*v, "use_authtok"))
471 ctrl |= WINBIND_USE_AUTHTOK_ARG;
472 else if (!strcasecmp(*v, "use_first_pass"))
473 ctrl |= WINBIND_USE_FIRST_PASS_ARG;
474 else if (!strcasecmp(*v, "try_first_pass"))
475 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
476 else if (!strcasecmp(*v, "unknown_ok"))
477 ctrl |= WINBIND_UNKNOWN_OK_ARG;
478 else if (!strncasecmp(*v, "require_membership_of",
479 strlen("require_membership_of")))
480 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
481 else if (!strncasecmp(*v, "require-membership-of",
482 strlen("require-membership-of")))
483 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
484 else if (!strcasecmp(*v, "krb5_auth"))
485 ctrl |= WINBIND_KRB5_AUTH;
486 else if (!strncasecmp(*v, "krb5_ccache_type",
487 strlen("krb5_ccache_type")))
488 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
489 else if (!strcasecmp(*v, "cached_login"))
490 ctrl |= WINBIND_CACHED_LOGIN;
491 else if (!strcasecmp(*v, "mkhomedir"))
492 ctrl |= WINBIND_MKHOMEDIR;
493 else {
494 __pam_log(pamh, ctrl, LOG_ERR,
495 "pam_parse: unknown option: %s", *v);
496 return -1;
497 }
498
499 }
500
501 if (result_d) {
502 *result_d = d;
503 } else {
504 if (d) {
505 iniparser_freedict(d);
506 }
507 }
508
509 return ctrl;
510 };
511
512 static int _pam_winbind_free_context(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
513 {
514 if (!ctx) {
515 return 0;
516 }
517
518 if (ctx->dict) {
519 iniparser_freedict(ctx->dict);
520 }
521
522 return 0;
523 }
524
525 static int _pam_winbind_init_context(pam_handle_t *pamh,
/* [<][>][^][v][top][bottom][index][help] */
526 int flags,
527 int argc,
528 const char **argv,
529 struct pwb_context **ctx_p)
530 {
531 struct pwb_context *r = NULL;
532
533 #ifdef HAVE_GETTEXT
534 textdomain_init();
535 #endif
536
537 r = TALLOC_ZERO_P(NULL, struct pwb_context);
538 if (!r) {
539 return PAM_BUF_ERR;
540 }
541
542 talloc_set_destructor(r, _pam_winbind_free_context);
543
544 r->pamh = pamh;
545 r->flags = flags;
546 r->argc = argc;
547 r->argv = argv;
548 r->ctrl = _pam_parse(pamh, flags, argc, argv, &r->dict);
549 if (r->ctrl == -1) {
550 TALLOC_FREE(r);
551 return PAM_SYSTEM_ERR;
552 }
553
554 *ctx_p = r;
555
556 return PAM_SUCCESS;
557 }
558
559 static void _pam_winbind_cleanup_func(pam_handle_t *pamh,
/* [<][>][^][v][top][bottom][index][help] */
560 void *data,
561 int error_status)
562 {
563 int ctrl = _pam_parse(pamh, 0, 0, NULL, NULL);
564 if (_pam_log_is_debug_state_enabled(ctrl)) {
565 __pam_log_debug(pamh, ctrl, LOG_DEBUG,
566 "[pamh: %p] CLEAN: cleaning up PAM data %p "
567 "(error_status = %d)", pamh, data,
568 error_status);
569 }
570 TALLOC_FREE(data);
571 }
572
573
574 static const struct ntstatus_errors {
575 const char *ntstatus_string;
576 const char *error_string;
577 } ntstatus_errors[] = {
578 {"NT_STATUS_OK",
579 N_("Success")},
580 {"NT_STATUS_BACKUP_CONTROLLER",
581 N_("No primary Domain Controler available")},
582 {"NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
583 N_("No domain controllers found")},
584 {"NT_STATUS_NO_LOGON_SERVERS",
585 N_("No logon servers")},
586 {"NT_STATUS_PWD_TOO_SHORT",
587 N_("Password too short")},
588 {"NT_STATUS_PWD_TOO_RECENT",
589 N_("The password of this user is too recent to change")},
590 {"NT_STATUS_PWD_HISTORY_CONFLICT",
591 N_("Password is already in password history")},
592 {"NT_STATUS_PASSWORD_EXPIRED",
593 N_("Your password has expired")},
594 {"NT_STATUS_PASSWORD_MUST_CHANGE",
595 N_("You need to change your password now")},
596 {"NT_STATUS_INVALID_WORKSTATION",
597 N_("You are not allowed to logon from this workstation")},
598 {"NT_STATUS_INVALID_LOGON_HOURS",
599 N_("You are not allowed to logon at this time")},
600 {"NT_STATUS_ACCOUNT_EXPIRED",
601 N_("Your account has expired. "
602 "Please contact your System administrator")}, /* SCNR */
603 {"NT_STATUS_ACCOUNT_DISABLED",
604 N_("Your account is disabled. "
605 "Please contact your System administrator")}, /* SCNR */
606 {"NT_STATUS_ACCOUNT_LOCKED_OUT",
607 N_("Your account has been locked. "
608 "Please contact your System administrator")}, /* SCNR */
609 {"NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
610 N_("Invalid Trust Account")},
611 {"NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT",
612 N_("Invalid Trust Account")},
613 {"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
614 N_("Invalid Trust Account")},
615 {"NT_STATUS_ACCESS_DENIED",
616 N_("Access is denied")},
617 {NULL, NULL}
618 };
619
620 static const char *_get_ntstatus_error_string(const char *nt_status_string)
/* [<][>][^][v][top][bottom][index][help] */
621 {
622 int i;
623 for (i=0; ntstatus_errors[i].ntstatus_string != NULL; i++) {
624 if (!strcasecmp(ntstatus_errors[i].ntstatus_string,
625 nt_status_string)) {
626 return _(ntstatus_errors[i].error_string);
627 }
628 }
629 return NULL;
630 }
631
632 /* --- authentication management functions --- */
633
634 /* Attempt a conversation */
635
636 static int converse(const pam_handle_t *pamh,
/* [<][>][^][v][top][bottom][index][help] */
637 int nargs,
638 struct pam_message **message,
639 struct pam_response **response)
640 {
641 int retval;
642 struct pam_conv *conv;
643
644 retval = _pam_get_item(pamh, PAM_CONV, &conv);
645 if (retval == PAM_SUCCESS) {
646 retval = conv->conv(nargs,
647 (const struct pam_message **)message,
648 response, conv->appdata_ptr);
649 }
650
651 return retval; /* propagate error status */
652 }
653
654
655 static int _make_remark(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
656 int type,
657 const char *text)
658 {
659 int retval = PAM_SUCCESS;
660
661 struct pam_message *pmsg[1], msg[1];
662 struct pam_response *resp;
663
664 if (ctx->flags & WINBIND_SILENT) {
665 return PAM_SUCCESS;
666 }
667
668 pmsg[0] = &msg[0];
669 msg[0].msg = discard_const_p(char, text);
670 msg[0].msg_style = type;
671
672 resp = NULL;
673 retval = converse(ctx->pamh, 1, pmsg, &resp);
674
675 if (resp) {
676 _pam_drop_reply(resp, 1);
677 }
678 return retval;
679 }
680
681 static int _make_remark_v(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
682 int type,
683 const char *format,
684 va_list args)
685 {
686 char *var;
687 int ret;
688
689 ret = vasprintf(&var, format, args);
690 if (ret < 0) {
691 _pam_log(ctx, LOG_ERR, "memory allocation failure");
692 return ret;
693 }
694
695 ret = _make_remark(ctx, type, var);
696 SAFE_FREE(var);
697 return ret;
698 }
699
700 static int _make_remark_format(struct pwb_context *ctx, int type, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
/* [<][>][^][v][top][bottom][index][help] */
701 static int _make_remark_format(struct pwb_context *ctx, int type, const char *format, ...)
702 {
703 int ret;
704 va_list args;
705
706 va_start(args, format);
707 ret = _make_remark_v(ctx, type, format, args);
708 va_end(args);
709 return ret;
710 }
711
712 static int pam_winbind_request_log(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
713 int retval,
714 const char *user,
715 const char *fn)
716 {
717 switch (retval) {
718 case PAM_AUTH_ERR:
719 /* incorrect password */
720 _pam_log(ctx, LOG_WARNING, "user '%s' denied access "
721 "(incorrect password or invalid membership)", user);
722 return retval;
723 case PAM_ACCT_EXPIRED:
724 /* account expired */
725 _pam_log(ctx, LOG_WARNING, "user '%s' account expired",
726 user);
727 return retval;
728 case PAM_AUTHTOK_EXPIRED:
729 /* password expired */
730 _pam_log(ctx, LOG_WARNING, "user '%s' password expired",
731 user);
732 return retval;
733 case PAM_NEW_AUTHTOK_REQD:
734 /* new password required */
735 _pam_log(ctx, LOG_WARNING, "user '%s' new password "
736 "required", user);
737 return retval;
738 case PAM_USER_UNKNOWN:
739 /* the user does not exist */
740 _pam_log_debug(ctx, LOG_NOTICE, "user '%s' not found",
741 user);
742 if (ctx->ctrl & WINBIND_UNKNOWN_OK_ARG) {
743 return PAM_IGNORE;
744 }
745 return retval;
746 case PAM_SUCCESS:
747 /* Otherwise, the authentication looked good */
748 if (strcmp(fn, "wbcLogonUser") == 0) {
749 _pam_log(ctx, LOG_NOTICE,
750 "user '%s' granted access", user);
751 } else {
752 _pam_log(ctx, LOG_NOTICE,
753 "user '%s' OK", user);
754 }
755 return retval;
756 default:
757 /* we don't know anything about this return value */
758 _pam_log(ctx, LOG_ERR,
759 "internal module error (retval = %s(%d), user = '%s')",
760 _pam_error_code_str(retval), retval, user);
761 return retval;
762 }
763 }
764
765 static int wbc_auth_error_to_pam_error(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
766 struct wbcAuthErrorInfo *e,
767 wbcErr status,
768 const char *username,
769 const char *fn)
770 {
771 int ret = PAM_AUTH_ERR;
772
773 if (WBC_ERROR_IS_OK(status)) {
774 _pam_log_debug(ctx, LOG_DEBUG, "request %s succeeded",
775 fn);
776 ret = PAM_SUCCESS;
777 return pam_winbind_request_log(ctx, ret, username, fn);
778 }
779
780 if (e) {
781 if (e->pam_error != PAM_SUCCESS) {
782 _pam_log(ctx, LOG_ERR,
783 "request %s failed: %s, "
784 "PAM error: %s (%d), NTSTATUS: %s, "
785 "Error message was: %s",
786 fn,
787 wbcErrorString(status),
788 _pam_error_code_str(e->pam_error),
789 e->pam_error,
790 e->nt_string,
791 e->display_string);
792 ret = e->pam_error;
793 return pam_winbind_request_log(ctx, ret, username, fn);
794 }
795
796 _pam_log(ctx, LOG_ERR, "request %s failed, but PAM error 0!", fn);
797
798 ret = PAM_SERVICE_ERR;
799 return pam_winbind_request_log(ctx, ret, username, fn);
800 }
801
802 ret = wbc_error_to_pam_error(status);
803 return pam_winbind_request_log(ctx, ret, username, fn);
804 }
805
806 #if defined(HAVE_PAM_RADIO_TYPE)
807 static bool _pam_winbind_change_pwd(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
808 {
809 struct pam_message msg, *pmsg;
810 struct pam_response *resp = NULL;
811 const char *prompt;
812 int ret;
813 bool retval = false;
814 prompt = _("Do you want to change your password now?");
815 pmsg = &msg;
816 msg.msg_style = PAM_RADIO_TYPE;
817 msg.msg = prompt;
818 ret = converse(ctx->pamh, 1, &pmsg, &resp);
819 if (resp == NULL) {
820 if (ret == PAM_SUCCESS) {
821 _pam_log(ctx, LOG_CRIT, "pam_winbind: system error!\n");
822 return false;
823 }
824 }
825 if (ret != PAM_SUCCESS) {
826 return false;
827 }
828 _pam_log(ctx, LOG_CRIT, "Received [%s] reply from application.\n", resp->resp);
829
830 if (strcasecmp(resp->resp, "yes") == 0) {
831 retval = true;
832 }
833
834 _pam_drop_reply(resp, 1);
835 return retval;
836 }
837 #else
838 static bool _pam_winbind_change_pwd(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
839 {
840 return false;
841 }
842 #endif
843
844 /**
845 * send a password expiry message if required
846 *
847 * @param ctx PAM winbind context.
848 * @param next_change expected (calculated) next expiry date.
849 * @param already_expired pointer to a boolean to indicate if the password is
850 * already expired.
851 *
852 * @return boolean Returns true if message has been sent, false if not.
853 */
854
855 static bool _pam_send_password_expiry_message(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
856 time_t next_change,
857 time_t now,
858 int warn_pwd_expire,
859 bool *already_expired,
860 bool *change_pwd)
861 {
862 int days = 0;
863 struct tm tm_now, tm_next_change;
864 bool retval = false;
865 int ret;
866
867 if (already_expired) {
868 *already_expired = false;
869 }
870
871 if (change_pwd) {
872 *change_pwd = false;
873 }
874
875 if (next_change <= now) {
876 PAM_WB_REMARK_DIRECT(ctx, "NT_STATUS_PASSWORD_EXPIRED");
877 if (already_expired) {
878 *already_expired = true;
879 }
880 return true;
881 }
882
883 if ((next_change < 0) ||
884 (next_change > now + warn_pwd_expire * SECONDS_PER_DAY)) {
885 return false;
886 }
887
888 if ((localtime_r(&now, &tm_now) == NULL) ||
889 (localtime_r(&next_change, &tm_next_change) == NULL)) {
890 return false;
891 }
892
893 days = (tm_next_change.tm_yday+tm_next_change.tm_year*365) -
894 (tm_now.tm_yday+tm_now.tm_year*365);
895
896 if (days == 0) {
897 ret = _make_remark(ctx, PAM_TEXT_INFO,
898 _("Your password expires today.\n"));
899
900 /*
901 * If change_pwd and already_expired is null.
902 * We are just sending a notification message.
903 * We don't expect any response in this case.
904 */
905
906 if (!change_pwd && !already_expired) {
907 return true;
908 }
909
910 /*
911 * successfully sent the warning message.
912 * Give the user a chance to change pwd.
913 */
914 if (ret == PAM_SUCCESS) {
915 if (change_pwd) {
916 retval = _pam_winbind_change_pwd(ctx);
917 if (retval) {
918 *change_pwd = true;
919 }
920 }
921 }
922 return true;
923 }
924
925 if (days > 0 && days < warn_pwd_expire) {
926
927 ret = _make_remark_format(ctx, PAM_TEXT_INFO,
928 _("Your password will expire in %d %s.\n"),
929 days, (days > 1) ? _("days"):_("day"));
930 /*
931 * If change_pwd and already_expired is null.
932 * We are just sending a notification message.
933 * We don't expect any response in this case.
934 */
935
936 if (!change_pwd && !already_expired) {
937 return true;
938 }
939
940 /*
941 * successfully sent the warning message.
942 * Give the user a chance to change pwd.
943 */
944 if (ret == PAM_SUCCESS) {
945 if (change_pwd) {
946 retval = _pam_winbind_change_pwd(ctx);
947 if (retval) {
948 *change_pwd = true;
949 }
950 }
951 }
952 return true;
953 }
954
955 return false;
956 }
957
958 /**
959 * Send a warning if the password expires in the near future
960 *
961 * @param ctx PAM winbind context.
962 * @param response The full authentication response structure.
963 * @param already_expired boolean, is the pwd already expired?
964 *
965 * @return void.
966 */
967
968 static void _pam_warn_password_expiry(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
969 const struct wbcAuthUserInfo *info,
970 const struct wbcUserPasswordPolicyInfo *policy,
971 int warn_pwd_expire,
972 bool *already_expired,
973 bool *change_pwd)
974 {
975 time_t now = time(NULL);
976 time_t next_change = 0;
977
978 if (!info || !policy) {
979 return;
980 }
981
982 if (already_expired) {
983 *already_expired = false;
984 }
985
986 if (change_pwd) {
987 *change_pwd = false;
988 }
989
990 /* accounts with WBC_ACB_PWNOEXP set never receive a warning */
991 if (info->acct_flags & WBC_ACB_PWNOEXP) {
992 return;
993 }
994
995 /* no point in sending a warning if this is a grace logon */
996 if (PAM_WB_GRACE_LOGON(info->user_flags)) {
997 return;
998 }
999
1000 /* check if the info3 must change timestamp has been set */
1001 next_change = info->pass_must_change_time;
1002
1003 if (_pam_send_password_expiry_message(ctx, next_change, now,
1004 warn_pwd_expire,
1005 already_expired,
1006 change_pwd)) {
1007 return;
1008 }
1009
1010 /* now check for the global password policy */
1011 /* good catch from Ralf Haferkamp: an expiry of "never" is translated
1012 * to -1 */
1013 if ((policy->expire == (int64_t)-1) ||
1014 (policy->expire == 0)) {
1015 return;
1016 }
1017
1018 next_change = info->pass_last_set_time + policy->expire;
1019
1020 if (_pam_send_password_expiry_message(ctx, next_change, now,
1021 warn_pwd_expire,
1022 already_expired,
1023 change_pwd)) {
1024 return;
1025 }
1026
1027 /* no warning sent */
1028 }
1029
1030 #define IS_SID_STRING(name) (strncmp("S-", name, 2) == 0)
1031
1032 /**
1033 * Append a string, making sure not to overflow and to always return a
1034 * NULL-terminated string.
1035 *
1036 * @param dest Destination string buffer (must already be NULL-terminated).
1037 * @param src Source string buffer.
1038 * @param dest_buffer_size Size of dest buffer in bytes.
1039 *
1040 * @return false if dest buffer is not big enough (no bytes copied), true on
1041 * success.
1042 */
1043
1044 static bool safe_append_string(char *dest,
/* [<][>][^][v][top][bottom][index][help] */
1045 const char *src,
1046 int dest_buffer_size)
1047 {
1048 int dest_length = strlen(dest);
1049 int src_length = strlen(src);
1050
1051 if (dest_length + src_length + 1 > dest_buffer_size) {
1052 return false;
1053 }
1054
1055 memcpy(dest + dest_length, src, src_length + 1);
1056 return true;
1057 }
1058
1059 /**
1060 * Convert a names into a SID string, appending it to a buffer.
1061 *
1062 * @param ctx PAM winbind context.
1063 * @param user User in PAM request.
1064 * @param name Name to convert.
1065 * @param sid_list_buffer Where to append the string sid.
1066 * @param sid_list_buffer Size of sid_list_buffer (in bytes).
1067 *
1068 * @return false on failure, true on success.
1069 */
1070 static bool winbind_name_to_sid_string(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1071 const char *user,
1072 const char *name,
1073 char *sid_list_buffer,
1074 int sid_list_buffer_size)
1075 {
1076 const char* sid_string = NULL;
1077 char *sid_str = NULL;
1078
1079 /* lookup name? */
1080 if (IS_SID_STRING(name)) {
1081 sid_string = name;
1082 } else {
1083 wbcErr wbc_status;
1084 struct wbcDomainSid sid;
1085 enum wbcSidType type;
1086
1087 _pam_log_debug(ctx, LOG_DEBUG,
1088 "no sid given, looking up: %s\n", name);
1089
1090 wbc_status = wbcLookupName("", name, &sid, &type);
1091 if (!WBC_ERROR_IS_OK(wbc_status)) {
1092 _pam_log(ctx, LOG_INFO,
1093 "could not lookup name: %s\n", name);
1094 return false;
1095 }
1096
1097 wbc_status = wbcSidToString(&sid, &sid_str);
1098 if (!WBC_ERROR_IS_OK(wbc_status)) {
1099 return false;
1100 }
1101
1102 sid_string = sid_str;
1103 }
1104
1105 if (!safe_append_string(sid_list_buffer, sid_string,
1106 sid_list_buffer_size)) {
1107 wbcFreeMemory(sid_str);
1108 return false;
1109 }
1110
1111 wbcFreeMemory(sid_str);
1112 return true;
1113 }
1114
1115 /**
1116 * Convert a list of names into a list of sids.
1117 *
1118 * @param ctx PAM winbind context.
1119 * @param user User in PAM request.
1120 * @param name_list List of names or string sids, separated by commas.
1121 * @param sid_list_buffer Where to put the list of string sids.
1122 * @param sid_list_buffer Size of sid_list_buffer (in bytes).
1123 *
1124 * @return false on failure, true on success.
1125 */
1126 static bool winbind_name_list_to_sid_string_list(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1127 const char *user,
1128 const char *name_list,
1129 char *sid_list_buffer,
1130 int sid_list_buffer_size)
1131 {
1132 bool result = false;
1133 char *current_name = NULL;
1134 const char *search_location;
1135 const char *comma;
1136 int len;
1137
1138 if (sid_list_buffer_size > 0) {
1139 sid_list_buffer[0] = 0;
1140 }
1141
1142 search_location = name_list;
1143 while ((comma = strstr(search_location, ",")) != NULL) {
1144 current_name = strndup(search_location,
1145 comma - search_location);
1146 if (NULL == current_name) {
1147 goto out;
1148 }
1149
1150 if (!winbind_name_to_sid_string(ctx, user,
1151 current_name,
1152 sid_list_buffer,
1153 sid_list_buffer_size)) {
1154 /*
1155 * If one group name failed, we must not fail
1156 * the authentication totally, continue with
1157 * the following group names. If user belongs to
1158 * one of the valid groups, we must allow it
1159 * login. -- BoYang
1160 */
1161
1162 _pam_log(ctx, LOG_INFO, "cannot convert group %s to sid, "
1163 "check if group %s is valid group.", current_name,
1164 current_name);
1165 _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s "
1166 "to sid, please contact your administrator to see "
1167 "if group %s is valid."), current_name, current_name);
1168 SAFE_FREE(current_name);
1169 search_location = comma + 1;
1170 continue;
1171 }
1172
1173 SAFE_FREE(current_name);
1174
1175 if (!safe_append_string(sid_list_buffer, ",",
1176 sid_list_buffer_size)) {
1177 goto out;
1178 }
1179
1180 search_location = comma + 1;
1181 }
1182
1183 if (!winbind_name_to_sid_string(ctx, user, search_location,
1184 sid_list_buffer,
1185 sid_list_buffer_size)) {
1186 _pam_log(ctx, LOG_INFO, "cannot convert group %s to sid, "
1187 "check if group %s is valid group.", search_location,
1188 search_location);
1189 _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s "
1190 "to sid, please contact your administrator to see "
1191 "if group %s is valid."), search_location, search_location);
1192 /*
1193 * The lookup of the last name failed..
1194 * It results in require_member_of_sid ends with ','
1195 * It is malformated parameter here, overwrite the last ','.
1196 */
1197 len = strlen(sid_list_buffer);
1198 if (len) {
1199 if (sid_list_buffer[len - 1] == ',') {
1200 sid_list_buffer[len - 1] = '\0';
1201 }
1202 }
1203 }
1204
1205 result = true;
1206
1207 out:
1208 SAFE_FREE(current_name);
1209 return result;
1210 }
1211
1212 /**
1213 * put krb5ccname variable into environment
1214 *
1215 * @param ctx PAM winbind context.
1216 * @param krb5ccname env variable retrieved from winbindd.
1217 *
1218 * @return void.
1219 */
1220
1221 static void _pam_setup_krb5_env(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1222 struct wbcLogonUserInfo *info)
1223 {
1224 char var[PATH_MAX];
1225 int ret;
1226 uint32_t i;
1227 const char *krb5ccname = NULL;
1228
1229 if (off(ctx->ctrl, WINBIND_KRB5_AUTH)) {
1230 return;
1231 }
1232
1233 if (!info) {
1234 return;
1235 }
1236
1237 for (i=0; i < info->num_blobs; i++) {
1238 if (strcasecmp(info->blobs[i].name, "krb5ccname") == 0) {
1239 krb5ccname = (const char *)info->blobs[i].blob.data;
1240 break;
1241 }
1242 }
1243
1244 if (!krb5ccname || (strlen(krb5ccname) == 0)) {
1245 return;
1246 }
1247
1248 _pam_log_debug(ctx, LOG_DEBUG,
1249 "request returned KRB5CCNAME: %s", krb5ccname);
1250
1251 if (snprintf(var, sizeof(var), "KRB5CCNAME=%s", krb5ccname) == -1) {
1252 return;
1253 }
1254
1255 ret = pam_putenv(ctx->pamh, var);
1256 if (ret) {
1257 _pam_log(ctx, LOG_ERR,
1258 "failed to set KRB5CCNAME to %s: %s",
1259 var, pam_strerror(ctx->pamh, ret));
1260 }
1261 }
1262
1263 /**
1264 * Copy unix username if available (further processed in PAM).
1265 *
1266 * @param ctx PAM winbind context
1267 * @param user_ret A pointer that holds a pointer to a string
1268 * @param unix_username A username
1269 *
1270 * @return void.
1271 */
1272
1273 static void _pam_setup_unix_username(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1274 char **user_ret,
1275 struct wbcLogonUserInfo *info)
1276 {
1277 const char *unix_username = NULL;
1278 uint32_t i;
1279
1280 if (!user_ret || !info) {
1281 return;
1282 }
1283
1284 for (i=0; i < info->num_blobs; i++) {
1285 if (strcasecmp(info->blobs[i].name, "unix_username") == 0) {
1286 unix_username = (const char *)info->blobs[i].blob.data;
1287 break;
1288 }
1289 }
1290
1291 if (!unix_username || !unix_username[0]) {
1292 return;
1293 }
1294
1295 *user_ret = strdup(unix_username);
1296 }
1297
1298 /**
1299 * Set string into the PAM stack.
1300 *
1301 * @param ctx PAM winbind context.
1302 * @param data_name Key name for pam_set_data.
1303 * @param value String value.
1304 *
1305 * @return void.
1306 */
1307
1308 static void _pam_set_data_string(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1309 const char *data_name,
1310 const char *value)
1311 {
1312 int ret;
1313
1314 if (!data_name || !value || (strlen(data_name) == 0) ||
1315 (strlen(value) == 0)) {
1316 return;
1317 }
1318
1319 ret = pam_set_data(ctx->pamh, data_name, talloc_strdup(NULL, value),
1320 _pam_winbind_cleanup_func);
1321 if (ret) {
1322 _pam_log_debug(ctx, LOG_DEBUG,
1323 "Could not set data %s: %s\n",
1324 data_name, pam_strerror(ctx->pamh, ret));
1325 }
1326 }
1327
1328 /**
1329 * Set info3 strings into the PAM stack.
1330 *
1331 * @param ctx PAM winbind context.
1332 * @param data_name Key name for pam_set_data.
1333 * @param value String value.
1334 *
1335 * @return void.
1336 */
1337
1338 static void _pam_set_data_info3(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1339 const struct wbcAuthUserInfo *info)
1340 {
1341 _pam_set_data_string(ctx, PAM_WINBIND_HOMEDIR,
1342 info->home_directory);
1343 _pam_set_data_string(ctx, PAM_WINBIND_LOGONSCRIPT,
1344 info->logon_script);
1345 _pam_set_data_string(ctx, PAM_WINBIND_LOGONSERVER,
1346 info->logon_server);
1347 _pam_set_data_string(ctx, PAM_WINBIND_PROFILEPATH,
1348 info->profile_path);
1349 }
1350
1351 /**
1352 * Free info3 strings in the PAM stack.
1353 *
1354 * @param pamh PAM handle
1355 *
1356 * @return void.
1357 */
1358
1359 static void _pam_free_data_info3(pam_handle_t *pamh)
/* [<][>][^][v][top][bottom][index][help] */
1360 {
1361 pam_set_data(pamh, PAM_WINBIND_HOMEDIR, NULL, NULL);
1362 pam_set_data(pamh, PAM_WINBIND_LOGONSCRIPT, NULL, NULL);
1363 pam_set_data(pamh, PAM_WINBIND_LOGONSERVER, NULL, NULL);
1364 pam_set_data(pamh, PAM_WINBIND_PROFILEPATH, NULL, NULL);
1365 }
1366
1367 /**
1368 * Send PAM_ERROR_MSG for cached or grace logons.
1369 *
1370 * @param ctx PAM winbind context.
1371 * @param username User in PAM request.
1372 * @param info3_user_flgs Info3 flags containing logon type bits.
1373 *
1374 * @return void.
1375 */
1376
1377 static void _pam_warn_logon_type(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1378 const char *username,
1379 uint32_t info3_user_flgs)
1380 {
1381 /* inform about logon type */
1382 if (PAM_WB_GRACE_LOGON(info3_user_flgs)) {
1383
1384 _make_remark(ctx, PAM_ERROR_MSG,
1385 _("Grace login. "
1386 "Please change your password as soon you're "
1387 "online again"));
1388 _pam_log_debug(ctx, LOG_DEBUG,
1389 "User %s logged on using grace logon\n",
1390 username);
1391
1392 } else if (PAM_WB_CACHED_LOGON(info3_user_flgs)) {
1393
1394 _make_remark(ctx, PAM_ERROR_MSG,
1395 _("Domain Controller unreachable, "
1396 "using cached credentials instead. "
1397 "Network resources may be unavailable"));
1398 _pam_log_debug(ctx, LOG_DEBUG,
1399 "User %s logged on using cached credentials\n",
1400 username);
1401 }
1402 }
1403
1404 /**
1405 * Send PAM_ERROR_MSG for krb5 errors.
1406 *
1407 * @param ctx PAM winbind context.
1408 * @param username User in PAM request.
1409 * @param info3_user_flgs Info3 flags containing logon type bits.
1410 *
1411 * @return void.
1412 */
1413
1414 static void _pam_warn_krb5_failure(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1415 const char *username,
1416 uint32_t info3_user_flgs)
1417 {
1418 if (PAM_WB_KRB5_CLOCK_SKEW(info3_user_flgs)) {
1419 _make_remark(ctx, PAM_ERROR_MSG,
1420 _("Failed to establish your Kerberos Ticket cache "
1421 "due time differences\n"
1422 "with the domain controller. "
1423 "Please verify the system time.\n"));
1424 _pam_log_debug(ctx, LOG_DEBUG,
1425 "User %s: Clock skew when getting Krb5 TGT\n",
1426 username);
1427 }
1428 }
1429
1430 static bool _pam_check_remark_auth_err(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1431 const struct wbcAuthErrorInfo *e,
1432 const char *nt_status_string,
1433 int *pam_error)
1434 {
1435 const char *ntstatus = NULL;
1436 const char *error_string = NULL;
1437
1438 if (!e || !pam_error) {
1439 return false;
1440 }
1441
1442 ntstatus = e->nt_string;
1443 if (!ntstatus) {
1444 return false;
1445 }
1446
1447 if (strcasecmp(ntstatus, nt_status_string) == 0) {
1448
1449 error_string = _get_ntstatus_error_string(nt_status_string);
1450 if (error_string) {
1451 _make_remark(ctx, PAM_ERROR_MSG, error_string);
1452 *pam_error = e->pam_error;
1453 return true;
1454 }
1455
1456 if (e->display_string) {
1457 _make_remark(ctx, PAM_ERROR_MSG, e->display_string);
1458 *pam_error = e->pam_error;
1459 return true;
1460 }
1461
1462 _make_remark(ctx, PAM_ERROR_MSG, nt_status_string);
1463 *pam_error = e->pam_error;
1464
1465 return true;
1466 }
1467
1468 return false;
1469 };
1470
1471 /**
1472 * Compose Password Restriction String for a PAM_ERROR_MSG conversation.
1473 *
1474 * @param i The wbcUserPasswordPolicyInfo struct.
1475 *
1476 * @return string (caller needs to talloc_free).
1477 */
1478
1479 static char *_pam_compose_pwd_restriction_string(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1480 struct wbcUserPasswordPolicyInfo *i)
1481 {
1482 char *str = NULL;
1483
1484 if (!i) {
1485 goto failed;
1486 }
1487
1488 str = talloc_asprintf(ctx, _("Your password "));
1489 if (!str) {
1490 goto failed;
1491 }
1492
1493 if (i->min_length_password > 0) {
1494 str = talloc_asprintf_append(str,
1495 _("must be at least %d characters; "),
1496 i->min_length_password);
1497 if (!str) {
1498 goto failed;
1499 }
1500 }
1501
1502 if (i->password_history > 0) {
1503 str = talloc_asprintf_append(str,
1504 _("cannot repeat any of your previous %d "
1505 "passwords; "),
1506 i->password_history);
1507 if (!str) {
1508 goto failed;
1509 }
1510 }
1511
1512 if (i->password_properties & WBC_DOMAIN_PASSWORD_COMPLEX) {
1513 str = talloc_asprintf_append(str,
1514 _("must contain capitals, numerals "
1515 "or punctuation; "
1516 "and cannot contain your account "
1517 "or full name; "));
1518 if (!str) {
1519 goto failed;
1520 }
1521 }
1522
1523 str = talloc_asprintf_append(str,
1524 _("Please type a different password. "
1525 "Type a password which meets these requirements in "
1526 "both text boxes."));
1527 if (!str) {
1528 goto failed;
1529 }
1530
1531 return str;
1532
1533 failed:
1534 TALLOC_FREE(str);
1535 return NULL;
1536 }
1537
1538 static int _pam_create_homedir(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1539 const char *dirname,
1540 mode_t mode)
1541 {
1542 struct stat sbuf;
1543
1544 if (stat(dirname, &sbuf) == 0) {
1545 return PAM_SUCCESS;
1546 }
1547
1548 if (mkdir(dirname, mode) != 0) {
1549
1550 _make_remark_format(ctx, PAM_TEXT_INFO,
1551 _("Creating directory: %s failed: %s"),
1552 dirname, strerror(errno));
1553 _pam_log(ctx, LOG_ERR, "could not create dir: %s (%s)",
1554 dirname, strerror(errno));
1555 return PAM_PERM_DENIED;
1556 }
1557
1558 return PAM_SUCCESS;
1559 }
1560
1561 static int _pam_chown_homedir(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1562 const char *dirname,
1563 uid_t uid,
1564 gid_t gid)
1565 {
1566 if (chown(dirname, uid, gid) != 0) {
1567 _pam_log(ctx, LOG_ERR, "failed to chown user homedir: %s (%s)",
1568 dirname, strerror(errno));
1569 return PAM_PERM_DENIED;
1570 }
1571
1572 return PAM_SUCCESS;
1573 }
1574
1575 static int _pam_mkhomedir(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
1576 {
1577 struct passwd *pwd = NULL;
1578 char *token = NULL;
1579 char *create_dir = NULL;
1580 char *user_dir = NULL;
1581 int ret;
1582 const char *username;
1583 mode_t mode = 0700;
1584 char *safe_ptr = NULL;
1585 char *p = NULL;
1586
1587 /* Get the username */
1588 ret = pam_get_user(ctx->pamh, &username, NULL);
1589 if ((ret != PAM_SUCCESS) || (!username)) {
1590 _pam_log_debug(ctx, LOG_DEBUG, "can not get the username");
1591 return PAM_SERVICE_ERR;
1592 }
1593
1594 pwd = getpwnam(username);
1595 if (pwd == NULL) {
1596 _pam_log_debug(ctx, LOG_DEBUG, "can not get the username");
1597 return PAM_USER_UNKNOWN;
1598 }
1599 _pam_log_debug(ctx, LOG_DEBUG, "homedir is: %s", pwd->pw_dir);
1600
1601 ret = _pam_create_homedir(ctx, pwd->pw_dir, 0700);
1602 if (ret == PAM_SUCCESS) {
1603 ret = _pam_chown_homedir(ctx, pwd->pw_dir,
1604 pwd->pw_uid,
1605 pwd->pw_gid);
1606 }
1607
1608 if (ret == PAM_SUCCESS) {
1609 return ret;
1610 }
1611
1612 /* maybe we need to create parent dirs */
1613 create_dir = talloc_strdup(ctx, "/");
1614 if (!create_dir) {
1615 return PAM_BUF_ERR;
1616 }
1617
1618 /* find final directory */
1619 user_dir = strrchr(pwd->pw_dir, '/');
1620 if (!user_dir) {
1621 return PAM_BUF_ERR;
1622 }
1623 user_dir++;
1624
1625 _pam_log(ctx, LOG_DEBUG, "final directory: %s", user_dir);
1626
1627 p = pwd->pw_dir;
1628
1629 while ((token = strtok_r(p, "/", &safe_ptr)) != NULL) {
1630
1631 mode = 0755;
1632
1633 p = NULL;
1634
1635 _pam_log_debug(ctx, LOG_DEBUG, "token is %s", token);
1636
1637 create_dir = talloc_asprintf_append(create_dir, "%s/", token);
1638 if (!create_dir) {
1639 return PAM_BUF_ERR;
1640 }
1641 _pam_log_debug(ctx, LOG_DEBUG, "current_dir is %s", create_dir);
1642
1643 if (strcmp(token, user_dir) == 0) {
1644 _pam_log_debug(ctx, LOG_DEBUG, "assuming last directory: %s", token);
1645 mode = 0700;
1646 }
1647
1648 ret = _pam_create_homedir(ctx, create_dir, mode);
1649 if (ret) {
1650 return ret;
1651 }
1652 }
1653
1654 return _pam_chown_homedir(ctx, create_dir,
1655 pwd->pw_uid,
1656 pwd->pw_gid);
1657 }
1658
1659 /* talk to winbindd */
1660 static int winbind_auth_request(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1661 const char *user,
1662 const char *pass,
1663 const char *member,
1664 const char *cctype,
1665 const int warn_pwd_expire,
1666 struct wbcAuthErrorInfo **p_error,
1667 struct wbcLogonUserInfo **p_info,
1668 struct wbcUserPasswordPolicyInfo **p_policy,
1669 time_t *pwd_last_set,
1670 char **user_ret)
1671 {
1672 wbcErr wbc_status;
1673
1674 struct wbcLogonUserParams logon;
1675 char membership_of[1024];
1676 uid_t user_uid = -1;
1677 uint32_t flags = WBFLAG_PAM_INFO3_TEXT |
1678 WBFLAG_PAM_GET_PWD_POLICY;
1679
1680 struct wbcLogonUserInfo *info = NULL;
1681 struct wbcAuthUserInfo *user_info = NULL;
1682 struct wbcAuthErrorInfo *error = NULL;
1683 struct wbcUserPasswordPolicyInfo *policy = NULL;
1684
1685 int ret = PAM_AUTH_ERR;
1686 int i;
1687 const char *codes[] = {
1688 "NT_STATUS_PASSWORD_EXPIRED",
1689 "NT_STATUS_PASSWORD_MUST_CHANGE",
1690 "NT_STATUS_INVALID_WORKSTATION",
1691 "NT_STATUS_INVALID_LOGON_HOURS",
1692 "NT_STATUS_ACCOUNT_EXPIRED",
1693 "NT_STATUS_ACCOUNT_DISABLED",
1694 "NT_STATUS_ACCOUNT_LOCKED_OUT",
1695 "NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
1696 "NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT",
1697 "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
1698 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
1699 "NT_STATUS_NO_LOGON_SERVERS",
1700 "NT_STATUS_WRONG_PASSWORD",
1701 "NT_STATUS_ACCESS_DENIED"
1702 };
1703
1704 if (pwd_last_set) {
1705 *pwd_last_set = 0;
1706 }
1707
1708 /* Krb5 auth always has to go against the KDC of the user's realm */
1709
1710 if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1711 flags |= WBFLAG_PAM_CONTACT_TRUSTDOM;
1712 }
1713
1714 if (ctx->ctrl & (WINBIND_KRB5_AUTH|WINBIND_CACHED_LOGIN)) {
1715 struct passwd *pwd = NULL;
1716
1717 pwd = getpwnam(user);
1718 if (pwd == NULL) {
1719 return PAM_USER_UNKNOWN;
1720 }
1721 user_uid = pwd->pw_uid;
1722 }
1723
1724 if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1725
1726 _pam_log_debug(ctx, LOG_DEBUG,
1727 "enabling krb5 login flag\n");
1728
1729 flags |= WBFLAG_PAM_KRB5 |
1730 WBFLAG_PAM_FALLBACK_AFTER_KRB5;
1731 }
1732
1733 if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
1734 _pam_log_debug(ctx, LOG_DEBUG,
1735 "enabling cached login flag\n");
1736 flags |= WBFLAG_PAM_CACHED_LOGIN;
1737 }
1738
1739 if (user_ret) {
1740 *user_ret = NULL;
1741 flags |= WBFLAG_PAM_UNIX_NAME;
1742 }
1743
1744 if (cctype != NULL) {
1745 _pam_log_debug(ctx, LOG_DEBUG,
1746 "enabling request for a %s krb5 ccache\n",
1747 cctype);
1748 }
1749
1750 if (member != NULL) {
1751
1752 ZERO_STRUCT(membership_of);
1753
1754 if (!winbind_name_list_to_sid_string_list(ctx, user, member,
1755 membership_of,
1756 sizeof(membership_of))) {
1757 _pam_log_debug(ctx, LOG_ERR,
1758 "failed to serialize membership of sid "
1759 "\"%s\"\n", member);
1760 return PAM_AUTH_ERR;
1761 }
1762 }
1763
1764 ZERO_STRUCT(logon);
1765
1766 logon.username = user;
1767 logon.password = pass;
1768
1769 if (cctype) {
1770 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1771 &logon.blobs,
1772 "krb5_cc_type",
1773 0,
1774 (uint8_t *)cctype,
1775 strlen(cctype)+1);
1776 if (!WBC_ERROR_IS_OK(wbc_status)) {
1777 goto done;
1778 }
1779 }
1780
1781 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1782 &logon.blobs,
1783 "flags",
1784 0,
1785 (uint8_t *)&flags,
1786 sizeof(flags));
1787 if (!WBC_ERROR_IS_OK(wbc_status)) {
1788 goto done;
1789 }
1790
1791 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1792 &logon.blobs,
1793 "user_uid",
1794 0,
1795 (uint8_t *)&user_uid,
1796 sizeof(user_uid));
1797 if (!WBC_ERROR_IS_OK(wbc_status)) {
1798 goto done;
1799 }
1800
1801 if (member) {
1802 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1803 &logon.blobs,
1804 "membership_of",
1805 0,
1806 (uint8_t *)membership_of,
1807 sizeof(membership_of));
1808 if (!WBC_ERROR_IS_OK(wbc_status)) {
1809 goto done;
1810 }
1811 }
1812
1813 wbc_status = wbcLogonUser(&logon, &info, &error, &policy);
1814 ret = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
1815 user, "wbcLogonUser");
1816 wbcFreeMemory(logon.blobs);
1817 logon.blobs = NULL;
1818
1819 if (info && info->info) {
1820 user_info = info->info;
1821 }
1822
1823 if (pwd_last_set && user_info) {
1824 *pwd_last_set = user_info->pass_last_set_time;
1825 }
1826
1827 if (p_info && info) {
1828 *p_info = info;
1829 }
1830
1831 if (p_policy && policy) {
1832 *p_policy = policy;
1833 }
1834
1835 if (p_error && error) {
1836 /* We want to process the error in the caller. */
1837 *p_error = error;
1838 return ret;
1839 }
1840
1841 for (i=0; i<ARRAY_SIZE(codes); i++) {
1842 int _ret = ret;
1843 if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
1844 ret = _ret;
1845 goto done;
1846 }
1847 }
1848
1849 if ((ret == PAM_SUCCESS) && user_info && policy && info) {
1850
1851 bool already_expired = false;
1852 bool change_pwd = false;
1853
1854 /* warn a user if the password is about to expire soon */
1855 _pam_warn_password_expiry(ctx, user_info, policy,
1856 warn_pwd_expire,
1857 &already_expired,
1858 &change_pwd);
1859
1860 if (already_expired == true) {
1861
1862 SMB_TIME_T last_set = user_info->pass_last_set_time;
1863
1864 _pam_log_debug(ctx, LOG_DEBUG,
1865 "Password has expired "
1866 "(Password was last set: %lld, "
1867 "the policy says it should expire here "
1868 "%lld (now it's: %lu))\n",
1869 (long long int)last_set,
1870 (long long int)last_set +
1871 policy->expire,
1872 time(NULL));
1873
1874 return PAM_AUTHTOK_EXPIRED;
1875 }
1876
1877 if (change_pwd) {
1878 ret = PAM_NEW_AUTHTOK_REQD;
1879 goto done;
1880 }
1881
1882 /* inform about logon type */
1883 _pam_warn_logon_type(ctx, user, user_info->user_flags);
1884
1885 /* inform about krb5 failures */
1886 _pam_warn_krb5_failure(ctx, user, user_info->user_flags);
1887
1888 /* set some info3 info for other modules in the stack */
1889 _pam_set_data_info3(ctx, user_info);
1890
1891 /* put krb5ccname into env */
1892 _pam_setup_krb5_env(ctx, info);
1893
1894 /* If winbindd returned a username, return the pointer to it
1895 * here. */
1896 _pam_setup_unix_username(ctx, user_ret, info);
1897 }
1898
1899 done:
1900 if (logon.blobs) {
1901 wbcFreeMemory(logon.blobs);
1902 }
1903 if (info && info->blobs && !p_info) {
1904 wbcFreeMemory(info->blobs);
1905 }
1906 if (error && !p_error) {
1907 wbcFreeMemory(error);
1908 }
1909 if (info && !p_info) {
1910 wbcFreeMemory(info);
1911 }
1912 if (policy && !p_policy) {
1913 wbcFreeMemory(policy);
1914 }
1915
1916 return ret;
1917 }
1918
1919 /* talk to winbindd */
1920 static int winbind_chauthtok_request(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
1921 const char *user,
1922 const char *oldpass,
1923 const char *newpass,
1924 time_t pwd_last_set)
1925 {
1926 wbcErr wbc_status;
1927 struct wbcChangePasswordParams params;
1928 struct wbcAuthErrorInfo *error = NULL;
1929 struct wbcUserPasswordPolicyInfo *policy = NULL;
1930 enum wbcPasswordChangeRejectReason reject_reason = -1;
1931 uint32_t flags = 0;
1932
1933 int i;
1934 const char *codes[] = {
1935 "NT_STATUS_BACKUP_CONTROLLER",
1936 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
1937 "NT_STATUS_NO_LOGON_SERVERS",
1938 "NT_STATUS_ACCESS_DENIED",
1939 "NT_STATUS_PWD_TOO_SHORT", /* TODO: tell the min pwd length ? */
1940 "NT_STATUS_PWD_TOO_RECENT", /* TODO: tell the minage ? */
1941 "NT_STATUS_PWD_HISTORY_CONFLICT" /* TODO: tell the history length ? */
1942 };
1943 int ret = PAM_AUTH_ERR;
1944
1945 ZERO_STRUCT(params);
1946
1947 if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1948 flags |= WBFLAG_PAM_KRB5 |
1949 WBFLAG_PAM_CONTACT_TRUSTDOM;
1950 }
1951
1952 if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
1953 flags |= WBFLAG_PAM_CACHED_LOGIN;
1954 }
1955
1956 params.account_name = user;
1957 params.level = WBC_AUTH_USER_LEVEL_PLAIN;
1958 params.old_password.plaintext = oldpass;
1959 params.new_password.plaintext = newpass;
1960 params.flags = flags;
1961
1962 wbc_status = wbcChangeUserPasswordEx(¶ms, &error, &reject_reason, &policy);
1963 ret = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
1964 user, "wbcChangeUserPasswordEx");
1965
1966 if (WBC_ERROR_IS_OK(wbc_status)) {
1967 _pam_log(ctx, LOG_NOTICE,
1968 "user '%s' password changed", user);
1969 return PAM_SUCCESS;
1970 }
1971
1972 if (!error) {
1973 wbcFreeMemory(policy);
1974 return ret;
1975 }
1976
1977 for (i=0; i<ARRAY_SIZE(codes); i++) {
1978 int _ret = ret;
1979 if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
1980 ret = _ret;
1981 goto done;
1982 }
1983 }
1984
1985 if (!strcasecmp(error->nt_string,
1986 "NT_STATUS_PASSWORD_RESTRICTION")) {
1987
1988 char *pwd_restriction_string = NULL;
1989 SMB_TIME_T min_pwd_age = 0;
1990
1991 if (policy) {
1992 min_pwd_age = policy->min_passwordage;
1993 }
1994
1995 /* FIXME: avoid to send multiple PAM messages after another */
1996 switch (reject_reason) {
1997 case -1:
1998 break;
1999 case WBC_PWD_CHANGE_REJECT_OTHER:
2000 if ((min_pwd_age > 0) &&
2001 (pwd_last_set + min_pwd_age > time(NULL))) {
2002 PAM_WB_REMARK_DIRECT(ctx,
2003 "NT_STATUS_PWD_TOO_RECENT");
2004 }
2005 break;
2006 case WBC_PWD_CHANGE_REJECT_TOO_SHORT:
2007 PAM_WB_REMARK_DIRECT(ctx,
2008 "NT_STATUS_PWD_TOO_SHORT");
2009 break;
2010 case WBC_PWD_CHANGE_REJECT_IN_HISTORY:
2011 PAM_WB_REMARK_DIRECT(ctx,
2012 "NT_STATUS_PWD_HISTORY_CONFLICT");
2013 break;
2014 case WBC_PWD_CHANGE_REJECT_COMPLEXITY:
2015 _make_remark(ctx, PAM_ERROR_MSG,
2016 _("Password does not meet "
2017 "complexity requirements"));
2018 break;
2019 default:
2020 _pam_log_debug(ctx, LOG_DEBUG,
2021 "unknown password change "
2022 "reject reason: %d",
2023 reject_reason);
2024 break;
2025 }
2026
2027 pwd_restriction_string =
2028 _pam_compose_pwd_restriction_string(ctx, policy);
2029 if (pwd_restriction_string) {
2030 _make_remark(ctx, PAM_ERROR_MSG,
2031 pwd_restriction_string);
2032 TALLOC_FREE(pwd_restriction_string);
2033 }
2034 }
2035 done:
2036 wbcFreeMemory(error);
2037 wbcFreeMemory(policy);
2038
2039 return ret;
2040 }
2041
2042 /*
2043 * Checks if a user has an account
2044 *
2045 * return values:
2046 * 1 = User not found
2047 * 0 = OK
2048 * -1 = System error
2049 */
2050 static int valid_user(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
2051 const char *user)
2052 {
2053 /* check not only if the user is available over NSS calls, also make
2054 * sure it's really a winbind user, this is important when stacking PAM
2055 * modules in the 'account' or 'password' facility. */
2056
2057 wbcErr wbc_status;
2058 struct passwd *pwd = NULL;
2059 struct passwd *wb_pwd = NULL;
2060
2061 pwd = getpwnam(user);
2062 if (pwd == NULL) {
2063 return 1;
2064 }
2065
2066 wbc_status = wbcGetpwnam(user, &wb_pwd);
2067 wbcFreeMemory(wb_pwd);
2068 if (!WBC_ERROR_IS_OK(wbc_status)) {
2069 _pam_log(ctx, LOG_DEBUG, "valid_user: wbcGetpwnam gave %s\n",
2070 wbcErrorString(wbc_status));
2071 }
2072
2073 switch (wbc_status) {
2074 case WBC_ERR_UNKNOWN_USER:
2075 return 1;
2076 case WBC_ERR_SUCCESS:
2077 return 0;
2078 default:
2079 break;
2080 }
2081 return -1;
2082 }
2083
2084 static char *_pam_delete(register char *xx)
/* [<][>][^][v][top][bottom][index][help] */
2085 {
2086 _pam_overwrite(xx);
2087 _pam_drop(xx);
2088 return NULL;
2089 }
2090
2091 /*
2092 * obtain a password from the user
2093 */
2094
2095 static int _winbind_read_password(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
2096 unsigned int ctrl,
2097 const char *comment,
2098 const char *prompt1,
2099 const char *prompt2,
2100 const char **pass)
2101 {
2102 int authtok_flag;
2103 int retval;
2104 const char *item;
2105 char *token;
2106
2107 _pam_log(ctx, LOG_DEBUG, "getting password (0x%08x)", ctrl);
2108
2109 /*
2110 * make sure nothing inappropriate gets returned
2111 */
2112
2113 *pass = token = NULL;
2114
2115 /*
2116 * which authentication token are we getting?
2117 */
2118
2119 if (on(WINBIND__OLD_PASSWORD, ctrl)) {
2120 authtok_flag = PAM_OLDAUTHTOK;
2121 } else {
2122 authtok_flag = PAM_AUTHTOK;
2123 }
2124
2125 /*
2126 * should we obtain the password from a PAM item ?
2127 */
2128
2129 if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) ||
2130 on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
2131 retval = _pam_get_item(ctx->pamh, authtok_flag, &item);
2132 if (retval != PAM_SUCCESS) {
2133 /* very strange. */
2134 _pam_log(ctx, LOG_ALERT,
2135 "pam_get_item returned error "
2136 "to unix-read-password");
2137 return retval;
2138 } else if (item != NULL) { /* we have a password! */
2139 *pass = item;
2140 item = NULL;
2141 _pam_log(ctx, LOG_DEBUG,
2142 "pam_get_item returned a password");
2143 return PAM_SUCCESS;
2144 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
2145 return PAM_AUTHTOK_RECOVER_ERR; /* didn't work */
2146 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
2147 && off(WINBIND__OLD_PASSWORD, ctrl)) {
2148 return PAM_AUTHTOK_RECOVER_ERR;
2149 }
2150 }
2151 /*
2152 * getting here implies we will have to get the password from the
2153 * user directly.
2154 */
2155
2156 {
2157 struct pam_message msg[3], *pmsg[3];
2158 struct pam_response *resp;
2159 int i, replies;
2160
2161 /* prepare to converse */
2162
2163 if (comment != NULL && off(ctrl, WINBIND_SILENT)) {
2164 pmsg[0] = &msg[0];
2165 msg[0].msg_style = PAM_TEXT_INFO;
2166 msg[0].msg = discard_const_p(char, comment);
2167 i = 1;
2168 } else {
2169 i = 0;
2170 }
2171
2172 pmsg[i] = &msg[i];
2173 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
2174 msg[i++].msg = discard_const_p(char, prompt1);
2175 replies = 1;
2176
2177 if (prompt2 != NULL) {
2178 pmsg[i] = &msg[i];
2179 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
2180 msg[i++].msg = discard_const_p(char, prompt2);
2181 ++replies;
2182 }
2183 /* so call the conversation expecting i responses */
2184 resp = NULL;
2185 retval = converse(ctx->pamh, i, pmsg, &resp);
2186 if (resp == NULL) {
2187 if (retval == PAM_SUCCESS) {
2188 retval = PAM_AUTHTOK_RECOVER_ERR;
2189 }
2190 goto done;
2191 }
2192 if (retval != PAM_SUCCESS) {
2193 _pam_drop_reply(resp, i);
2194 goto done;
2195 }
2196
2197 /* interpret the response */
2198
2199 token = x_strdup(resp[i - replies].resp);
2200 if (!token) {
2201 _pam_log(ctx, LOG_NOTICE,
2202 "could not recover "
2203 "authentication token");
2204 retval = PAM_AUTHTOK_RECOVER_ERR;
2205 goto done;
2206 }
2207
2208 if (replies == 2) {
2209 /* verify that password entered correctly */
2210 if (!resp[i - 1].resp ||
2211 strcmp(token, resp[i - 1].resp)) {
2212 _pam_delete(token); /* mistyped */
2213 retval = PAM_AUTHTOK_RECOVER_ERR;
2214 _make_remark(ctx, PAM_ERROR_MSG,
2215 MISTYPED_PASS);
2216 }
2217 }
2218
2219 /*
2220 * tidy up the conversation (resp_retcode) is ignored
2221 * -- what is it for anyway? AGM
2222 */
2223 _pam_drop_reply(resp, i);
2224 }
2225
2226 done:
2227 if (retval != PAM_SUCCESS) {
2228 _pam_log_debug(ctx, LOG_DEBUG,
2229 "unable to obtain a password");
2230 return retval;
2231 }
2232 /* 'token' is the entered password */
2233
2234 /* we store this password as an item */
2235
2236 retval = pam_set_item(ctx->pamh, authtok_flag, token);
2237 _pam_delete(token); /* clean it up */
2238 if (retval != PAM_SUCCESS ||
2239 (retval = _pam_get_item(ctx->pamh, authtok_flag, &item)) != PAM_SUCCESS) {
2240
2241 _pam_log(ctx, LOG_CRIT, "error manipulating password");
2242 return retval;
2243
2244 }
2245
2246 *pass = item;
2247 item = NULL; /* break link to password */
2248
2249 return PAM_SUCCESS;
2250 }
2251
2252 static const char *get_conf_item_string(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
2253 const char *item,
2254 int config_flag)
2255 {
2256 int i = 0;
2257 const char *parm_opt = NULL;
2258
2259 if (!(ctx->ctrl & config_flag)) {
2260 goto out;
2261 }
2262
2263 /* let the pam opt take precedence over the pam_winbind.conf option */
2264 for (i=0; i<ctx->argc; i++) {
2265
2266 if ((strncmp(ctx->argv[i], item, strlen(item)) == 0)) {
2267 char *p;
2268
2269 if ((p = strchr(ctx->argv[i], '=')) == NULL) {
2270 _pam_log(ctx, LOG_INFO,
2271 "no \"=\" delimiter for \"%s\" found\n",
2272 item);
2273 goto out;
2274 }
2275 _pam_log_debug(ctx, LOG_INFO,
2276 "PAM config: %s '%s'\n", item, p+1);
2277 return p + 1;
2278 }
2279 }
2280
2281 if (ctx->dict) {
2282 char *key = NULL;
2283
2284 key = talloc_asprintf(ctx, "global:%s", item);
2285 if (!key) {
2286 goto out;
2287 }
2288
2289 parm_opt = iniparser_getstr(ctx->dict, key);
2290 TALLOC_FREE(key);
2291
2292 _pam_log_debug(ctx, LOG_INFO, "CONFIG file: %s '%s'\n",
2293 item, parm_opt);
2294 }
2295 out:
2296 return parm_opt;
2297 }
2298
2299 static int get_config_item_int(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
2300 const char *item,
2301 int config_flag)
2302 {
2303 int i, parm_opt = -1;
2304
2305 if (!(ctx->ctrl & config_flag)) {
2306 goto out;
2307 }
2308
2309 /* let the pam opt take precedence over the pam_winbind.conf option */
2310 for (i = 0; i < ctx->argc; i++) {
2311
2312 if ((strncmp(ctx->argv[i], item, strlen(item)) == 0)) {
2313 char *p;
2314
2315 if ((p = strchr(ctx->argv[i], '=')) == NULL) {
2316 _pam_log(ctx, LOG_INFO,
2317 "no \"=\" delimiter for \"%s\" found\n",
2318 item);
2319 goto out;
2320 }
2321 parm_opt = atoi(p + 1);
2322 _pam_log_debug(ctx, LOG_INFO,
2323 "PAM config: %s '%d'\n",
2324 item, parm_opt);
2325 return parm_opt;
2326 }
2327 }
2328
2329 if (ctx->dict) {
2330 char *key = NULL;
2331
2332 key = talloc_asprintf(ctx, "global:%s", item);
2333 if (!key) {
2334 goto out;
2335 }
2336
2337 parm_opt = iniparser_getint(ctx->dict, key, -1);
2338 TALLOC_FREE(key);
2339
2340 _pam_log_debug(ctx, LOG_INFO,
2341 "CONFIG file: %s '%d'\n",
2342 item, parm_opt);
2343 }
2344 out:
2345 return parm_opt;
2346 }
2347
2348 static const char *get_krb5_cc_type_from_config(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
2349 {
2350 return get_conf_item_string(ctx, "krb5_ccache_type",
2351 WINBIND_KRB5_CCACHE_TYPE);
2352 }
2353
2354 static const char *get_member_from_config(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
2355 {
2356 const char *ret = NULL;
2357 ret = get_conf_item_string(ctx, "require_membership_of",
2358 WINBIND_REQUIRED_MEMBERSHIP);
2359 if (ret) {
2360 return ret;
2361 }
2362 return get_conf_item_string(ctx, "require-membership-of",
2363 WINBIND_REQUIRED_MEMBERSHIP);
2364 }
2365
2366 static int get_warn_pwd_expire_from_config(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
2367 {
2368 int ret;
2369 ret = get_config_item_int(ctx, "warn_pwd_expire",
2370 WINBIND_WARN_PWD_EXPIRE);
2371 /* no or broken setting */
2372 if (ret <= 0) {
2373 return DEFAULT_DAYS_TO_WARN_BEFORE_PWD_EXPIRES;
2374 }
2375 return ret;
2376 }
2377
2378 /**
2379 * Retrieve the winbind separator.
2380 *
2381 * @param ctx PAM winbind context.
2382 *
2383 * @return string separator character. NULL on failure.
2384 */
2385
2386 static char winbind_get_separator(struct pwb_context *ctx)
/* [<][>][^][v][top][bottom][index][help] */
2387 {
2388 wbcErr wbc_status;
2389 static struct wbcInterfaceDetails *details = NULL;
2390
2391 wbc_status = wbcInterfaceDetails(&details);
2392 if (!WBC_ERROR_IS_OK(wbc_status)) {
2393 _pam_log(ctx, LOG_ERR,
2394 "Could not retrieve winbind interface details: %s",
2395 wbcErrorString(wbc_status));
2396 return '\0';
2397 }
2398
2399 if (!details) {
2400 return '\0';
2401 }
2402
2403 return details->winbind_separator;
2404 }
2405
2406
2407 /**
2408 * Convert a upn to a name.
2409 *
2410 * @param ctx PAM winbind context.
2411 * @param upn USer UPN to be trabslated.
2412 *
2413 * @return converted name. NULL pointer on failure. Caller needs to free.
2414 */
2415
2416 static char* winbind_upn_to_username(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
2417 const char *upn)
2418 {
2419 char sep;
2420 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
2421 struct wbcDomainSid sid;
2422 enum wbcSidType type;
2423 char *domain;
2424 char *name;
2425 char *p;
2426
2427 /* This cannot work when the winbind separator = @ */
2428
2429 sep = winbind_get_separator(ctx);
2430 if (!sep || sep == '@') {
2431 return NULL;
2432 }
2433
2434 name = talloc_strdup(ctx, upn);
2435 if (!name) {
2436 return NULL;
2437 }
2438
2439 if ((p = strchr(name, '@')) != NULL) {
2440 *p = 0;
2441 domain = p + 1;
2442 }
2443
2444 /* Convert the UPN to a SID */
2445
2446 wbc_status = wbcLookupName(domain, name, &sid, &type);
2447 if (!WBC_ERROR_IS_OK(wbc_status)) {
2448 return NULL;
2449 }
2450
2451 /* Convert the the SID back to the sAMAccountName */
2452
2453 wbc_status = wbcLookupSid(&sid, &domain, &name, &type);
2454 if (!WBC_ERROR_IS_OK(wbc_status)) {
2455 return NULL;
2456 }
2457
2458 return talloc_asprintf(ctx, "%s\\%s", domain, name);
2459 }
2460
2461 static int _pam_delete_cred(pam_handle_t *pamh, int flags,
/* [<][>][^][v][top][bottom][index][help] */
2462 int argc, const char **argv)
2463 {
2464 int retval = PAM_SUCCESS;
2465 struct pwb_context *ctx = NULL;
2466 struct wbcLogoffUserParams logoff;
2467 struct wbcAuthErrorInfo *error = NULL;
2468 const char *user;
2469 wbcErr wbc_status = WBC_ERR_SUCCESS;
2470
2471 ZERO_STRUCT(logoff);
2472
2473 retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2474 if (retval) {
2475 goto out;
2476 }
2477
2478 _PAM_LOG_FUNCTION_ENTER("_pam_delete_cred", ctx);
2479
2480 if (ctx->ctrl & WINBIND_KRB5_AUTH) {
2481
2482 /* destroy the ccache here */
2483
2484 uint32_t wbc_flags = 0;
2485 const char *ccname = NULL;
2486 struct passwd *pwd = NULL;
2487
2488 retval = pam_get_user(pamh, &user, _("Username: "));
2489 if (retval) {
2490 _pam_log(ctx, LOG_ERR,
2491 "could not identify user");
2492 goto out;
2493 }
2494
2495 if (user == NULL) {
2496 _pam_log(ctx, LOG_ERR,
2497 "username was NULL!");
2498 retval = PAM_USER_UNKNOWN;
2499 goto out;
2500 }
2501
2502 _pam_log_debug(ctx, LOG_DEBUG,
2503 "username [%s] obtained", user);
2504
2505 ccname = pam_getenv(pamh, "KRB5CCNAME");
2506 if (ccname == NULL) {
2507 _pam_log_debug(ctx, LOG_DEBUG,
2508 "user has no KRB5CCNAME environment");
2509 }
2510
2511 pwd = getpwnam(user);
2512 if (pwd == NULL) {
2513 retval = PAM_USER_UNKNOWN;
2514 goto out;
2515 }
2516
2517 wbc_flags = WBFLAG_PAM_KRB5 |
2518 WBFLAG_PAM_CONTACT_TRUSTDOM;
2519
2520 logoff.username = user;
2521
2522 if (ccname) {
2523 wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2524 &logoff.blobs,
2525 "ccfilename",
2526 0,
2527 (uint8_t *)ccname,
2528 strlen(ccname)+1);
2529 if (!WBC_ERROR_IS_OK(wbc_status)) {
2530 goto out;
2531 }
2532 }
2533
2534 wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2535 &logoff.blobs,
2536 "flags",
2537 0,
2538 (uint8_t *)&wbc_flags,
2539 sizeof(wbc_flags));
2540 if (!WBC_ERROR_IS_OK(wbc_status)) {
2541 goto out;
2542 }
2543
2544 wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2545 &logoff.blobs,
2546 "user_uid",
2547 0,
2548 (uint8_t *)&pwd->pw_uid,
2549 sizeof(pwd->pw_uid));
2550 if (!WBC_ERROR_IS_OK(wbc_status)) {
2551 goto out;
2552 }
2553
2554 wbc_status = wbcLogoffUserEx(&logoff, &error);
2555 retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
2556 user, "wbcLogoffUser");
2557 wbcFreeMemory(error);
2558 wbcFreeMemory(logoff.blobs);
2559 logoff.blobs = NULL;
2560
2561 if (!WBC_ERROR_IS_OK(wbc_status)) {
2562 _pam_log(ctx, LOG_INFO,
2563 "failed to logoff user %s: %s\n",
2564 user, wbcErrorString(wbc_status));
2565 }
2566 }
2567
2568 out:
2569 if (logoff.blobs) {
2570 wbcFreeMemory(logoff.blobs);
2571 }
2572
2573 if (!WBC_ERROR_IS_OK(wbc_status)) {
2574 retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
2575 user, "wbcLogoffUser");
2576 }
2577
2578 /*
2579 * Delete the krb5 ccname variable from the PAM environment
2580 * if it was set by winbind.
2581 */
2582 if ((ctx->ctrl & WINBIND_KRB5_AUTH) && pam_getenv(pamh, "KRB5CCNAME")) {
2583 pam_putenv(pamh, "KRB5CCNAME");
2584 }
2585
2586 _PAM_LOG_FUNCTION_LEAVE("_pam_delete_cred", ctx, retval);
2587
2588 TALLOC_FREE(ctx);
2589
2590 return retval;
2591 }
2592
2593 PAM_EXTERN
2594 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
/* [<][>][^][v][top][bottom][index][help] */
2595 int argc, const char **argv)
2596 {
2597 const char *username;
2598 const char *password;
2599 const char *member = NULL;
2600 const char *cctype = NULL;
2601 int warn_pwd_expire;
2602 int retval = PAM_AUTH_ERR;
2603 char *username_ret = NULL;
2604 char *new_authtok_required = NULL;
2605 char *real_username = NULL;
2606 struct pwb_context *ctx = NULL;
2607
2608 retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2609 if (retval) {
2610 goto out;
2611 }
2612
2613 _PAM_LOG_FUNCTION_ENTER("pam_sm_authenticate", ctx);
2614
2615 /* Get the username */
2616 retval = pam_get_user(pamh, &username, NULL);
2617 if ((retval != PAM_SUCCESS) || (!username)) {
2618 _pam_log_debug(ctx, LOG_DEBUG,
2619 "can not get the username");
2620 retval = PAM_SERVICE_ERR;
2621 goto out;
2622 }
2623
2624
2625 #if defined(AIX)
2626 /* Decode the user name since AIX does not support logn user
2627 names by default. The name is encoded as _#uid. */
2628
2629 if (username[0] == '_') {
2630 uid_t id = atoi(&username[1]);
2631 struct passwd *pw = NULL;
2632
2633 if ((id!=0) && ((pw = getpwuid(id)) != NULL)) {
2634 real_username = strdup(pw->pw_name);
2635 }
2636 }
2637 #endif
2638
2639 if (!real_username) {
2640 /* Just making a copy of the username we got from PAM */
2641 if ((real_username = strdup(username)) == NULL) {
2642 _pam_log_debug(ctx, LOG_DEBUG,
2643 "memory allocation failure when copying "
2644 "username");
2645 retval = PAM_SERVICE_ERR;
2646 goto out;
2647 }
2648 }
2649
2650 /* Maybe this was a UPN */
2651
2652 if (strchr(real_username, '@') != NULL) {
2653 char *samaccountname = NULL;
2654
2655 samaccountname = winbind_upn_to_username(ctx,
2656 real_username);
2657 if (samaccountname) {
2658 free(real_username);
2659 real_username = strdup(samaccountname);
2660 }
2661 }
2662
2663 retval = _winbind_read_password(ctx, ctx->ctrl, NULL,
2664 _("Password: "), NULL,
2665 &password);
2666
2667 if (retval != PAM_SUCCESS) {
2668 _pam_log(ctx, LOG_ERR,
2669 "Could not retrieve user's password");
2670 retval = PAM_AUTHTOK_ERR;
2671 goto out;
2672 }
2673
2674 /* Let's not give too much away in the log file */
2675
2676 #ifdef DEBUG_PASSWORD
2677 _pam_log_debug(ctx, LOG_INFO,
2678 "Verify user '%s' with password '%s'",
2679 real_username, password);
2680 #else
2681 _pam_log_debug(ctx, LOG_INFO,
2682 "Verify user '%s'", real_username);
2683 #endif
2684
2685 member = get_member_from_config(ctx);
2686 cctype = get_krb5_cc_type_from_config(ctx);
2687 warn_pwd_expire = get_warn_pwd_expire_from_config(ctx);
2688
2689 /* Now use the username to look up password */
2690 retval = winbind_auth_request(ctx, real_username, password,
2691 member, cctype, warn_pwd_expire,
2692 NULL, NULL, NULL,
2693 NULL, &username_ret);
2694
2695 if (retval == PAM_NEW_AUTHTOK_REQD ||
2696 retval == PAM_AUTHTOK_EXPIRED) {
2697
2698 char *new_authtok_required_during_auth = NULL;
2699
2700 new_authtok_required = talloc_asprintf(NULL, "%d", retval);
2701 if (!new_authtok_required) {
2702 retval = PAM_BUF_ERR;
2703 goto out;
2704 }
2705
2706 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD,
2707 new_authtok_required,
2708 _pam_winbind_cleanup_func);
2709
2710 retval = PAM_SUCCESS;
2711
2712 new_authtok_required_during_auth = talloc_asprintf(NULL, "%d", true);
2713 if (!new_authtok_required_during_auth) {
2714 retval = PAM_BUF_ERR;
2715 goto out;
2716 }
2717
2718 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
2719 new_authtok_required_during_auth,
2720 _pam_winbind_cleanup_func);
2721
2722 goto out;
2723 }
2724
2725 out:
2726 if (username_ret) {
2727 pam_set_item (pamh, PAM_USER, username_ret);
2728 _pam_log_debug(ctx, LOG_INFO,
2729 "Returned user was '%s'", username_ret);
2730 free(username_ret);
2731 }
2732
2733 if (real_username) {
2734 free(real_username);
2735 }
2736
2737 if (!new_authtok_required) {
2738 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, NULL, NULL);
2739 }
2740
2741 if (retval != PAM_SUCCESS) {
2742 _pam_free_data_info3(pamh);
2743 }
2744
2745 _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
2746
2747 TALLOC_FREE(ctx);
2748
2749 return retval;
2750 }
2751
2752 PAM_EXTERN
2753 int pam_sm_setcred(pam_handle_t *pamh, int flags,
/* [<][>][^][v][top][bottom][index][help] */
2754 int argc, const char **argv)
2755 {
2756 int ret = PAM_SYSTEM_ERR;
2757 struct pwb_context *ctx = NULL;
2758
2759 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2760 if (ret) {
2761 goto out;
2762 }
2763
2764 _PAM_LOG_FUNCTION_ENTER("pam_sm_setcred", ctx);
2765
2766 switch (flags & ~PAM_SILENT) {
2767
2768 case PAM_DELETE_CRED:
2769 ret = _pam_delete_cred(pamh, flags, argc, argv);
2770 break;
2771 case PAM_REFRESH_CRED:
2772 _pam_log_debug(ctx, LOG_WARNING,
2773 "PAM_REFRESH_CRED not implemented");
2774 ret = PAM_SUCCESS;
2775 break;
2776 case PAM_REINITIALIZE_CRED:
2777 _pam_log_debug(ctx, LOG_WARNING,
2778 "PAM_REINITIALIZE_CRED not implemented");
2779 ret = PAM_SUCCESS;
2780 break;
2781 case PAM_ESTABLISH_CRED:
2782 _pam_log_debug(ctx, LOG_WARNING,
2783 "PAM_ESTABLISH_CRED not implemented");
2784 ret = PAM_SUCCESS;
2785 break;
2786 default:
2787 ret = PAM_SYSTEM_ERR;
2788 break;
2789 }
2790
2791 out:
2792
2793 _PAM_LOG_FUNCTION_LEAVE("pam_sm_setcred", ctx, ret);
2794
2795 TALLOC_FREE(ctx);
2796
2797 return ret;
2798 }
2799
2800 /*
2801 * Account management. We want to verify that the account exists
2802 * before returning PAM_SUCCESS
2803 */
2804 PAM_EXTERN
2805 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
/* [<][>][^][v][top][bottom][index][help] */
2806 int argc, const char **argv)
2807 {
2808 const char *username;
2809 int ret = PAM_USER_UNKNOWN;
2810 void *tmp = NULL;
2811 struct pwb_context *ctx = NULL;
2812
2813 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2814 if (ret) {
2815 goto out;
2816 }
2817
2818 _PAM_LOG_FUNCTION_ENTER("pam_sm_acct_mgmt", ctx);
2819
2820
2821 /* Get the username */
2822 ret = pam_get_user(pamh, &username, NULL);
2823 if ((ret != PAM_SUCCESS) || (!username)) {
2824 _pam_log_debug(ctx, LOG_DEBUG,
2825 "can not get the username");
2826 ret = PAM_SERVICE_ERR;
2827 goto out;
2828 }
2829
2830 /* Verify the username */
2831 ret = valid_user(ctx, username);
2832 switch (ret) {
2833 case -1:
2834 /* some sort of system error. The log was already printed */
2835 ret = PAM_SERVICE_ERR;
2836 goto out;
2837 case 1:
2838 /* the user does not exist */
2839 _pam_log_debug(ctx, LOG_NOTICE, "user '%s' not found",
2840 username);
2841 if (ctx->ctrl & WINBIND_UNKNOWN_OK_ARG) {
2842 ret = PAM_IGNORE;
2843 goto out;
2844 }
2845 ret = PAM_USER_UNKNOWN;
2846 goto out;
2847 case 0:
2848 pam_get_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD,
2849 (const void **)&tmp);
2850 if (tmp != NULL) {
2851 ret = atoi((const char *)tmp);
2852 switch (ret) {
2853 case PAM_AUTHTOK_EXPIRED:
2854 /* fall through, since new token is required in this case */
2855 case PAM_NEW_AUTHTOK_REQD:
2856 _pam_log(ctx, LOG_WARNING,
2857 "pam_sm_acct_mgmt success but %s is set",
2858 PAM_WINBIND_NEW_AUTHTOK_REQD);
2859 _pam_log(ctx, LOG_NOTICE,
2860 "user '%s' needs new password",
2861 username);
2862 /* PAM_AUTHTOKEN_REQD does not exist, but is documented in the manpage */
2863 ret = PAM_NEW_AUTHTOK_REQD;
2864 goto out;
2865 default:
2866 _pam_log(ctx, LOG_WARNING,
2867 "pam_sm_acct_mgmt success");
2868 _pam_log(ctx, LOG_NOTICE,
2869 "user '%s' granted access", username);
2870 ret = PAM_SUCCESS;
2871 goto out;
2872 }
2873 }
2874
2875 /* Otherwise, the authentication looked good */
2876 _pam_log(ctx, LOG_NOTICE,
2877 "user '%s' granted access", username);
2878 ret = PAM_SUCCESS;
2879 goto out;
2880 default:
2881 /* we don't know anything about this return value */
2882 _pam_log(ctx, LOG_ERR,
2883 "internal module error (ret = %d, user = '%s')",
2884 ret, username);
2885 ret = PAM_SERVICE_ERR;
2886 goto out;
2887 }
2888
2889 /* should not be reached */
2890 ret = PAM_IGNORE;
2891
2892 out:
2893
2894 _PAM_LOG_FUNCTION_LEAVE("pam_sm_acct_mgmt", ctx, ret);
2895
2896 TALLOC_FREE(ctx);
2897
2898 return ret;
2899 }
2900
2901 PAM_EXTERN
2902 int pam_sm_open_session(pam_handle_t *pamh, int flags,
/* [<][>][^][v][top][bottom][index][help] */
2903 int argc, const char **argv)
2904 {
2905 int ret = PAM_SUCCESS;
2906 struct pwb_context *ctx = NULL;
2907
2908 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2909 if (ret) {
2910 goto out;
2911 }
2912
2913 _PAM_LOG_FUNCTION_ENTER("pam_sm_open_session", ctx);
2914
2915 if (ctx->ctrl & WINBIND_MKHOMEDIR) {
2916 /* check and create homedir */
2917 ret = _pam_mkhomedir(ctx);
2918 }
2919 out:
2920 _PAM_LOG_FUNCTION_LEAVE("pam_sm_open_session", ctx, ret);
2921
2922 TALLOC_FREE(ctx);
2923
2924 return ret;
2925 }
2926
2927 PAM_EXTERN
2928 int pam_sm_close_session(pam_handle_t *pamh, int flags,
/* [<][>][^][v][top][bottom][index][help] */
2929 int argc, const char **argv)
2930 {
2931 int ret = PAM_SUCCESS;
2932 struct pwb_context *ctx = NULL;
2933
2934 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2935 if (ret) {
2936 goto out;
2937 }
2938
2939 _PAM_LOG_FUNCTION_ENTER("pam_sm_close_session", ctx);
2940
2941 out:
2942 _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx, ret);
2943
2944 TALLOC_FREE(ctx);
2945
2946 return ret;
2947 }
2948
2949 /**
2950 * evaluate whether we need to re-authenticate with kerberos after a
2951 * password change
2952 *
2953 * @param ctx PAM winbind context.
2954 * @param user The username
2955 *
2956 * @return boolean Returns true if required, false if not.
2957 */
2958
2959 static bool _pam_require_krb5_auth_after_chauthtok(struct pwb_context *ctx,
/* [<][>][^][v][top][bottom][index][help] */
2960 const char *user)
2961 {
2962
2963 /* Make sure that we only do this if a) the chauthtok got initiated
2964 * during a logon attempt (authenticate->acct_mgmt->chauthtok) b) any
2965 * later password change via the "passwd" command if done by the user
2966 * itself
2967 * NB. If we login from gdm or xdm and the password expires,
2968 * we change the password, but there is no memory cache.
2969 * Thus, even for passthrough login, we should do the
2970 * authentication again to update memory cache.
2971 * --- BoYang
2972 * */
2973
2974 char *new_authtok_reqd_during_auth = NULL;
2975 struct passwd *pwd = NULL;
2976
2977 _pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
2978 &new_authtok_reqd_during_auth);
2979 pam_set_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
2980 NULL, NULL);
2981
2982 if (new_authtok_reqd_during_auth) {
2983 return true;
2984 }
2985
2986 pwd = getpwnam(user);
2987 if (!pwd) {
2988 return false;
2989 }
2990
2991 if (getuid() == pwd->pw_uid) {
2992 return true;
2993 }
2994
2995 return false;
2996 }
2997
2998
2999 PAM_EXTERN
3000 int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
/* [<][>][^][v][top][bottom][index][help] */
3001 int argc, const char **argv)
3002 {
3003 unsigned int lctrl;
3004 int ret;
3005 bool cached_login = false;
3006
3007 /* <DO NOT free() THESE> */
3008 const char *user;
3009 char *pass_old, *pass_new;
3010 /* </DO NOT free() THESE> */
3011
3012 char *Announce;
3013
3014 int retry = 0;
3015 char *username_ret = NULL;
3016 struct wbcAuthErrorInfo *error = NULL;
3017 struct pwb_context *ctx = NULL;
3018
3019 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
3020 if (ret) {
3021 goto out;
3022 }
3023
3024 _PAM_LOG_FUNCTION_ENTER("pam_sm_chauthtok", ctx);
3025
3026 cached_login = (ctx->ctrl & WINBIND_CACHED_LOGIN);
3027
3028 /* clearing offline bit for auth */
3029 ctx->ctrl &= ~WINBIND_CACHED_LOGIN;
3030
3031 /*
3032 * First get the name of a user
3033 */
3034 ret = pam_get_user(pamh, &user, _("Username: "));
3035 if (ret) {
3036 _pam_log(ctx, LOG_ERR,
3037 "password - could not identify user");
3038 goto out;
3039 }
3040
3041 if (user == NULL) {
3042 _pam_log(ctx, LOG_ERR, "username was NULL!");
3043 ret = PAM_USER_UNKNOWN;
3044 goto out;
3045 }
3046
3047 _pam_log_debug(ctx, LOG_DEBUG, "username [%s] obtained", user);
3048
3049 /* check if this is really a user in winbindd, not only in NSS */
3050 ret = valid_user(ctx, user);
3051 switch (ret) {
3052 case 1:
3053 ret = PAM_USER_UNKNOWN;
3054 goto out;
3055 case -1:
3056 ret = PAM_SYSTEM_ERR;
3057 goto out;
3058 default:
3059 break;
3060 }
3061
3062 /*
3063 * obtain and verify the current password (OLDAUTHTOK) for
3064 * the user.
3065 */
3066
3067 if (flags & PAM_PRELIM_CHECK) {
3068 time_t pwdlastset_prelim = 0;
3069
3070 /* instruct user what is happening */
3071
3072 #define greeting _("Changing password for")
3073 Announce = talloc_asprintf(ctx, "%s %s", greeting, user);
3074 if (!Announce) {
3075 _pam_log(ctx, LOG_CRIT,
3076 "password - out of memory");
3077 ret = PAM_BUF_ERR;
3078 goto out;
3079 }
3080 #undef greeting
3081
3082 lctrl = ctx->ctrl | WINBIND__OLD_PASSWORD;
3083 ret = _winbind_read_password(ctx, lctrl,
3084 Announce,
3085 _("(current) NT password: "),
3086 NULL,
3087 (const char **) &pass_old);
3088 TALLOC_FREE(Announce);
3089 if (ret != PAM_SUCCESS) {
3090 _pam_log(ctx, LOG_NOTICE,
3091 "password - (old) token not obtained");
3092 goto out;
3093 }
3094
3095 /* verify that this is the password for this user */
3096
3097 ret = winbind_auth_request(ctx, user, pass_old,
3098 NULL, NULL, 0,
3099 &error, NULL, NULL,
3100 &pwdlastset_prelim, NULL);
3101
3102 if (ret != PAM_ACCT_EXPIRED &&
3103 ret != PAM_AUTHTOK_EXPIRED &&
3104 ret != PAM_NEW_AUTHTOK_REQD &&
3105 ret != PAM_SUCCESS) {
3106 pass_old = NULL;
3107 goto out;
3108 }
3109
3110 pam_set_data(pamh, PAM_WINBIND_PWD_LAST_SET,
3111 (void *)pwdlastset_prelim, NULL);
3112
3113 ret = pam_set_item(pamh, PAM_OLDAUTHTOK,
3114 (const void *) pass_old);
3115 pass_old = NULL;
3116 if (ret != PAM_SUCCESS) {
3117 _pam_log(ctx, LOG_CRIT,
3118 "failed to set PAM_OLDAUTHTOK");
3119 }
3120 } else if (flags & PAM_UPDATE_AUTHTOK) {
3121
3122 time_t pwdlastset_update = 0;
3123
3124 /*
3125 * obtain the proposed password
3126 */
3127
3128 /*
3129 * get the old token back.
3130 */
3131
3132 ret = _pam_get_item(pamh, PAM_OLDAUTHTOK, &pass_old);
3133
3134 if (ret != PAM_SUCCESS) {
3135 _pam_log(ctx, LOG_NOTICE,
3136 "user not authenticated");
3137 goto out;
3138 }
3139
3140 lctrl = ctx->ctrl & ~WINBIND_TRY_FIRST_PASS_ARG;
3141
3142 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
3143 lctrl |= WINBIND_USE_FIRST_PASS_ARG;
3144 }
3145 retry = 0;
3146 ret = PAM_AUTHTOK_ERR;
3147 while ((ret != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
3148 /*
3149 * use_authtok is to force the use of a previously entered
3150 * password -- needed for pluggable password strength checking
3151 */
3152
3153 ret = _winbind_read_password(ctx, lctrl,
3154 NULL,
3155 _("Enter new NT password: "),
3156 _("Retype new NT password: "),
3157 (const char **)&pass_new);
3158
3159 if (ret != PAM_SUCCESS) {
3160 _pam_log_debug(ctx, LOG_ALERT,
3161 "password - "
3162 "new password not obtained");
3163 pass_old = NULL;/* tidy up */
3164 goto out;
3165 }
3166
3167 /*
3168 * At this point we know who the user is and what they
3169 * propose as their new password. Verify that the new
3170 * password is acceptable.
3171 */
3172
3173 if (pass_new[0] == '\0') {/* "\0" password = NULL */
3174 pass_new = NULL;
3175 }
3176 }
3177
3178 /*
3179 * By reaching here we have approved the passwords and must now
3180 * rebuild the password database file.
3181 */
3182 _pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
3183 &pwdlastset_update);
3184
3185 /*
3186 * if cached creds were enabled, make sure to set the
3187 * WINBIND_CACHED_LOGIN bit here in order to have winbindd
3188 * update the cached creds storage - gd
3189 */
3190 if (cached_login) {
3191 ctx->ctrl |= WINBIND_CACHED_LOGIN;
3192 }
3193
3194 ret = winbind_chauthtok_request(ctx, user, pass_old,
3195 pass_new, pwdlastset_update);
3196 if (ret) {
3197 pass_old = pass_new = NULL;
3198 goto out;
3199 }
3200
3201 if (_pam_require_krb5_auth_after_chauthtok(ctx, user)) {
3202
3203 const char *member = NULL;
3204 const char *cctype = NULL;
3205 int warn_pwd_expire;
3206 struct wbcLogonUserInfo *info = NULL;
3207 struct wbcUserPasswordPolicyInfo *policy = NULL;
3208
3209 member = get_member_from_config(ctx);
3210 cctype = get_krb5_cc_type_from_config(ctx);
3211 warn_pwd_expire = get_warn_pwd_expire_from_config(ctx);
3212
3213 /* Keep WINBIND_CACHED_LOGIN bit for
3214 * authentication after changing the password.
3215 * This will update the cached credentials in case
3216 * that winbindd_dual_pam_chauthtok() fails
3217 * to update them.
3218 * --- BoYang
3219 * */
3220
3221 ret = winbind_auth_request(ctx, user, pass_new,
3222 member, cctype, 0,
3223 &error, &info, &policy,
3224 NULL, &username_ret);
3225 pass_old = pass_new = NULL;
3226
3227 if (ret == PAM_SUCCESS) {
3228
3229 struct wbcAuthUserInfo *user_info = NULL;
3230
3231 if (info && info->info) {
3232 user_info = info->info;
3233 }
3234
3235 /* warn a user if the password is about to
3236 * expire soon */
3237 _pam_warn_password_expiry(ctx, user_info, policy,
3238 warn_pwd_expire,
3239 NULL, NULL);
3240
3241 /* set some info3 info for other modules in the
3242 * stack */
3243 _pam_set_data_info3(ctx, user_info);
3244
3245 /* put krb5ccname into env */
3246 _pam_setup_krb5_env(ctx, info);
3247
3248 if (username_ret) {
3249 pam_set_item(pamh, PAM_USER,
3250 username_ret);
3251 _pam_log_debug(ctx, LOG_INFO,
3252 "Returned user was '%s'",
3253 username_ret);
3254 free(username_ret);
3255 }
3256
3257 }
3258
3259 if (info && info->blobs) {
3260 wbcFreeMemory(info->blobs);
3261 }
3262 wbcFreeMemory(info);
3263 wbcFreeMemory(policy);
3264
3265 goto out;
3266 }
3267 } else {
3268 ret = PAM_SERVICE_ERR;
3269 }
3270
3271 out:
3272 {
3273 /* Deal with offline errors. */
3274 int i;
3275 const char *codes[] = {
3276 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
3277 "NT_STATUS_NO_LOGON_SERVERS",
3278 "NT_STATUS_ACCESS_DENIED"
3279 };
3280
3281 for (i=0; i<ARRAY_SIZE(codes); i++) {
3282 int _ret;
3283 if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
3284 break;
3285 }
3286 }
3287 }
3288
3289 wbcFreeMemory(error);
3290
3291 _PAM_LOG_FUNCTION_LEAVE("pam_sm_chauthtok", ctx, ret);
3292
3293 TALLOC_FREE(ctx);
3294
3295 return ret;
3296 }
3297
3298 #ifdef PAM_STATIC
3299
3300 /* static module data */
3301
3302 struct pam_module _pam_winbind_modstruct = {
3303 MODULE_NAME,
3304 pam_sm_authenticate,
3305 pam_sm_setcred,
3306 pam_sm_acct_mgmt,
3307 pam_sm_open_session,
3308 pam_sm_close_session,
3309 pam_sm_chauthtok
3310 };
3311
3312 #endif
3313
3314 /*
3315 * Copyright (c) Andrew Tridgell <tridge@samba.org> 2000
3316 * Copyright (c) Tim Potter <tpot@samba.org> 2000
3317 * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
3318 * Copyright (c) Guenther Deschner <gd@samba.org> 2005-2008
3319 * Copyright (c) Jan Rêkorajski 1999.
3320 * Copyright (c) Andrew G. Morgan 1996-8.
3321 * Copyright (c) Alex O. Yuriev, 1996.
3322 * Copyright (c) Cristian Gafton 1996.
3323 * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
3324 *
3325 * Redistribution and use in source and binary forms, with or without
3326 * modification, are permitted provided that the following conditions
3327 * are met:
3328 * 1. Redistributions of source code must retain the above copyright
3329 * notice, and the entire permission notice in its entirety,
3330 * including the disclaimer of warranties.
3331 * 2. Redistributions in binary form must reproduce the above copyright
3332 * notice, this list of conditions and the following disclaimer in the
3333 * documentation and/or other materials provided with the distribution.
3334 * 3. The name of the author may not be used to endorse or promote
3335 * products derived from this software without specific prior
3336 * written permission.
3337 *
3338 * ALTERNATIVELY, this product may be distributed under the terms of
3339 * the GNU Public License, in which case the provisions of the GPL are
3340 * required INSTEAD OF the above restrictions. (This clause is
3341 * necessary due to a potential bad interaction between the GPL and
3342 * the restrictions contained in a BSD-style copyright.)
3343 *
3344 * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
3345 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
3346 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
3347 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
3348 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
3349 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
3350 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3351 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
3352 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
3353 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
3354 * OF THE POSSIBILITY OF SUCH DAMAGE.
3355 */