source: branches/samba-3.2.x/source/smbd/password.c@ 247

Last change on this file since 247 was 232, checked in by Herwig Bauernfeind, 17 years ago

Update 3.2 branch to 3.2.8
File size: 22.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Jeremy Allison 2007.
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22
23/* users from session setup */
24static char *session_userlist = NULL;
25/* workgroup from session setup. */
26static char *session_workgroup = NULL;
27
28/* this holds info on user ids that are already validated for this VC */
29static user_struct *validated_users;
30static uint16_t next_vuid = VUID_OFFSET;
31static int num_validated_vuids;
32
33enum server_allocated_state { SERVER_ALLOCATED_REQUIRED_YES,
34 SERVER_ALLOCATED_REQUIRED_NO,
35 SERVER_ALLOCATED_REQUIRED_ANY};
36
37static user_struct *get_valid_user_struct_internal(uint16 vuid,
38 enum server_allocated_state server_allocated)
39{
40 user_struct *usp;
41 int count=0;
42
43 if (vuid == UID_FIELD_INVALID)
44 return NULL;
45
46 for (usp=validated_users;usp;usp=usp->next,count++) {
47 if (vuid == usp->vuid) {
48 switch (server_allocated) {
49 case SERVER_ALLOCATED_REQUIRED_YES:
50 if (usp->server_info == NULL) {
51 continue;
52 }
53 break;
54 case SERVER_ALLOCATED_REQUIRED_NO:
55 if (usp->server_info != NULL) {
56 continue;
57 }
58 case SERVER_ALLOCATED_REQUIRED_ANY:
59 break;
60 }
61 if (count > 10) {
62 DLIST_PROMOTE(validated_users, usp);
63 }
64 return usp;
65 }
66 }
67
68 return NULL;
69}
70
71/****************************************************************************
72 Check if a uid has been validated, and return an pointer to the user_struct
73 if it has. NULL if not. vuid is biased by an offset. This allows us to
74 tell random client vuid's (normally zero) from valid vuids.
75****************************************************************************/
76
77user_struct *get_valid_user_struct(uint16 vuid)
78{
79 return get_valid_user_struct_internal(vuid,
80 SERVER_ALLOCATED_REQUIRED_YES);
81}
82
83bool is_partial_auth_vuid(uint16 vuid)
84{
85 if (vuid == UID_FIELD_INVALID) {
86 return False;
87 }
88 return get_valid_user_struct_internal(vuid,
89 SERVER_ALLOCATED_REQUIRED_NO) ? True : False;
90}
91
92/****************************************************************************
93 Get the user struct of a partial NTLMSSP login
94****************************************************************************/
95
96user_struct *get_partial_auth_user_struct(uint16 vuid)
97{
98 return get_valid_user_struct_internal(vuid,
99 SERVER_ALLOCATED_REQUIRED_NO);
100}
101
102/****************************************************************************
103 Invalidate a uid.
104****************************************************************************/
105
106void invalidate_vuid(uint16 vuid)
107{
108 user_struct *vuser = NULL;
109
110 if (vuid == UID_FIELD_INVALID) {
111 return;
112 }
113
114 vuser = get_valid_user_struct_internal(vuid,
115 SERVER_ALLOCATED_REQUIRED_ANY);
116 if (vuser == NULL) {
117 return;
118 }
119
120 session_yield(vuser);
121
122 data_blob_free(&vuser->session_key);
123
124 if (vuser->auth_ntlmssp_state) {
125 auth_ntlmssp_end(&vuser->auth_ntlmssp_state);
126 }
127
128 DLIST_REMOVE(validated_users, vuser);
129
130 /* clear the vuid from the 'cache' on each connection, and
131 from the vuid 'owner' of connections */
132 conn_clear_vuid_cache(vuid);
133
134 TALLOC_FREE(vuser);
135 num_validated_vuids--;
136}
137
138/****************************************************************************
139 Invalidate all vuid entries for this process.
140****************************************************************************/
141
142void invalidate_all_vuids(void)
143{
144 user_struct *usp, *next=NULL;
145
146 for (usp=validated_users;usp;usp=next) {
147 next = usp->next;
148 invalidate_vuid(usp->vuid);
149 }
150}
151
152static void increment_next_vuid(uint16_t *vuid)
153{
154 *vuid += 1;
155
156 /* Check for vuid wrap. */
157 if (*vuid == UID_FIELD_INVALID) {
158 *vuid = VUID_OFFSET;
159 }
160}
161
162/****************************************************
163 Create a new partial auth user struct.
164*****************************************************/
165
166int register_initial_vuid(void)
167{
168 user_struct *vuser;
169
170 /* Paranoia check. */
171 if(lp_security() == SEC_SHARE) {
172 smb_panic("register_initial_vuid: "
173 "Tried to register uid in security=share");
174 }
175
176 /* Limit allowed vuids to 16bits - VUID_OFFSET. */
177 if (num_validated_vuids >= 0xFFFF-VUID_OFFSET) {
178 return UID_FIELD_INVALID;
179 }
180
181 if((vuser = talloc_zero(NULL, user_struct)) == NULL) {
182 DEBUG(0,("register_initial_vuid: "
183 "Failed to talloc users struct!\n"));
184 return UID_FIELD_INVALID;
185 }
186
187 /* Allocate a free vuid. Yes this is a linear search... */
188 while( get_valid_user_struct_internal(next_vuid,
189 SERVER_ALLOCATED_REQUIRED_ANY) != NULL ) {
190 increment_next_vuid(&next_vuid);
191 }
192
193 DEBUG(10,("register_initial_vuid: allocated vuid = %u\n",
194 (unsigned int)next_vuid ));
195
196 vuser->vuid = next_vuid;
197
198 /*
199 * This happens in an unfinished NTLMSSP session setup. We
200 * need to allocate a vuid between the first and second calls
201 * to NTLMSSP.
202 */
203 increment_next_vuid(&next_vuid);
204 num_validated_vuids++;
205
206 DLIST_ADD(validated_users, vuser);
207 return vuser->vuid;
208}
209
210/**
211 * register that a valid login has been performed, establish 'session'.
212 * @param server_info The token returned from the authentication process.
213 * (now 'owned' by register_existing_vuid)
214 *
215 * @param session_key The User session key for the login session (now also
216 * 'owned' by register_existing_vuid)
217 *
218 * @param respose_blob The NT challenge-response, if available. (May be
219 * freed after this call)
220 *
221 * @param smb_name The untranslated name of the user
222 *
223 * @return Newly allocated vuid, biased by an offset. (This allows us to
224 * tell random client vuid's (normally zero) from valid vuids.)
225 *
226 */
227
228int register_existing_vuid(uint16 vuid,
229 auth_serversupplied_info *server_info,
230 DATA_BLOB session_key,
231 DATA_BLOB response_blob,
232 const char *smb_name)
233{
234 user_struct *vuser = get_partial_auth_user_struct(vuid);
235 if (!vuser) {
236 goto fail;
237 }
238
239 /* Use this to keep tabs on all our info from the authentication */
240 vuser->server_info = server_info;
241
242 /* Ensure that the server_info will disappear with
243 * the vuser it is now attached to */
244
245 talloc_steal(vuser, vuser->server_info);
246
247 /* the next functions should be done by a SID mapping system (SMS) as
248 * the new real sam db won't have reference to unix uids or gids
249 */
250
251 vuser->uid = server_info->uid;
252 vuser->gid = server_info->gid;
253
254 vuser->n_groups = server_info->n_groups;
255 if (vuser->n_groups) {
256 if (!(vuser->groups = (gid_t *)talloc_memdup(vuser,
257 server_info->groups,
258 sizeof(gid_t)*vuser->n_groups))) {
259 DEBUG(0,("register_existing_vuid: "
260 "failed to talloc_memdup vuser->groups\n"));
261 goto fail;
262 }
263 }
264
265 vuser->guest = server_info->guest;
266 fstrcpy(vuser->user.unix_name, server_info->unix_name);
267
268 /* This is a potentially untrusted username */
269 alpha_strcpy(vuser->user.smb_name, smb_name, ". _-$",
270 sizeof(vuser->user.smb_name));
271
272 fstrcpy(vuser->user.domain, pdb_get_domain(server_info->sam_account));
273 fstrcpy(vuser->user.full_name,
274 pdb_get_fullname(server_info->sam_account));
275
276 {
277 /* Keep the homedir handy */
278 const char *homedir =
279 pdb_get_homedir(server_info->sam_account);
280 const char *logon_script =
281 pdb_get_logon_script(server_info->sam_account);
282
283 if (!IS_SAM_DEFAULT(server_info->sam_account,
284 PDB_UNIXHOMEDIR)) {
285 const char *unix_homedir =
286 pdb_get_unix_homedir(server_info->sam_account);
287 if (unix_homedir) {
288 vuser->unix_homedir = unix_homedir;
289 }
290 } else {
291 struct passwd *passwd =
292 getpwnam_alloc(vuser, vuser->user.unix_name);
293 if (passwd) {
294 vuser->unix_homedir = passwd->pw_dir;
295 /* Ensure that the unix_homedir now
296 * belongs to vuser, so it goes away
297 * with it, not with passwd below: */
298 talloc_steal(vuser, vuser->unix_homedir);
299 TALLOC_FREE(passwd);
300 }
301 }
302
303 if (homedir) {
304 vuser->homedir = homedir;
305 }
306 if (logon_script) {
307 vuser->logon_script = logon_script;
308 }
309 }
310 vuser->session_key = session_key;
311
312 DEBUG(10,("register_existing_vuid: (%u,%u) %s %s %s guest=%d\n",
313 (unsigned int)vuser->uid,
314 (unsigned int)vuser->gid,
315 vuser->user.unix_name, vuser->user.smb_name,
316 vuser->user.domain, vuser->guest ));
317
318 DEBUG(3, ("register_existing_vuid: User name: %s\t"
319 "Real name: %s\n", vuser->user.unix_name,
320 vuser->user.full_name));
321
322 if (server_info->ptok) {
323 vuser->nt_user_token = dup_nt_token(vuser, server_info->ptok);
324 } else {
325 DEBUG(1, ("register_existing_vuid: server_info does not "
326 "contain a user_token - cannot continue\n"));
327 goto fail;
328 }
329
330 DEBUG(3,("register_existing_vuid: UNIX uid %d is UNIX user %s, "
331 "and will be vuid %u\n",
332 (int)vuser->uid,vuser->user.unix_name, vuser->vuid));
333
334 if (!session_claim(vuser)) {
335 DEBUG(1, ("register_existing_vuid: Failed to claim session "
336 "for vuid=%d\n",
337 vuser->vuid));
338 goto fail;
339 }
340
341 /* Register a home dir service for this user if
342 (a) This is not a guest connection,
343 (b) we have a home directory defined
344 (c) there s not an existing static share by that name
345 If a share exists by this name (autoloaded or not) reuse it . */
346
347 vuser->homes_snum = -1;
348 if ( (!vuser->guest) && vuser->unix_homedir && *(vuser->unix_homedir)) {
349 int servicenumber = lp_servicenumber(vuser->user.unix_name);
350 if ( servicenumber == -1 ) {
351 DEBUG(3, ("Adding homes service for user '%s' using "
352 "home directory: '%s'\n",
353 vuser->user.unix_name, vuser->unix_homedir));
354 vuser->homes_snum =
355 add_home_service(vuser->user.unix_name,
356 vuser->user.unix_name,
357 vuser->unix_homedir);
358 } else {
359 DEBUG(3, ("Using static (or previously created) "
360 "service for user '%s'; path = '%s'\n",
361 vuser->user.unix_name,
362 lp_pathname(servicenumber) ));
363 vuser->homes_snum = servicenumber;
364 }
365 }
366
367 if (srv_is_signing_negotiated() && !vuser->guest &&
368 !srv_signing_started()) {
369 /* Try and turn on server signing on the first non-guest
370 * sessionsetup. */
371 srv_set_signing(vuser->session_key, response_blob);
372 }
373
374 /* fill in the current_user_info struct */
375 set_current_user_info( &vuser->user );
376 return vuser->vuid;
377
378 fail:
379
380 if (vuser) {
381 invalidate_vuid(vuid);
382 }
383 return UID_FIELD_INVALID;
384}
385
386/****************************************************************************
387 Add a name to the session users list.
388****************************************************************************/
389
390void add_session_user(const char *user)
391{
392 struct passwd *pw;
393 char *tmp;
394
395 pw = Get_Pwnam_alloc(talloc_tos(), user);
396
397 if (pw == NULL) {
398 return;
399 }
400
401 if (session_userlist == NULL) {
402 session_userlist = SMB_STRDUP(pw->pw_name);
403 goto done;
404 }
405
406 if (in_list(pw->pw_name,session_userlist,False) ) {
407 goto done;
408 }
409
410 if (strlen(session_userlist) > 128 * 1024) {
411 DEBUG(3,("add_session_user: session userlist already "
412 "too large.\n"));
413 goto done;
414 }
415
416 if (asprintf(&tmp, "%s %s", session_userlist, pw->pw_name) == -1) {
417 DEBUG(3, ("asprintf failed\n"));
418 goto done;
419 }
420
421 SAFE_FREE(session_userlist);
422 session_userlist = tmp;
423 done:
424 TALLOC_FREE(pw);
425}
426
427/****************************************************************************
428 In security=share mode we need to store the client workgroup, as that's
429 what Vista uses for the NTLMv2 calculation.
430****************************************************************************/
431
432void add_session_workgroup(const char *workgroup)
433{
434 if (session_workgroup) {
435 SAFE_FREE(session_workgroup);
436 }
437 session_workgroup = smb_xstrdup(workgroup);
438}
439
440/****************************************************************************
441 In security=share mode we need to return the client workgroup, as that's
442 what Vista uses for the NTLMv2 calculation.
443****************************************************************************/
444
445const char *get_session_workgroup(void)
446{
447 return session_workgroup;
448}
449
450/****************************************************************************
451 Check if a user is in a netgroup user list. If at first we don't succeed,
452 try lower case.
453****************************************************************************/
454
455bool user_in_netgroup(const char *user, const char *ngname)
456{
457#ifdef HAVE_NETGROUP
458 static char *mydomain = NULL;
459 fstring lowercase_user;
460
461 if (mydomain == NULL)
462 yp_get_default_domain(&mydomain);
463
464 if(mydomain == NULL) {
465 DEBUG(5,("Unable to get default yp domain, "
466 "let's try without specifying it\n"));
467 }
468
469 DEBUG(5,("looking for user %s of domain %s in netgroup %s\n",
470 user, mydomain?mydomain:"(ANY)", ngname));
471
472 if (innetgr(ngname, NULL, user, mydomain)) {
473 DEBUG(5,("user_in_netgroup: Found\n"));
474 return (True);
475 } else {
476
477 /*
478 * Ok, innetgr is case sensitive. Try once more with lowercase
479 * just in case. Attempt to fix #703. JRA.
480 */
481
482 fstrcpy(lowercase_user, user);
483 strlower_m(lowercase_user);
484
485 DEBUG(5,("looking for user %s of domain %s in netgroup %s\n",
486 lowercase_user, mydomain?mydomain:"(ANY)", ngname));
487
488 if (innetgr(ngname, NULL, lowercase_user, mydomain)) {
489 DEBUG(5,("user_in_netgroup: Found\n"));
490 return (True);
491 }
492 }
493#endif /* HAVE_NETGROUP */
494 return False;
495}
496
497/****************************************************************************
498 Check if a user is in a user list - can check combinations of UNIX
499 and netgroup lists.
500****************************************************************************/
501
502bool user_in_list(const char *user,const char **list)
503{
504 if (!list || !*list)
505 return False;
506
507 DEBUG(10,("user_in_list: checking user %s in list\n", user));
508
509 while (*list) {
510
511 DEBUG(10,("user_in_list: checking user |%s| against |%s|\n",
512 user, *list));
513
514 /*
515 * Check raw username.
516 */
517 if (strequal(user, *list))
518 return(True);
519
520 /*
521 * Now check to see if any combination
522 * of UNIX and netgroups has been specified.
523 */
524
525 if(**list == '@') {
526 /*
527 * Old behaviour. Check netgroup list
528 * followed by UNIX list.
529 */
530 if(user_in_netgroup(user, *list +1))
531 return True;
532 if(user_in_group(user, *list +1))
533 return True;
534 } else if (**list == '+') {
535
536 if((*(*list +1)) == '&') {
537 /*
538 * Search UNIX list followed by netgroup.
539 */
540 if(user_in_group(user, *list +2))
541 return True;
542 if(user_in_netgroup(user, *list +2))
543 return True;
544
545 } else {
546
547 /*
548 * Just search UNIX list.
549 */
550
551 if(user_in_group(user, *list +1))
552 return True;
553 }
554
555 } else if (**list == '&') {
556
557 if(*(*list +1) == '+') {
558 /*
559 * Search netgroup list followed by UNIX list.
560 */
561 if(user_in_netgroup(user, *list +2))
562 return True;
563 if(user_in_group(user, *list +2))
564 return True;
565 } else {
566 /*
567 * Just search netgroup list.
568 */
569 if(user_in_netgroup(user, *list +1))
570 return True;
571 }
572 }
573
574 list++;
575 }
576 return(False);
577}
578
579/****************************************************************************
580 Check if a username is valid.
581****************************************************************************/
582
583static bool user_ok(const char *user, int snum)
584{
585 char **valid, **invalid;
586 bool ret;
587
588 valid = invalid = NULL;
589 ret = True;
590
591 if (lp_invalid_users(snum)) {
592 str_list_copy(talloc_tos(), &invalid, lp_invalid_users(snum));
593 if (invalid &&
594 str_list_substitute(invalid, "%S", lp_servicename(snum))) {
595
596 /* This is used in sec=share only, so no current user
597 * around to pass to str_list_sub_basic() */
598
599 if ( invalid && str_list_sub_basic(invalid, "", "") ) {
600 ret = !user_in_list(user,
601 (const char **)invalid);
602 }
603 }
604 }
605 TALLOC_FREE(invalid);
606
607 if (ret && lp_valid_users(snum)) {
608 str_list_copy(talloc_tos(), &valid, lp_valid_users(snum));
609 if ( valid &&
610 str_list_substitute(valid, "%S", lp_servicename(snum)) ) {
611
612 /* This is used in sec=share only, so no current user
613 * around to pass to str_list_sub_basic() */
614
615 if ( valid && str_list_sub_basic(valid, "", "") ) {
616 ret = user_in_list(user, (const char **)valid);
617 }
618 }
619 }
620 TALLOC_FREE(valid);
621
622 if (ret && lp_onlyuser(snum)) {
623 char **user_list = str_list_make(
624 talloc_tos(), lp_username(snum), NULL);
625 if (user_list &&
626 str_list_substitute(user_list, "%S",
627 lp_servicename(snum))) {
628 ret = user_in_list(user, (const char **)user_list);
629 }
630 TALLOC_FREE(user_list);
631 }
632
633 return(ret);
634}
635
636/****************************************************************************
637 Validate a group username entry. Return the username or NULL.
638****************************************************************************/
639
640static char *validate_group(char *group, DATA_BLOB password,int snum)
641{
642#ifdef HAVE_NETGROUP
643 {
644 char *host, *user, *domain;
645 setnetgrent(group);
646 while (getnetgrent(&host, &user, &domain)) {
647 if (user) {
648 if (user_ok(user, snum) &&
649 password_ok(user,password)) {
650 endnetgrent();
651 return(user);
652 }
653 }
654 }
655 endnetgrent();
656 }
657#endif
658
659#ifdef HAVE_GETGRENT
660 {
661 struct group *gptr;
662 setgrent();
663 while ((gptr = (struct group *)getgrent())) {
664 if (strequal(gptr->gr_name,group))
665 break;
666 }
667
668 /*
669 * As user_ok can recurse doing a getgrent(), we must
670 * copy the member list onto the heap before
671 * use. Bug pointed out by [email protected].
672 */
673
674 if (gptr) {
675 char *member_list = NULL;
676 size_t list_len = 0;
677 char *member;
678 int i;
679
680 for(i = 0; gptr->gr_mem && gptr->gr_mem[i]; i++) {
681 list_len += strlen(gptr->gr_mem[i])+1;
682 }
683 list_len++;
684
685 member_list = (char *)SMB_MALLOC(list_len);
686 if (!member_list) {
687 endgrent();
688 return NULL;
689 }
690
691 *member_list = '\0';
692 member = member_list;
693
694 for(i = 0; gptr->gr_mem && gptr->gr_mem[i]; i++) {
695 size_t member_len = strlen(gptr->gr_mem[i])+1;
696
697 DEBUG(10,("validate_group: = gr_mem = "
698 "%s\n", gptr->gr_mem[i]));
699
700 safe_strcpy(member, gptr->gr_mem[i],
701 list_len - (member-member_list));
702 member += member_len;
703 }
704
705 endgrent();
706
707 member = member_list;
708 while (*member) {
709 if (user_ok(member,snum) &&
710 password_ok(member,password)) {
711 char *name = talloc_strdup(talloc_tos(),
712 member);
713 SAFE_FREE(member_list);
714 return name;
715 }
716
717 DEBUG(10,("validate_group = member = %s\n",
718 member));
719
720 member += strlen(member) + 1;
721 }
722
723 SAFE_FREE(member_list);
724 } else {
725 endgrent();
726 return NULL;
727 }
728 }
729#endif
730 return(NULL);
731}
732
733/****************************************************************************
734 Check for authority to login to a service with a given username/password.
735 Note this is *NOT* used when logging on using sessionsetup_and_X.
736****************************************************************************/
737
738bool authorise_login(int snum, fstring user, DATA_BLOB password,
739 bool *guest)
740{
741 bool ok = False;
742
743#ifdef DEBUG_PASSWORD
744 DEBUG(100,("authorise_login: checking authorisation on "
745 "user=%s pass=%s\n", user,password.data));
746#endif
747
748 *guest = False;
749
750 /* there are several possibilities:
751 1) login as the given user with given password
752 2) login as a previously registered username with the given
753 password
754 3) login as a session list username with the given password
755 4) login as a previously validated user/password pair
756 5) login as the "user =" user with given password
757 6) login as the "user =" user with no password
758 (guest connection)
759 7) login as guest user with no password
760
761 if the service is guest_only then steps 1 to 5 are skipped
762 */
763
764 /* now check the list of session users */
765 if (!ok) {
766 char *auser;
767 char *user_list = NULL;
768 char *saveptr;
769
770 if ( session_userlist )
771 user_list = SMB_STRDUP(session_userlist);
772 else
773 user_list = SMB_STRDUP("");
774
775 if (!user_list)
776 return(False);
777
778 for (auser = strtok_r(user_list, LIST_SEP, &saveptr);
779 !ok && auser;
780 auser = strtok_r(NULL, LIST_SEP, &saveptr)) {
781 fstring user2;
782 fstrcpy(user2,auser);
783 if (!user_ok(user2,snum))
784 continue;
785
786 if (password_ok(user2,password)) {
787 ok = True;
788 fstrcpy(user,user2);
789 DEBUG(3,("authorise_login: ACCEPTED: session "
790 "list username (%s) and given "
791 "password ok\n", user));
792 }
793 }
794
795 SAFE_FREE(user_list);
796 }
797
798 /* check the user= fields and the given password */
799 if (!ok && lp_username(snum)) {
800 TALLOC_CTX *ctx = talloc_tos();
801 char *auser;
802 char *user_list = talloc_strdup(ctx, lp_username(snum));
803 char *saveptr;
804
805 if (!user_list) {
806 goto check_guest;
807 }
808
809 user_list = talloc_string_sub(ctx,
810 user_list,
811 "%S",
812 lp_servicename(snum));
813
814 if (!user_list) {
815 goto check_guest;
816 }
817
818 for (auser = strtok_r(user_list, LIST_SEP, &saveptr);
819 auser && !ok;
820 auser = strtok_r(NULL, LIST_SEP, &saveptr)) {
821 if (*auser == '@') {
822 auser = validate_group(auser+1,password,snum);
823 if (auser) {
824 ok = True;
825 fstrcpy(user,auser);
826 DEBUG(3,("authorise_login: ACCEPTED: "
827 "group username and given "
828 "password ok (%s)\n", user));
829 }
830 } else {
831 fstring user2;
832 fstrcpy(user2,auser);
833 if (user_ok(user2,snum) &&
834 password_ok(user2,password)) {
835 ok = True;
836 fstrcpy(user,user2);
837 DEBUG(3,("authorise_login: ACCEPTED: "
838 "user list username and "
839 "given password ok (%s)\n",
840 user));
841 }
842 }
843 }
844 }
845
846 check_guest:
847
848 /* check for a normal guest connection */
849 if (!ok && GUEST_OK(snum)) {
850 struct passwd *guest_pw;
851 fstring guestname;
852 fstrcpy(guestname,lp_guestaccount());
853 guest_pw = Get_Pwnam_alloc(talloc_tos(), guestname);
854 if (guest_pw != NULL) {
855 fstrcpy(user,guestname);
856 ok = True;
857 DEBUG(3,("authorise_login: ACCEPTED: guest account "
858 "and guest ok (%s)\n", user));
859 } else {
860 DEBUG(0,("authorise_login: Invalid guest account "
861 "%s??\n",guestname));
862 }
863 TALLOC_FREE(guest_pw);
864 *guest = True;
865 }
866
867 if (ok && !user_ok(user, snum)) {
868 DEBUG(0,("authorise_login: rejected invalid user %s\n",user));
869 ok = False;
870 }
871
872 return(ok);
873}
Note: See TracBrowser for help on using the repository browser.