/src/samba/source3/auth/auth_util.c

Source
/*
   Unix SMB/CIFS implementation.
   Authentication utility functions
   Copyright (C) Andrew Tridgell 1992-1998
   Copyright (C) Andrew Bartlett 2001-2011
   Copyright (C) Jeremy Allison 2000-2001
   Copyright (C) Rafal Szczesniak 2002
   Copyright (C) Volker Lendecke 2006-2008

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "dom_sid.h"
#include "includes.h"
#include "auth.h"
#include "lib/util_unixsids.h"
#include "../libcli/auth/libcli_auth.h"
#include "rpc_client/init_lsa.h"
#include "../libcli/security/security.h"
#include "../lib/util/util_pw.h"
#include "lib/winbind_util.h"
#include "passdb.h"
#include "../librpc/gen_ndr/ndr_auth.h"
#include "../auth/auth_sam_reply.h"
#include "../librpc/gen_ndr/idmap.h"
#include "lib/param/loadparm.h"
#include "../lib/tsocket/tsocket.h"
#include "rpc_client/util_netlogon.h"
#include "source4/auth/auth.h"
#include "auth/auth_util.h"
#include "source3/lib/substitute.h"

#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH

/****************************************************************************
 Create a UNIX user on demand.
****************************************************************************/

static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
{
  TALLOC_CTX *ctx = talloc_tos();
  const struct loadparm_substitution *lp_sub =
    loadparm_s3_global_substitution();
  char *add_script;
  int ret;

  add_script = lp_add_user_script(ctx, lp_sub);
  if (!add_script || !*add_script) {
    return -1;
  }
  add_script = talloc_all_string_sub(ctx,
        add_script,
        "%u",
        unix_username);
  if (!add_script) {
    return -1;
  }
  if (domain) {
    add_script = talloc_all_string_sub(ctx,
          add_script,
          "%D",
          domain);
    if (!add_script) {
      return -1;
    }
  }
  if (homedir) {
    add_script = talloc_all_string_sub(ctx,
        add_script,
        "%H",
        homedir);
    if (!add_script) {
      return -1;
    }
  }
  ret = smbrun(add_script, NULL, NULL);
  flush_pwnam_cache();
  DEBUG(ret ? 0 : 3,
    ("smb_create_user: Running the command `%s' gave %d\n",
     add_script,ret));
  return ret;
}

/****************************************************************************
 Create an auth_usersupplied_data structure after appropriate mapping.
****************************************************************************/

NTSTATUS make_user_info_map(TALLOC_CTX *mem_ctx,
          struct auth_usersupplied_info **user_info,
          const char *smb_name,
          const char *client_domain,
          const char *workstation_name,
          const struct tsocket_address *remote_address,
          const struct tsocket_address *local_address,
          const char *service_description,
          const DATA_BLOB *lm_pwd,
          const DATA_BLOB *nt_pwd,
          const struct samr_Password *lm_interactive_pwd,
          const struct samr_Password *nt_interactive_pwd,
          const char *plaintext,
          enum auth_password_state password_state)
{
  const char *domain;
  NTSTATUS result;
  bool was_mapped;
  char *internal_username = NULL;

  was_mapped = map_username(talloc_tos(), smb_name, &internal_username);
  if (!internal_username) {
    return NT_STATUS_NO_MEMORY;
  }

  DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
     client_domain, smb_name, workstation_name));

  /*
   * We let the auth stack canonicalize, username
   * and domain.
   */
  domain = client_domain;

  result = make_user_info(mem_ctx, user_info, smb_name, internal_username,
        client_domain, domain, workstation_name,
        remote_address, local_address,
        service_description, lm_pwd, nt_pwd,
        lm_interactive_pwd, nt_interactive_pwd,
        plaintext, password_state);
  if (NT_STATUS_IS_OK(result)) {
    /* did we actually map the user to a different name? */
    (*user_info)->was_mapped = was_mapped;
  }
  return result;
}

/****************************************************************************
 Create an auth_usersupplied_data, making the DATA_BLOBs here.
 Decrypt and encrypt the passwords.
****************************************************************************/

bool make_user_info_netlogon_network(TALLOC_CTX *mem_ctx,
             struct auth_usersupplied_info **user_info,
             const char *smb_name,
             const char *client_domain,
             const char *workstation_name,
             const struct tsocket_address *remote_address,
             const struct tsocket_address *local_address,
             uint32_t logon_parameters,
             const uchar *lm_network_pwd,
             int lm_pwd_len,
             const uchar *nt_network_pwd,
             int nt_pwd_len)
{
  bool ret;
  NTSTATUS status;
  DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
  DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);

  status = make_user_info_map(mem_ctx, user_info,
            smb_name, client_domain,
            workstation_name,
            remote_address,
            local_address,
            "SamLogon",
            lm_pwd_len ? &lm_blob : NULL,
            nt_pwd_len ? &nt_blob : NULL,
            NULL, NULL, NULL,
            AUTH_PASSWORD_RESPONSE);

  if (NT_STATUS_IS_OK(status)) {
    (*user_info)->logon_parameters = logon_parameters;
  }
  ret = NT_STATUS_IS_OK(status) ? true : false;

  data_blob_free(&lm_blob);
  data_blob_free(&nt_blob);
  return ret;
}

/****************************************************************************
 Create an auth_usersupplied_data, making the DATA_BLOBs here.
 Decrypt and encrypt the passwords.
****************************************************************************/

bool make_user_info_netlogon_interactive(TALLOC_CTX *mem_ctx,
           struct auth_usersupplied_info **user_info,
           const char *smb_name,
           const char *client_domain,
           const char *workstation_name,
           const struct tsocket_address *remote_address,
           const struct tsocket_address *local_address,
           uint32_t logon_parameters,
           const uchar chal[8],
           const uchar lm_interactive_pwd[16],
           const uchar nt_interactive_pwd[16])
{
  struct samr_Password lm_pwd;
  struct samr_Password nt_pwd;
  unsigned char local_lm_response[24];
  unsigned char local_nt_response[24];
  int rc;

  if (lm_interactive_pwd)
    memcpy(lm_pwd.hash, lm_interactive_pwd, sizeof(lm_pwd.hash));

  if (nt_interactive_pwd)
    memcpy(nt_pwd.hash, nt_interactive_pwd, sizeof(nt_pwd.hash));

  if (lm_interactive_pwd) {
    rc = SMBOWFencrypt(lm_pwd.hash, chal,
           local_lm_response);
    if (rc != 0) {
      return false;
    }
  }

  if (nt_interactive_pwd) {
    rc = SMBOWFencrypt(nt_pwd.hash, chal,
            local_nt_response);
    if (rc != 0) {
      return false;
    }
  }

  {
    bool ret;
    NTSTATUS nt_status;
    DATA_BLOB local_lm_blob = data_blob_null;
    DATA_BLOB local_nt_blob = data_blob_null;

    if (lm_interactive_pwd) {
      local_lm_blob = data_blob(local_lm_response,
              sizeof(local_lm_response));
    }

    if (nt_interactive_pwd) {
      local_nt_blob = data_blob(local_nt_response,
              sizeof(local_nt_response));
    }

    nt_status = make_user_info_map(
      mem_ctx,
      user_info,
      smb_name, client_domain, workstation_name,
      remote_address,
      local_address,
      "SamLogon",
      lm_interactive_pwd ? &local_lm_blob : NULL,
      nt_interactive_pwd ? &local_nt_blob : NULL,
      lm_interactive_pwd ? &lm_pwd : NULL,
      nt_interactive_pwd ? &nt_pwd : NULL,
      NULL, AUTH_PASSWORD_HASH);

    if (NT_STATUS_IS_OK(nt_status)) {
      (*user_info)->logon_parameters = logon_parameters;
      (*user_info)->flags |= USER_INFO_INTERACTIVE_LOGON;
    }

    ret = NT_STATUS_IS_OK(nt_status) ? true : false;
    data_blob_free(&local_lm_blob);
    data_blob_free(&local_nt_blob);
    return ret;
  }
}


/****************************************************************************
 Create an auth_usersupplied_data structure
****************************************************************************/

bool make_user_info_for_reply(TALLOC_CTX *mem_ctx,
            struct auth_usersupplied_info **user_info,
            const char *smb_name,
            const char *client_domain,
            const struct tsocket_address *remote_address,
            const struct tsocket_address *local_address,
            const char *service_description,
            const uint8_t chal[8],
            DATA_BLOB plaintext_password)
{

  DATA_BLOB local_lm_blob;
  DATA_BLOB local_nt_blob;
  NTSTATUS ret;
  char *plaintext_password_string;
  /*
   * Not encrypted - do so.
   */

  DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
     "format.\n"));
  if (plaintext_password.data && plaintext_password.length) {
    unsigned char local_lm_response[24];

#ifdef DEBUG_PASSWORD
    DEBUG(10,("Unencrypted password (len %d):\n",
        (int)plaintext_password.length));
    dump_data(100, plaintext_password.data,
        plaintext_password.length);
#endif

    SMBencrypt( (const char *)plaintext_password.data,
          (const uchar*)chal, local_lm_response);
    local_lm_blob = data_blob(local_lm_response, 24);

    /* We can't do an NT hash here, as the password needs to be
       case insensitive */
    local_nt_blob = data_blob_null;
  } else {
    local_lm_blob = data_blob_null;
    local_nt_blob = data_blob_null;
  }

  plaintext_password_string = talloc_strndup(talloc_tos(),
               (const char *)plaintext_password.data,
               plaintext_password.length);
  if (!plaintext_password_string) {
    return false;
  }
  talloc_keep_secret(plaintext_password_string);

  ret = make_user_info(mem_ctx,
    user_info, smb_name, smb_name, client_domain, client_domain,
    get_remote_machine_name(),
    remote_address,
    local_address,
          service_description,
    local_lm_blob.data ? &local_lm_blob : NULL,
    local_nt_blob.data ? &local_nt_blob : NULL,
    NULL, NULL,
    plaintext_password_string,
    AUTH_PASSWORD_PLAIN);

  TALLOC_FREE(plaintext_password_string);

  data_blob_free(&local_lm_blob);
  return NT_STATUS_IS_OK(ret) ? true : false;
}

/****************************************************************************
 Create an auth_usersupplied_data structure
****************************************************************************/

NTSTATUS make_user_info_for_reply_enc(TALLOC_CTX *mem_ctx,
              struct auth_usersupplied_info **user_info,
                                      const char *smb_name,
                                      const char *client_domain,
              const struct tsocket_address *remote_address,
              const struct tsocket_address *local_address,
              const char *service_description,
              DATA_BLOB lm_resp, DATA_BLOB nt_resp)
{
  bool allow_raw = lp_raw_ntlmv2_auth();

  if (!allow_raw && nt_resp.length >= 48) {
    /*
     * NTLMv2_RESPONSE has at least 48 bytes
     * and should only be supported via NTLMSSP.
     */
    DEBUG(2,("Rejecting raw NTLMv2 authentication with "
       "user [%s\\%s] from[%s]\n",
       client_domain, smb_name,
       tsocket_address_string(remote_address, mem_ctx)));
    return NT_STATUS_INVALID_PARAMETER;
  }

  return make_user_info(mem_ctx,
            user_info, smb_name, smb_name,
            client_domain, client_domain,
            get_remote_machine_name(),
            remote_address,
            local_address,
            service_description,
            lm_resp.data && (lm_resp.length > 0) ? &lm_resp : NULL,
            nt_resp.data && (nt_resp.length > 0) ? &nt_resp : NULL,
            NULL, NULL, NULL,
            AUTH_PASSWORD_RESPONSE);
}

/****************************************************************************
 Create a guest user_info blob, for anonymous authentication.
****************************************************************************/

bool make_user_info_guest(TALLOC_CTX *mem_ctx,
        const struct tsocket_address *remote_address,
        const struct tsocket_address *local_address,
        const char *service_description,
        struct auth_usersupplied_info **user_info)
{
  NTSTATUS nt_status;

  nt_status = make_user_info(mem_ctx,
           user_info,
           "","",
           "","",
           "",
           remote_address,
           local_address,
           service_description,
           NULL, NULL,
           NULL, NULL,
           NULL,
           AUTH_PASSWORD_RESPONSE);

  return NT_STATUS_IS_OK(nt_status) ? true : false;
}

static NTSTATUS log_nt_token(struct security_token *token)
{
  TALLOC_CTX *frame = talloc_stackframe();
  const struct loadparm_substitution *lp_sub =
    loadparm_s3_global_substitution();
  char *command;
  char *group_sidstr;
  struct dom_sid_buf buf;
  size_t i;

  if ((lp_log_nt_token_command(frame, lp_sub) == NULL) ||
      (strlen(lp_log_nt_token_command(frame, lp_sub)) == 0)) {
    TALLOC_FREE(frame);
    return NT_STATUS_OK;
  }

  group_sidstr = talloc_strdup(frame, "");
  for (i=1; i<token->num_sids; i++) {
    group_sidstr = talloc_asprintf(
      frame, "%s %s", group_sidstr,
      dom_sid_str_buf(&token->sids[i], &buf));
  }

  command = talloc_string_sub(
    frame, lp_log_nt_token_command(frame, lp_sub),
    "%s", dom_sid_str_buf(&token->sids[0], &buf));
  command = talloc_string_sub(frame, command, "%t", group_sidstr);

  if (command == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  DEBUG(8, ("running command: [%s]\n", command));
  if (smbrun(command, NULL, NULL) != 0) {
    DEBUG(0, ("Could not log NT token\n"));
    TALLOC_FREE(frame);
    return NT_STATUS_ACCESS_DENIED;
  }

  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

/*
 * Create the token to use from server_info->info3 and
 * server_info->sids (the info3/sam groups). Find the unix gids.
 */

NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
          const struct auth_serversupplied_info *server_info,
          DATA_BLOB *session_key,
          const char *smb_username, /* for ->sanitized_username, for %U subs */
          struct auth_session_info **session_info_out)
{
  struct security_token *t;
  NTSTATUS status;
  size_t i;
  struct dom_sid tmp_sid;
  struct auth_session_info *session_info = NULL;
  struct unixid *ids;
  bool is_allowed = false;

  /* Ensure we can't possible take a code path leading to a
   * null deref. */
  if (!server_info) {
    return NT_STATUS_LOGON_FAILURE;
  }

  if (is_allowed_domain(server_info->info3->base.logon_domain.string)) {
    is_allowed = true;
  }

  /* Check if we have extra info about the user. */
  if (dom_sid_in_domain(&global_sid_Unix_Users,
            &server_info->extra.user_sid) ||
      dom_sid_in_domain(&global_sid_Unix_Groups,
            &server_info->extra.pgid_sid))
  {
    is_allowed = true;
  }

  if (!is_allowed) {
    DBG_NOTICE("Authentication failed for user [%s] "
         "from firewalled domain [%s]\n",
         server_info->info3->base.account_name.string,
         server_info->info3->base.logon_domain.string);
    return NT_STATUS_AUTHENTICATION_FIREWALL_FAILED;
  }

  if (server_info->cached_session_info != NULL) {
    session_info = copy_session_info(mem_ctx,
        server_info->cached_session_info);
    if (session_info == NULL) {
      goto nomem;
    }

    /* This is a potentially untrusted username for use in %U */
    session_info->unix_info->sanitized_username =
      talloc_alpha_strcpy(session_info->unix_info,
              smb_username,
              SAFE_NETBIOS_CHARS "$");
    if (session_info->unix_info->sanitized_username == NULL) {
      goto nomem;
    }

    session_info->unique_session_token = GUID_random();

    *session_info_out = session_info;
    return NT_STATUS_OK;
  }

  session_info = talloc_zero(mem_ctx, struct auth_session_info);
  if (!session_info) {
    goto nomem;
  }

  session_info->unix_token = talloc_zero(session_info, struct security_unix_token);
  if (!session_info->unix_token) {
    goto nomem;
  }

  session_info->unix_token->uid = server_info->utok.uid;
  session_info->unix_token->gid = server_info->utok.gid;

  session_info->unix_info = talloc_zero(session_info, struct auth_user_info_unix);
  if (!session_info->unix_info) {
    goto nomem;
  }

  session_info->unix_info->unix_name = talloc_strdup(session_info, server_info->unix_name);
  if (!session_info->unix_info->unix_name) {
    goto nomem;
  }

  /* This is a potentially untrusted username for use in %U */
  session_info->unix_info->sanitized_username =
    talloc_alpha_strcpy(session_info->unix_info,
            smb_username,
            SAFE_NETBIOS_CHARS "$");
  if (session_info->unix_info->sanitized_username == NULL) {
    goto nomem;
  }

  if (session_key) {
    data_blob_free(&session_info->session_key);
    session_info->session_key = data_blob_talloc(session_info,
                  session_key->data,
                  session_key->length);
    if (!session_info->session_key.data && session_key->length) {
      goto nomem;
    }
  } else {
    session_info->session_key = data_blob_talloc( session_info, server_info->session_key.data,
                    server_info->session_key.length);
  }

  /* We need to populate session_info->info with the information found in server_info->info3 */
  status = make_user_info_SamBaseInfo(session_info, "", &server_info->info3->base,
              server_info->guest == false,
              &session_info->info);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("conversion of info3 into auth_user_info failed!\n"));
    goto fail;
  }

  /*
   * If the user name was mapped to some local unix user,
   * we can not make much use of the SIDs the
   * domain controller provided us with.
   */
  if (server_info->nss_token) {
    char *found_username = NULL;
    status = create_token_from_username(session_info,
                server_info->unix_name,
                server_info->guest,
                &session_info->unix_token->uid,
                &session_info->unix_token->gid,
                &found_username,
                &session_info->security_token);
    if (NT_STATUS_IS_OK(status)) {
      session_info->unix_info->unix_name = found_username;
    }
  } else {
    status = create_local_nt_token_from_info3(session_info,
                server_info->guest,
                server_info->info3,
                &server_info->extra,
                &session_info->security_token);
  }

  if (!NT_STATUS_IS_OK(status)) {
    goto fail;
  }

  /* Convert the SIDs to gids. */

  session_info->unix_token->ngroups = 0;
  session_info->unix_token->groups = NULL;

  t = session_info->security_token;

  ids = talloc_array(talloc_tos(), struct unixid,
         t->num_sids);
  if (ids == NULL) {
    goto nomem;
  }

  if (!sids_to_unixids(t->sids, t->num_sids, ids)) {
    goto nomem;
  }

  for (i=0; i<t->num_sids; i++) {

    if (i == 0 && ids[i].type != ID_TYPE_BOTH) {
      continue;
    }

    if (ids[i].type != ID_TYPE_GID &&
        ids[i].type != ID_TYPE_BOTH) {
      struct dom_sid_buf buf;
      DEBUG(10, ("Could not convert SID %s to gid, "
           "ignoring it\n",
           dom_sid_str_buf(&t->sids[i], &buf)));
      continue;
    }
    if (!add_gid_to_array_unique(session_info->unix_token,
               ids[i].id,
               &session_info->unix_token->groups,
               &session_info->unix_token->ngroups)) {
      goto nomem;
    }
  }

  /*
   * Add the "Unix Group" SID for each gid to catch mapped groups
   * and their Unix equivalent.  This is to solve the backwards
   * compatibility problem of 'valid users = +ntadmin' where
   * ntadmin has been paired with "Domain Admins" in the group
   * mapping table.  Otherwise smb.conf would need to be changed
   * to 'valid user = "Domain Admins"'.  --jerry
   *
   * For consistency we also add the "Unix User" SID,
   * so that the complete unix token is represented within
   * the nt token.
   */

  uid_to_unix_users_sid(session_info->unix_token->uid, &tmp_sid);
  status = add_sid_to_array_unique(
    session_info->security_token,
    &tmp_sid,
    &session_info->security_token->sids,
    &session_info->security_token->num_sids);
  if (!NT_STATUS_IS_OK(status)) {
    goto fail;
  }

  gid_to_unix_groups_sid(session_info->unix_token->gid, &tmp_sid);
  status = add_sid_to_array_unique(
    session_info->security_token,
    &tmp_sid,
    &session_info->security_token->sids,
    &session_info->security_token->num_sids);
  if (!NT_STATUS_IS_OK(status)) {
    goto fail;
  }

  for ( i=0; i<session_info->unix_token->ngroups; i++ ) {
    gid_to_unix_groups_sid(session_info->unix_token->groups[i], &tmp_sid);
    status = add_sid_to_array_unique(
      session_info->security_token,
      &tmp_sid,
      &session_info->security_token->sids,
      &session_info->security_token->num_sids);
    if (!NT_STATUS_IS_OK(status)) {
      goto fail;
    }
  }

  security_token_debug(DBGC_AUTH, 10, session_info->security_token);
  debug_unix_user_token(DBGC_AUTH, 10,
            session_info->unix_token->uid,
            session_info->unix_token->gid,
            session_info->unix_token->ngroups,
            session_info->unix_token->groups);

  status = log_nt_token(session_info->security_token);
  if (!NT_STATUS_IS_OK(status)) {
    goto fail;
  }

  session_info->unique_session_token = GUID_random();

  *session_info_out = session_info;
  return NT_STATUS_OK;
nomem:
  status = NT_STATUS_NO_MEMORY;
fail:
  TALLOC_FREE(session_info);
  return status;
}

NTSTATUS auth3_user_info_dc_add_hints(struct auth_user_info_dc *user_info_dc,
              uid_t uid,
              gid_t gid,
              uint32_t flags)
{
  uint32_t orig_num_sids = user_info_dc->num_sids;
  struct dom_sid tmp_sid = { 0, };
  NTSTATUS status;

  /*
   * We add S-5-88-1-X in order to pass the uid
   * for the unix token.
   */
  sid_compose(&tmp_sid,
        &global_sid_Unix_NFS_Users,
        (uint32_t)uid);
  status = add_sid_to_array_attrs_unique(user_info_dc->sids,
                 &tmp_sid,
                 SE_GROUP_DEFAULT_FLAGS,
                 &user_info_dc->sids,
                 &user_info_dc->num_sids);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("add_sid_to_array_unique failed: %s\n",
        nt_errstr(status)));
    goto fail;
  }

  /*
   * We add S-5-88-2-X in order to pass the gid
   * for the unix token.
   */
  sid_compose(&tmp_sid,
        &global_sid_Unix_NFS_Groups,
        (uint32_t)gid);
  status = add_sid_to_array_attrs_unique(user_info_dc->sids,
                 &tmp_sid,
                 SE_GROUP_DEFAULT_FLAGS,
                 &user_info_dc->sids,
                 &user_info_dc->num_sids);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("add_sid_to_array_unique failed: %s\n",
        nt_errstr(status)));
    goto fail;
  }

  /*
   * We add S-5-88-3-X in order to pass some flags
   * (AUTH3_UNIX_HINT_*) to auth3_create_session_info().
   */
  sid_compose(&tmp_sid,
        &global_sid_Unix_NFS_Mode,
        flags);
  status = add_sid_to_array_attrs_unique(user_info_dc->sids,
                 &tmp_sid,
                 SE_GROUP_DEFAULT_FLAGS,
                 &user_info_dc->sids,
                 &user_info_dc->num_sids);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("add_sid_to_array_unique failed: %s\n",
        nt_errstr(status)));
    goto fail;
  }

  return NT_STATUS_OK;

fail:
  user_info_dc->num_sids = orig_num_sids;
  return status;
}

static NTSTATUS auth3_session_info_create(
  TALLOC_CTX *mem_ctx,
  const struct auth_user_info_dc *user_info_dc,
  const char *original_user_name,
  uint32_t session_info_flags,
  struct auth_session_info **session_info_out)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct auth_session_info *session_info = NULL;
  uid_t hint_uid = -1;
  bool found_hint_uid = false;
  uid_t hint_gid = -1;
  bool found_hint_gid = false;
  uint32_t hint_flags = 0;
  bool found_hint_flags = false;
  bool need_getpwuid = false;
  struct unixid *ids = NULL;
  uint32_t num_gids = 0;
  gid_t *gids = NULL;
  struct dom_sid tmp_sid = { 0, };
  NTSTATUS status;
  size_t i;
  bool ok;

  *session_info_out = NULL;

  if (user_info_dc->num_sids == 0) {
    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_TOKEN;
  }

  if (user_info_dc->info == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_TOKEN;
  }

  if (user_info_dc->info->account_name == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_TOKEN;
  }

  session_info = talloc_zero(mem_ctx, struct auth_session_info);
  if (session_info == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  /* keep this under frame for easier cleanup */
  talloc_reparent(mem_ctx, frame, session_info);

  session_info->info = auth_user_info_copy(session_info,
             user_info_dc->info);
  if (session_info->info == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  session_info->security_token = talloc_zero(session_info,
               struct security_token);
  if (session_info->security_token == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  /*
   * Avoid a lot of reallocations and allocate what we'll
   * use in most cases.
   */
  session_info->security_token->sids = talloc_zero_array(
            session_info->security_token,
            struct dom_sid,
            user_info_dc->num_sids);
  if (session_info->security_token->sids == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  for (i = PRIMARY_USER_SID_INDEX; i < user_info_dc->num_sids; i++) {
    struct security_token *nt_token = session_info->security_token;
    int cmp;

    /*
     * S-1-5-88-X-Y sids are only used to give hints
     * to the unix token construction.
     *
     * S-1-5-88-1-Y gives the uid=Y
     * S-1-5-88-2-Y gives the gid=Y
     * S-1-5-88-3-Y gives flags=Y: AUTH3_UNIX_HINT_*
     */
    cmp = dom_sid_compare_domain(&global_sid_Unix_NFS,
               &user_info_dc->sids[i].sid);
    if (cmp == 0) {
      bool match;
      uint32_t hint = 0;

      match = sid_peek_rid(&user_info_dc->sids[i].sid, &hint);
      if (!match) {
        continue;
      }

      match = dom_sid_in_domain(&global_sid_Unix_NFS_Users,
              &user_info_dc->sids[i].sid);
      if (match) {
        if (found_hint_uid) {
          TALLOC_FREE(frame);
          return NT_STATUS_INVALID_TOKEN;
        }
        found_hint_uid = true;
        hint_uid = (uid_t)hint;
        continue;
      }

      match = dom_sid_in_domain(&global_sid_Unix_NFS_Groups,
              &user_info_dc->sids[i].sid);
      if (match) {
        if (found_hint_gid) {
          TALLOC_FREE(frame);
          return NT_STATUS_INVALID_TOKEN;
        }
        found_hint_gid = true;
        hint_gid = (gid_t)hint;
        continue;
      }

      match = dom_sid_in_domain(&global_sid_Unix_NFS_Mode,
              &user_info_dc->sids[i].sid);
      if (match) {
        if (found_hint_flags) {
          TALLOC_FREE(frame);
          return NT_STATUS_INVALID_TOKEN;
        }
        found_hint_flags = true;
        hint_flags = hint;
        continue;
      }

      continue;
    }

    status = add_sid_to_array_unique(nt_token->sids,
             &user_info_dc->sids[i].sid,
             &nt_token->sids,
             &nt_token->num_sids);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

  /*
   * We need at least one usable SID
   */
  if (session_info->security_token->num_sids == 0) {
    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_TOKEN;
  }

  /*
   * We need all tree hints: uid, gid, flags
   * or none of them.
   */
  if (found_hint_uid || found_hint_gid || found_hint_flags) {
    if (!found_hint_uid) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_TOKEN;
    }

    if (!found_hint_gid) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_TOKEN;
    }

    if (!found_hint_flags) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_TOKEN;
    }
  }

  if (!(user_info_dc->info->user_flags & NETLOGON_GUEST)) {
    session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
  }

  status = finalize_local_nt_token(session_info->security_token,
           session_info_flags);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }

  /*
   * unless set otherwise, the session key is the user session
   * key from the auth subsystem
   */
  if (user_info_dc->user_session_key.length != 0) {
    session_info->session_key = data_blob_dup_talloc_s(
      session_info, user_info_dc->user_session_key);
    if (session_info->session_key.data == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }

  if (!(session_info_flags & AUTH_SESSION_INFO_UNIX_TOKEN)) {
    goto done;
  }

  session_info->unix_token = talloc_zero(session_info, struct security_unix_token);
  if (session_info->unix_token == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }
  session_info->unix_token->uid = -1;
  session_info->unix_token->gid = -1;

  session_info->unix_info = talloc_zero(session_info, struct auth_user_info_unix);
  if (session_info->unix_info == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  /* Convert the SIDs to uid/gids. */

  ids = talloc_zero_array(frame, struct unixid,
        session_info->security_token->num_sids);
  if (ids == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  if (!(hint_flags & AUTH3_UNIX_HINT_DONT_TRANSLATE_FROM_SIDS)) {
    ok = sids_to_unixids(session_info->security_token->sids,
             session_info->security_token->num_sids,
             ids);
    if (!ok) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }

  if (found_hint_uid) {
    session_info->unix_token->uid = hint_uid;
  } else if (ids[0].type == ID_TYPE_UID) {
    /*
     * The primary SID resolves to a UID only.
     */
    session_info->unix_token->uid = ids[0].id;
  } else if (ids[0].type == ID_TYPE_BOTH) {
    /*
     * The primary SID resolves to a UID and GID,
     * use it as uid and add it as first element
     * to the groups array.
     */
    session_info->unix_token->uid = ids[0].id;

    ok = add_gid_to_array_unique(session_info->unix_token,
               session_info->unix_token->uid,
               &session_info->unix_token->groups,
               &session_info->unix_token->ngroups);
    if (!ok) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  } else {
    /*
     * It we can't get a uid, we can't imporsonate
     * the user.
     */
    TALLOC_FREE(frame);
    return NT_STATUS_INVALID_TOKEN;
  }

  if (found_hint_gid) {
    session_info->unix_token->gid = hint_gid;
  } else {
    need_getpwuid = true;
  }

  if (hint_flags & AUTH3_UNIX_HINT_QUALIFIED_NAME) {
    session_info->unix_info->unix_name =
      talloc_asprintf(session_info->unix_info,
          "%s%c%s",
          session_info->info->domain_name,
          *lp_winbind_separator(),
          session_info->info->account_name);
    if (session_info->unix_info->unix_name == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  } else if (hint_flags & AUTH3_UNIX_HINT_ISLOLATED_NAME) {
    session_info->unix_info->unix_name =
      talloc_strdup(session_info->unix_info,
              session_info->info->account_name);
    if (session_info->unix_info->unix_name == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  } else {
    need_getpwuid = true;
  }

  if (need_getpwuid) {
    struct passwd *pwd = NULL;

    /*
     * Ask the system for the primary gid
     * and the real unix name.
     */
    pwd = getpwuid_alloc(frame, session_info->unix_token->uid);
    if (pwd == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_TOKEN;
    }
    if (!found_hint_gid) {
      session_info->unix_token->gid = pwd->pw_gid;
    }

    session_info->unix_info->unix_name =
      talloc_strdup(session_info->unix_info, pwd->pw_name);
    if (session_info->unix_info->unix_name == NULL) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }

    TALLOC_FREE(pwd);
  }

  ok = add_gid_to_array_unique(session_info->unix_token,
             session_info->unix_token->gid,
             &session_info->unix_token->groups,
             &session_info->unix_token->ngroups);
  if (!ok) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  /* This is a potentially untrusted username for use in %U */
  session_info->unix_info->sanitized_username =
    talloc_alpha_strcpy(session_info->unix_info,
            original_user_name,
            SAFE_NETBIOS_CHARS "$");
  if (session_info->unix_info->sanitized_username == NULL) {
    TALLOC_FREE(frame);
    return NT_STATUS_NO_MEMORY;
  }

  for (i=0; i < session_info->security_token->num_sids; i++) {

    if (ids[i].type != ID_TYPE_GID &&
        ids[i].type != ID_TYPE_BOTH) {
      struct security_token *nt_token =
        session_info->security_token;
      struct dom_sid_buf buf;

      DEBUG(10, ("Could not convert SID %s to gid, "
           "ignoring it\n",
           dom_sid_str_buf(&nt_token->sids[i], &buf)));
      continue;
    }

    ok = add_gid_to_array_unique(session_info->unix_token,
               ids[i].id,
               &session_info->unix_token->groups,
               &session_info->unix_token->ngroups);
    if (!ok) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }
  TALLOC_FREE(ids);

  /*
   * Now we must get any groups this user has been
   * added to in /etc/group and merge them in.
   * This has to be done in every code path
   * that creates an NT token, as remote users
   * may have been added to the local /etc/group
   * database. Tokens created merely from the
   * info3 structs (via the DC or via the krb5 PAC)
   * won't have these local groups. Note the
   * groups added here will only be UNIX groups
   * (S-1-22-2-XXXX groups) as getgroups_unix_user()
   * turns off winbindd before calling getgroups().
   *
   * NB. This is duplicating work already
   * done in the 'unix_user:' case of
   * create_token_from_sid() but won't
   * do anything other than be inefficient
   * in that case.
   */
  if (!(hint_flags & AUTH3_UNIX_HINT_DONT_EXPAND_UNIX_GROUPS)) {
    ok = getgroups_unix_user(frame,
           session_info->unix_info->unix_name,
           session_info->unix_token->gid,
           &gids, &num_gids);
    if (!ok) {
      TALLOC_FREE(frame);
      return NT_STATUS_INVALID_TOKEN;
    }
  }

  for (i=0; i < num_gids; i++) {

    ok = add_gid_to_array_unique(session_info->unix_token,
               gids[i],
               &session_info->unix_token->groups,
               &session_info->unix_token->ngroups);
    if (!ok) {
      TALLOC_FREE(frame);
      return NT_STATUS_NO_MEMORY;
    }
  }
  TALLOC_FREE(gids);

  if (hint_flags & AUTH3_UNIX_HINT_DONT_TRANSLATE_TO_SIDS) {
    /*
     * We should not translate the unix token uid/gids
     * to S-1-22-X-Y SIDs.
     */
    goto done;
  }

  /*
   * Add the "Unix Group" SID for each gid to catch mapped groups
   * and their Unix equivalent.  This is to solve the backwards
   * compatibility problem of 'valid users = +ntadmin' where
   * ntadmin has been paired with "Domain Admins" in the group
   * mapping table.  Otherwise smb.conf would need to be changed
   * to 'valid user = "Domain Admins"'.  --jerry
   *
   * For consistency we also add the "Unix User" SID,
   * so that the complete unix token is represented within
   * the nt token.
   */

  uid_to_unix_users_sid(session_info->unix_token->uid, &tmp_sid);
  status = add_sid_to_array_unique(session_info->security_token, &tmp_sid,
           &session_info->security_token->sids,
           &session_info->security_token->num_sids);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }

  gid_to_unix_groups_sid(session_info->unix_token->gid, &tmp_sid);
  status = add_sid_to_array_unique(session_info->security_token, &tmp_sid,
           &session_info->security_token->sids,
           &session_info->security_token->num_sids);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }

  for (i=0; i < session_info->unix_token->ngroups; i++ ) {
    struct security_token *nt_token = session_info->security_token;

    gid_to_unix_groups_sid(session_info->unix_token->groups[i],
               &tmp_sid);
    status = add_sid_to_array_unique(nt_token->sids,
             &tmp_sid,
             &nt_token->sids,
             &nt_token->num_sids);
    if (!NT_STATUS_IS_OK(status)) {
      TALLOC_FREE(frame);
      return status;
    }
  }

done:
  security_token_debug(DBGC_AUTH, 10, session_info->security_token);
  if (session_info->unix_token != NULL) {
    debug_unix_user_token(DBGC_AUTH, 10,
              session_info->unix_token->uid,
              session_info->unix_token->gid,
              session_info->unix_token->ngroups,
              session_info->unix_token->groups);
  }

  status = log_nt_token(session_info->security_token);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(frame);
    return status;
  }

  session_info->unique_session_token = GUID_random();

  *session_info_out = talloc_move(mem_ctx, &session_info);
  TALLOC_FREE(frame);
  return NT_STATUS_OK;
}

/***************************************************************************
 Make (and fill) a server_info struct from a 'struct passwd' by conversion
 to a struct samu
***************************************************************************/

NTSTATUS make_server_info_pw(TALLOC_CTX *mem_ctx,
           const char *unix_username,
           const struct passwd *pwd,
           struct auth_serversupplied_info **server_info)
{
  NTSTATUS status;
  TALLOC_CTX *tmp_ctx = NULL;
  struct auth_serversupplied_info *result;

  tmp_ctx = talloc_stackframe();
  if (tmp_ctx == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  result = make_server_info(tmp_ctx);
  if (result == NULL) {
    status = NT_STATUS_NO_MEMORY;
    goto done;
  }

  status = passwd_to_SamInfo3(result,
            unix_username,
            pwd,
            &result->info3,
            &result->extra);
  if (!NT_STATUS_IS_OK(status)) {
    goto done;
  }

  result->unix_name = talloc_strdup(result, unix_username);
  if (result->unix_name == NULL) {
    status = NT_STATUS_NO_MEMORY;
    goto done;
  }

  result->utok.uid = pwd->pw_uid;
  result->utok.gid = pwd->pw_gid;

  *server_info = talloc_move(mem_ctx, &result);
  status = NT_STATUS_OK;
done:
  talloc_free(tmp_ctx);

  return status;
}

static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,
        struct netr_SamInfo3 *info3)
{
  const char *guest_account = lp_guest_account();
  struct dom_sid domain_sid;
  struct passwd *pwd;
  const char *tmp;

  pwd = Get_Pwnam_alloc(mem_ctx, guest_account);
  if (pwd == NULL) {
    DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
       "account [%s]!\n", guest_account));
    return NT_STATUS_NO_SUCH_USER;
  }

  /* Set account name */
  tmp = talloc_strdup(mem_ctx, pwd->pw_name);
  if (tmp == NULL) {
    return NT_STATUS_NO_MEMORY;
  }
  init_lsa_String(&info3->base.account_name, tmp);

  /* Set domain name */
  tmp = talloc_strdup(mem_ctx, get_global_sam_name());
  if (tmp == NULL) {
    return NT_STATUS_NO_MEMORY;
  }
  init_lsa_StringLarge(&info3->base.logon_domain, tmp);

  /* Domain sid */
  sid_copy(&domain_sid, get_global_sam_sid());

  info3->base.domain_sid = dom_sid_dup(mem_ctx, &domain_sid);
  if (info3->base.domain_sid == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  /* Guest rid */
  info3->base.rid = DOMAIN_RID_GUEST;

  /* Primary gid */
  info3->base.primary_gid = DOMAIN_RID_GUESTS;

  /* Set as guest */
  info3->base.user_flags = NETLOGON_GUEST;

  TALLOC_FREE(pwd);
  return NT_STATUS_OK;
}

/***************************************************************************
 Make (and fill) a user_info struct for a guest login.
 This *must* succeed for smbd to start. If there is no mapping entry for
 the guest gid, then create one.

 The resulting structure is a 'session_info' because
 create_local_token() has already been called on it.  This is quite
 nasty, as the auth subsystem isn't expect this, but the behavior is
 left as-is for now.
***************************************************************************/

static NTSTATUS make_new_session_info_guest(TALLOC_CTX *mem_ctx,
    struct auth_session_info **_session_info,
    struct auth_serversupplied_info **_server_info)
{
  struct auth_session_info *session_info = NULL;
  struct auth_serversupplied_info *server_info = NULL;
  const char *guest_account = lp_guest_account();
  const char *domain = lp_netbios_name();
  struct netr_SamInfo3 info3 = {};
  TALLOC_CTX *tmp_ctx = talloc_stackframe();
  NTSTATUS status;

  status = get_guest_info3(tmp_ctx, &info3);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("get_guest_info3 failed with %s\n",
        nt_errstr(status)));
    goto done;
  }

  status = make_server_info_info3(tmp_ctx,
          guest_account,
          domain,
          &server_info,
          &info3);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("make_server_info_info3 failed with %s\n",
        nt_errstr(status)));
    goto done;
  }

  server_info->guest = true;

  /* This should not be done here (we should produce a server
   * info, and later construct a session info from it), but for
   * now this does not change the previous behavior */
  status = create_local_token(tmp_ctx, server_info, NULL,
            server_info->info3->base.account_name.string,
            &session_info);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("create_local_token failed: %s\n",
        nt_errstr(status)));
    goto done;
  }

  /*
   * It's ugly, but for now it's
   * needed to force Builtin_Guests
   * here, because memberships of
   * Builtin_Guests might be incomplete.
   */
  status = add_sid_to_array_unique(session_info->security_token,
           &global_sid_Builtin_Guests,
           &session_info->security_token->sids,
           &session_info->security_token->num_sids);
  if (!NT_STATUS_IS_OK(status)) {
    DBG_ERR("Failed to force Builtin_Guests to nt token\n");
    goto done;
  }

  /* annoying, but the Guest really does have a session key, and it is
     all zeros! */
  session_info->session_key = data_blob_talloc_zero(session_info, 16);

  *_session_info = talloc_move(mem_ctx, &session_info);
  *_server_info = talloc_move(mem_ctx, &server_info);

  status = NT_STATUS_OK;
done:
  TALLOC_FREE(tmp_ctx);
  return status;
}

/***************************************************************************
 Make (and fill) a auth_session_info struct for a system user login.
 This *must* succeed for smbd to start.
***************************************************************************/

static NTSTATUS make_new_session_info_system(TALLOC_CTX *mem_ctx,
              struct auth_session_info **session_info)
{
  TALLOC_CTX *frame = talloc_stackframe();
  struct auth_user_info_dc *user_info_dc = NULL;
  uid_t uid = -1;
  gid_t gid = -1;
  uint32_t hint_flags = 0;
  uint32_t session_info_flags = 0;
  NTSTATUS status;

  status = auth_system_user_info_dc(frame, lp_netbios_name(),
            &user_info_dc);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("auth_system_user_info_dc failed: %s\n",
        nt_errstr(status)));
    goto done;
  }

  /*
   * Just get the initial uid/gid
   * and don't expand the unix groups.
   */
  uid = sec_initial_uid();
  gid = sec_initial_gid();
  hint_flags |= AUTH3_UNIX_HINT_DONT_EXPAND_UNIX_GROUPS;

  /*
   * Also avoid sid mapping to gids,
   * as well as adding the unix_token uid/gids as
   * S-1-22-X-Y SIDs to the nt token.
   */
  hint_flags |= AUTH3_UNIX_HINT_DONT_TRANSLATE_FROM_SIDS;
  hint_flags |= AUTH3_UNIX_HINT_DONT_TRANSLATE_TO_SIDS;

  /*
   * The unix name will be "NT AUTHORITY+SYSTEM",
   * where '+' is the "winbind separator" character.
   */
  hint_flags |= AUTH3_UNIX_HINT_QUALIFIED_NAME;
  status = auth3_user_info_dc_add_hints(user_info_dc,
                uid,
                gid,
                hint_flags);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("auth3_user_info_dc_add_hints failed: %s\n",
        nt_errstr(status)));
    goto done;
  }

  session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
  session_info_flags |= AUTH_SESSION_INFO_UNIX_TOKEN;
  status = auth3_session_info_create(mem_ctx, user_info_dc,
             user_info_dc->info->account_name,
             session_info_flags,
             session_info);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("auth3_session_info_create failed: %s\n",
        nt_errstr(status)));
    goto done;
  }

done:
  TALLOC_FREE(frame);
  return status;
}

static NTSTATUS make_new_session_info_anonymous(TALLOC_CTX *mem_ctx,
          struct auth_session_info **session_info)
{
  TALLOC_CTX *frame = talloc_stackframe();
  const char *guest_account = lp_guest_account();
  struct auth_user_info_dc *user_info_dc = NULL;
  struct passwd *pwd = NULL;
  uint32_t hint_flags = 0;
  uint32_t session_info_flags = 0;
  NTSTATUS status;

  /*
   * We use the guest account for the unix token
   * while we use a true anonymous nt token.
   *
   * It's very important to have a separate
   * nt token for anonymous.
   */

  pwd = Get_Pwnam_alloc(frame, guest_account);
  if (pwd == NULL) {
    DBG_ERR("Unable to locate guest account [%s]!\n",
      guest_account);
    status = NT_STATUS_NO_SUCH_USER;
    goto done;
  }

  status = auth_anonymous_user_info_dc(frame, lp_netbios_name(),
               &user_info_dc);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("auth_anonymous_user_info_dc failed: %s\n",
        nt_errstr(status)));
    goto done;
  }

  /*
   * Note we don't pass AUTH3_UNIX_HINT_QUALIFIED_NAME
   * nor AUTH3_UNIX_HINT_ISOLATED_NAME here
   * as we want the unix name be found by getpwuid_alloc().
   */

  status = auth3_user_info_dc_add_hints(user_info_dc,
                pwd->pw_uid,
                pwd->pw_gid,
                hint_flags);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("auth3_user_info_dc_add_hints failed: %s\n",
        nt_errstr(status)));
    goto done;
  }

  /*
   * In future we may want to remove
   * AUTH_SESSION_INFO_DEFAULT_GROUPS.
   *
   * Similar to Windows with EveryoneIncludesAnonymous
   * and RestrictAnonymous.
   *
   * We may introduce AUTH_SESSION_INFO_ANON_WORLD...
   *
   * But for this is required to keep the existing tests
   * working.
   */
  session_info_flags |= AUTH_SESSION_INFO_DEFAULT_GROUPS;
  session_info_flags |= AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
  session_info_flags |= AUTH_SESSION_INFO_UNIX_TOKEN;
  status = auth3_session_info_create(mem_ctx, user_info_dc,
             "",
             session_info_flags,
             session_info);
  if (!NT_STATUS_IS_OK(status)) {
    DEBUG(0, ("auth3_session_info_create failed: %s\n",
        nt_errstr(status)));
    goto done;
  }

done:
  TALLOC_FREE(frame);
  return status;
}

/****************************************************************************
  Fake a auth_session_info just from a username (as a
  session_info structure, with create_local_token() already called on
  it.
****************************************************************************/

NTSTATUS make_session_info_from_username(TALLOC_CTX *mem_ctx,
           const char *username,
           bool is_guest,
           struct auth_session_info **session_info)
{
  struct passwd *pwd;
  NTSTATUS status;
  struct auth_serversupplied_info *result;
  TALLOC_CTX *tmp_ctx;

  tmp_ctx = talloc_stackframe();
  if (tmp_ctx == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  pwd = Get_Pwnam_alloc(tmp_ctx, username);
  if (pwd == NULL) {
    status = NT_STATUS_NO_SUCH_USER;
    goto done;
  }

  status = make_server_info_pw(tmp_ctx, pwd->pw_name, pwd, &result);
  if (!NT_STATUS_IS_OK(status)) {
    goto done;
  }

  result->nss_token = true;
  result->guest = is_guest;

  /* Now turn the server_info into a session_info with the full token etc */
  status = create_local_token(mem_ctx,
            result,
            NULL,
            pwd->pw_name,
            session_info);

done:
  talloc_free(tmp_ctx);

  return status;
}

/* This function MUST only used to create the cached server_info for
 * guest.
 *
 * This is a lossy conversion.  Variables known to be lost so far
 * include:
 *
 * - nss_token (not needed because the only read doesn't happen
 * for the GUEST user, as this routine populates ->security_token
 *
 * - extra (not needed because the guest account must have valid RIDs per the output of get_guest_info3())
 *
 * - The 'server_info' parameter allows the missing 'info3' to be copied across.
 */
static struct auth_serversupplied_info *copy_session_info_serverinfo_guest(TALLOC_CTX *mem_ctx,
                     const struct auth_session_info *src,
                     struct auth_serversupplied_info *server_info)
{
  struct auth_serversupplied_info *dst;
  NTSTATUS status;

  dst = make_server_info(mem_ctx);
  if (dst == NULL) {
    return NULL;
  }

  /* This element must be provided to convert back to an auth_serversupplied_info */
  SMB_ASSERT(src->unix_info);

  dst->guest = true;

  /* This element must be provided to convert back to an
   * auth_serversupplied_info.  This needs to be from the
   * auth_session_info because the group values in particular
   * may change during create_local_token() processing */
  SMB_ASSERT(src->unix_token);
  dst->utok.uid = src->unix_token->uid;
  dst->utok.gid = src->unix_token->gid;
  dst->utok.ngroups = src->unix_token->ngroups;
  if (src->unix_token->ngroups != 0) {
    dst->utok.groups = (gid_t *)talloc_memdup(
      dst, src->unix_token->groups,
      sizeof(gid_t)*dst->utok.ngroups);
  } else {
    dst->utok.groups = NULL;
  }

  /* We must have a security_token as otherwise the lossy
   * conversion without nss_token would cause create_local_token
   * to take the wrong path */
  SMB_ASSERT(src->security_token);

  dst->session_key = data_blob_talloc( dst, src->session_key.data,
            src->session_key.length);

  /* This is OK because this functions is only used for the
   * GUEST account, which has all-zero keys for both values */
  dst->lm_session_key = data_blob_talloc(dst, src->session_key.data,
            src->session_key.length);

  status = copy_netr_SamInfo3(dst,
            server_info->info3,
            &dst->info3);
  if (!NT_STATUS_IS_OK(status)) {
    TALLOC_FREE(dst);
    return NULL;
  }

  dst->unix_name = talloc_strdup(dst, src->unix_info->unix_name);
  if (!dst->unix_name) {
    TALLOC_FREE(dst);
    return NULL;
  }

  dst->cached_session_info = src;
  return dst;
}

static struct auth_session_info *guest_info = NULL;
static struct auth_session_info *anonymous_info = NULL;

static struct auth_serversupplied_info *guest_server_info = NULL;

bool init_guest_session_info(TALLOC_CTX *mem_ctx)
{
  NTSTATUS status;

  if (guest_info != NULL)
    return true;

  status = make_new_session_info_guest(mem_ctx,
               &guest_info,
               &guest_server_info);
  if (!NT_STATUS_IS_OK(status)) {
    return false;
  }

  status = make_new_session_info_anonymous(mem_ctx,
             &anonymous_info);
  if (!NT_STATUS_IS_OK(status)) {
    return false;
  }

  return true;
}

bool reinit_guest_session_info(TALLOC_CTX *mem_ctx)
{
  TALLOC_FREE(guest_info);
  TALLOC_FREE(guest_server_info);
  TALLOC_FREE(anonymous_info);

  DBG_DEBUG("Reinitialing guest info\n");

  return init_guest_session_info(mem_ctx);
}

NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
        struct auth_serversupplied_info **server_info)
{
  /* This is trickier than it would appear to need to be because
   * we are trying to avoid certain costly operations when the
   * structure is converted to a 'auth_session_info' again in
   * create_local_token() */
  *server_info = copy_session_info_serverinfo_guest(mem_ctx, guest_info, guest_server_info);
  return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
}

NTSTATUS make_session_info_guest(TALLOC_CTX *mem_ctx,
        struct auth_session_info **session_info)
{
  *session_info = copy_session_info(mem_ctx, guest_info);
  return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
}

NTSTATUS make_server_info_anonymous(TALLOC_CTX *mem_ctx,
            struct auth_serversupplied_info **server_info)
{
  if (anonymous_info == NULL) {
    return NT_STATUS_UNSUCCESSFUL;
  }

  /*
   * This is trickier than it would appear to need to be because
   * we are trying to avoid certain costly operations when the
   * structure is converted to a 'auth_session_info' again in
   * create_local_token()
   *
   * We use a guest server_info, but with the anonymous session info,
   * which means create_local_token() will return a copy
   * of the anonymous token.
   *
   * The server info is just used as legacy in order to
   * keep existing code working. Maybe some debug messages
   * will still refer to guest instead of anonymous.
   */
  *server_info = copy_session_info_serverinfo_guest(mem_ctx, anonymous_info,
                guest_server_info);
  if (*server_info == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  return NT_STATUS_OK;
}

NTSTATUS make_session_info_anonymous(TALLOC_CTX *mem_ctx,
             struct auth_session_info **session_info)
{
  if (anonymous_info == NULL) {
    return NT_STATUS_UNSUCCESSFUL;
  }

  *session_info = copy_session_info(mem_ctx, anonymous_info);
  if (*session_info == NULL) {
    return NT_STATUS_NO_MEMORY;
  }

  return NT_STATUS_OK;
}

static struct auth_session_info *system_info = NULL;

NTSTATUS init_system_session_info(TALLOC_CTX *mem_ctx)
{
  if (system_info != NULL)
    return NT_STATUS_OK;

  return make_new_session_info_system(mem_ctx, &system_info);
}

NTSTATUS make_session_info_system(TALLOC_CTX *mem_ctx,
        struct auth_session_info **session_info)
{
  if (system_info == NULL) return NT_STATUS_UNSUCCESSFUL;
  *session_info = copy_session_info(mem_ctx, system_info);
  return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
}

const struct auth_session_info *get_session_info_system(void)
{
    return system_info;
}

/***************************************************************************
 Purely internal function for make_server_info_info3
***************************************************************************/

static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
            const char *username,
            const struct dom_sid *sid,
            char **found_username,
            struct passwd **pwd,
            bool *username_was_mapped)
{
  char *orig_dom_user = NULL;
  char *dom_user = NULL;
  char *lower_username = NULL;
  char *real_username = NULL;
  struct passwd *passwd;

  lower_username = strlower_talloc(mem_ctx, username);
  if (!lower_username) {
    return NT_STATUS_NO_MEMORY;
  }

  orig_dom_user = talloc_asprintf(mem_ctx,
        "%s%c%s",
        domain,
        *lp_winbind_separator(),
        lower_username);
  if (!orig_dom_user) {
    return NT_STATUS_NO_MEMORY;
  }

  /* Get the passwd struct.  Try to create the account if necessary. */

  *username_was_mapped = map_username(mem_ctx, orig_dom_user, &dom_user);
  if (!dom_user) {
    return NT_STATUS_NO_MEMORY;
  }

  passwd = smb_getpwnam(mem_ctx, dom_user, &real_username, false);
  if (!passwd && !*username_was_mapped) {
    struct dom_sid_buf buf;
    uid_t uid;
    bool ok;

    DBG_DEBUG("Failed to find authenticated user %s via "
        "getpwnam(), fallback to sid_to_uid(%s).\n",
        dom_user, dom_sid_str_buf(sid, &buf));

    ok = sid_to_uid(sid, &uid);
    if (!ok) {
      DBG_ERR("Failed to convert SID %s to a UID (dom_user[%s])\n",
        dom_sid_str_buf(sid, &buf), dom_user);
      return NT_STATUS_NO_SUCH_USER;
    }
    passwd = getpwuid_alloc(mem_ctx, uid);
    if (!passwd) {
      DBG_ERR("Failed to find local account with UID %lld for SID %s (dom_user[%s])\n",
        (long long)uid,
        dom_sid_str_buf(sid, &buf),
        dom_user);
      return NT_STATUS_NO_SUCH_USER;
    }
    real_username = talloc_strdup(mem_ctx, passwd->pw_name);
  }
  if (!passwd) {
    DEBUG(3, ("Failed to find authenticated user %s via "
        "getpwnam(), denying access.\n", dom_user));
    return NT_STATUS_NO_SUCH_USER;
  }

  if (!real_username) {
    return NT_STATUS_NO_MEMORY;
  }

  *pwd = passwd;

  /* This is pointless -- there is no support for differing
     unix and windows names.  Make sure to always store the
     one we actually looked up and succeeded. Have I mentioned
     why I hate the 'winbind use default domain' parameter?
                                   --jerry              */

  *found_username = talloc_strdup( mem_ctx, real_username );

  return NT_STATUS_OK;
}

/****************************************************************************
 Wrapper to allow the getpwnam() call to strip the domain name and
 try again in case a local UNIX user is already there.  Also run through
 the username if we fallback to the username only.
 ****************************************************************************/

struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, const char *domuser,
           char **p_save_username, bool create )
{
  struct passwd *pw = NULL;
  char *p = NULL;
  const char *username = NULL;

  /* we only save a copy of the username it has been mangled
     by winbindd use default domain */
  *p_save_username = NULL;

  /* don't call map_username() here since it has to be done higher
     up the stack so we don't call it multiple times */

  username = talloc_strdup(mem_ctx, domuser);
  if (!username) {
    return NULL;
  }

  p = strchr_m( username, *lp_winbind_separator() );

  /* code for a DOMAIN\user string */

  if ( p ) {
    const char *domain = NULL;

    /* split the domain and username into 2 strings */
    *p = '\0';
    domain = username;
    p++;
    username = p;

    if (strequal(domain, get_global_sam_name())) {
      /*
       * This typically don't happen
       * as check_sam_Security()
       * don't call make_server_info_info3()
       * and thus check_account().
       *
       * But we better keep this.
       */
      goto username_only;
    }

    pw = Get_Pwnam_alloc( mem_ctx, domuser );
    if (pw == NULL) {
      return NULL;
    }
    /* make sure we get the case of the username correct */
    /* work around 'winbind use default domain = yes' */

    if ( lp_winbind_use_default_domain() &&
         !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
      *p_save_username = talloc_asprintf(mem_ctx,
              "%s%c%s",
              domain,
              *lp_winbind_separator(),
              pw->pw_name);
      if (!*p_save_username) {
        TALLOC_FREE(pw);
        return NULL;
      }
    } else {
      *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
    }

    /* whew -- done! */
    return pw;

  }

  /* just lookup a plain username */
username_only:
  pw = Get_Pwnam_alloc(mem_ctx, username);

  /* Create local user if requested but only if winbindd
     is not running.  We need to protect against cases
     where winbindd is failing and then prematurely
     creating users in /etc/passwd */

  if ( !pw && create && !winbind_ping() ) {
    /* Don't add a machine account. */
    if (username[strlen(username)-1] == '$')
      return NULL;

    _smb_create_user(NULL, username, NULL);
    pw = Get_Pwnam_alloc(mem_ctx, username);
  }

  /* one last check for a valid passwd struct */

  if (pw) {
    *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
  }
  return pw;
}

/***************************************************************************
 Make a server_info struct from the info3 returned by a domain logon
***************************************************************************/

NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
        const char *sent_nt_username,
        const char *domain,
        struct auth_serversupplied_info **server_info,
        const struct netr_SamInfo3 *info3)
{
  NTSTATUS nt_status;
  char *found_username = NULL;
  const char *nt_domain;
  const char *nt_username;
  struct dom_sid user_sid;
  struct dom_sid group_sid;
  bool username_was_mapped;
  struct passwd *pwd;
  struct auth_serversupplied_info *result;
  struct dom_sid sid;
  TALLOC_CTX *tmp_ctx = talloc_stackframe();

  /*
     Here is where we should check the list of
     trusted domains, and verify that the SID
     matches.
  */

  if (!sid_compose(&user_sid, info3->base.domain_sid, info3->base.rid)) {
    nt_status = NT_STATUS_INVALID_PARAMETER;
    goto out;
  }

  if (!sid_compose(&group_sid, info3->base.domain_sid,
       info3->base.primary_gid)) {
    nt_status = NT_STATUS_INVALID_PARAMETER;
    goto out;
  }

  nt_username = talloc_strdup(tmp_ctx, info3->base.account_name.string);
  if (!nt_username) {
    /* If the server didn't give us one, just use the one we sent
     * them */
    nt_username = sent_nt_username;
  }

  nt_domain = talloc_strdup(mem_ctx, info3->base.logon_domain.string);
  if (!nt_domain) {
    /* If the server didn't give us one, just use the one we sent
     * them */
    nt_domain = domain;
  }

  /* If getpwnam() fails try the add user script (2.2.x behavior).

     We use the _unmapped_ username here in an attempt to provide
     consistent username mapping behavior between kerberos and NTLM[SSP]
     authentication in domain mode security.  I.E. Username mapping
     should be applied to the fully qualified username
     (e.g. DOMAIN\user) and not just the login name.  Yes this means we
     called map_username() unnecessarily in make_user_info_map() but
     that is how the current code is designed.  Making the change here
     is the least disruptive place.  -- jerry */

  /* this call will try to create the user if necessary */

  sid_copy(&sid, info3->base.domain_sid);
  sid_append_rid(&sid, info3->base.rid);

  nt_status = check_account(tmp_ctx,
          nt_domain,
          nt_username,
          &sid,
          &found_username,
          &pwd,
          &username_was_mapped);

  if (!NT_STATUS_IS_OK(nt_status)) {
    /* Handle 'map to guest = Bad Uid */
    if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER) &&
        (lp_security() == SEC_ADS || lp_security() == SEC_DOMAIN) &&
        lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID) {
      DBG_NOTICE("Try to map %s to guest account\n",
           nt_username);
      nt_status = make_server_info_guest(tmp_ctx, &result);
      if (NT_STATUS_IS_OK(nt_status)) {
        *server_info = talloc_move(mem_ctx, &result);
      }
    }
    goto out;
  } else if ((lp_security() == SEC_ADS || lp_security() == SEC_DOMAIN) &&
       !is_myname(domain) && pwd->pw_uid < lp_min_domain_uid()) {
    /*
     * !is_myname(domain) because when smbd starts tries to setup
     * the guest user info, calling this function with nobody
     * username. Nobody is usually uid 65535 but it can be changed
     * to a regular user with 'guest account' parameter
     */
    nt_status = NT_STATUS_INVALID_TOKEN;
    DBG_NOTICE("Username '%s%s%s' is invalid on this system, "
         "it does not meet 'min domain uid' "
         "restriction (%u < %u): %s\n",
         nt_domain, lp_winbind_separator(), nt_username,
         pwd->pw_uid, lp_min_domain_uid(),
         nt_errstr(nt_status));
    goto out;
  }

  result = make_server_info(tmp_ctx);
  if (result == NULL) {
    DEBUG(4, ("make_server_info failed!\n"));
    nt_status = NT_STATUS_NO_MEMORY;
    goto out;
  }

  result->unix_name = talloc_strdup(result, found_username);

  /* copy in the info3 */
  nt_status = copy_netr_SamInfo3(result,
               info3,
               &result->info3);
  if (!NT_STATUS_IS_OK(nt_status)) {
    goto out;
  }

  /* Fill in the unix info we found on the way */

  result->utok.uid = pwd->pw_uid;
  result->utok.gid = pwd->pw_gid;

  /* ensure we are never given NULL session keys */

  if (all_zero(info3->base.key.key, sizeof(info3->base.key.key))) {
    result->session_key = data_blob_null;
  } else {
    result->session_key = data_blob_talloc_s(
      result,
      info3->base.key.key,
      sizeof(info3->base.key.key));
  }

  if (all_zero(info3->base.LMSessKey.key,
         sizeof(info3->base.LMSessKey.key))) {
    result->lm_session_key = data_blob_null;
  } else {
    result->lm_session_key = data_blob_talloc_s(
      result,
      info3->base.LMSessKey.key,
      sizeof(info3->base.LMSessKey.key));
  }

  result->nss_token |= username_was_mapped;

  result->guest = (info3->base.user_flags & NETLOGON_GUEST);

  *server_info = talloc_move(mem_ctx, &result);

  nt_status = NT_STATUS_OK;
out:
  talloc_free(tmp_ctx);

  return nt_status;
}

/*****************************************************************************
 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
******************************************************************************/

NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
            const char *sent_nt_username,
            const char *domain,
            const struct wbcAuthUserInfo *info,
            struct auth_serversupplied_info **server_info)
{
  struct netr_SamInfo3 info3;
  struct netr_SamInfo6 *info6;

  info6 = wbcAuthUserInfo_to_netr_SamInfo6(mem_ctx, info);
  if (!info6) {
    return NT_STATUS_NO_MEMORY;
  }

  info3.base = info6->base;
  info3.sidcount = info6->sidcount;
  info3.sids = info6->sids;

  return make_server_info_info3(mem_ctx,
              sent_nt_username, domain,
              server_info, &info3);
}

/**
 * Verify whether or not given domain is trusted.
 *
 * This should only be used on a DC.
 *
 * @param domain_name name of the domain to be verified
 * @return true if domain is one of the trusted ones or
 *         false if otherwise
 **/

bool is_trusted_domain(const char* dom_name)
{
  bool ret;

  if (!IS_DC) {
    return false;
  }

  if (dom_name == NULL || dom_name[0] == '\0') {
    return false;
  }

  if (strequal(dom_name, get_global_sam_name())) {
    return false;
  }

  become_root();
  DEBUG (5,("is_trusted_domain: Checking for domain trust with "
      "[%s]\n", dom_name ));
  ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
  unbecome_root();

  return ret;
}



/*
  on a logon error possibly map the error to success if "map to guest"
  is set appropriately
*/
NTSTATUS do_map_to_guest_server_info(TALLOC_CTX *mem_ctx,
             NTSTATUS status,
             const char *user,
             const char *domain,
             struct auth_serversupplied_info **server_info)
{
  user = user ? user : "";
  domain = domain ? domain : "";

  if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
    if ((lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_USER) ||
        (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD)) {
      DEBUG(3,("No such user %s [%s] - using guest account\n",
         user, domain));
      return make_server_info_guest(mem_ctx, server_info);
    }
  } else if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
    if (lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_PASSWORD) {
      DEBUG(3,("Registered username %s for guest access\n",
        user));
      return make_server_info_guest(mem_ctx, server_info);
    }
  }

  return status;
}

/*
  Extract session key from a session info and return it in a blob
  if intent is KEY_USE_16BYTES, truncate it to 16 bytes

  See sections 3.2.4.15 and 3.3.4.2 of MS-SMB
  Also see https://lists.samba.org/archive/cifs-protocol/2012-January/002265.html for details

  Note that returned session_key is referencing the original key, it is supposed to be
  short-lived. If original session_info->session_key is gone, the reference will be broken.
*/
NTSTATUS session_extract_session_key(const struct auth_session_info *session_info, DATA_BLOB *session_key, enum session_key_use_intent intent)
{

  if (session_key == NULL || session_info == NULL) {
    return NT_STATUS_INVALID_PARAMETER;
  }

  if (session_info->session_key.length == 0) {
    return NT_STATUS_NO_USER_SESSION_KEY;
  }

  *session_key = session_info->session_key;
  if (intent == KEY_USE_16BYTES) {
    session_key->length = MIN(session_info->session_key.length, 16);
  }
  return NT_STATUS_OK;
}

Coverage Report

Created: 2026-01-16 06:47