CVE-2020-25719 CVE-2020-25717: auth/gensec: always require a PAC in domain mode ...

AD domains always provide a PAC unless UF_NO_AUTH_DATA_REQUIRED is set
on the service account, which can only be explicitly configured,
but that's an invalid configuration!

We still try to support standalone servers in an MIT realm,
as legacy setup.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[jsutton@samba.org Removed knownfail entries]

diff --git a/auth/gensec/gensec_util.c b/auth/gensec/gensec_util.c
index e185acc0c2055917876df0151b4b417749f26903..694661b53b56303bf537ae404bed4ca6f5e5d8a4 100644 (file)
--- a/auth/gensec/gensec_util.c
+++ b/auth/gensec/gensec_util.c
@@ -25,6 +25,8 @@
 #include "auth/gensec/gensec_internal.h"
 #include "auth/common_auth.h"
 #include "../lib/util/asn1.h"
+#include "param/param.h"
+#include "libds/common/roles.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
@@ -46,10 +48,27 @@ NTSTATUS gensec_generate_session_info_pac(TALLOC_CTX *mem_ctx,
        session_info_flags |= AUTH_SESSION_INFO_DEFAULT_GROUPS;
 
        if (!pac_blob) {
-               if (gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
-                       DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access\n",
-                                 principal_string));
-                       return NT_STATUS_ACCESS_DENIED;
+               enum server_role server_role =
+                       lpcfg_server_role(gensec_security->settings->lp_ctx);
+
+               /*
+                * For any domain setup (DC or member) we require having
+                * a PAC, as the service ticket comes from an AD DC,
+                * which will always provide a PAC, unless
+                * UF_NO_AUTH_DATA_REQUIRED is configured for our
+                * account, but that's just an invalid configuration,
+                * the admin configured for us!
+                *
+                * As a legacy case, we still allow kerberos tickets from an MIT
+                * realm, but only in standalone mode. In that mode we'll only
+                * ever accept a kerberos authentication with a keytab file
+                * being explicitly configured via the 'keytab method' option.
+                */
+               if (server_role != ROLE_STANDALONE) {
+                       DBG_WARNING("Unable to find PAC in ticket from %s, "
+                                   "failing to allow access\n",
+                                   principal_string);
+                       return NT_STATUS_NO_IMPERSONATION_TOKEN;
                }
                DBG_NOTICE("Unable to find PAC for %s, resorting to local "
                           "user lookup\n", principal_string);

diff --git a/selftest/knownfail.d/no-pac b/selftest/knownfail.d/no-pac
deleted file mode 100644 (file)
index 9723d58..0000000
--- a/selftest/knownfail.d/no-pac
+++ /dev/null
@@ -1,4 +0,0 @@
-^samba.tests.krb5.test_ccache.samba.tests.krb5.test_ccache.CcacheTests.test_ccache_no_pac
-^samba.tests.krb5.test_ldap.samba.tests.krb5.test_ldap.LdapTests.test_ldap_no_pac
-^samba.tests.krb5.test_rpc.samba.tests.krb5.test_rpc.RpcTests.test_rpc_no_pac
-^samba.tests.krb5.test_smb.samba.tests.krb5.test_smb.SmbTests.test_smb_no_pac