From a7b308a01914458234bc05539e773e4c0762ad4b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Thu, 28 Jun 2018 12:41:41 +0200
Subject: [PATCH] AD: consider resource_groups in PAC as well
With recent versions of Active Directory the SIDs of Domain Local groups
might be only available in the resource_groups section of the PAC, this
feature is also called SID compression. To get a complete list of groups
the user is a member of the SIDs from this section must be extracted as
well.
Resolves https://pagure.io/SSSD/sssd/issue/3767
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
(cherry picked from commit 13c8450788a429fa49ba532b40ebfd7f3a4132e4)
DOWNSTREAM:
Resolves: rhbz#1592964 - Groups go missing with PAC enabled in sssd
---
src/external/samba.m4 | 8 ++
src/providers/ad/ad_pac.c | 130 ++++++++++++++++++++++++------
src/tests/cmocka/test_ad_common.c | 95 ++++++++++++++++++++++
3 files changed, 210 insertions(+), 23 deletions(-)
diff --git a/src/external/samba.m4 b/src/external/samba.m4
index 794cac2461d7fbd5e690ea105cd346cbe6fcce9a..7a8c1eb7b9069f18def4e915b0fb9ab054a68e01 100644
--- a/src/external/samba.m4
+++ b/src/external/samba.m4
@@ -122,3 +122,11 @@ int main(void)
AC_DEFINE_UNQUOTED(SMB_IDMAP_INTERFACE_VERSION, $idmap_version,
[Detected version of Samba's idmap plugin interface])
fi
+
+SAVE_CFLAGS=$CFLAGS
+CFLAGS="$CFLAGS $SMBCLIENT_CFLAGS $NDR_NBT_CFLAGS $NDR_KRB5PAC_CFLAGS -I/usr/include/samba-4.0"
+AC_CHECK_MEMBERS([struct PAC_LOGON_INFO.resource_groups], , ,
+ [[ #include <ndr.h>
+ #include <gen_ndr/krb5pac.h>
+ #include <gen_ndr/krb5pac.h>]])
+CFLAGS=$SAVE_CFLAGS
diff --git a/src/providers/ad/ad_pac.c b/src/providers/ad/ad_pac.c
index 1a344725fbf57d4d95c46163f2e31d44e69b3e65..80424b44e334958402cb8cfebedc1898f1e2f9c8 100644
--- a/src/providers/ad/ad_pac.c
+++ b/src/providers/ad/ad_pac.c
@@ -146,6 +146,87 @@ errno_t check_if_pac_is_available(TALLOC_CTX *mem_ctx,
return EOK;
}
+static errno_t
+add_sids_from_rid_array_to_hash_table(struct dom_sid *dom_sid,
+ struct samr_RidWithAttributeArray *groups,
+ struct sss_idmap_ctx *idmap_ctx,
+ hash_table_t *sid_table)
+{
+ enum idmap_error_code err;
+ char *dom_sid_str = NULL;
+ size_t dom_sid_str_len;
+ char *sid_str = NULL;
+ char *rid_start;
+ hash_key_t key;
+ hash_value_t value;
+ int ret;
+ size_t c;
+ TALLOC_CTX *tmp_ctx = NULL;
+
+ tmp_ctx = talloc_new(NULL);
+ if (tmp_ctx == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_new failed.\n");
+ return ENOMEM;
+ }
+
+ key.type = HASH_KEY_STRING;
+ value.type = HASH_VALUE_ULONG;
+
+ err = sss_idmap_smb_sid_to_sid(idmap_ctx, dom_sid, &dom_sid_str);
+ if (err != IDMAP_SUCCESS) {
+ DEBUG(SSSDBG_OP_FAILURE, "sss_idmap_smb_sid_to_sid failed.\n");
+ ret = EFAULT;
+ goto done;
+ }
+
+ dom_sid_str_len = strlen(dom_sid_str);
+ sid_str = talloc_zero_size(tmp_ctx, dom_sid_str_len + 12);
+ if (sid_str == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_zero_size failed.\n");
+ ret = ENOMEM;
+ goto done;
+ }
+ rid_start = sid_str + dom_sid_str_len;
+
+ memcpy(sid_str, dom_sid_str, dom_sid_str_len);
+
+ for (c = 0; c < groups->count; c++) {
+ memset(rid_start, '\0', 12);
+ ret = snprintf(rid_start, 12, "-%lu",
+ (unsigned long) groups->rids[c].rid);
+ if (ret < 0 || ret > 12) {
+ DEBUG(SSSDBG_OP_FAILURE, "snprintf failed.\n");
+ ret = EIO;
+ goto done;
+ }
+
+ key.str = sid_str;
+ value.ul = 0;
+
+ ret = hash_enter(sid_table, &key, &value);
+ if (ret != HASH_SUCCESS) {
+ DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed [%d][%s].\n",
+ ret, hash_error_string(ret));
+ ret = EIO;
+ goto done;
+ }
+
+ }
+
+ ret = EOK;
+
+done:
+ sss_idmap_free_sid(idmap_ctx, dom_sid_str);
+ talloc_free(tmp_ctx);
+
+ return ret;
+}
+
+struct resource_groups {
+ struct dom_sid2 *domain_sid;
+ struct samr_RidWithAttributeArray groups;
+};
+
errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
struct sss_idmap_ctx *idmap_ctx,
struct PAC_LOGON_INFO *logon_info,
@@ -157,6 +238,7 @@ errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
int ret;
size_t s;
struct netr_SamInfo3 *info3;
+ struct resource_groups resource_groups = { 0 };
char *sid_str = NULL;
char *msid_str = NULL;
char *user_dom_sid_str = NULL;
@@ -188,9 +270,15 @@ errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
}
info3 = &logon_info->info3;
+#ifdef HAVE_STRUCT_PAC_LOGON_INFO_RESOURCE_GROUPS
+ resource_groups.domain_sid = logon_info->resource_groups.domain_sid;
+ resource_groups.groups.count = logon_info->resource_groups.groups.count;
+ resource_groups.groups.rids = logon_info->resource_groups.groups.rids;
+#endif
ret = sss_hash_create(tmp_ctx,
- info3->sidcount + info3->base.groups.count + 2,
+ info3->sidcount + info3->base.groups.count + 2
+ + resource_groups.groups.count,
&sid_table);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE, "sss_hash_create failed.\n");
@@ -265,28 +353,13 @@ errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
goto done;
}
-
- for (s = 0; s < info3->base.groups.count; s++) {
- memset(rid_start, '\0', 12);
- ret = snprintf(rid_start, 12, "-%lu",
- (unsigned long) info3->base.groups.rids[s].rid);
- if (ret < 0 || ret > 12) {
- DEBUG(SSSDBG_OP_FAILURE, "snprintf failed.\n");
- ret = EIO;
- goto done;
- }
-
- key.str = sid_str;
- value.ul = 0;
-
- ret = hash_enter(sid_table, &key, &value);
- if (ret != HASH_SUCCESS) {
- DEBUG(SSSDBG_OP_FAILURE, "hash_enter failed [%d][%s].\n",
- ret, hash_error_string(ret));
- ret = EIO;
- goto done;
- }
-
+ ret = add_sids_from_rid_array_to_hash_table(info3->base.domain_sid,
+ &info3->base.groups,
+ idmap_ctx, sid_table);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "add_sids_from_rid_array_to_hash_table failed.\n");
+ goto done;
}
for(s = 0; s < info3->sidcount; s++) {
@@ -311,6 +384,17 @@ errno_t ad_get_sids_from_pac(TALLOC_CTX *mem_ctx,
}
}
+ if (resource_groups.domain_sid != NULL) {
+ ret = add_sids_from_rid_array_to_hash_table(resource_groups.domain_sid,
+ &resource_groups.groups,
+ idmap_ctx, sid_table);
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "add_sids_from_rid_array_to_hash_table failed.\n");
+ goto done;
+ }
+ }
+
num_sids = hash_count(sid_table);
sid_list = talloc_array(tmp_ctx, char *, num_sids);
if (sid_list == NULL) {
diff --git a/src/tests/cmocka/test_ad_common.c b/src/tests/cmocka/test_ad_common.c
index 39ebbc63324ca40d071f30582d2f15d732f6c466..ac3b0d0ab3c7b0a0ee4d21d96e1b4783ff1b4139 100644
--- a/src/tests/cmocka/test_ad_common.c
+++ b/src/tests/cmocka/test_ad_common.c
@@ -207,6 +207,29 @@ static void test_check_if_pac_is_available(void **state)
"BEAEUAVgBFAEwAdv///4yBQZ5ZQnp3qwj2lKGcd0UAAAAAdv//" \
"/39fn4UneD5l6YxP8w/U0coAAAAA"
+#define TEST_PAC_RESOURCE_GROUPS_BASE64 \
+ "BQAAAAAAAAABAAAA8AEAAFgAAAAAAAAACgAAABQAAABIAgAA" \
+ "AAAAAAwAAABYAAAAYAIAAAAAAAAGAAAAEAAAALgCAAAAAAAA" \
+ "BwAAABQAAADIAgAAAAAAAAEQCADMzMzM4AEAAAAAAAAAAAIA" \
+ "Rr0gPUQO1AH/////////f/////////9/TRPNRwtu0wFN0zZy" \
+ "1G7TAf////////9/CgAKAAQAAgAKAAoACAACAAAAAAAMAAIA" \
+ "AAAAABAAAgAAAAAAFAACAAAAAAAYAAIACwAAAFEEAAABAgAA" \
+ "AwAAABwAAgAgAgAAAAAAAAAAAAAAAAAAAAAAAAQABgAgAAIA" \
+ "BgAIACQAAgAoAAIAAAAAAAAAAAAQAgAAAAAAAAAAAAAAAAAA" \
+ "AAAAAAAAAAAAAAAAAAAAAAEAAAAsAAIANAACAAEAAAA4AAIA" \
+ "BQAAAAAAAAAFAAAAdAB1AHMAZQByAAAABQAAAAAAAAAFAAAA" \
+ "dAB1AHMAZQByAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
+ "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAECAAAHAAAA" \
+ "YgQAAAcAAABjBAAABwAAAAMAAAAAAAAAAgAAAEQAQwAEAAAA" \
+ "AAAAAAMAAABXAEkATgAAAAQAAAABBAAAAAAABRUAAAAkYm0r" \
+ "SyFumd73jX0BAAAAMAACAAcAAAABAAAAAQEAAAAAABIBAAAA" \
+ "BAAAAAEEAAAAAAAFFQAAACRibStLIW6Z3veNfQEAAABoBAAA" \
+ "BwAAIAAAAACAEuVfRA7UAQoAdAB1AHMAZQByAAAAAAAoABAA" \
+ "HAA4AAAAAAAAAAAAdAB1AHMAZQByAEAAdwBpAG4ALgB0AHIA" \
+ "dQBzAHQALgB0AGUAcwB0AFcASQBOAC4AVABSAFUAUwBUAC4A" \
+ "VABFAFMAVAAAAAAAEAAAAOGTj7I9Qn7XebOqdHb///+fHhrZ" \
+ "kBt0So4jOFBk84sDAAAAAA=="
+
static void test_ad_get_data_from_pac(void **state)
{
int ret;
@@ -303,6 +326,73 @@ static void test_ad_get_sids_from_pac(void **state)
sss_idmap_free(idmap_ctx);
}
+#ifdef HAVE_STRUCT_PAC_LOGON_INFO_RESOURCE_GROUPS
+static void test_ad_get_sids_from_pac_with_resource_groups(void **state)
+{
+ int ret;
+ struct PAC_LOGON_INFO *logon_info;
+ uint8_t *test_pac_blob;
+ size_t test_pac_blob_size;
+ char *user_sid;
+ char *primary_group_sid;
+ size_t num_sids;
+ char **sid_list;
+ struct sss_idmap_ctx *idmap_ctx;
+ enum idmap_error_code err;
+ size_t c;
+ size_t s;
+
+ const char *sid_check_list[] = { "S-1-5-21-728588836-2574131531-2106456030-513",
+ "S-1-5-21-728588836-2574131531-2106456030-1122",
+ "S-1-5-21-728588836-2574131531-2106456030-1123",
+ "S-1-5-21-728588836-2574131531-2106456030-1128",
+ "S-1-18-1",
+ NULL };
+
+ struct ad_common_test_ctx *test_ctx = talloc_get_type(*state,
+ struct ad_common_test_ctx);
+
+ err = sss_idmap_init(sss_idmap_talloc, test_ctx, sss_idmap_talloc_free,
+ &idmap_ctx);
+ assert_int_equal(err, IDMAP_SUCCESS);
+
+ test_pac_blob = sss_base64_decode(test_ctx, TEST_PAC_RESOURCE_GROUPS_BASE64,
+ &test_pac_blob_size);
+ assert_non_null(test_pac_blob_size);
+
+ ret = ad_get_data_from_pac(test_ctx, test_pac_blob, test_pac_blob_size,
+ &logon_info);
+ assert_int_equal(ret, EOK);
+
+ ret = ad_get_sids_from_pac(test_ctx, idmap_ctx, logon_info, &user_sid,
+ &primary_group_sid, &num_sids, &sid_list);
+ assert_int_equal(ret, EOK);
+ assert_string_equal(user_sid,
+ "S-1-5-21-728588836-2574131531-2106456030-1105");
+ assert_string_equal(primary_group_sid,
+ "S-1-5-21-728588836-2574131531-2106456030-513");
+ assert_int_equal(num_sids, 5);
+
+ for (c = 0; sid_check_list[c] != NULL; c++) {
+ for (s = 0; s < num_sids; s++) {
+ if (strcmp(sid_check_list[c], sid_list[s]) == 0) {
+ break;
+ }
+ }
+ if (s == num_sids) {
+ fail_msg("SID [%s] not found in SID list.", sid_check_list[c]);
+ }
+ }
+
+ talloc_free(test_pac_blob);
+ talloc_free(logon_info);
+ talloc_free(user_sid);
+ talloc_free(primary_group_sid);
+ talloc_free(sid_list);
+ sss_idmap_free(idmap_ctx);
+}
+#endif
+
static void test_ad_get_pac_data_from_user_entry(void **state)
{
int ret;
@@ -912,6 +1002,11 @@ int main(int argc, const char *argv[])
cmocka_unit_test_setup_teardown(test_ad_get_sids_from_pac,
test_ad_common_setup,
test_ad_common_teardown),
+#ifdef HAVE_STRUCT_PAC_LOGON_INFO_RESOURCE_GROUPS
+ cmocka_unit_test_setup_teardown(test_ad_get_sids_from_pac_with_resource_groups,
+ test_ad_common_setup,
+ test_ad_common_teardown),
+#endif
cmocka_unit_test_setup_teardown(test_ad_get_pac_data_from_user_entry,
test_ad_common_setup,
test_ad_common_teardown),
--
2.17.1