@@ -29,7 +29,7 @@ let ( let* ) = Result.bind
2929
3030let ( <!> ) x f = Rresult.R. reword_error f x
3131
32- let (>> | ) = Rresult. (>> | )
32+ let ( >> | ) = Rresult. ( >> | )
3333
3434let maybe_raise (x : ('a, exn) result ) : 'a =
3535 match x with Ok x -> x | Error e -> raise e
@@ -68,8 +68,7 @@ let ntlm_auth uname passwd : (unit, exn) result =
6868 ! Xapi_globs. ntlm_auth_cmd args
6969 in
7070 Ok ()
71- with _ ->
72- Error (auth_ex uname)
71+ with _ -> Error (auth_ex uname)
7372
7473module Ldap = struct
7574 type user = {
@@ -180,7 +179,6 @@ module Ldap = struct
180179 ; password_expired= logand user_account_control passw_expire_bit <> 0l
181180 }
182181
183-
184182 let net_ads (sid : string ) : (string, exn) result =
185183 try
186184 let args = [" ads" ; " sid" ; " -d" ; debug_level; " --machine-pass" ; sid] in
@@ -204,7 +202,6 @@ module Ldap = struct
204202end
205203
206204module Wbinfo = struct
207-
208205 let exception_of_stderr =
209206 let open Auth_signature in
210207 let regex = Re.Perl. (compile (re {|.* (WBC_ERR_ [A - Z_ ]* ).*| })) in
@@ -241,8 +238,8 @@ module Wbinfo = struct
241238 let generic_err () =
242239 Error (generic_ex " 'wbinfo %s' failed" (String. concat " " args))
243240 in
241+ (* we trust wbinfo will not print any sensitive info on failure *)
244242 try
245- (* we trust wbinfo will not print any sensitive info on failure *)
246243 let stdout = Helpers. call_script ~log_output: On_failure wb_cmd args in
247244 Ok stdout
248245 with
@@ -297,8 +294,7 @@ module Wbinfo = struct
297294 | [|_; name; _|] ->
298295 Some (Other name)
299296 | _ ->
300- None
301- )
297+ None )
302298 in
303299 fun sid ->
304300 let args = [" --sid-to-name" ; sid] in
@@ -348,7 +344,7 @@ module Wbinfo = struct
348344 | _ ->
349345 Error ()
350346
351- let uid_info_of_uid (uid : int ) =
347+ let uid_info_of_uid (uid : int ) =
352348 let args = [" --uid-info" ; string_of_int uid] in
353349 let * stdout = call_wbinfo args in
354350 parse_uid_info stdout < ! > fun () -> parsing_ex args
@@ -387,13 +383,13 @@ let query_domain_workgroup ~domain ~db_workgroup =
387383 try
388384 let kdc =
389385 Helpers. call_script ~log_output: On_failure net_cmd
390- [" lookup" ; " kdc" ; domain; " -d" ; debug_level]
386+ [" lookup" ; " kdc" ; domain; " -d" ; debug_level]
391387 (* Result like 10.71.212.25:88\n10.62.1.25:88\n*)
392388 |> String. split_on_char '\n'
393389 |> List. hd
394390 |> String. split_on_char ':'
395391 |> List. hd
396- in
392+ in
397393
398394 let lines =
399395 Helpers. call_script ~log_output: On_failure net_cmd
@@ -498,10 +494,13 @@ let disable_machine_account ~service_name = function
498494 | Some u , Some p -> (
499495 (* Disable machine account in DC *)
500496 let env = [|Printf. sprintf " PASSWD=%s" p|] in
501- let args = [" ads" ; " leave" ; " -U" ; u; " --keep-account" ; " -d" ; debug_level] in
497+ let args =
498+ [" ads" ; " leave" ; " -U" ; u; " --keep-account" ; " -d" ; debug_level]
499+ in
502500 try
503501 Helpers. call_script ~env net_cmd args |> ignore ;
504- debug " Succeed to disable the machine account for domain %s" service_name
502+ debug " Succeed to disable the machine account for domain %s"
503+ service_name
505504 with _ ->
506505 let msg =
507506 Printf. sprintf " Failed to disable the machine account for domain %s"
@@ -624,37 +623,39 @@ module AuthADWinbind : Auth_signature.AUTH_MODULE = struct
624623 Raises auth_failure if authentication is not successful
625624 *)
626625
627- let authenticate_username_password uname password =
628- (* the ntlm_auth binary expects the username to be in either SAM or UPN format.
629- * we use wbinfo to try to convert the provided [uname] into said format.
630- * as a last ditch attempt, we try to auth with the provided [uname]
631- *
632- * see CA-346287 for more information *)
633- let orig_uname = uname in
634- (let * sid =
635- (* we change the exception, since otherwise we get an (incorrect) error
636- * message saying that credentials are correct, but we are not authorized *)
637- get_subject_identifier' uname < ! > function
638- | Auth_failure _ as e ->
639- e
640- | Auth_service_error (E_GENERIC, msg ) ->
641- Auth_failure msg
642- | e ->
643- D. error " authenticate_username_password:ex: %s" (Printexc. to_string e) ;
644- Auth_failure
645- (Printf. sprintf " couldn't get SID from username='%s'" uname)
646- in
647- let * () =
648- match Wbinfo. name_of_sid sid >> | Wbinfo. string_of_name with
649- | Error e ->
650- D. warn " authenticate_username_password: trying original uname. ex: %s"
651- (Printexc. to_string e) ;
652- ntlm_auth orig_uname password
653- | Ok uname ->
654- ntlm_auth orig_uname password
655- in
656- Ok sid)
657- |> maybe_raise
626+ let authenticate_username_password uname password =
627+ (* the ntlm_auth binary expects the username to be in either SAM or UPN format.
628+ * we use wbinfo to try to convert the provided [uname] into said format.
629+ * as a last ditch attempt, we try to auth with the provided [uname]
630+ *
631+ * see CA-346287 for more information *)
632+ let orig_uname = uname in
633+ (let * sid =
634+ (* we change the exception, since otherwise we get an (incorrect) error
635+ * message saying that credentials are correct, but we are not authorized *)
636+ get_subject_identifier' uname < ! > function
637+ | Auth_failure _ as e ->
638+ e
639+ | Auth_service_error (E_GENERIC, msg ) ->
640+ Auth_failure msg
641+ | e ->
642+ D. error " authenticate_username_password:ex: %s"
643+ (Printexc. to_string e) ;
644+ Auth_failure
645+ (Printf. sprintf " couldn't get SID from username='%s'" uname)
646+ in
647+ let * () =
648+ match Wbinfo. name_of_sid sid >> | Wbinfo. string_of_name with
649+ | Error e ->
650+ D. warn
651+ " authenticate_username_password: trying original uname. ex: %s"
652+ (Printexc. to_string e) ;
653+ ntlm_auth orig_uname password
654+ | Ok uname ->
655+ ntlm_auth orig_uname password
656+ in
657+ Ok sid)
658+ |> maybe_raise
658659
659660 (* subject_id Authenticate_ticket(string ticket)
660661
0 commit comments