diff options
| -rw-r--r-- | source3/Makefile.in | 2 | ||||
| -rw-r--r-- | source3/utils/ntlm_auth.c | 57 | ||||
| -rw-r--r-- | source3/utils/ntlm_auth_proto.h | 1 |
3 files changed, 58 insertions, 2 deletions
diff --git a/source3/Makefile.in b/source3/Makefile.in index fdcd86a0886..585bd5d7aca 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -2813,7 +2813,7 @@ bin/ntlm_auth@EXEEXT@: $(BINARY_PREREQS) $(NTLM_AUTH_OBJ) $(PARAM_OBJ) \ @$(CC) -o $@ $(LDFLAGS) $(DYNEXP) $(NTLM_AUTH_OBJ) \ $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(LIBS) \ $(POPT_LIBS) $(KRB5LIBS) $(LDAP_LIBS) $(NSCD_LIBS) \ - $(LIBTALLOC_LIBS) $(LIBTDB_LIBS) $(LIBWBCLIENT_LIBS) + $(LIBTALLOC_LIBS) $(LIBTDB_LIBS) $(LIBWBCLIENT_LIBS) @INIPARSERLIBS@ bin/pam_smbpass.@SHLIBEXT@: $(BINARY_PREREQS) $(PAM_SMBPASS_OBJ) @LIBTALLOC_TARGET@ @LIBWBCLIENT_TARGET@ @LIBTDB_TARGET@ @echo "Linking shared library $@" diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c index 50688bf6986..6de5ea67e43 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c @@ -26,6 +26,13 @@ #include "includes.h" #include "utils/ntlm_auth.h" #include "../libcli/auth/libcli_auth.h" +#include <iniparser.h> + +#ifndef PAM_WINBIND_CONFIG_FILE +#define PAM_WINBIND_CONFIG_FILE "/etc/security/pam_winbind.conf" +#endif + +#define WINBIND_KRB5_AUTH 0x00000080 #undef DBGC_CLASS #define DBGC_CLASS DBGC_WINBIND @@ -125,6 +132,7 @@ static int use_cached_creds; static const char *require_membership_of; static const char *require_membership_of_sid; +static const char *opt_pam_winbind_conf; static char winbind_separator(void) { @@ -279,6 +287,36 @@ static bool get_require_membership_sid(void) { return False; } + +/* + * Get some configuration from pam_winbind.conf to see if we + * need to contact trusted domain + */ + +int get_pam_winbind_config() +{ + int ctrl = 0; + dictionary *d = NULL; + + if (!opt_pam_winbind_conf || !*opt_pam_winbind_conf) { + opt_pam_winbind_conf = PAM_WINBIND_CONFIG_FILE; + } + + d = iniparser_load(CONST_DISCARD(char *, opt_pam_winbind_conf)); + + if (!d) { + return 0; + } + + if (iniparser_getboolean(d, CONST_DISCARD(char *, "global:krb5_auth"), false)) { + ctrl |= WINBIND_KRB5_AUTH; + } + + iniparser_freedict(d); + + return ctrl; +} + /* Authenticate a user with a plaintext password */ static bool check_plaintext_auth(const char *user, const char *pass, @@ -677,12 +715,27 @@ static NTSTATUS do_ccache_ntlm_auth(DATA_BLOB initial_msg, DATA_BLOB challenge_m { struct winbindd_request wb_request; struct winbindd_response wb_response; + int ctrl = 0; NSS_STATUS result; /* get winbindd to do the ntlmssp step on our behalf */ ZERO_STRUCT(wb_request); ZERO_STRUCT(wb_response); + /* + * This is tricky here. If we set krb5_auth in pam_winbind.conf + * creds for users in trusted domain will be stored the winbindd + * child of the trusted domain. If we ask the primary domain for + * ntlm_ccache_auth, it will fail. So, we have to ask the trusted + * domain's child for ccache_ntlm_auth. that is to say, we have to + * set WBFALG_PAM_CONTACT_TRUSTDOM in request.flags. + */ + ctrl = get_pam_winbind_config(); + + if (ctrl | WINBIND_KRB5_AUTH) { + wb_request.flags |= WBFLAG_PAM_CONTACT_TRUSTDOM; + } + fstr_sprintf(wb_request.data.ccache_ntlm_auth.user, "%s%c%s", opt_domain, winbind_separator(), opt_username); wb_request.data.ccache_ntlm_auth.uid = geteuid(); @@ -2308,7 +2361,8 @@ enum { OPT_USER_SESSION_KEY, OPT_DIAGNOSTICS, OPT_REQUIRE_MEMBERSHIP, - OPT_USE_CACHED_CREDS + OPT_USE_CACHED_CREDS, + OPT_PAM_WINBIND_CONF }; int main(int argc, const char **argv) @@ -2347,6 +2401,7 @@ enum { { "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "Use cached credentials if no password is given"}, { "diagnostics", 0, POPT_ARG_NONE, &diagnostics, OPT_DIAGNOSTICS, "Perform diagnostics on the authentictaion chain"}, { "require-membership-of", 0, POPT_ARG_STRING, &require_membership_of, OPT_REQUIRE_MEMBERSHIP, "Require that a user be a member of this group (either name or SID) for authentication to succeed" }, + { "pam-winbind-conf", 0, POPT_ARG_STRING, &opt_pam_winbind_conf, OPT_PAM_WINBIND_CONF, "Require that request must set WBFLAG_PAM_CONTACT_TRUSTDOM when krb5 auth is required" }, POPT_COMMON_CONFIGFILE POPT_COMMON_VERSION POPT_TABLEEND diff --git a/source3/utils/ntlm_auth_proto.h b/source3/utils/ntlm_auth_proto.h index e48a190ed66..5f8d26465bf 100644 --- a/source3/utils/ntlm_auth_proto.h +++ b/source3/utils/ntlm_auth_proto.h @@ -44,5 +44,6 @@ NTSTATUS contact_winbind_auth_crap(const char *username, /* The following definitions come from utils/ntlm_auth_diagnostics.c */ bool diagnose_ntlm_auth(void); +int get_pam_winbind_config(void); #endif /* _NTLM_AUTH_PROTO_H_ */ |