able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/ds/security/gina/msgina/wlsec.c

2623 lines
70 KiB
C
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/****************************** Module Header ******************************\
* Module Name: security.c
*
* Copyright (c) 1991, Microsoft Corporation
*
* Handles security aspects of winlogon operation.
*
* History:
* 12-05-91 Davidc Created - mostly taken from old winlogon.c
\***************************************************************************/
#include "msgina.h"
#include "authmon.h"
#pragma hdrstop
#define SECURITY_WIN32
#define SECURITY_KERBEROS
#include <security.h>
#include <secint.h>
#include <wincrypt.h>
#include <sclogon.h>
#include <md5.h>
#include <align.h>
#include <ginacomn.h>
//
// 'Constants' used in this module only.
//
SID_IDENTIFIER_AUTHORITY gSystemSidAuthority = SECURITY_NT_AUTHORITY;
SID_IDENTIFIER_AUTHORITY gLocalSidAuthority = SECURITY_LOCAL_SID_AUTHORITY;
PSID gLocalSid; // Initialized in 'InitializeSecurityGlobals'
PSID gAdminSid; // Initialized in 'InitializeSecurityGlobals'
PSID pWinlogonSid; // Initialized in 'InitializeSecurityGlobals'
//
// This structure wraps parameters passed to the background logon thread.
// The background logon is queued to the thread pool after a fast-cached
// logon to update the cached credentials.
//
typedef struct _BACKGROUND_LOGON_PARAMETERS {
ULONG AuthenticationPackage;
ULONG AuthenticationInformationLength;
PVOID AuthenticationInformation;
PWCHAR UserSidString;
HANDLE LsaHandle;
} BACKGROUND_LOGON_PARAMETERS, *PBACKGROUND_LOGON_PARAMETERS;
//
// Routines to check for & perform fast cached logon if policy allows it.
//
NTSTATUS
AttemptCachedLogon(
HANDLE LsaHandle,
PLSA_STRING OriginName,
SECURITY_LOGON_TYPE LogonType,
ULONG AuthenticationPackage,
PVOID AuthenticationInformation,
ULONG AuthenticationInformationLength,
PTOKEN_GROUPS LocalGroups,
PTOKEN_SOURCE SourceContext,
PVOID *ProfileBuffer,
PULONG ProfileBufferLength,
PLUID LogonId,
PHANDLE UserToken,
PQUOTA_LIMITS Quotas,
PNTSTATUS SubStatus,
POPTIMIZED_LOGON_STATUS OptimizedLogonStatus
);
DWORD
BackgroundLogonWorker(
PBACKGROUND_LOGON_PARAMETERS LogonParameters
);
#define PASSWORD_HASH_STRING TEXT("Long string used by msgina inside of winlogon to hash out the password")
typedef LONG ACEINDEX;
typedef ACEINDEX *PACEINDEX;
typedef struct _MYACE {
PSID Sid;
ACCESS_MASK AccessMask;
UCHAR InheritFlags;
} MYACE;
typedef MYACE *PMYACE;
BOOL
InitializeWindowsSecurity(
PGLOBALS pGlobals
);
BOOL
InitializeAuthentication(
IN PGLOBALS pGlobals
);
/***************************************************************************\
* SetMyAce
*
* Helper routine that fills in a MYACE structure.
*
* History:
* 02-06-92 Davidc Created
\***************************************************************************/
VOID
SetMyAce(
PMYACE MyAce,
PSID Sid,
ACCESS_MASK Mask,
UCHAR InheritFlags
)
{
MyAce->Sid = Sid;
MyAce->AccessMask= Mask;
MyAce->InheritFlags = InheritFlags;
}
/***************************************************************************\
* CreateAccessAllowedAce
*
* Allocates memory for an ACCESS_ALLOWED_ACE and fills it in.
* The memory should be freed by calling DestroyACE.
*
* Returns pointer to ACE on success, NULL on failure
*
* History:
* 12-05-91 Davidc Created
\***************************************************************************/
PVOID
CreateAccessAllowedAce(
PSID Sid,
ACCESS_MASK AccessMask,
UCHAR AceFlags,
UCHAR InheritFlags
)
{
ULONG LengthSid = RtlLengthSid(Sid);
ULONG LengthACE = sizeof(ACE_HEADER) + sizeof(ACCESS_MASK) + LengthSid;
PACCESS_ALLOWED_ACE Ace;
Ace = (PACCESS_ALLOWED_ACE)Alloc(LengthACE);
if (Ace == NULL) {
DebugLog((DEB_ERROR, "CreateAccessAllowedAce : Failed to allocate ace\n"));
return NULL;
}
Ace->Header.AceType = ACCESS_ALLOWED_ACE_TYPE;
Ace->Header.AceSize = (UCHAR)LengthACE;
Ace->Header.AceFlags = AceFlags | InheritFlags;
Ace->Mask = AccessMask;
RtlCopySid(LengthSid, (PSID)(&(Ace->SidStart)), Sid );
return(Ace);
}
/***************************************************************************\
* DestroyAce
*
* Frees the memory allocate for an ACE
*
* History:
* 12-05-91 Davidc Created
\***************************************************************************/
VOID
DestroyAce(
PVOID Ace
)
{
Free(Ace);
}
/***************************************************************************\
* CreateSecurityDescriptor
*
* Creates a security descriptor containing an ACL containing the specified ACEs
*
* A SD created with this routine should be destroyed using
* DeleteSecurityDescriptor
*
* Returns a pointer to the security descriptor or NULL on failure.
*
* 02-06-92 Davidc Created.
\***************************************************************************/
PSECURITY_DESCRIPTOR
CreateSecurityDescriptor(
PMYACE MyAce,
ACEINDEX AceCount
)
{
NTSTATUS Status;
ACEINDEX AceIndex;
PACCESS_ALLOWED_ACE *Ace;
PACL Acl = NULL;
PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
ULONG LengthAces;
ULONG LengthAcl;
ULONG LengthSd;
//
// Allocate space for the ACE pointer array
//
Ace = (PACCESS_ALLOWED_ACE *)Alloc(sizeof(PACCESS_ALLOWED_ACE) * AceCount);
if (Ace == NULL) {
DebugLog((DEB_ERROR, "Failed to allocated ACE array\n"));
return(NULL);
}
//
// Create the ACEs and calculate total ACE size
//
LengthAces = 0;
for (AceIndex=0; AceIndex < AceCount; AceIndex ++) {
Ace[AceIndex] = CreateAccessAllowedAce(MyAce[AceIndex].Sid,
MyAce[AceIndex].AccessMask,
0,
MyAce[AceIndex].InheritFlags);
if (Ace[AceIndex] == NULL) {
DebugLog((DEB_ERROR, "Failed to allocate ace\n"));
} else {
LengthAces += Ace[AceIndex]->Header.AceSize;
}
}
//
// Calculate ACL and SD sizes
//
LengthAcl = sizeof(ACL) + LengthAces;
LengthSd = SECURITY_DESCRIPTOR_MIN_LENGTH;
//
// Create the ACL
//
Acl = Alloc(LengthAcl);
if (Acl != NULL) {
Status = RtlCreateAcl(Acl, LengthAcl, ACL_REVISION);
ASSERT(NT_SUCCESS(Status));
//
// Add the ACES to the ACL and destroy the ACEs
//
for (AceIndex = 0; AceIndex < AceCount; AceIndex ++) {
if (Ace[AceIndex] != NULL) {
Status = RtlAddAce(Acl, ACL_REVISION, 0, Ace[AceIndex],
Ace[AceIndex]->Header.AceSize);
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "AddAce failed, status = 0x%lx", Status));
}
DestroyAce( Ace[AceIndex] );
}
}
} else {
DebugLog((DEB_ERROR, "Failed to allocate ACL\n"));
for ( AceIndex = 0 ; AceIndex < AceCount ; AceIndex++ )
{
if ( Ace[AceIndex] )
{
DestroyAce( Ace[ AceIndex ] );
}
}
}
//
// Free the ACE pointer array
//
Free(Ace);
//
// Create the security descriptor
//
SecurityDescriptor = Alloc(LengthSd);
if (SecurityDescriptor != NULL) {
Status = RtlCreateSecurityDescriptor(SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
ASSERT(NT_SUCCESS(Status));
//
// Set the DACL on the security descriptor
//
Status = RtlSetDaclSecurityDescriptor(SecurityDescriptor, TRUE, Acl, FALSE);
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "SetDACLSD failed, status = 0x%lx", Status));
}
} else {
DebugLog((DEB_ERROR, "Failed to allocate security descriptor\n"));
Free( Acl );
}
//
// Return with our spoils
//
return(SecurityDescriptor);
}
//+---------------------------------------------------------------------------
//
// Function: FreeSecurityDescriptor
//
// Synopsis: Frees security descriptors created by CreateSecurityDescriptor
//
// Arguments: [SecurityDescriptor] --
//
// History: 5-09-96 RichardW Created
//
// Notes:
//
//----------------------------------------------------------------------------
VOID
FreeSecurityDescriptor(
PSECURITY_DESCRIPTOR SecurityDescriptor
)
{
PACL Acl;
BOOL Present;
BOOL Defaulted;
Acl = NULL;
GetSecurityDescriptorDacl( SecurityDescriptor,
&Present,
&Acl,
&Defaulted );
if ( Acl )
{
Free( Acl );
}
Free( SecurityDescriptor );
}
/***************************************************************************\
* CreateUserThreadTokenSD
*
* Creates a security descriptor to protect tokens on user threads
*
* History:
* 12-05-91 Davidc Created
\***************************************************************************/
PSECURITY_DESCRIPTOR
CreateUserThreadTokenSD(
PSID UserSid,
PSID WinlogonSid
)
{
MYACE Ace[2];
ACEINDEX AceCount = 0;
PSECURITY_DESCRIPTOR SecurityDescriptor;
ASSERT(UserSid != NULL); // should always have a non-null user sid
//
// Define the User ACEs
//
SetMyAce(&(Ace[AceCount++]),
UserSid,
TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS |
TOKEN_ADJUST_DEFAULT | TOKEN_QUERY |
TOKEN_DUPLICATE | TOKEN_IMPERSONATE | READ_CONTROL,
0
);
//
// Define the Winlogon ACEs
//
SetMyAce(&(Ace[AceCount++]),
WinlogonSid,
TOKEN_ALL_ACCESS,
0
);
// Check we didn't goof
ASSERT((sizeof(Ace) / sizeof(MYACE)) >= AceCount);
//
// Create the security descriptor
//
SecurityDescriptor = CreateSecurityDescriptor(Ace, AceCount);
if (SecurityDescriptor == NULL) {
DebugLog((DEB_ERROR, "failed to create user process token security descriptor\n"));
}
return(SecurityDescriptor);
}
/***************************************************************************\
* InitializeSecurityGlobals
*
* Initializes the various global constants (mainly Sids used in this module.
*
* History:
* 12-05-91 Davidc Created
\***************************************************************************/
VOID
InitializeSecurityGlobals(
VOID
)
{
NTSTATUS Status;
SID_IDENTIFIER_AUTHORITY SystemSidAuthority = SECURITY_NT_AUTHORITY;
ULONG SidLength;
//
// Get our sid so it can be put on object ACLs
//
SidLength = RtlLengthRequiredSid(1);
pWinlogonSid = (PSID)Alloc(SidLength);
if (!pWinlogonSid)
{
//
// We're dead. Couldn't even allocate memory for a measly SID...
//
return;
}
RtlInitializeSid(pWinlogonSid, &SystemSidAuthority, 1);
*(RtlSubAuthoritySid(pWinlogonSid, 0)) = SECURITY_LOCAL_SYSTEM_RID;
//
// Initialize the local sid for later
//
Status = RtlAllocateAndInitializeSid(
&gLocalSidAuthority,
1,
SECURITY_LOCAL_RID,
0, 0, 0, 0, 0, 0, 0,
&gLocalSid
);
if (!NT_SUCCESS(Status)) {
WLPrint(("Failed to initialize local sid, status = 0x%lx", Status));
}
//
// Initialize the admin sid for later
//
Status = RtlAllocateAndInitializeSid(
&gSystemSidAuthority,
2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_ADMINS,
0, 0, 0, 0, 0, 0,
&gAdminSid
);
if (!NT_SUCCESS(Status)) {
WLPrint(("Failed to initialize admin alias sid, status = 0x%lx", Status));
}
}
VOID
FreeSecurityGlobals(
VOID
)
{
RtlFreeSid(gAdminSid);
RtlFreeSid(gLocalSid);
LocalFree(pWinlogonSid);
}
/***************************************************************************\
* InitializeAuthentication
*
* Initializes the authentication service. i.e. connects to the authentication
* package using the Lsa.
*
* On successful return, the following fields of our global structure are
* filled in :
* LsaHandle
* SecurityMode
* AuthenticationPackage
*
* Returns TRUE on success, FALSE on failure
*
* History:
* 12-05-91 Davidc Created
\***************************************************************************/
BOOL
InitializeAuthentication(
IN PGLOBALS pGlobals
)
{
NTSTATUS Status;
STRING LogonProcessName;
if (!EnablePrivilege(SE_TCB_PRIVILEGE, TRUE))
{
DebugLog((DEB_ERROR, "Failed to enable SeTcbPrivilege!\n"));
return(FALSE);
}
//
// Hookup to the LSA and locate our authentication package.
//
RtlInitString(&LogonProcessName, "Winlogon\\MSGina");
Status = LsaRegisterLogonProcess(
&LogonProcessName,
&pGlobals->LsaHandle,
&pGlobals->SecurityMode
);
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "LsaRegisterLogonProcess failed: %#x\n", Status));
return(FALSE);
}
return TRUE;
}
PVOID
FormatPasswordCredentials(
IN PUNICODE_STRING UserName,
IN PUNICODE_STRING Domain,
IN PUNICODE_STRING Password,
IN BOOLEAN Unlock,
IN OPTIONAL PLUID LogonId,
OUT PULONG Size
)
{
PKERB_INTERACTIVE_LOGON KerbAuthInfo;
ULONG AuthInfoSize;
PSECURITY_SEED_AND_LENGTH SeedAndLength;
UCHAR Seed;
PBYTE Where;
SeedAndLength = (PSECURITY_SEED_AND_LENGTH)(&Password->Length);
Seed = SeedAndLength->Seed;
//
// Build the authentication information buffer
//
if (Seed != 0) {
RevealPassword( Password );
}
AuthInfoSize = sizeof(KERB_INTERACTIVE_UNLOCK_LOGON) +
UserName->Length + 2 +
Domain->Length + 2 +
Password->Length + 2 ;
KerbAuthInfo = Alloc(AuthInfoSize);
if (KerbAuthInfo == NULL) {
DebugLog((DEB_ERROR, "failed to allocate memory for authentication buffer\n"));
return( NULL );
}
//
// This authentication buffer will be used for a logon attempt
//
if (Unlock)
{
ASSERT(ARGUMENT_PRESENT(LogonId));
KerbAuthInfo->MessageType = KerbWorkstationUnlockLogon ;
((PKERB_INTERACTIVE_UNLOCK_LOGON) KerbAuthInfo)->LogonId = *LogonId;
Where = (PBYTE) (KerbAuthInfo) + sizeof(KERB_INTERACTIVE_UNLOCK_LOGON);
}
else
{
KerbAuthInfo->MessageType = KerbInteractiveLogon ;
Where = (PBYTE) (KerbAuthInfo + 1);
}
//
// Copy the user name into the authentication buffer
//
KerbAuthInfo->UserName.Length =
(USHORT) sizeof(TCHAR) * (USHORT) lstrlen(UserName->Buffer);
KerbAuthInfo->UserName.MaximumLength =
KerbAuthInfo->UserName.Length + sizeof(TCHAR);
KerbAuthInfo->UserName.Buffer = (PWSTR)Where;
lstrcpy(KerbAuthInfo->UserName.Buffer, UserName->Buffer);
//
// Copy the domain name into the authentication buffer
//
KerbAuthInfo->LogonDomainName.Length =
(USHORT) sizeof(TCHAR) * (USHORT) lstrlen(Domain->Buffer);
KerbAuthInfo->LogonDomainName.MaximumLength =
KerbAuthInfo->LogonDomainName.Length + sizeof(TCHAR);
KerbAuthInfo->LogonDomainName.Buffer = (PWSTR)
((PBYTE)(KerbAuthInfo->UserName.Buffer) +
KerbAuthInfo->UserName.MaximumLength);
lstrcpy(KerbAuthInfo->LogonDomainName.Buffer, Domain->Buffer);
//
// Copy the password into the authentication buffer
// Hide it once we have copied it. Use the same seed value
// that we used for the original password in pGlobals.
//
KerbAuthInfo->Password.Length =
(USHORT) sizeof(TCHAR) * (USHORT) lstrlen(Password->Buffer);
KerbAuthInfo->Password.MaximumLength =
KerbAuthInfo->Password.Length + sizeof(TCHAR);
KerbAuthInfo->Password.Buffer = (PWSTR)
((PBYTE)(KerbAuthInfo->LogonDomainName.Buffer) +
KerbAuthInfo->LogonDomainName.MaximumLength);
lstrcpy(KerbAuthInfo->Password.Buffer, Password->Buffer);
if ( Seed != 0 )
{
HidePassword( &Seed, Password);
}
HidePassword( &Seed, (PUNICODE_STRING) &KerbAuthInfo->Password);
*Size = AuthInfoSize ;
return KerbAuthInfo ;
}
PVOID
FormatSmartCardCredentials(
PUNICODE_STRING Pin,
PVOID SmartCardInfo,
IN BOOLEAN Unlock,
IN OPTIONAL PLUID LogonId,
OUT PULONG Size
)
{
PKERB_SMART_CARD_LOGON KerbAuthInfo;
ULONG AuthInfoSize;
PSECURITY_SEED_AND_LENGTH SeedAndLength;
UCHAR Seed;
PULONG ScInfo ;
PUCHAR Where ;
SeedAndLength = (PSECURITY_SEED_AND_LENGTH)(&Pin->Length);
Seed = SeedAndLength->Seed;
//
// Build the authentication information buffer
//
ScInfo = (PULONG) SmartCardInfo ;
if (Seed != 0) {
RevealPassword( Pin );
}
AuthInfoSize = sizeof( KERB_SMART_CARD_UNLOCK_LOGON ) +
ROUND_UP_COUNT(Pin->Length + 2, 8) + *ScInfo ;
KerbAuthInfo = (PKERB_SMART_CARD_LOGON) LocalAlloc( LMEM_FIXED, AuthInfoSize );
if ( !KerbAuthInfo )
{
return NULL ;
}
if (Unlock)
{
ASSERT(ARGUMENT_PRESENT(LogonId));
KerbAuthInfo->MessageType = KerbSmartCardUnlockLogon ;
((PKERB_SMART_CARD_UNLOCK_LOGON) KerbAuthInfo)->LogonId = *LogonId;
Where = (PUCHAR) (KerbAuthInfo) + sizeof(KERB_SMART_CARD_UNLOCK_LOGON) ;
}
else
{
KerbAuthInfo->MessageType = KerbSmartCardLogon ;
Where = (PUCHAR) (KerbAuthInfo + 1) ;
}
KerbAuthInfo->Pin.Buffer = (PWSTR) Where ;
KerbAuthInfo->Pin.Length = Pin->Length ;
KerbAuthInfo->Pin.MaximumLength = Pin->Length + 2 ;
RtlCopyMemory( Where, Pin->Buffer, Pin->Length + 2 );
Where += ROUND_UP_COUNT(Pin->Length + 2, 8) ;
if ( Seed != 0 )
{
HidePassword( &Seed, Pin );
}
KerbAuthInfo->CspDataLength = *ScInfo ;
KerbAuthInfo->CspData = Where ;
RtlCopyMemory( Where, SmartCardInfo, *ScInfo );
*Size = AuthInfoSize ;
return KerbAuthInfo ;
}
/***************************************************************************\
* LogonUser
*
* Calls the Lsa to logon the specified user.
*
* The LogonSid and a LocalSid is added to the user's groups on successful logon
*
* For this release, password lengths are restricted to 255 bytes in length.
* This allows us to use the upper byte of the String.Length field to
* carry a seed needed to decode the run-encoded password. If the password
* is not run-encoded, the upper byte of the String.Length field should
* be zero.
*
* NOTE: This function will LocalFree the passed in AuthInfo buffer.
*
* On successful return, LogonToken is a handle to the user's token,
* the profile buffer contains user profile information.
*
* History:
* 12-05-91 Davidc Created
\***************************************************************************/
NTSTATUS
WinLogonUser(
IN HANDLE LsaHandle,
IN ULONG AuthenticationPackage,
IN SECURITY_LOGON_TYPE LogonType,
IN PVOID AuthInfo,
IN ULONG AuthInfoSize,
IN PSID LogonSid,
OUT PLUID LogonId,
OUT PHANDLE LogonToken,
OUT PQUOTA_LIMITS Quotas,
OUT PVOID *pProfileBuffer,
OUT PULONG pProfileBufferLength,
OUT PNTSTATUS pSubStatus,
OUT POPTIMIZED_LOGON_STATUS OptimizedLogonStatus
)
{
NTSTATUS Status;
STRING OriginName;
TOKEN_SOURCE SourceContext;
PTOKEN_GROUPS TokenGroups = NULL;
PMSV1_0_INTERACTIVE_PROFILE UserProfile;
PWCHAR UserSidString;
DWORD ErrorCode;
DWORD LogonCacheable;
DWORD DaysToCheck;
DWORD DaysToExpiry;
LARGE_INTEGER CurrentTime;
BOOLEAN UserLoggedOnUsingCache;
DebugLog((DEB_TRACE, " LsaHandle = %x\n", LsaHandle));
DebugLog((DEB_TRACE, " AuthenticationPackage = %d\n", AuthenticationPackage));
#if DBG
if (!RtlValidSid(LogonSid))
{
DebugLog((DEB_ERROR, "LogonSid is invalid!\n"));
Status = STATUS_INVALID_PARAMETER;
goto cleanup;
}
#endif
//
// Initialize source context structure
//
strncpy(SourceContext.SourceName, "User32 ", sizeof(SourceContext.SourceName)); // LATER from res file
Status = NtAllocateLocallyUniqueId(&SourceContext.SourceIdentifier);
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "failed to allocate locally unique id, status = 0x%lx", Status));
goto cleanup;
}
//
// Get any run-encoding information out of the way
// and decode the password. This creates a window
// where the cleartext password will be in memory.
// Keep it short.
//
// Save the seed so we can use the same one again.
//
//
// Set logon origin
//
RtlInitString(&OriginName, "Winlogon");
//
// Create logon token groups
//
#define TOKEN_GROUP_COUNT 2 // We'll add the local SID and the logon SID
TokenGroups = (PTOKEN_GROUPS)Alloc(sizeof(TOKEN_GROUPS) +
(TOKEN_GROUP_COUNT - ANYSIZE_ARRAY) * sizeof(SID_AND_ATTRIBUTES));
if (TokenGroups == NULL) {
DebugLog((DEB_ERROR, "failed to allocate memory for token groups"));
Status = STATUS_NO_MEMORY;
goto cleanup;
}
//
// Fill in the logon token group list
//
TokenGroups->GroupCount = TOKEN_GROUP_COUNT;
TokenGroups->Groups[0].Sid = LogonSid;
TokenGroups->Groups[0].Attributes =
SE_GROUP_MANDATORY | SE_GROUP_ENABLED |
SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_LOGON_ID;
TokenGroups->Groups[1].Sid = gLocalSid;
TokenGroups->Groups[1].Attributes =
SE_GROUP_MANDATORY | SE_GROUP_ENABLED |
SE_GROUP_ENABLED_BY_DEFAULT;
//
// If logging on Interactive to the console, try cached logon first.
//
UserLoggedOnUsingCache = FALSE;
if (LogonType == Interactive) {
//
// Optimized logon that does not hit the network does not
// make sense for local logins.
//
if (IsMachineDomainMember()) {
Status = AttemptCachedLogon(LsaHandle,
&OriginName,
CachedInteractive,
AuthenticationPackage,
AuthInfo,
AuthInfoSize,
TokenGroups,
&SourceContext,
pProfileBuffer,
pProfileBufferLength,
LogonId,
LogonToken,
Quotas,
pSubStatus,
OptimizedLogonStatus);
if (NT_SUCCESS(Status)) {
UserLoggedOnUsingCache = TRUE;
//
// AttemptCachedLogon will take care of freeing AuthInfo.
//
AuthInfo = NULL;
}
} else {
*OptimizedLogonStatus = OLS_MachineIsNotDomainMember;
}
} else {
*OptimizedLogonStatus = OLS_NonCachedLogonType;
}
//
// If we have not been able to log the user on using cached credentials,
// fall back to real network logon.
//
if (!UserLoggedOnUsingCache) {
Status = LsaLogonUser (
LsaHandle,
&OriginName,
LogonType,
AuthenticationPackage,
AuthInfo,
AuthInfoSize,
TokenGroups,
&SourceContext,
pProfileBuffer,
pProfileBufferLength,
LogonId,
LogonToken,
Quotas,
pSubStatus
);
}
#if 0
// If this failed it may be because we are doing a UPN logon. Try again
// with no domain
if (!NT_SUCCESS(Status))
{
*pfUpnLogon = TRUE;
PKERB_INTERACTIVE_LOGON pinfo = (PKERB_INTERACTIVE_LOGON) AuthInfo;
// Null out domain string
pinfo->LogonDomainName.Length = 0;
pinfo->LogonDomainName.Buffer[0] = 0;
Status = LsaLogonUser (
LsaHandle,
&OriginName,
LogonType,
AuthenticationPackage,
AuthInfo,
AuthInfoSize,
TokenGroups,
&SourceContext,
pProfileBuffer,
pProfileBufferLength,
LogonId,
LogonToken,
Quotas,
pSubStatus
);
}
#endif
//
// If this was a successful login perform tasks for optimized logon
// maintenance.
//
if (NT_SUCCESS(Status)) {
UserProfile = *pProfileBuffer;
//
// Get user's SID in string form.
//
UserSidString = GcGetSidString(*LogonToken);
if (UserSidString) {
//
// Save whether we did an optimized logon or the reason why
// we did not.
//
GcSetOptimizedLogonStatus(UserSidString, *OptimizedLogonStatus);
//
// Check if this was a cached logon.
//
if (!(UserProfile->UserFlags & LOGON_CACHED_ACCOUNT))
{
FgPolicyRefreshInfo UserPolicyRefreshInfo;
//
// If this is not a cached logon because user's profile
// does not allow it, we have to force group policy to
// apply synchronously.
//
ErrorCode = GcCheckIfProfileAllowsCachedLogon(&UserProfile->HomeDirectory,
&UserProfile->ProfilePath,
UserSidString,
&LogonCacheable);
if (ErrorCode != ERROR_SUCCESS || !LogonCacheable) {
//
// If policy is already sync, leave it alone.
//
GetNextFgPolicyRefreshInfo( UserSidString, &UserPolicyRefreshInfo );
if ( UserPolicyRefreshInfo.mode == GP_ModeAsyncForeground )
{
UserPolicyRefreshInfo.reason = GP_ReasonNonCachedCredentials;
UserPolicyRefreshInfo.mode = GP_ModeSyncForeground;
SetNextFgPolicyRefreshInfo( UserSidString, UserPolicyRefreshInfo );
}
}
//
// Determine if we should allow next logon to be optimized.
// We may have disallowed optimizing next logon via this
// mechanism because
// - Our background logon attempt failed e.g. password has
// changed, account has been disabled etc.
// - We are entering the password expiry warning period.
// When we do an optimized logon warning dialogs don't show
// because cached logon invents password expiry time field.
//
// We will allow optimized logon again if this was a non
// cached logon and user got authenticated by the DC, unless
// we are entering the password expiry warning period.
//
if (LogonType == Interactive) {
//
// Are we entering password expiry warning period?
//
GetSystemTimeAsFileTime((FILETIME*) &CurrentTime);
DaysToCheck = GetPasswordExpiryWarningPeriod();
if (GetDaysToExpiry(&CurrentTime,
&UserProfile->PasswordMustChange,
&DaysToExpiry)) {
if (DaysToExpiry > DaysToCheck) {
//
// We passed this check too. We can allow optimized
// logon next time. Note that, even if we allow it,
// policy, profile, logon scripts etc. might still
// disallow it!
//
GcSetNextLogonCacheable(UserSidString, TRUE);
}
}
}
}
GcDeleteSidString(UserSidString);
}
}
cleanup:
if (AuthInfo) {
LocalFree(AuthInfo);
}
if (TokenGroups) {
Free(TokenGroups);
}
return(Status);
}
/***************************************************************************\
* EnablePrivilege
*
* Enables/disables the specified well-known privilege in the current thread
* token if there is one, otherwise the current process token.
*
* Returns TRUE on success, FALSE on failure
*
* History:
* 12-05-91 Davidc Created
\***************************************************************************/
BOOL
EnablePrivilege(
ULONG Privilege,
BOOL Enable
)
{
NTSTATUS Status;
BOOLEAN WasEnabled;
//
// Try the thread token first
//
Status = RtlAdjustPrivilege(Privilege,
(BOOLEAN)Enable,
TRUE,
&WasEnabled);
if (Status == STATUS_NO_TOKEN) {
//
// No thread token, use the process token
//
Status = RtlAdjustPrivilege(Privilege,
(BOOLEAN)Enable,
FALSE,
&WasEnabled);
}
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "Failed to %ws privilege : 0x%lx, status = 0x%lx", Enable ? TEXT("enable") : TEXT("disable"), Privilege, Status));
return(FALSE);
}
return(TRUE);
}
/***************************************************************************\
* TestTokenForAdmin
*
* Returns TRUE if the token passed represents an admin user, otherwise FALSE
*
* The token handle passed must have TOKEN_QUERY access.
*
* History:
* 05-06-92 Davidc Created
\***************************************************************************/
BOOL
TestTokenForAdmin(
HANDLE Token
)
{
BOOL FoundAdmin ;
TOKEN_TYPE Type ;
NTSTATUS Status ;
ULONG Actual ;
HANDLE ImpToken ;
Status = NtQueryInformationToken( Token,
TokenType,
(PVOID) &Type,
sizeof( Type ),
&Actual );
if ( !NT_SUCCESS( Status ) )
{
return FALSE ;
}
if ( Type == TokenPrimary )
{
//
// Need an impersonation token for this:
//
if ( DuplicateTokenEx( Token,
TOKEN_IMPERSONATE | TOKEN_READ,
NULL,
SecurityImpersonation,
TokenImpersonation,
&ImpToken ) )
{
if ( !CheckTokenMembership( ImpToken, gAdminSid, &FoundAdmin ) )
{
FoundAdmin = FALSE ;
}
CloseHandle( ImpToken );
}
else
{
FoundAdmin = FALSE ;
}
}
else
{
if ( !CheckTokenMembership( Token, gAdminSid, &FoundAdmin ) )
{
FoundAdmin = FALSE ;
}
}
return FoundAdmin ;
}
/***************************************************************************\
* TestUserForAdmin
*
* Returns TRUE if the named user is an admin. This is done by attempting to
* log the user on and examining their token.
*
* NOTE: The password will be erased upon return to prevent it from being
* visually identifiable in a pagefile.
*
* History:
* 03-16-92 Davidc Created
\***************************************************************************/
BOOL
TestUserForAdmin(
PGLOBALS pGlobals,
IN PWCHAR UserName,
IN PWCHAR Domain,
IN PUNICODE_STRING PasswordString
)
{
NTSTATUS Status, SubStatus, IgnoreStatus;
UNICODE_STRING UserNameString;
UNICODE_STRING DomainString;
PVOID ProfileBuffer;
ULONG ProfileBufferLength;
QUOTA_LIMITS Quotas;
HANDLE Token;
BOOL UserIsAdmin;
LUID LogonId;
PVOID AuthInfo ;
ULONG AuthInfoSize ;
RtlInitUnicodeString(&UserNameString, UserName);
RtlInitUnicodeString(&DomainString, Domain);
//
// Temporarily log this new subject on and see if their groups
// contain the appropriate admin group
//
AuthInfo = FormatPasswordCredentials(
&UserNameString,
&DomainString,
PasswordString,
FALSE, // no unlock
NULL, // no logon id
&AuthInfoSize );
if ( !AuthInfo )
{
return FALSE ;
}
Status = WinLogonUser(
pGlobals->LsaHandle,
pGlobals->AuthenticationPackage,
Interactive,
AuthInfo,
AuthInfoSize,
pGlobals->LogonSid, // any sid will do
&LogonId,
&Token,
&Quotas,
&ProfileBuffer,
&ProfileBufferLength,
&SubStatus,
&pGlobals->OptimizedLogonStatus);
RtlEraseUnicodeString( PasswordString );
//
// If we couldn't log them on, they're not an admin
//
if (!NT_SUCCESS(Status)) {
return(FALSE);
}
//
// Free up the profile buffer
//
IgnoreStatus = LsaFreeReturnBuffer(ProfileBuffer);
ASSERT(NT_SUCCESS(IgnoreStatus));
//
// See if the token represents an admin user
//
UserIsAdmin = TestTokenForAdmin(Token);
//
// We're finished with the token
//
IgnoreStatus = NtClose(Token);
ASSERT(NT_SUCCESS(IgnoreStatus));
return(UserIsAdmin);
}
BOOL
UnlockLogon(
PGLOBALS pGlobals,
IN BOOL SmartCardUnlock,
IN PWCHAR UserName,
IN PWCHAR Domain,
IN PUNICODE_STRING PasswordString,
OUT PNTSTATUS pStatus,
OUT PBOOL IsAdmin,
OUT PBOOL IsLoggedOnUser,
OUT PVOID *pProfileBuffer,
OUT ULONG *pProfileBufferLength
)
{
NTSTATUS Status, SubStatus, IgnoreStatus;
UNICODE_STRING UserNameString;
UNICODE_STRING DomainString;
QUOTA_LIMITS Quotas;
HANDLE Token;
HANDLE ImpToken ;
LUID LogonId;
PVOID AuthInfo ;
ULONG AuthInfoSize ;
ULONG SidSize ;
UCHAR Buffer[ sizeof( TOKEN_USER ) + 8 + SID_MAX_SUB_AUTHORITIES * sizeof(DWORD) ];
PTOKEN_USER User ;
PUCHAR SmartCardInfo ;
PWLX_SC_NOTIFICATION_INFO ScInfo = NULL;
PVOID LocalProfileBuffer = NULL;
ULONG LocalProfileBufferLength;
#ifdef SMARTCARD_DOGFOOD
DWORD StartTime, EndTime;
#endif
//
// Assume no admin
//
*IsAdmin = FALSE ;
*IsLoggedOnUser = FALSE ;
//
// Bundle up the credentials for passing down to the auth pkgs:
//
if ( !SmartCardUnlock )
{
RtlInitUnicodeString(&UserNameString, UserName);
RtlInitUnicodeString(&DomainString, Domain);
AuthInfo = FormatPasswordCredentials(
&UserNameString,
&DomainString,
PasswordString,
TRUE, // unlock
&pGlobals->LogonId,
&AuthInfoSize );
}
else
{
if ( !pWlxFuncs->WlxGetOption( pGlobals->hGlobalWlx,
WLX_OPTION_SMART_CARD_INFO,
(PULONG_PTR) &ScInfo ) )
{
return FALSE ;
}
if ( ScInfo == NULL )
{
return FALSE ;
}
SmartCardInfo = ScBuildLogonInfo(
ScInfo->pszCard,
ScInfo->pszReader,
ScInfo->pszContainer,
ScInfo->pszCryptoProvider );
#ifndef SMARTCARD_DOGFOOD
LocalFree(ScInfo);
#endif
if ( SmartCardInfo == NULL )
{
#ifdef SMARTCARD_DOGFOOD
LocalFree(ScInfo);
#endif
return FALSE ;
}
AuthInfo = FormatSmartCardCredentials(
PasswordString,
SmartCardInfo,
TRUE, // unlock
&pGlobals->LogonId,
&AuthInfoSize);
LocalFree( SmartCardInfo );
}
//
// Make sure that worked:
//
if ( !AuthInfo )
{
#ifdef SMARTCARD_DOGFOOD
if (ScInfo)
LocalFree(ScInfo);
#endif
return FALSE ;
}
#ifdef SMARTCARD_DOGFOOD
StartTime = GetTickCount();
#endif
//
// Initialize profile buffer
//
if ( !pProfileBuffer )
{
pProfileBuffer = &LocalProfileBuffer;
pProfileBufferLength = &LocalProfileBufferLength;
}
SubStatus = 0;
Status = WinLogonUser(
pGlobals->LsaHandle,
( SmartCardUnlock ? pGlobals->SmartCardLogonPackage : pGlobals->PasswordLogonPackage ),
Unlock,
AuthInfo,
AuthInfoSize,
pGlobals->LogonSid, // any sid will do
&LogonId,
&Token,
&Quotas,
pProfileBuffer,
pProfileBufferLength,
&SubStatus,
&pGlobals->OptimizedLogonStatus);
if (SmartCardUnlock)
{
switch (SubStatus)
{
case STATUS_SMARTCARD_WRONG_PIN:
case STATUS_SMARTCARD_CARD_BLOCKED:
case STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED:
case STATUS_SMARTCARD_NO_CARD:
case STATUS_SMARTCARD_NO_KEY_CONTAINER:
case STATUS_SMARTCARD_NO_CERTIFICATE:
case STATUS_SMARTCARD_NO_KEYSET:
case STATUS_SMARTCARD_IO_ERROR:
case STATUS_SMARTCARD_CERT_EXPIRED:
case STATUS_SMARTCARD_CERT_REVOKED:
case STATUS_ISSUING_CA_UNTRUSTED:
case STATUS_REVOCATION_OFFLINE_C:
case STATUS_PKINIT_CLIENT_FAILURE:
Status = SubStatus;
break;
}
}
#ifdef SMARTCARD_DOGFOOD
EndTime = GetTickCount();
if (SmartCardUnlock)
{
AuthMonitor(
AuthOperUnlock,
g_Console,
&pGlobals->UserNameString,
&pGlobals->DomainString,
(ScInfo ? ScInfo->pszCard : NULL),
(ScInfo ? ScInfo->pszReader : NULL),
(PKERB_SMART_CARD_PROFILE) pGlobals->Profile,
EndTime - StartTime,
Status
);
}
if (ScInfo)
LocalFree(ScInfo);
#endif
//
// Do *NOT* erase the password string.
//
// RtlEraseUnicodeString( PasswordString );
if ( !NT_SUCCESS( Status ) )
{
if ( Status == STATUS_ACCOUNT_RESTRICTION )
{
Status = SubStatus ;
}
}
*pStatus = Status ;
//
// If we couldn't log them on, forget it.
//
if (!NT_SUCCESS(Status)) {
return(FALSE);
}
//
// No error check - if we can't tell if the user is an admin, then
// as far as we're concerned, he isn't.
//
*IsAdmin = TestTokenForAdmin( Token );
//
// Determine if this really is the logged on user:
//
User = (PTOKEN_USER) Buffer ;
Status = NtQueryInformationToken(
Token,
TokenUser,
User,
sizeof( Buffer ),
&SidSize );
if ( NT_SUCCESS( Status ) )
{
if ( pGlobals->UserProcessData.UserSid )
{
if ( DuplicateToken( Token,
SecurityImpersonation,
&ImpToken ) )
{
if ( !CheckTokenMembership(ImpToken,
pGlobals->UserProcessData.UserSid,
IsLoggedOnUser ) )
{
*IsLoggedOnUser = FALSE ;
}
NtClose( ImpToken );
}
else
{
if ( RtlEqualSid( User->User.Sid,
pGlobals->UserProcessData.UserSid ) )
{
*IsLoggedOnUser = TRUE ;
}
else
{
*IsLoggedOnUser = FALSE ;
}
}
}
else
{
*IsLoggedOnUser = FALSE ;
}
}
//
// If we're using our local buffer pointer, free up the profile buffer
//
if ( LocalProfileBuffer )
{
IgnoreStatus = LsaFreeReturnBuffer(LocalProfileBuffer);
ASSERT(NT_SUCCESS(IgnoreStatus));
}
//
// We're finished with the token
//
IgnoreStatus = NtClose(Token);
ASSERT(NT_SUCCESS(IgnoreStatus));
return( TRUE );
}
/***************************************************************************\
* FUNCTION: ImpersonateUser
*
* PURPOSE: Impersonates the user by setting the users token
* on the specified thread. If no thread is specified the token
* is set on the current thread.
*
* RETURNS: Handle to be used on call to StopImpersonating() or NULL on failure
* If a non-null thread handle was passed in, the handle returned will
* be the one passed in. (See note)
*
* NOTES: Take care when passing in a thread handle and then calling
* StopImpersonating() with the handle returned by this routine.
* StopImpersonating() will close any thread handle passed to it -
* even yours !
*
* HISTORY:
*
* 04-21-92 Davidc Created.
*
\***************************************************************************/
HANDLE
ImpersonateUser(
PUSER_PROCESS_DATA UserProcessData,
HANDLE ThreadHandle
)
{
NTSTATUS Status, IgnoreStatus;
HANDLE UserToken = UserProcessData->UserToken;
SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
OBJECT_ATTRIBUTES ObjectAttributes;
HANDLE ImpersonationToken;
BOOL ThreadHandleOpened = FALSE;
if (ThreadHandle == NULL) {
//
// Get a handle to the current thread.
// Once we have this handle, we can set the user's impersonation
// token into the thread and remove it later even though we ARE
// the user for the removal operation. This is because the handle
// contains the access rights - the access is not re-evaluated
// at token removal time.
//
Status = NtDuplicateObject( NtCurrentProcess(), // Source process
NtCurrentThread(), // Source handle
NtCurrentProcess(), // Target process
&ThreadHandle, // Target handle
THREAD_SET_THREAD_TOKEN,// Access
0L, // Attributes
DUPLICATE_SAME_ATTRIBUTES
);
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "ImpersonateUser : Failed to duplicate thread handle, status = 0x%lx", Status));
return(NULL);
}
ThreadHandleOpened = TRUE;
}
//
// If the usertoken is NULL, there's nothing to do
//
if (UserToken != NULL) {
//
// UserToken is a primary token - create an impersonation token version
// of it so we can set it on our thread
//
InitializeObjectAttributes(
&ObjectAttributes,
NULL,
0L,
NULL,
UserProcessData->NewThreadTokenSD);
SecurityQualityOfService.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
SecurityQualityOfService.ImpersonationLevel = SecurityImpersonation;
SecurityQualityOfService.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
SecurityQualityOfService.EffectiveOnly = FALSE;
ObjectAttributes.SecurityQualityOfService = &SecurityQualityOfService;
Status = NtDuplicateToken( UserToken,
TOKEN_IMPERSONATE | TOKEN_ADJUST_PRIVILEGES |
TOKEN_QUERY,
&ObjectAttributes,
FALSE,
TokenImpersonation,
&ImpersonationToken
);
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "Failed to duplicate users token to create impersonation thread, status = 0x%lx", Status));
if (ThreadHandleOpened) {
IgnoreStatus = NtClose(ThreadHandle);
ASSERT(NT_SUCCESS(IgnoreStatus));
}
return(NULL);
}
//
// Set the impersonation token on this thread so we 'are' the user
//
Status = NtSetInformationThread( ThreadHandle,
ThreadImpersonationToken,
(PVOID)&ImpersonationToken,
sizeof(ImpersonationToken)
);
//
// We're finished with our handle to the impersonation token
//
IgnoreStatus = NtClose(ImpersonationToken);
ASSERT(NT_SUCCESS(IgnoreStatus));
//
// Check we set the token on our thread ok
//
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "Failed to set user impersonation token on winlogon thread, status = 0x%lx", Status));
if (ThreadHandleOpened) {
IgnoreStatus = NtClose(ThreadHandle);
ASSERT(NT_SUCCESS(IgnoreStatus));
}
return(NULL);
}
}
return(ThreadHandle);
}
/***************************************************************************\
* FUNCTION: StopImpersonating
*
* PURPOSE: Stops impersonating the client by removing the token on the
* current thread.
*
* PARAMETERS: ThreadHandle - handle returned by ImpersonateUser() call.
*
* RETURNS: TRUE on success, FALSE on failure
*
* NOTES: If a thread handle was passed in to ImpersonateUser() then the
* handle returned was one and the same. If this is passed to
* StopImpersonating() the handle will be closed. Take care !
*
* HISTORY:
*
* 04-21-92 Davidc Created.
*
\***************************************************************************/
BOOL
StopImpersonating(
HANDLE ThreadHandle
)
{
NTSTATUS Status, IgnoreStatus;
HANDLE ImpersonationToken;
//
// Remove the user's token from our thread so we are 'ourself' again
//
ImpersonationToken = NULL;
Status = NtSetInformationThread( ThreadHandle,
ThreadImpersonationToken,
(PVOID)&ImpersonationToken,
sizeof(ImpersonationToken)
);
//
// We're finished with the thread handle
//
IgnoreStatus = NtClose(ThreadHandle);
ASSERT(NT_SUCCESS(IgnoreStatus));
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "Failed to remove user impersonation token from winlogon thread, status = 0x%lx", Status));
}
return(NT_SUCCESS(Status));
}
/***************************************************************************\
* TestUserPrivilege
*
* Looks at the user token to determine if they have the specified privilege
*
* Returns TRUE if the user has the privilege, otherwise FALSE
*
* History:
* 04-21-92 Davidc Created
\***************************************************************************/
BOOL
TestUserPrivilege(
HANDLE UserToken,
ULONG Privilege
)
{
NTSTATUS Status;
NTSTATUS IgnoreStatus;
BOOL TokenOpened;
LUID LuidPrivilege;
LUID TokenPrivilege;
PTOKEN_PRIVILEGES Privileges;
ULONG BytesRequired;
ULONG i;
BOOL Found;
TokenOpened = FALSE;
//
// If the token is NULL, get a token for the current process since
// this is the token that will be inherited by new processes.
//
if (UserToken == NULL) {
Status = NtOpenProcessToken(
NtCurrentProcess(),
TOKEN_QUERY,
&UserToken
);
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "Can't open own process token for token_query access"));
return(FALSE);
}
TokenOpened = TRUE;
}
//
// Find out how much memory we need to allocate
//
Status = NtQueryInformationToken(
UserToken, // Handle
TokenPrivileges, // TokenInformationClass
NULL, // TokenInformation
0, // TokenInformationLength
&BytesRequired // ReturnLength
);
if (Status != STATUS_BUFFER_TOO_SMALL) {
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "Failed to query privileges from user token, status = 0x%lx", Status));
}
if (TokenOpened) {
IgnoreStatus = NtClose(UserToken);
ASSERT(NT_SUCCESS(IgnoreStatus));
}
return(FALSE);
}
//
// Allocate space for the privilege array
//
Privileges = Alloc(BytesRequired);
if (Privileges == NULL) {
DebugLog((DEB_ERROR, "Failed to allocate memory for user privileges"));
if (TokenOpened) {
IgnoreStatus = NtClose(UserToken);
ASSERT(NT_SUCCESS(IgnoreStatus));
}
return(FALSE);
}
//
// Read in the user privileges
//
Status = NtQueryInformationToken(
UserToken, // Handle
TokenPrivileges, // TokenInformationClass
Privileges, // TokenInformation
BytesRequired, // TokenInformationLength
&BytesRequired // ReturnLength
);
//
// We're finished with the token handle
//
if (TokenOpened) {
IgnoreStatus = NtClose(UserToken);
ASSERT(NT_SUCCESS(IgnoreStatus));
}
//
// See if we got the privileges
//
if (!NT_SUCCESS(Status)) {
DebugLog((DEB_ERROR, "Failed to query privileges from user token"));
Free(Privileges);
return(FALSE);
}
//
// See if the user has the privilege we're looking for.
//
LuidPrivilege = RtlConvertLongToLuid(Privilege);
Found = FALSE;
for (i=0; i<Privileges->PrivilegeCount; i++) {
TokenPrivilege = *((LUID UNALIGNED *) &Privileges->Privileges[i].Luid);
if (RtlEqualLuid(&TokenPrivilege, &LuidPrivilege))
{
Found = TRUE;
break;
}
}
Free(Privileges);
return(Found);
}
/***************************************************************************\
* FUNCTION: HidePassword
*
* PURPOSE: Run-encodes the password so that it is not very visually
* distinguishable. This is so that if it makes it to a
* paging file, it wont be obvious.
*
* if pGlobals->Seed is zero, then we will allocate and assign
* a seed value. Otherwise, the existing seed value is used.
*
* WARNING - This routine will use the upper portion of the
* password's length field to store the seed used in encoding
* password. Be careful you don't pass such a string to
* a routine that looks at the length (like and RPC routine).
*
*
* RETURNS: (None)
*
* NOTES:
*
* HISTORY:
*
* 04-27-93 JimK Created.
*
\***************************************************************************/
VOID
HidePassword(
PUCHAR Seed OPTIONAL,
PUNICODE_STRING Password
)
{
PSECURITY_SEED_AND_LENGTH
SeedAndLength;
UCHAR
LocalSeed;
//
// If no seed address passed, use our own local seed buffer
//
if (Seed == NULL) {
Seed = &LocalSeed;
LocalSeed = 0;
}
SeedAndLength = (PSECURITY_SEED_AND_LENGTH)&Password->Length;
//ASSERT(*((LPWCH)SeedAndLength+Password->Length) == 0);
ASSERT((SeedAndLength->Seed) == 0);
RtlRunEncodeUnicodeString(
Seed,
Password
);
SeedAndLength->Seed = (*Seed);
return;
}
/***************************************************************************\
* FUNCTION: RevealPassword
*
* PURPOSE: Reveals a previously hidden password so that it
* is plain text once again.
*
* RETURNS: (None)
*
* NOTES:
*
* HISTORY:
*
* 04-27-93 JimK Created.
*
\***************************************************************************/
VOID
RevealPassword(
PUNICODE_STRING HiddenPassword
)
{
PSECURITY_SEED_AND_LENGTH
SeedAndLength;
UCHAR
Seed;
SeedAndLength = (PSECURITY_SEED_AND_LENGTH)&HiddenPassword->Length;
Seed = SeedAndLength->Seed;
SeedAndLength->Seed = 0;
RtlRunDecodeUnicodeString(
Seed,
HiddenPassword
);
return;
}
/***************************************************************************\
* FUNCTION: ErasePassword
*
* PURPOSE: zeros a password that is no longer needed.
*
* RETURNS: (None)
*
* NOTES:
*
* HISTORY:
*
* 04-27-93 JimK Created.
*
\***************************************************************************/
VOID
ErasePassword(
PUNICODE_STRING Password
)
{
PSECURITY_SEED_AND_LENGTH
SeedAndLength;
SeedAndLength = (PSECURITY_SEED_AND_LENGTH)&Password->Length;
SeedAndLength->Seed = 0;
RtlEraseUnicodeString(
Password
);
return;
}
VOID
HashPassword(
PUNICODE_STRING Password,
PUCHAR HashBuffer
)
{
MD5_CTX Context ;
MD5Init( &Context );
MD5Update( &Context, (PUCHAR) Password->Buffer, Password->Length );
MD5Update( &Context, (PUCHAR) PASSWORD_HASH_STRING, sizeof( PASSWORD_HASH_STRING ) );
MD5Final( &Context );
RtlCopyMemory( HashBuffer,
Context.digest,
MD5DIGESTLEN );
}
/***************************************************************************\
* AttemptCachedLogon
*
* Checks to see if we are allowed to use cached credentials to log the user
* in fast, and does so.
*
* Parameters are the same list of parameters passed to LsaLogonUser.
*
* On successful return, LogonToken is a handle to the user's token,
* the profile buffer contains user profile information.
*
* History:
* 03-23-01 Cenke Created
\***************************************************************************/
NTSTATUS
AttemptCachedLogon(
HANDLE LsaHandle,
PLSA_STRING OriginName,
SECURITY_LOGON_TYPE LogonType,
ULONG AuthenticationPackage,
PVOID AuthenticationInformation,
ULONG AuthenticationInformationLength,
PTOKEN_GROUPS LocalGroups,
PTOKEN_SOURCE SourceContext,
PVOID *ProfileBuffer,
PULONG ProfileBufferLength,
PLUID LogonId,
PHANDLE UserToken,
PQUOTA_LIMITS Quotas,
PNTSTATUS SubStatus,
POPTIMIZED_LOGON_STATUS OptimizedLogonStatus
)
{
PWCHAR UserSidString;
PMSV1_0_INTERACTIVE_PROFILE UserProfile;
FgPolicyRefreshInfo UserPolicyRefreshInfo;
PBACKGROUND_LOGON_PARAMETERS LogonParameters;
OSVERSIONINFOEXW OsVersion;
NTSTATUS Status;
DWORD ErrorCode;
BOOL Success;
DWORD NextLogonCacheable;
BOOLEAN UserLoggedOn;
BOOL RunSynchronous;
//
// Initialize locals.
//
UserSidString = NULL;
UserLoggedOn = FALSE;
LogonParameters = NULL;
*OptimizedLogonStatus = OLS_Unspecified;
//
// Verify parameters.
//
ASSERT(LogonType == CachedInteractive);
//
// Check if SKU allows cached interactive logons.
//
ZeroMemory(&OsVersion, sizeof(OsVersion));
OsVersion.dwOSVersionInfoSize = sizeof(OsVersion);
Status = RtlGetVersion((POSVERSIONINFOW)&OsVersion);
if (!NT_SUCCESS(Status)) {
*OptimizedLogonStatus = OLS_UnsupportedSKU;
goto cleanup;
}
if (OsVersion.wProductType != VER_NT_WORKSTATION) {
Status = STATUS_NOT_SUPPORTED;
*OptimizedLogonStatus = OLS_UnsupportedSKU;
goto cleanup;
}
//
// Attempt a cached logon.
//
Status = LsaLogonUser(LsaHandle,
OriginName,
LogonType,
AuthenticationPackage,
AuthenticationInformation,
AuthenticationInformationLength,
LocalGroups,
SourceContext,
ProfileBuffer,
ProfileBufferLength,
LogonId,
UserToken,
Quotas,
SubStatus);
//
// If cached logon was not successful we cannot continue.
//
if (!NT_SUCCESS(Status)) {
*OptimizedLogonStatus = OLS_LogonFailed;
goto cleanup;
}
UserLoggedOn = TRUE;
//
// Get user's SID.
//
UserSidString = GcGetSidString(*UserToken);
if (!UserSidString) {
Status = STATUS_INSUFFICIENT_RESOURCES;
*OptimizedLogonStatus = OLS_InsufficientResources;
goto cleanup;
}
//
// Check if in last logon of this user we determined we cannot do
// a cached logon this time.
//
ErrorCode = GcGetNextLogonCacheable(UserSidString, &NextLogonCacheable);
if (ErrorCode == ERROR_SUCCESS && !NextLogonCacheable) {
Status = STATUS_NOT_SUPPORTED;
*OptimizedLogonStatus = OLS_NextLogonNotCacheable;
goto cleanup;
}
//
// Does policy allow cached logons on this machine for the user?
//
if (IsSyncForegroundPolicyRefresh(FALSE, *UserToken)) {
Status = STATUS_NOT_SUPPORTED;
*OptimizedLogonStatus = OLS_SyncMachinePolicy;
goto cleanup;
}
//
// Check if policy allows cached logon for this user.
//
ErrorCode = GetNextFgPolicyRefreshInfo(UserSidString,
&UserPolicyRefreshInfo);
if (ErrorCode != ERROR_SUCCESS ||
UserPolicyRefreshInfo.mode != GP_ModeAsyncForeground) {
Status = STATUS_NOT_SUPPORTED;
*OptimizedLogonStatus = OLS_SyncUserPolicy;
goto cleanup;
}
//
// Check if user profile does not support default cached logons.
// e.g if the user has a remote home directory or a roaming profile etc.
//
UserProfile = *ProfileBuffer;
ErrorCode = GcCheckIfProfileAllowsCachedLogon(&UserProfile->HomeDirectory,
&UserProfile->ProfilePath,
UserSidString,
&NextLogonCacheable);
if (ErrorCode != ERROR_SUCCESS || !NextLogonCacheable) {
Status = STATUS_NOT_SUPPORTED;
*OptimizedLogonStatus = OLS_ProfileDisallows;
goto cleanup;
}
//
// Check if logon scripts are set to run synchronously.
//
RunSynchronous = GcCheckIfLogonScriptsRunSync(UserSidString);
if (RunSynchronous) {
Status = STATUS_NOT_SUPPORTED;
*OptimizedLogonStatus = OLS_SyncLogonScripts;
goto cleanup;
}
//
// We are fine to run with cached logon. We still need to launch a work
// item to do a real interactive logon that will update the cache.
//
LogonParameters = Alloc(sizeof(*LogonParameters));
if (!LogonParameters) {
Status = STATUS_INSUFFICIENT_RESOURCES;
*OptimizedLogonStatus = OLS_InsufficientResources;
goto cleanup;
}
//
// Initialize the structure so we know what to cleanup.
//
ZeroMemory(LogonParameters, sizeof(*LogonParameters));
LogonParameters->LsaHandle = LsaHandle;
//
// Hand over the allocated UserSidString to background logon to cleanup.
//
LogonParameters->UserSidString = UserSidString;
UserSidString = NULL;
//
// Hand over AuthenticationInfo structure to background logon.
// The password is already hidden.
//
LogonParameters->AuthenticationPackage = AuthenticationPackage;
LogonParameters->AuthenticationInformationLength = AuthenticationInformationLength;
//
// Background logon will use the authentication information and free it.
//
LogonParameters->AuthenticationInformation = AuthenticationInformation;
//
// Queue a work item to perform the background logon to update the cache.
// This background "logon" has nothing to do with the current user
// successfully logging on, logging off etc. So we don't have to monitor
// those. All it does is to update the cache.
//
Success = QueueUserWorkItem(BackgroundLogonWorker,
LogonParameters,
WT_EXECUTELONGFUNCTION);
if (!Success) {
//
// We want to back out from the cached logon if we could not queue
// an actual logon to update the cache for the next time.
//
Status = STATUS_INSUFFICIENT_RESOURCES;
*OptimizedLogonStatus = OLS_InsufficientResources;
goto cleanup;
}
//
// We are done.
//
Status = STATUS_SUCCESS;
*OptimizedLogonStatus = OLS_LogonIsCached;
cleanup:
if (!NT_SUCCESS(Status)) {
//
// If we failed after logging on the user using cached credentials,
// we have to cleanup.
//
if (UserLoggedOn) {
//
// Close the user's token.
//
CloseHandle(*UserToken);
//
// Free the profile buffer.
//
if (*ProfileBuffer) {
LsaFreeReturnBuffer(*ProfileBuffer);
}
}
if (LogonParameters) {
if (LogonParameters->UserSidString) {
GcDeleteSidString(LogonParameters->UserSidString);
}
Free(LogonParameters);
}
}
if (UserSidString) {
GcDeleteSidString(UserSidString);
}
return Status;
}
/***************************************************************************\
* BackgroundLogonWorker
*
* If the actual interactive logon was performed using cached credentials
* because of policy, this workitem is queued to perform an actual network
* logon to update the cached information in the security packages.
*
* Authentication information to perform the logon is passed in as the
* parameter and must be freed when the thread is done.
*
* History:
* 03-23-01 Cenke Created
\***************************************************************************/
DWORD
BackgroundLogonWorker(
PBACKGROUND_LOGON_PARAMETERS LogonParameters
)
{
PMSV1_0_INTERACTIVE_PROFILE Profile;
HANDLE UserToken;
LSA_STRING OriginName;
TOKEN_SOURCE SourceContext;
QUOTA_LIMITS Quotas;
PSECURITY_LOGON_SESSION_DATA LogonSessionData;
LUID LogonId;
NTSTATUS SubStatus;
NTSTATUS Status;
DWORD ErrorCode;
ULONG ProfileBufferLength;
ULONG NameBufferNumChars;
static LONG LogonServicesStarted = 0;
DWORD MaxWaitTime;
BOOLEAN UserLoggedOn;
BOOLEAN ImpersonatingUser;
WCHAR NameBuffer[UNLEN + 1];
DWORD DaysToCheck;
DWORD DaysToExpiry;
LARGE_INTEGER CurrentTime;
//
// Initialize locals.
//
Profile = NULL;
RtlInitString(&OriginName, "Winlogon-Background");
LogonSessionData = NULL;
ZeroMemory(&SourceContext, sizeof(SourceContext));
strncpy(SourceContext.SourceName, "GinaBkg", TOKEN_SOURCE_LENGTH);
UserLoggedOn = FALSE;
ImpersonatingUser = FALSE;
NameBufferNumChars = sizeof(NameBuffer) / sizeof(NameBuffer[0]);
//
// Verify parameters.
//
ASSERT(LogonParameters);
ASSERT(LogonParameters->AuthenticationInformation);
ASSERT(LogonParameters->UserSidString);
//
// Make sure workstation and netlogon services have started.
//
if (!LogonServicesStarted) {
MaxWaitTime = 120000; // 2 minutes.
GcWaitForServiceToStart(SERVICE_WORKSTATION, MaxWaitTime);
GcWaitForServiceToStart(SERVICE_NETLOGON, MaxWaitTime);
LogonServicesStarted = 1;
}
//
// Try to log the user in to initiate update of cached credentials.
//
Status = LsaLogonUser(LogonParameters->LsaHandle,
&OriginName,
Interactive,
LogonParameters->AuthenticationPackage,
LogonParameters->AuthenticationInformation,
LogonParameters->AuthenticationInformationLength,
NULL,
&SourceContext,
&(PVOID)Profile,
&ProfileBufferLength,
&LogonId,
&UserToken,
&Quotas,
&SubStatus);
if (!NT_SUCCESS(Status)) {
//
// If the error is real we will force non-cached logon next time.
//
if (Status != STATUS_NO_LOGON_SERVERS) {
GcSetNextLogonCacheable(LogonParameters->UserSidString, FALSE);
}
ErrorCode = LsaNtStatusToWinError(Status);
goto cleanup;
}
UserLoggedOn = TRUE;
//
// Did we actually end up doing a cached logon?
//
if (Profile->UserFlags & LOGON_CACHED_ACCOUNT) {
//
// We are done, just cleanup.
//
ErrorCode = ERROR_SUCCESS;
goto cleanup;
}
//
// If we are entering the password expiry warning period, disable optimized
// logon for next time so warning dialogs get shown. Otherwise for cached
// logons password expiry date gets invented to be forever in future.
//
if (Profile) {
GetSystemTimeAsFileTime((FILETIME*) &CurrentTime);
DaysToCheck = GetPasswordExpiryWarningPeriod();
if (GetDaysToExpiry(&CurrentTime,
&Profile->PasswordMustChange,
&DaysToExpiry)) {
if (DaysToCheck >= DaysToExpiry) {
GcSetNextLogonCacheable(LogonParameters->UserSidString, FALSE);
}
}
}
//
// Make a GetUserName call to update the user name cache. Ignore errors.
//
if (!ImpersonateLoggedOnUser(UserToken)) {
ErrorCode = GetLastError();
goto cleanup;
}
ImpersonatingUser = TRUE;
GetUserNameEx(NameSamCompatible, NameBuffer, &NameBufferNumChars);
//
// We are done.
//
ErrorCode = ERROR_SUCCESS;
cleanup:
//
// Stop impersonation.
//
if (ImpersonatingUser) {
RevertToSelf();
}
//
// Cleanup passed in LogonParameters.
//
LocalFree(LogonParameters->AuthenticationInformation);
Free(LogonParameters->UserSidString);
Free(LogonParameters);
//
// If the user logged on, cleanup.
//
if (UserLoggedOn) {
CloseHandle(UserToken);
if (Profile) {
LsaFreeReturnBuffer(Profile);
}
}
if (LogonSessionData) {
LsaFreeReturnBuffer(LogonSessionData);
}
return ErrorCode;
}
Reference in a new issue Copy permalink