Mercurial > dovecot > original-hg > dovecot-1.2

annotate src/auth/mech-gssapi.c @ 8094:641d761219a6 HEAD

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Support GSS-SPNEGO mechanism if GSSAPI library supports it. Based on a patch by Jason Gunthorpe.
author Timo Sirainen <tss@iki.fi>
date Wed, 13 Aug 2008 16:22:53 -0400
parents 9ca5e8f66d10
children 1f948670f274
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
1 /*
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
2 * GSSAPI Module
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
3 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
4 * Copyright (c) 2005 Jelmer Vernooij <jelmer@samba.org>
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
5 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
6 * Related standards:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
7 * - draft-ietf-sasl-gssapi-03
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
8 * - RFC2222
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
9 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
10 * Some parts inspired by an older patch from Colin Walters
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
11 *
4382
f8d37e26a2b3 Relicensed dovecot-auth to MIT.
Timo Sirainen <tss@iki.fi>
parents: 4004
diff changeset
12 * This software is released under the MIT license.
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
13 */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
14
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
15 #include "common.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
16 #include "mech.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
17 #include "passdb.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
18 #include "str.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
19 #include "str-sanitize.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
20 #include "buffer.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
21 #include "hex-binary.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
22 #include "safe-memset.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
23
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
24 #ifdef HAVE_GSSAPI
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
25
7477
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
26 #ifndef HAVE___GSS_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
27 # define USE_KRB5_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
28 # include <krb5.h>
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
29 #endif
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
30
4862
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain
Timo Sirainen <tss@iki.fi>
parents: 4782
diff changeset
31 #ifdef HAVE_GSSAPI_GSSAPI_H
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain
Timo Sirainen <tss@iki.fi>
parents: 4782
diff changeset
32 # include <gssapi/gssapi.h>
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain
Timo Sirainen <tss@iki.fi>
parents: 4782
diff changeset
33 #elif defined (HAVE_GSSAPI_H)
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain
Timo Sirainen <tss@iki.fi>
parents: 4782
diff changeset
34 # include <gssapi.h>
7610
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it.
Timo Sirainen <tss@iki.fi>
parents: 7480
diff changeset
35 #endif
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it.
Timo Sirainen <tss@iki.fi>
parents: 7480
diff changeset
36
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it.
Timo Sirainen <tss@iki.fi>
parents: 7480
diff changeset
37 #ifdef HAVE_GSSAPI_GSSAPI_KRB5_H
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it.
Timo Sirainen <tss@iki.fi>
parents: 7480
diff changeset
38 # include <gssapi/gssapi_krb5.h>
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it.
Timo Sirainen <tss@iki.fi>
parents: 7480
diff changeset
39 #elif defined (HAVE_GSSAPI_KRB5_H)
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it.
Timo Sirainen <tss@iki.fi>
parents: 7480
diff changeset
40 # include <gssapi_krb5.h>
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it.
Timo Sirainen <tss@iki.fi>
parents: 7480
diff changeset
41 #else
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it.
Timo Sirainen <tss@iki.fi>
parents: 7480
diff changeset
42 # undef USE_KRB5_USEROK
4862
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain
Timo Sirainen <tss@iki.fi>
parents: 4782
diff changeset
43 #endif
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
44
5859
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
45 #ifdef HAVE_GSSAPI_GSSAPI_EXT_H
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
46 # include <gssapi/gssapi_ext.h>
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
47 #endif
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
48
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
49 /* Non-zero flags defined in RFC 2222 */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
50 enum sasl_gssapi_qop {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
51 SASL_GSSAPI_QOP_UNSPECIFIED = 0x00,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
52 SASL_GSSAPI_QOP_AUTH_ONLY = 0x01,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
53 SASL_GSSAPI_QOP_AUTH_INT = 0x02,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
54 SASL_GSSAPI_QOP_AUTH_CONF = 0x04
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
55 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
56
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
57 struct gssapi_auth_request {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
58 struct auth_request auth_request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
59 gss_ctx_id_t gss_ctx;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
60 gss_cred_id_t service_cred;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
61
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
62 enum {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
63 GSS_STATE_SEC_CONTEXT,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
64 GSS_STATE_WRAP,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
65 GSS_STATE_UNWRAP
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
66 } sasl_gssapi_state;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
67
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
68 gss_name_t authn_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
69 gss_name_t authz_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
70
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
71 pool_t pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
72 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
73
8068
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
74 static bool gssapi_initialized = FALSE;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
75
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
76 static void auth_request_log_gss_error(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
77 OM_uint32 status_value, int status_type,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
78 const char *description)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
79 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
80 OM_uint32 message_context = 0;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
81 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
82 gss_buffer_desc status_string;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
83
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
84 do {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
85 major_status = gss_display_status(&minor_status, status_value,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
86 status_type, GSS_C_NO_OID,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
87 &message_context,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
88 &status_string);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
89
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
90 auth_request_log_error(request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
91 "While %s: %s", description,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
92 str_sanitize(status_string.value, (size_t)-1));
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
93
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
94 major_status = gss_release_buffer(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
95 &status_string);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
96 } while (message_context != 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
97 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
98
8068
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
99 static void mech_gssapi_initialize(void)
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
100 {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
101 const char *path;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
102
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
103 path = getenv("KRB5_KTNAME");
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
104 if (path != NULL) {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
105 #ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
106 gsskrb5_register_acceptor_identity(path);
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
107 #elif defined (HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY)
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
108 krb5_gss_register_acceptor_identity(path);
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
109 #endif
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
110 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
111 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
112
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
113 static struct auth_request *mech_gssapi_auth_new(void)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
114 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
115 struct gssapi_auth_request *request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
116 pool_t pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
117
8068
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
118 if (!gssapi_initialized) {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
119 gssapi_initialized = TRUE;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
120 mech_gssapi_initialize();
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
121 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity()
Timo Sirainen <tss@iki.fi>
parents: 7610
diff changeset
122
3695
4f8598b0ca62 Use a bit larger initial pool sizes
Timo Sirainen <tss@iki.fi>
parents: 3683
diff changeset
123 pool = pool_alloconly_create("gssapi_auth_request", 1024);
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
124 request = p_new(pool, struct gssapi_auth_request, 1);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
125 request->pool = pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
126
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
127 request->gss_ctx = GSS_C_NO_CONTEXT;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
128
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
129 request->auth_request.pool = pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
130 return &request->auth_request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
131 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
132
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
133 static OM_uint32 obtain_service_credentials(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
134 gss_cred_id_t *ret)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
135 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
136 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
137 string_t *principal_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
138 gss_buffer_desc inbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
139 gss_name_t gss_principal;
4628
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
140 const char *service_name;
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
141
8093
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts.
Timo Sirainen <tss@iki.fi>
parents: 8068
diff changeset
142 if (strcmp(request->auth->gssapi_hostname, "$ALL") == 0) {
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts.
Timo Sirainen <tss@iki.fi>
parents: 8068
diff changeset
143 auth_request_log_info(request, "gssapi",
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts.
Timo Sirainen <tss@iki.fi>
parents: 8068
diff changeset
144 "Using all keytab entries");
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts.
Timo Sirainen <tss@iki.fi>
parents: 8068
diff changeset
145 *ret = GSS_C_NO_CREDENTIAL;
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts.
Timo Sirainen <tss@iki.fi>
parents: 8068
diff changeset
146 return GSS_S_COMPLETE;
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts.
Timo Sirainen <tss@iki.fi>
parents: 8068
diff changeset
147 }
9ca5e8f66d10 Added support for gssapi_hostname=$ALL for multihomed hosts.
Timo Sirainen <tss@iki.fi>
parents: 8068
diff changeset
148
4628
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
149 if (strcasecmp(request->service, "POP3") == 0) {
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
150 /* The standard POP3 service name with GSSAPI is called
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
151 just "pop". */
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
152 service_name = "pop";
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
153 } else {
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
154 service_name = t_str_lcase(request->service);
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
155 }
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
156
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
157 principal_name = t_str_new(128);
4628
fc5ae043fdcc POP3 service name is "pop" with GSSAPI.
Timo Sirainen <tss@iki.fi>
parents: 4451
diff changeset
158 str_append(principal_name, service_name);
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
159 str_append_c(principal_name, '@');
5439
c5401a8f4679 Added auth_gssapi_hostname setting.
Timo Sirainen <tss@iki.fi>
parents: 5259
diff changeset
160 str_append(principal_name, request->auth->gssapi_hostname);
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
161
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
162 auth_request_log_info(request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
163 "Obtaining credentials for %s", str_c(principal_name));
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
164
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
165 inbuf.length = str_len(principal_name);
4451
1a35d53c18fc Array API redesigned to work using unions. It now provides type safety
Timo Sirainen <tss@iki.fi>
parents: 4382
diff changeset
166 inbuf.value = str_c_modifiable(principal_name);
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
167
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
168 major_status = gss_import_name(&minor_status, &inbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
169 GSS_C_NT_HOSTBASED_SERVICE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
170 &gss_principal);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
171
3879
928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to
Timo Sirainen <tss@iki.fi>
parents: 3766
diff changeset
172 str_free(&principal_name);
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
173
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
174 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
175 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
176 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
177 "importing principal name");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
178 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
179 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
180
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
181 major_status = gss_acquire_cred(&minor_status, gss_principal, 0,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
182 GSS_C_NULL_OID_SET, GSS_C_ACCEPT,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
183 ret, NULL, NULL);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
184
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
185 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
186 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
187 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
188 "acquiring service credentials");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
189 auth_request_log_gss_error(request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
190 GSS_C_MECH_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
191 "acquiring service credentials");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
192 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
193 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
194
4004
10d1c3301b87 Crashfix. Patch by Mark Davies
Timo Sirainen <tss@iki.fi>
parents: 3879
diff changeset
195 gss_release_name(&minor_status, &gss_principal);
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
196
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
197 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
198 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
199
7477
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
200 #ifndef HAVE___GSS_USEROK
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
201 static gss_name_t
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
202 import_name(struct auth_request *request, void *str, size_t len)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
203 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
204 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
205 gss_buffer_desc name_buf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
206 gss_name_t name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
207
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
208 name_buf.value = str;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
209 name_buf.length = len;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
210 major_status = gss_import_name(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
211 &name_buf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
212 GSS_C_NO_OID,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
213 &name);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
214 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
215 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
216 GSS_C_GSS_CODE, "gss_import_name");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
217 return GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
218 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
219
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
220 return name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
221 }
7477
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
222 #endif
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
223
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
224 static void gssapi_sec_context(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
225 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
226 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
227 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
228 gss_buffer_desc outbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
229
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
230 major_status = gss_accept_sec_context (
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
231 &minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
232 &request->gss_ctx,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
233 request->service_cred,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
234 &inbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
235 GSS_C_NO_CHANNEL_BINDINGS,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
236 &request->authn_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
237 NULL, /* mech_type */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
238 &outbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
239 NULL, /* ret_flags */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
240 NULL, /* time_rec */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
241 NULL /* delegated_cred_handle */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
242 );
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
243
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
244 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
245 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
246 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
247 "processing incoming data");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
248 auth_request_log_gss_error(&request->auth_request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
249 GSS_C_MECH_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
250 "processing incoming data");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
251
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
252 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
253 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
254 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
255
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
256 if (major_status == GSS_S_COMPLETE) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
257 request->sasl_gssapi_state = GSS_STATE_WRAP;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
258 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
259 "security context state completed.");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
260 } else {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
261 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
262 "Processed incoming packet correctly, "
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
263 "waiting for another.");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
264 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
265
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
266 request->auth_request.callback(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
267 AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
268 outbuf.value, outbuf.length);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
269
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
270 major_status = gss_release_buffer(&minor_status, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
271 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
272
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
273 static void gssapi_wrap(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
274 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
275 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
276 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
277 gss_buffer_desc outbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
278 unsigned char ret[4];
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
279
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
280 /* The clients return data should be empty here */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
281
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
282 /* Only authentication, no integrity or confidentiality
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
283 protection (yet?) */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
284 ret[0] = (SASL_GSSAPI_QOP_UNSPECIFIED |
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
285 SASL_GSSAPI_QOP_AUTH_ONLY);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
286 ret[1] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
287 ret[2] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
288 ret[3] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
289
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
290 inbuf.length = 4;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
291 inbuf.value = ret;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
292
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
293 major_status = gss_wrap(&minor_status, request->gss_ctx, 0,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
294 GSS_C_QOP_DEFAULT, &inbuf, NULL, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
295
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
296 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
297 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
298 GSS_C_GSS_CODE, "sending security layer negotiation");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
299 auth_request_log_gss_error(&request->auth_request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
300 GSS_C_MECH_CODE, "sending security layer negotiation");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
301 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
302 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
303 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
304
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
305 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
306 "Negotiated security layer");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
307
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
308 request->auth_request.callback(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
309 AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
310 outbuf.value, outbuf.length);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
311
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
312 major_status = gss_release_buffer(&minor_status, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
313
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
314 request->sasl_gssapi_state = GSS_STATE_UNWRAP;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
315 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
316
7477
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
317 #ifdef USE_KRB5_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
318 static bool gssapi_krb5_userok(struct gssapi_auth_request *request)
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
319 {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
320 krb5_context ctx;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
321 krb5_principal princ;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
322 krb5_error_code krb5_err;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
323 OM_uint32 major_status, minor_status;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
324 gss_buffer_desc princ_name;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
325 gss_OID name_type;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
326 const char *princ_display_name;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
327 bool ret = FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
328
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
329 /* Parse out the principal's username */
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
330 major_status = gss_display_name(&minor_status, request->authn_name,
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
331 &princ_name, &name_type);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
332 if (major_status != GSS_S_COMPLETE) {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
333 auth_request_log_gss_error(&request->auth_request, major_status,
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
334 GSS_C_GSS_CODE,
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
335 "gssapi_krb5_userok");
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
336 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
337 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
338 if (name_type != GSS_KRB5_NT_PRINCIPAL_NAME) {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
339 auth_request_log_error(&request->auth_request, "gssapi",
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
340 "OID not kerberos principal name");
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
341 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
342 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
343 princ_display_name = t_strndup(princ_name.value, princ_name.length);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
344 gss_release_buffer(&minor_status, &princ_name);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
345
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
346 /* Init a krb5 context and parse the principal username */
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
347 krb5_err = krb5_init_context(&ctx);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
348 if (krb5_err != 0) {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
349 auth_request_log_error(&request->auth_request, "gssapi",
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
350 "krb5_init_context() failed: %d", (int)krb5_err);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
351 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
352 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
353 krb5_err = krb5_parse_name(ctx, princ_display_name, &princ);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
354 if (krb5_err != 0) {
7480
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos.
Timo Sirainen <tss@iki.fi>
parents: 7477
diff changeset
355 /* writing the error string would be better, but we probably
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos.
Timo Sirainen <tss@iki.fi>
parents: 7477
diff changeset
356 rarely get here and there doesn't seem to be a standard
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos.
Timo Sirainen <tss@iki.fi>
parents: 7477
diff changeset
357 way of getting it */
7477
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
358 auth_request_log_error(&request->auth_request, "gssapi",
7480
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos.
Timo Sirainen <tss@iki.fi>
parents: 7477
diff changeset
359 "krb5_parse_name() failed: %d",
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos.
Timo Sirainen <tss@iki.fi>
parents: 7477
diff changeset
360 (int)krb5_err);
7477
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
361 } else {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
362 /* See if the principal is authorized to act as the
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
363 specified user */
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
364 ret = krb5_kuserok(ctx, princ, request->auth_request.user);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
365 krb5_free_principal(ctx, princ);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
366 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
367 krb5_free_context(ctx);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
368 return ret;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
369 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
370 #endif
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
371
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
372 static void gssapi_unwrap(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
373 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
374 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
375 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
376 gss_buffer_desc outbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
377 int equal_authn_authz = 0;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
378
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
379 major_status = gss_unwrap(&minor_status, request->gss_ctx,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
380 &inbuf, &outbuf, NULL, NULL);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
381
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
382 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
383 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
384 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
385 "final negotiation: gss_unwrap");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
386 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
387 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
388 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
389
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
390 if (outbuf.length <= 4) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
391 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
392 "Invalid response length");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
393 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
394 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
395 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
396
5859
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
397 #ifdef HAVE___GSS_USEROK
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
398 /* Solaris __gss_userok() correctly handles cross-realm
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
399 authentication. */
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
400 request->auth_request.user =
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
401 p_strndup(request->auth_request.pool,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
402 (unsigned char *)outbuf.value + 4,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
403 outbuf.length - 4);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
404
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
405 major_status = __gss_userok(&minor_status, request->authn_name,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
406 request->auth_request.user,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
407 &equal_authn_authz);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
408 if (GSS_ERROR(major_status)) {
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
409 auth_request_log_gss_error(&request->auth_request, major_status,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
410 GSS_C_GSS_CODE,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
411 "__gss_userok failed");
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
412 auth_request_fail(&request->auth_request);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
413 return;
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
414 }
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
415
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
416 if (equal_authn_authz == 0) {
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
417 auth_request_log_error(&request->auth_request, "gssapi",
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
418 "credentials not valid");
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
419
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
420 auth_request_fail(&request->auth_request);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
421 return;
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
422 }
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
423 #else
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
424 request->authz_name = import_name(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
425 (unsigned char *)outbuf.value + 4,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
426 outbuf.length - 4);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
427 if ((request->authn_name == GSS_C_NO_NAME) ||
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
428 (request->authz_name == GSS_C_NO_NAME)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
429 /* XXX (pod): is this check necessary? */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
430 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
431 "one of authn_name or authz_name not determined");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
432 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
433 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
434 }
7451
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error.
Timo Sirainen <tss@iki.fi>
parents: 6428
diff changeset
435
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error.
Timo Sirainen <tss@iki.fi>
parents: 6428
diff changeset
436 request->auth_request.user =
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error.
Timo Sirainen <tss@iki.fi>
parents: 6428
diff changeset
437 p_strndup(request->auth_request.pool,
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error.
Timo Sirainen <tss@iki.fi>
parents: 6428
diff changeset
438 (unsigned char *)outbuf.value + 4,
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error.
Timo Sirainen <tss@iki.fi>
parents: 6428
diff changeset
439 outbuf.length - 4);
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error.
Timo Sirainen <tss@iki.fi>
parents: 6428
diff changeset
440
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
441 major_status = gss_compare_name(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
442 request->authn_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
443 request->authz_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
444 &equal_authn_authz);
7477
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
445 #ifdef USE_KRB5_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
446 if (equal_authn_authz == 0)
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
447 equal_authn_authz = gssapi_krb5_userok(request);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek.
Timo Sirainen <tss@iki.fi>
parents: 7451
diff changeset
448 #endif
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
449 if (equal_authn_authz == 0) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
450 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
451 "authn_name and authz_name differ: not supported");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
452 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
453 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
454 }
5859
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson.
Timo Sirainen <tss@iki.fi>
parents: 5439
diff changeset
455 #endif
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
456 auth_request_success(&request->auth_request, NULL, 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
457 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
458
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
459 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
460 mech_gssapi_auth_continue(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
461 const unsigned char *data, size_t data_size)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
462 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
463 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
464 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
465 gss_buffer_desc inbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
466
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
467 inbuf.value = (void *)data;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
468 inbuf.length = data_size;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
469
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
470 switch (gssapi_request->sasl_gssapi_state) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
471 case GSS_STATE_SEC_CONTEXT:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
472 gssapi_sec_context(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
473 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
474 case GSS_STATE_WRAP:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
475 gssapi_wrap(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
476 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
477 case GSS_STATE_UNWRAP:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
478 gssapi_unwrap(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
479 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
480 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
481 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
482
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
483 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
484 mech_gssapi_auth_initial(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
485 const unsigned char *data, size_t data_size)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
486 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
487 OM_uint32 major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
488 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
489 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
490
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
491 major_status =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
492 obtain_service_credentials(request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
493 &gssapi_request->service_cred);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
494
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
495 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
496 auth_request_internal_failure(request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
497 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
498 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
499 gssapi_request->authn_name = GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
500 gssapi_request->authz_name = GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
501
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
502 gssapi_request->sasl_gssapi_state = GSS_STATE_SEC_CONTEXT;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
503
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
504 if (data_size == 0) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
505 /* The client should go first */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
506 request->callback(request, AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
507 NULL, 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
508 } else {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
509 mech_gssapi_auth_continue(request, data, data_size);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
510 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
511 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
512
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
513
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
514 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
515 mech_gssapi_auth_free(struct auth_request *request)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
516 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
517 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
518 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
519 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
520
6242
40e324d83d2b Crashfix for failed GSSAPI requests.
Timo Sirainen <tss@iki.fi>
parents: 6199
diff changeset
521 if (gssapi_request->gss_ctx != GSS_C_NO_CONTEXT) {
40e324d83d2b Crashfix for failed GSSAPI requests.
Timo Sirainen <tss@iki.fi>
parents: 6199
diff changeset
522 major_status = gss_delete_sec_context(&minor_status,
40e324d83d2b Crashfix for failed GSSAPI requests.
Timo Sirainen <tss@iki.fi>
parents: 6199
diff changeset
523 &gssapi_request->gss_ctx,
40e324d83d2b Crashfix for failed GSSAPI requests.
Timo Sirainen <tss@iki.fi>
parents: 6199
diff changeset
524 GSS_C_NO_BUFFER);
40e324d83d2b Crashfix for failed GSSAPI requests.
Timo Sirainen <tss@iki.fi>
parents: 6199
diff changeset
525 }
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
526
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
527 major_status = gss_release_cred(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
528 &gssapi_request->service_cred);
5259
228eacfb2647 Added more debug logging.
Timo Sirainen <tss@iki.fi>
parents: 4862
diff changeset
529 if (gssapi_request->authn_name != GSS_C_NO_NAME) {
228eacfb2647 Added more debug logging.
Timo Sirainen <tss@iki.fi>
parents: 4862
diff changeset
530 major_status = gss_release_name(&minor_status,
228eacfb2647 Added more debug logging.
Timo Sirainen <tss@iki.fi>
parents: 4862
diff changeset
531 &gssapi_request->authn_name);
228eacfb2647 Added more debug logging.
Timo Sirainen <tss@iki.fi>
parents: 4862
diff changeset
532 }
228eacfb2647 Added more debug logging.
Timo Sirainen <tss@iki.fi>
parents: 4862
diff changeset
533 if (gssapi_request->authz_name != GSS_C_NO_NAME) {
228eacfb2647 Added more debug logging.
Timo Sirainen <tss@iki.fi>
parents: 4862
diff changeset
534 major_status = gss_release_name(&minor_status,
228eacfb2647 Added more debug logging.
Timo Sirainen <tss@iki.fi>
parents: 4862
diff changeset
535 &gssapi_request->authz_name);
228eacfb2647 Added more debug logging.
Timo Sirainen <tss@iki.fi>
parents: 4862
diff changeset
536 }
6428
7cad076906eb pool_unref() now takes ** pointer.
Timo Sirainen <tss@iki.fi>
parents: 6242
diff changeset
537 pool_unref(&request->pool);
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
538 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
539
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
540 const struct mech_module mech_gssapi = {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
541 "GSSAPI",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
542
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
543 MEMBER(flags) 0,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
544
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
545 MEMBER(passdb_need_plain) FALSE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
546 MEMBER(passdb_need_credentials) FALSE,
4782
2c1cc5bbc260 Added auth_request_set_credentials() to modify credentials in passdb and
Timo Sirainen <tss@iki.fi>
parents: 4628
diff changeset
547 MEMBER(passdb_need_set_credentials) FALSE,
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
548
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
549 mech_gssapi_auth_new,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
550 mech_gssapi_auth_initial,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
551 mech_gssapi_auth_continue,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
552 mech_gssapi_auth_free
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
553 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
554
8094
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
555 /* MTI Kerberos v1.5+ and Heimdal v0.7+ supports SPNEGO for Kerberos tickets
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
556 internally. Nothing else needs to be done here. Note however that this does
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
557 not support SPNEGO when the only available credential is NTLM.. */
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
558 const struct mech_module mech_gssapi_spnego = {
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
559 "GSS-SPNEGO",
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
560
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
561 MEMBER(flags) 0,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
562
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
563 MEMBER(passdb_need_plain) FALSE,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
564 MEMBER(passdb_need_credentials) FALSE,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
565 MEMBER(passdb_need_set_credentials) FALSE,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
566
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
567 mech_gssapi_auth_new,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
568 mech_gssapi_auth_initial,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
569 mech_gssapi_auth_continue,
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
570 mech_gssapi_auth_free
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
571 };
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
572
6199
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
573 #ifndef BUILTIN_GSSAPI
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
574 void mech_gssapi_init(void);
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
575 void mech_gssapi_deinit(void);
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
576
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
577 void mech_gssapi_init(void)
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
578 {
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
579 mech_register_module(&mech_gssapi);
8094
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
580 #ifdef HAVE_GSSAPI_SPNEGO
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
581 mech_register_module(&mech_gssapi_spnego);
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
582 #endif
6199
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
583 }
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
584
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
585 void mech_gssapi_deinit(void)
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
586 {
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
587 mech_unregister_module(&mech_gssapi);
8094
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
588 #ifdef HAVE_GSSAPI_SPNEGO
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
589 mech_unregister_module(&mech_gssapi_spnego);
641d761219a6 Support GSS-SPNEGO mechanism if GSSAPI library supports it.
Timo Sirainen <tss@iki.fi>
parents: 8093
diff changeset
590 #endif
6199
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
591 }
3683
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
592 #endif
6199
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
593
c1d09af8bdda Added --with-gssapi=plugin
Timo Sirainen <tss@iki.fi>
parents: 5860
diff changeset
594 #endif