dovecot/original-hg/dovecot-1.2: src/auth/mech-gssapi.c annotate

annotate src/auth/mech-gssapi.c @ 8068:9569038e0816 HEAD

gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() instead of relying on KRB5_KTNAME environment to be picked up.

author	Timo Sirainen <tss@iki.fi>
date	Mon, 04 Aug 2008 17:33:09 -0400
parents	280e570a5ced
children	9ca5e8f66d10

rev	line source
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	1 /*
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	2 * GSSAPI Module
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	3 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	4 * Copyright (c) 2005 Jelmer Vernooij <jelmer@samba.org>
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	5 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	6 * Related standards:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	7 * - draft-ietf-sasl-gssapi-03
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	8 * - RFC2222
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	9 *
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	10 * Some parts inspired by an older patch from Colin Walters
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	11 *
4382 f8d37e26a2b3 Relicensed dovecot-auth to MIT. Timo Sirainen <tss@iki.fi> parents: 4004 diff changeset	12 * This software is released under the MIT license.
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	13 */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	14
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	15 #include "common.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	16 #include "mech.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	17 #include "passdb.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	18 #include "str.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	19 #include "str-sanitize.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	20 #include "buffer.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	21 #include "hex-binary.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	22 #include "safe-memset.h"
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	23
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	24 #ifdef HAVE_GSSAPI
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	25
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	26 #ifndef HAVE___GSS_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	27 # define USE_KRB5_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	28 # include <krb5.h>
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	29 #endif
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	30
4862 bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	31 #ifdef HAVE_GSSAPI_GSSAPI_H
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	32 # include <gssapi/gssapi.h>
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	33 #elif defined (HAVE_GSSAPI_H)
bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	34 # include <gssapi.h>
7610 280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	35 #endif
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	36
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	37 #ifdef HAVE_GSSAPI_GSSAPI_KRB5_H
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	38 # include <gssapi/gssapi_krb5.h>
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	39 #elif defined (HAVE_GSSAPI_KRB5_H)
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	40 # include <gssapi_krb5.h>
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	41 #else
280e570a5ced gssapi: Check for gssapi_krb5.h existence before trying to use it. Timo Sirainen <tss@iki.fi> parents: 7480 diff changeset	42 # undef USE_KRB5_USEROK
4862 bddfbc560857 Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain Timo Sirainen <tss@iki.fi> parents: 4782 diff changeset	43 #endif
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	44
5859 dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	45 #ifdef HAVE_GSSAPI_GSSAPI_EXT_H
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	46 # include <gssapi/gssapi_ext.h>
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	47 #endif
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	48
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	49 /* Non-zero flags defined in RFC 2222 */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	50 enum sasl_gssapi_qop {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	51 SASL_GSSAPI_QOP_UNSPECIFIED = 0x00,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	52 SASL_GSSAPI_QOP_AUTH_ONLY = 0x01,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	53 SASL_GSSAPI_QOP_AUTH_INT = 0x02,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	54 SASL_GSSAPI_QOP_AUTH_CONF = 0x04
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	55 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	56
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	57 struct gssapi_auth_request {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	58 struct auth_request auth_request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	59 gss_ctx_id_t gss_ctx;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	60 gss_cred_id_t service_cred;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	61
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	62 enum {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	63 GSS_STATE_SEC_CONTEXT,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	64 GSS_STATE_WRAP,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	65 GSS_STATE_UNWRAP
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	66 } sasl_gssapi_state;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	67
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	68 gss_name_t authn_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	69 gss_name_t authz_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	70
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	71 pool_t pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	72 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	73
8068 9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	74 static bool gssapi_initialized = FALSE;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	75
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	76 static void auth_request_log_gss_error(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	77 OM_uint32 status_value, int status_type,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	78 const char *description)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	79 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	80 OM_uint32 message_context = 0;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	81 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	82 gss_buffer_desc status_string;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	83
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	84 do {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	85 major_status = gss_display_status(&minor_status, status_value,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	86 status_type, GSS_C_NO_OID,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	87 &message_context,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	88 &status_string);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	89
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	90 auth_request_log_error(request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	91 "While %s: %s", description,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	92 str_sanitize(status_string.value, (size_t)-1));
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	93
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	94 major_status = gss_release_buffer(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	95 &status_string);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	96 } while (message_context != 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	97 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	98
8068 9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	99 static void mech_gssapi_initialize(void)
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	100 {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	101 const char *path;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	102
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	103 path = getenv("KRB5_KTNAME");
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	104 if (path != NULL) {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	105 #ifdef HAVE_GSSKRB5_REGISTER_ACCEPTOR_IDENTITY
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	106 gsskrb5_register_acceptor_identity(path);
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	107 #elif defined (HAVE_KRB5_GSS_REGISTER_ACCEPTOR_IDENTITY)
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	108 krb5_gss_register_acceptor_identity(path);
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	109 #endif
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	110 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	111 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	112
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	113 static struct auth_request *mech_gssapi_auth_new(void)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	114 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	115 struct gssapi_auth_request *request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	116 pool_t pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	117
8068 9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	118 if (!gssapi_initialized) {
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	119 gssapi_initialized = TRUE;
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	120 mech_gssapi_initialize();
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	121 }
9569038e0816 gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() Timo Sirainen <tss@iki.fi> parents: 7610 diff changeset	122
3695 4f8598b0ca62 Use a bit larger initial pool sizes Timo Sirainen <tss@iki.fi> parents: 3683 diff changeset	123 pool = pool_alloconly_create("gssapi_auth_request", 1024);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	124 request = p_new(pool, struct gssapi_auth_request, 1);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	125 request->pool = pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	126
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	127 request->gss_ctx = GSS_C_NO_CONTEXT;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	128
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	129 request->auth_request.pool = pool;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	130 return &request->auth_request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	131 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	132
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	133 static OM_uint32 obtain_service_credentials(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	134 gss_cred_id_t *ret)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	135 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	136 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	137 string_t *principal_name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	138 gss_buffer_desc inbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	139 gss_name_t gss_principal;
4628 fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	140 const char *service_name;
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	141
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	142 if (strcasecmp(request->service, "POP3") == 0) {
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	143 /* The standard POP3 service name with GSSAPI is called
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	144 just "pop". */
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	145 service_name = "pop";
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	146 } else {
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	147 service_name = t_str_lcase(request->service);
fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	148 }
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	149
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	150 principal_name = t_str_new(128);
4628 fc5ae043fdcc POP3 service name is "pop" with GSSAPI. Timo Sirainen <tss@iki.fi> parents: 4451 diff changeset	151 str_append(principal_name, service_name);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	152 str_append_c(principal_name, '@');
5439 c5401a8f4679 Added auth_gssapi_hostname setting. Timo Sirainen <tss@iki.fi> parents: 5259 diff changeset	153 str_append(principal_name, request->auth->gssapi_hostname);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	154
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	155 auth_request_log_info(request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	156 "Obtaining credentials for %s", str_c(principal_name));
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	157
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	158 inbuf.length = str_len(principal_name);
4451 1a35d53c18fc Array API redesigned to work using unions. It now provides type safety Timo Sirainen <tss@iki.fi> parents: 4382 diff changeset	159 inbuf.value = str_c_modifiable(principal_name);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	160
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	161 major_status = gss_import_name(&minor_status, &inbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	162 GSS_C_NT_HOSTBASED_SERVICE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	163 &gss_principal);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	164
3879 928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to Timo Sirainen <tss@iki.fi> parents: 3766 diff changeset	165 str_free(&principal_name);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	166
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	167 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	168 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	169 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	170 "importing principal name");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	171 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	172 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	173
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	174 major_status = gss_acquire_cred(&minor_status, gss_principal, 0,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	175 GSS_C_NULL_OID_SET, GSS_C_ACCEPT,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	176 ret, NULL, NULL);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	177
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	178 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	179 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	180 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	181 "acquiring service credentials");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	182 auth_request_log_gss_error(request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	183 GSS_C_MECH_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	184 "acquiring service credentials");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	185 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	186 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	187
4004 10d1c3301b87 Crashfix. Patch by Mark Davies Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	188 gss_release_name(&minor_status, &gss_principal);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	189
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	190 return major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	191 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	192
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	193 #ifndef HAVE___GSS_USEROK
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	194 static gss_name_t
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	195 import_name(struct auth_request request, void str, size_t len)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	196 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	197 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	198 gss_buffer_desc name_buf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	199 gss_name_t name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	200
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	201 name_buf.value = str;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	202 name_buf.length = len;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	203 major_status = gss_import_name(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	204 &name_buf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	205 GSS_C_NO_OID,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	206 &name);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	207 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	208 auth_request_log_gss_error(request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	209 GSS_C_GSS_CODE, "gss_import_name");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	210 return GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	211 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	212
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	213 return name;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	214 }
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	215 #endif
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	216
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	217 static void gssapi_sec_context(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	218 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	219 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	220 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	221 gss_buffer_desc outbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	222
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	223 major_status = gss_accept_sec_context (
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	224 &minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	225 &request->gss_ctx,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	226 request->service_cred,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	227 &inbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	228 GSS_C_NO_CHANNEL_BINDINGS,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	229 &request->authn_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	230 NULL, /* mech_type */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	231 &outbuf,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	232 NULL, /* ret_flags */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	233 NULL, /* time_rec */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	234 NULL /* delegated_cred_handle */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	235 );
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	236
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	237 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	238 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	239 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	240 "processing incoming data");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	241 auth_request_log_gss_error(&request->auth_request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	242 GSS_C_MECH_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	243 "processing incoming data");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	244
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	245 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	246 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	247 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	248
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	249 if (major_status == GSS_S_COMPLETE) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	250 request->sasl_gssapi_state = GSS_STATE_WRAP;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	251 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	252 "security context state completed.");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	253 } else {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	254 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	255 "Processed incoming packet correctly, "
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	256 "waiting for another.");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	257 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	258
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	259 request->auth_request.callback(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	260 AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	261 outbuf.value, outbuf.length);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	262
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	263 major_status = gss_release_buffer(&minor_status, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	264 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	265
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	266 static void gssapi_wrap(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	267 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	268 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	269 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	270 gss_buffer_desc outbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	271 unsigned char ret[4];
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	272
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	273 /* The clients return data should be empty here */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	274
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	275 /* Only authentication, no integrity or confidentiality
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	276 protection (yet?) */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	277 ret[0] = (SASL_GSSAPI_QOP_UNSPECIFIED \|
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	278 SASL_GSSAPI_QOP_AUTH_ONLY);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	279 ret[1] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	280 ret[2] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	281 ret[3] = 0xFF;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	282
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	283 inbuf.length = 4;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	284 inbuf.value = ret;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	285
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	286 major_status = gss_wrap(&minor_status, request->gss_ctx, 0,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	287 GSS_C_QOP_DEFAULT, &inbuf, NULL, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	288
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	289 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	290 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	291 GSS_C_GSS_CODE, "sending security layer negotiation");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	292 auth_request_log_gss_error(&request->auth_request, minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	293 GSS_C_MECH_CODE, "sending security layer negotiation");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	294 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	295 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	296 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	297
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	298 auth_request_log_info(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	299 "Negotiated security layer");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	300
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	301 request->auth_request.callback(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	302 AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	303 outbuf.value, outbuf.length);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	304
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	305 major_status = gss_release_buffer(&minor_status, &outbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	306
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	307 request->sasl_gssapi_state = GSS_STATE_UNWRAP;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	308 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	309
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	310 #ifdef USE_KRB5_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	311 static bool gssapi_krb5_userok(struct gssapi_auth_request *request)
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	312 {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	313 krb5_context ctx;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	314 krb5_principal princ;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	315 krb5_error_code krb5_err;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	316 OM_uint32 major_status, minor_status;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	317 gss_buffer_desc princ_name;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	318 gss_OID name_type;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	319 const char *princ_display_name;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	320 bool ret = FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	321
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	322 /* Parse out the principal's username */
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	323 major_status = gss_display_name(&minor_status, request->authn_name,
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	324 &princ_name, &name_type);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	325 if (major_status != GSS_S_COMPLETE) {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	326 auth_request_log_gss_error(&request->auth_request, major_status,
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	327 GSS_C_GSS_CODE,
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	328 "gssapi_krb5_userok");
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	329 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	330 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	331 if (name_type != GSS_KRB5_NT_PRINCIPAL_NAME) {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	332 auth_request_log_error(&request->auth_request, "gssapi",
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	333 "OID not kerberos principal name");
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	334 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	335 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	336 princ_display_name = t_strndup(princ_name.value, princ_name.length);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	337 gss_release_buffer(&minor_status, &princ_name);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	338
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	339 /* Init a krb5 context and parse the principal username */
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	340 krb5_err = krb5_init_context(&ctx);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	341 if (krb5_err != 0) {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	342 auth_request_log_error(&request->auth_request, "gssapi",
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	343 "krb5_init_context() failed: %d", (int)krb5_err);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	344 return FALSE;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	345 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	346 krb5_err = krb5_parse_name(ctx, princ_display_name, &princ);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	347 if (krb5_err != 0) {
7480 ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	348 /* writing the error string would be better, but we probably
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	349 rarely get here and there doesn't seem to be a standard
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	350 way of getting it */
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	351 auth_request_log_error(&request->auth_request, "gssapi",
7480 ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	352 "krb5_parse_name() failed: %d",
ad0f32abda6d Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. Timo Sirainen <tss@iki.fi> parents: 7477 diff changeset	353 (int)krb5_err);
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	354 } else {
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	355 /* See if the principal is authorized to act as the
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	356 specified user */
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	357 ret = krb5_kuserok(ctx, princ, request->auth_request.user);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	358 krb5_free_principal(ctx, princ);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	359 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	360 krb5_free_context(ctx);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	361 return ret;
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	362 }
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	363 #endif
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	364
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	365 static void gssapi_unwrap(struct gssapi_auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	366 gss_buffer_desc inbuf)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	367 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	368 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	369 gss_buffer_desc outbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	370 int equal_authn_authz = 0;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	371
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	372 major_status = gss_unwrap(&minor_status, request->gss_ctx,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	373 &inbuf, &outbuf, NULL, NULL);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	374
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	375 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	376 auth_request_log_gss_error(&request->auth_request, major_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	377 GSS_C_GSS_CODE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	378 "final negotiation: gss_unwrap");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	379 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	380 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	381 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	382
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	383 if (outbuf.length <= 4) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	384 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	385 "Invalid response length");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	386 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	387 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	388 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	389
5859 dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	390 #ifdef HAVE___GSS_USEROK
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	391 /* Solaris __gss_userok() correctly handles cross-realm
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	392 authentication. */
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	393 request->auth_request.user =
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	394 p_strndup(request->auth_request.pool,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	395 (unsigned char *)outbuf.value + 4,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	396 outbuf.length - 4);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	397
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	398 major_status = __gss_userok(&minor_status, request->authn_name,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	399 request->auth_request.user,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	400 &equal_authn_authz);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	401 if (GSS_ERROR(major_status)) {
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	402 auth_request_log_gss_error(&request->auth_request, major_status,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	403 GSS_C_GSS_CODE,
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	404 "__gss_userok failed");
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	405 auth_request_fail(&request->auth_request);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	406 return;
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	407 }
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	408
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	409 if (equal_authn_authz == 0) {
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	410 auth_request_log_error(&request->auth_request, "gssapi",
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	411 "credentials not valid");
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	412
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	413 auth_request_fail(&request->auth_request);
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	414 return;
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	415 }
dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	416 #else
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	417 request->authz_name = import_name(&request->auth_request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	418 (unsigned char *)outbuf.value + 4,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	419 outbuf.length - 4);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	420 if ((request->authn_name == GSS_C_NO_NAME) \|\|
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	421 (request->authz_name == GSS_C_NO_NAME)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	422 /* XXX (pod): is this check necessary? */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	423 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	424 "one of authn_name or authz_name not determined");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	425 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	426 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	427 }
7451 4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	428
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	429 request->auth_request.user =
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	430 p_strndup(request->auth_request.pool,
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	431 (unsigned char *)outbuf.value + 4,
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	432 outbuf.length - 4);
4a64c2f8e194 GSSAPI: Show username in "autn_name and authz_name differ" error. Timo Sirainen <tss@iki.fi> parents: 6428 diff changeset	433
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	434 major_status = gss_compare_name(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	435 request->authn_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	436 request->authz_name,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	437 &equal_authn_authz);
7477 841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	438 #ifdef USE_KRB5_USEROK
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	439 if (equal_authn_authz == 0)
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	440 equal_authn_authz = gssapi_krb5_userok(request);
841209428d2d Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. Timo Sirainen <tss@iki.fi> parents: 7451 diff changeset	441 #endif
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	442 if (equal_authn_authz == 0) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	443 auth_request_log_error(&request->auth_request, "gssapi",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	444 "authn_name and authz_name differ: not supported");
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	445 auth_request_fail(&request->auth_request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	446 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	447 }
5859 dfdedb187b26 If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. Timo Sirainen <tss@iki.fi> parents: 5439 diff changeset	448 #endif
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	449 auth_request_success(&request->auth_request, NULL, 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	450 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	451
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	452 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	453 mech_gssapi_auth_continue(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	454 const unsigned char *data, size_t data_size)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	455 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	456 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	457 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	458 gss_buffer_desc inbuf;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	459
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	460 inbuf.value = (void *)data;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	461 inbuf.length = data_size;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	462
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	463 switch (gssapi_request->sasl_gssapi_state) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	464 case GSS_STATE_SEC_CONTEXT:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	465 gssapi_sec_context(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	466 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	467 case GSS_STATE_WRAP:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	468 gssapi_wrap(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	469 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	470 case GSS_STATE_UNWRAP:
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	471 gssapi_unwrap(gssapi_request, inbuf);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	472 break;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	473 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	474 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	475
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	476 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	477 mech_gssapi_auth_initial(struct auth_request *request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	478 const unsigned char *data, size_t data_size)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	479 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	480 OM_uint32 major_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	481 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	482 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	483
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	484 major_status =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	485 obtain_service_credentials(request,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	486 &gssapi_request->service_cred);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	487
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	488 if (GSS_ERROR(major_status)) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	489 auth_request_internal_failure(request);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	490 return;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	491 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	492 gssapi_request->authn_name = GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	493 gssapi_request->authz_name = GSS_C_NO_NAME;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	494
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	495 gssapi_request->sasl_gssapi_state = GSS_STATE_SEC_CONTEXT;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	496
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	497 if (data_size == 0) {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	498 /* The client should go first */
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	499 request->callback(request, AUTH_CLIENT_RESULT_CONTINUE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	500 NULL, 0);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	501 } else {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	502 mech_gssapi_auth_continue(request, data, data_size);
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	503 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	504 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	505
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	506
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	507 static void
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	508 mech_gssapi_auth_free(struct auth_request *request)
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	509 {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	510 OM_uint32 major_status, minor_status;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	511 struct gssapi_auth_request *gssapi_request =
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	512 (struct gssapi_auth_request *)request;
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	513
6242 40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	514 if (gssapi_request->gss_ctx != GSS_C_NO_CONTEXT) {
40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	515 major_status = gss_delete_sec_context(&minor_status,
40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	516 &gssapi_request->gss_ctx,
40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	517 GSS_C_NO_BUFFER);
40e324d83d2b Crashfix for failed GSSAPI requests. Timo Sirainen <tss@iki.fi> parents: 6199 diff changeset	518 }
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	519
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	520 major_status = gss_release_cred(&minor_status,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	521 &gssapi_request->service_cred);
5259 228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	522 if (gssapi_request->authn_name != GSS_C_NO_NAME) {
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	523 major_status = gss_release_name(&minor_status,
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	524 &gssapi_request->authn_name);
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	525 }
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	526 if (gssapi_request->authz_name != GSS_C_NO_NAME) {
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	527 major_status = gss_release_name(&minor_status,
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	528 &gssapi_request->authz_name);
228eacfb2647 Added more debug logging. Timo Sirainen <tss@iki.fi> parents: 4862 diff changeset	529 }
6428 7cad076906eb pool_unref() now takes ** pointer. Timo Sirainen <tss@iki.fi> parents: 6242 diff changeset	530 pool_unref(&request->pool);
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	531 }
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	532
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	533 const struct mech_module mech_gssapi = {
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	534 "GSSAPI",
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	535
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	536 MEMBER(flags) 0,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	537
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	538 MEMBER(passdb_need_plain) FALSE,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	539 MEMBER(passdb_need_credentials) FALSE,
4782 2c1cc5bbc260 Added auth_request_set_credentials() to modify credentials in passdb and Timo Sirainen <tss@iki.fi> parents: 4628 diff changeset	540 MEMBER(passdb_need_set_credentials) FALSE,
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	541
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	542 mech_gssapi_auth_new,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	543 mech_gssapi_auth_initial,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	544 mech_gssapi_auth_continue,
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	545 mech_gssapi_auth_free
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	546 };
28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	547
6199 c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	548 #ifndef BUILTIN_GSSAPI
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	549 void mech_gssapi_init(void);
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	550 void mech_gssapi_deinit(void);
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	551
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	552 void mech_gssapi_init(void)
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	553 {
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	554 mech_register_module(&mech_gssapi);
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	555 }
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	556
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	557 void mech_gssapi_deinit(void)
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	558 {
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	559 mech_unregister_module(&mech_gssapi);
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	560 }
3683 28cca6317829 Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by Timo Sirainen <tss@iki.fi> parents: diff changeset	561 #endif
6199 c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	562
c1d09af8bdda Added --with-gssapi=plugin Timo Sirainen <tss@iki.fi> parents: 5860 diff changeset	563 #endif

Mercurial > dovecot > original-hg > dovecot-1.2

annotate src/auth/mech-gssapi.c @ 8068:9569038e0816 HEAD